Merge WebKit at r82507: Initial merge by git

Change-Id: I60ce9d780725b58b45e54165733a8ffee23b683e

1387 files changed, 60058 insertions, 19217 deletions

diff --git a/Source/WebCore/Android.derived.jscbindings.mk b/Source/WebCore/Android.derived.jscbindings.mk
index 831f2f5..eb070a4 100644
--- a/Source/WebCore/Android.derived.jscbindings.mk
+++ b/Source/WebCore/Android.derived.jscbindings.mk
@@ -375,7 +375,12 @@ GEN := \
     $(intermediates)/page/JSNavigator.h \
     $(intermediates)/page/JSPositionError.h \
     $(intermediates)/page/JSScreen.h \
+<<<<<<< HEAD
     $(intermediates)/page/JSSpeechInputEvent.h \
+=======
+    $(intermediates)/page/JSWebKitAnimation.h \
+    $(intermediates)/page/JSWebKitAnimationList.h \
+>>>>>>> webkit.org at r82507
     $(intermediates)/page/JSWebKitPoint.h \
     $(intermediates)/page/JSWorkerNavigator.h
 
diff --git a/Source/WebCore/Android.derived.v8bindings.mk b/Source/WebCore/Android.derived.v8bindings.mk
index 1612df9..0bee200 100644
--- a/Source/WebCore/Android.derived.v8bindings.mk
+++ b/Source/WebCore/Android.derived.v8bindings.mk
@@ -361,7 +361,12 @@ GEN := \
     $(intermediates)/bindings/V8Navigator.h \
     $(intermediates)/bindings/V8PositionError.h \
     $(intermediates)/bindings/V8Screen.h \
+<<<<<<< HEAD
     $(intermediates)/bindings/V8SpeechInputEvent.h \
+=======
+    $(intermediates)/bindings/V8WebKitAnimation.h \
+    $(intermediates)/bindings/V8WebKitAnimationList.h \
+>>>>>>> webkit.org at r82507
     $(intermediates)/bindings/V8WebKitPoint.h \
     $(intermediates)/bindings/V8WorkerNavigator.h
 $(GEN): PRIVATE_PATH := $(LOCAL_PATH)
diff --git a/Source/WebCore/Android.jscbindings.mk b/Source/WebCore/Android.jscbindings.mk
index f3b12be..44738a9 100644
--- a/Source/WebCore/Android.jscbindings.mk
+++ b/Source/WebCore/Android.jscbindings.mk
@@ -217,7 +217,7 @@ LOCAL_SRC_FILES += \
 	bridge/c/c_runtime.cpp \
 	bridge/c/c_utility.cpp \
 	bridge/jni/JNIUtility.cpp \
-	bridge/jni/JavaMethod.cpp \
+	bridge/jni/JavaMethodJobject.cpp \
 	bridge/jni/JobjectWrapper.cpp \
 	bridge/jni/jsc/JNIUtilityPrivate.cpp \
 	bridge/jni/jsc/JavaArrayJSC.cpp \
diff --git a/Source/WebCore/Android.mk b/Source/WebCore/Android.mk
index b2ad8f4..f7ecf6d 100644
--- a/Source/WebCore/Android.mk
+++ b/Source/WebCore/Android.mk
@@ -101,7 +101,6 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	css/WebKitCSSTransformValue.cpp \
 	\
 	dom/ActiveDOMObject.cpp \
-	dom/AsyncScriptRunner.cpp \
 	dom/Attr.cpp \
 	dom/Attribute.cpp \
 	dom/BeforeTextInsertedEvent.cpp \
@@ -122,8 +121,12 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	dom/CustomEvent.cpp \
 	dom/DOMImplementation.cpp \
 	dom/DOMStringList.cpp \
+<<<<<<< HEAD
 	dom/DOMStringMap.cpp \
 	dom/DatasetDOMStringMap.cpp \
+=======
+	dom/DataTransferItem.cpp \
+>>>>>>> webkit.org at r82507
 	dom/DecodedDataDocumentParser.cpp \
 	dom/DeviceMotionController.cpp \
 	dom/DeviceMotionData.cpp \
@@ -141,6 +144,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	dom/ErrorEvent.cpp \
 	dom/Event.cpp \
 	dom/EventContext.cpp \
+	dom/EventDispatcher.cpp \
 	dom/EventNames.cpp \
 	dom/EventTarget.cpp \
 	dom/EventQueue.cpp \
@@ -183,11 +187,13 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	dom/ScriptableDocumentParser.cpp \
 	dom/ScriptElement.cpp \
 	dom/ScriptExecutionContext.cpp \
+	dom/ScriptRunner.cpp \
 	dom/SelectElement.cpp \
 	dom/SelectorNodeList.cpp \
 	dom/SpaceSplitString.cpp \
 	dom/StaticHashSetNodeList.cpp \
 	dom/StaticNodeList.cpp \
+	dom/StringCallback.cpp \
 	dom/StyleElement.cpp \
 	dom/StyledElement.cpp \
 	dom/TagNodeList.cpp \
@@ -460,6 +466,11 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	loader/cache/MemoryCache.cpp \
 	\
 	loader/icon/IconDatabase.cpp \
+<<<<<<< HEAD
+=======
+	loader/icon/IconDatabaseBase.cpp \
+	loader/icon/IconFetcher.cpp \
+>>>>>>> webkit.org at r82507
 	loader/icon/IconLoader.cpp \
 	loader/icon/IconRecord.cpp \
 	loader/icon/PageURLRecord.cpp \
@@ -507,6 +518,8 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	page/SpeechInputResult.cpp \
 	page/SuspendableTimer.cpp \
 	page/UserContentURLPattern.cpp \
+	page/WebKitAnimation.cpp \
+	page/WebKitAnimationList.cpp \
 	page/WindowFeatures.cpp \
 	page/WorkerNavigator.cpp \
 	\
@@ -523,7 +536,11 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	platform/ContentType.cpp \
 	platform/ContextMenuItem.cpp \
 	platform/CrossThreadCopier.cpp \
+<<<<<<< HEAD
 	platform/Cursor.cpp \
+=======
+	platform/DefaultLocalizationStrategy.cpp \
+>>>>>>> webkit.org at r82507
 	platform/DragData.cpp \
 	platform/DragImage.cpp \
 	platform/FileChooser.cpp \
diff --git a/Source/WebCore/Android.v8bindings.mk b/Source/WebCore/Android.v8bindings.mk
index f42fc28..8d858d9 100644
--- a/Source/WebCore/Android.v8bindings.mk
+++ b/Source/WebCore/Android.v8bindings.mk
@@ -52,6 +52,11 @@ LOCAL_SRC_FILES += \
 	bindings/v8/IsolatedWorld.cpp \
 	bindings/v8/MainThreadDOMData.cpp \
 	bindings/v8/NPV8Object.cpp \
+<<<<<<< HEAD
+=======
+	bindings/v8/RetainedDOMInfo.cpp \
+	bindings/v8/RuntimeEnabledFeatures.cpp \
+>>>>>>> webkit.org at r82507
 	bindings/v8/ScheduledAction.cpp \
 	bindings/v8/ScopedDOMDataStore.cpp \
 	bindings/v8/ScriptCachedFrameData.cpp \
@@ -182,6 +187,11 @@ LOCAL_SRC_FILES += \
 	bindings/v8/custom/V8StorageCustom.cpp \
 	bindings/v8/custom/V8StyleSheetCustom.cpp \
 	bindings/v8/custom/V8StyleSheetListCustom.cpp \
+<<<<<<< HEAD
+=======
+	bindings/v8/custom/V8TreeWalkerCustom.cpp \
+	bindings/v8/custom/V8WebKitAnimationCustom.cpp \
+>>>>>>> webkit.org at r82507
 	bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp \
 	bindings/v8/custom/V8WebKitPointConstructor.cpp \
 	bindings/v8/custom/V8WorkerContextCustom.cpp \
@@ -193,7 +203,7 @@ LOCAL_SRC_FILES += \
 
 LOCAL_SRC_FILES += \
 	bridge/jni/JNIUtility.cpp \
-	bridge/jni/JavaMethod.cpp \
+	bridge/jni/JavaMethodJobject.cpp \
 	bridge/jni/JobjectWrapper.cpp \
 	bridge/jni/v8/JNIUtilityPrivate.cpp \
 	bridge/jni/v8/JavaClassV8.cpp \
diff --git a/Source/WebCore/CMakeLists.txt b/Source/WebCore/CMakeLists.txt
index ed95064..630f76e 100644
--- a/Source/WebCore/CMakeLists.txt
+++ b/Source/WebCore/CMakeLists.txt
@@ -3,12 +3,8 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/accessibility"
     "${WEBCORE_DIR}/bindings"
     "${WEBCORE_DIR}/bindings/generic"
-    "${WEBCORE_DIR}/bindings/js"
-    "${WEBCORE_DIR}/bindings/js/specialization"
     "${WEBCORE_DIR}/bridge"
     "${WEBCORE_DIR}/bridge/c"
-    "${WEBCORE_DIR}/bridge/jni/jsc"
-    "${WEBCORE_DIR}/bridge/jsc"
     "${WEBCORE_DIR}/css"
     "${WEBCORE_DIR}/dom"
     "${WEBCORE_DIR}/dom/default"
@@ -86,7 +82,6 @@ SET(WebCore_INCLUDE_DIRECTORIES
 
 SET(WebCore_IDL_INCLUDES
     bindings/generic
-    bindings/js
     css
     dom
     fileapi
@@ -140,6 +135,8 @@ SET(WebCore_IDL_FILES
     dom/Comment.idl
     dom/CompositionEvent.idl
     dom/CustomEvent.idl
+    dom/DataTransferItem.idl
+    dom/DataTransferItems.idl
     dom/DeviceMotionEvent.idl
     dom/DeviceOrientationEvent.idl
     dom/DocumentFragment.idl
@@ -175,6 +172,7 @@ SET(WebCore_IDL_FILES
     dom/ProgressEvent.idl
     dom/RangeException.idl
     dom/Range.idl
+    dom/StringCallback.idl
     dom/TextEvent.idl
     dom/Text.idl
     dom/TouchEvent.idl
@@ -340,6 +338,8 @@ SET(WebCore_IDL_FILES
     page/SpeechInputEvent.idl
     page/SpeechInputResult.idl
     page/SpeechInputResultList.idl
+    page/WebKitAnimation.idl
+    page/WebKitAnimationList.idl
     page/WebKitPoint.idl
     page/WorkerNavigator.idl
 
@@ -453,168 +453,6 @@ SET(WebCore_SOURCES
     bindings/generic/ActiveDOMCallback.cpp
     bindings/generic/RuntimeEnabledFeatures.cpp
 
-    bindings/js/DOMObjectHashTableMap.cpp
-    bindings/js/DOMWrapperWorld.cpp
-    bindings/js/GCController.cpp
-    bindings/js/IDBBindingUtilities.cpp
-    bindings/js/JSAttrCustom.cpp
-    bindings/js/JSArrayBufferCustom.cpp
-    bindings/js/JSDataViewCustom.cpp
-    bindings/js/JSCDATASectionCustom.cpp
-    bindings/js/JSCSSFontFaceRuleCustom.cpp
-    bindings/js/JSCSSImportRuleCustom.cpp
-    bindings/js/JSCSSMediaRuleCustom.cpp
-    bindings/js/JSCSSPageRuleCustom.cpp
-    bindings/js/JSCSSRuleCustom.cpp
-    bindings/js/JSCSSRuleListCustom.cpp
-    bindings/js/JSCSSStyleDeclarationCustom.cpp
-    bindings/js/JSCSSStyleRuleCustom.cpp
-    bindings/js/JSCSSValueCustom.cpp
-    bindings/js/JSCallbackData.cpp
-    bindings/js/JSCanvasRenderingContext2DCustom.cpp
-    bindings/js/JSCanvasRenderingContextCustom.cpp
-    bindings/js/JSClipboardCustom.cpp
-    bindings/js/JSConsoleCustom.cpp
-    bindings/js/JSCoordinatesCustom.cpp
-    bindings/js/JSCustomPositionCallback.cpp
-    bindings/js/JSCustomPositionErrorCallback.cpp
-    bindings/js/JSCustomSQLStatementErrorCallback.cpp
-    bindings/js/JSCustomVoidCallback.cpp
-    bindings/js/JSCustomXPathNSResolver.cpp
-    bindings/js/JSDOMApplicationCacheCustom.cpp
-    bindings/js/JSDOMBinding.cpp
-    bindings/js/JSDOMFormDataCustom.cpp
-    bindings/js/JSDOMGlobalObject.cpp
-    bindings/js/JSDOMImplementationCustom.cpp
-    bindings/js/JSDOMMimeTypeArrayCustom.cpp
-    bindings/js/JSDOMPluginArrayCustom.cpp
-    bindings/js/JSDOMPluginCustom.cpp
-    bindings/js/JSDOMStringMapCustom.cpp
-    bindings/js/JSDOMWindowBase.cpp
-    bindings/js/JSDOMWindowCustom.cpp
-    bindings/js/JSDOMWindowShell.cpp
-    bindings/js/JSDOMWrapper.cpp
-    bindings/js/JSDataGridColumnListCustom.cpp
-    bindings/js/JSDataGridDataSource.cpp
-    bindings/js/JSDedicatedWorkerContextCustom.cpp
-    bindings/js/JSDeviceMotionEventCustom.cpp
-    bindings/js/JSDeviceOrientationEventCustom.cpp
-    bindings/js/JSDocumentCustom.cpp
-    bindings/js/JSElementCustom.cpp
-    bindings/js/JSErrorHandler.cpp
-    bindings/js/JSEventCustom.cpp
-    bindings/js/JSEventListener.cpp
-    bindings/js/JSEventSourceCustom.cpp
-    bindings/js/JSEventTarget.cpp
-    bindings/js/JSExceptionBase.cpp
-    bindings/js/JSFileReaderCustom.cpp
-    bindings/js/JSFloat32ArrayCustom.cpp
-    bindings/js/JSGeolocationCustom.cpp
-    bindings/js/JSHTMLAllCollectionCustom.cpp
-    bindings/js/JSHTMLAppletElementCustom.cpp
-    bindings/js/JSHTMLCanvasElementCustom.cpp
-    bindings/js/JSHTMLCollectionCustom.cpp
-    bindings/js/JSHTMLDataGridElementCustom.cpp
-    bindings/js/JSHTMLDocumentCustom.cpp
-    bindings/js/JSHTMLElementCustom.cpp
-    bindings/js/JSHTMLEmbedElementCustom.cpp
-    bindings/js/JSHTMLFormElementCustom.cpp
-    bindings/js/JSHTMLFrameElementCustom.cpp
-    bindings/js/JSHTMLFrameSetElementCustom.cpp
-    bindings/js/JSHTMLInputElementCustom.cpp
-    bindings/js/JSHTMLLinkElementCustom.cpp
-    bindings/js/JSHTMLObjectElementCustom.cpp
-    bindings/js/JSHTMLOptionsCollectionCustom.cpp
-    bindings/js/JSHTMLOutputElementCustom.cpp
-    bindings/js/JSHTMLSelectElementCustom.cpp
-    bindings/js/JSHTMLStyleElementCustom.cpp
-    bindings/js/JSHistoryCustom.cpp
-    bindings/js/JSIDBAnyCustom.cpp
-    bindings/js/JSIDBKeyCustom.cpp
-    bindings/js/JSImageConstructor.cpp
-    bindings/js/JSImageDataCustom.cpp
-    bindings/js/JSInt16ArrayCustom.cpp
-    bindings/js/JSInt32ArrayCustom.cpp
-    bindings/js/JSInt8ArrayCustom.cpp
-    bindings/js/JSInjectedScriptHostCustom.cpp
-    bindings/js/JSInspectorFrontendHostCustom.cpp
-    bindings/js/JSJavaScriptCallFrameCustom.cpp
-    bindings/js/JSLazyEventListener.cpp
-    bindings/js/JSLocationCustom.cpp
-    bindings/js/JSMainThreadExecState.cpp
-    bindings/js/JSMemoryInfoCustom.cpp
-    bindings/js/JSMessageChannelCustom.cpp
-    bindings/js/JSMessageEventCustom.cpp
-    bindings/js/JSMessagePortCustom.cpp
-    bindings/js/JSNamedNodeMapCustom.cpp
-    bindings/js/JSNavigatorCustom.cpp
-    bindings/js/JSNodeCustom.cpp
-    bindings/js/JSNodeFilterCondition.cpp
-    bindings/js/JSNodeFilterCustom.cpp
-    bindings/js/JSNodeIteratorCustom.cpp
-    bindings/js/JSNodeListCustom.cpp
-    bindings/js/JSOptionConstructor.cpp
-    bindings/js/JSPluginElementFunctions.cpp
-    bindings/js/JSProcessingInstructionCustom.cpp
-    bindings/js/JSSQLResultSetRowListCustom.cpp
-    bindings/js/JSSQLTransactionCustom.cpp
-    bindings/js/JSSQLTransactionSyncCustom.cpp
-    bindings/js/JSScriptProfileNodeCustom.cpp
-    bindings/js/JSSharedWorkerCustom.cpp
-    bindings/js/JSStorageCustom.cpp
-    bindings/js/JSStyleSheetCustom.cpp
-    bindings/js/JSStyleSheetListCustom.cpp
-    bindings/js/JSTextCustom.cpp
-    bindings/js/JSTouchCustom.cpp
-    bindings/js/JSTouchListCustom.cpp
-    bindings/js/JSTreeWalkerCustom.cpp
-    bindings/js/JSUint16ArrayCustom.cpp 
-    bindings/js/JSUint32ArrayCustom.cpp
-    bindings/js/JSUint8ArrayCustom.cpp
-    bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp
-    bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp
-    bindings/js/JSWebKitCSSMatrixCustom.cpp
-    bindings/js/JSWebKitPointCustom.cpp
-    bindings/js/JSWebSocketCustom.cpp
-    bindings/js/JSWorkerContextBase.cpp
-    bindings/js/JSWorkerContextCustom.cpp
-    bindings/js/JSWorkerCustom.cpp
-    bindings/js/JSXMLHttpRequestCustom.cpp
-    bindings/js/JSXMLHttpRequestUploadCustom.cpp
-    bindings/js/JSXSLTProcessorCustom.cpp
-    bindings/js/JavaScriptCallFrame.cpp
-    bindings/js/ScheduledAction.cpp
-    bindings/js/ScriptCachedFrameData.cpp
-    bindings/js/ScriptCallStackFactory.cpp
-    bindings/js/ScriptController.cpp
-    bindings/js/ScriptDebugServer.cpp
-    bindings/js/ScriptEventListener.cpp
-    bindings/js/ScriptFunctionCall.cpp
-    bindings/js/ScriptGCEvent.cpp
-    bindings/js/ScriptObject.cpp
-    bindings/js/ScriptProfile.cpp
-    bindings/js/ScriptProfiler.cpp
-    bindings/js/ScriptState.cpp
-    bindings/js/ScriptValue.cpp
-    bindings/js/SerializedScriptValue.cpp
-    bindings/js/WorkerScriptController.cpp
-
-    bridge/IdentifierRep.cpp
-    bridge/NP_jsobject.cpp
-    bridge/npruntime.cpp
-    bridge/runtime_array.cpp
-    bridge/runtime_method.cpp
-    bridge/runtime_object.cpp
-    bridge/runtime_root.cpp
-
-    bridge/c/CRuntimeObject.cpp
-    bridge/c/c_class.cpp
-    bridge/c/c_instance.cpp
-    bridge/c/c_runtime.cpp
-    bridge/c/c_utility.cpp
-
-    bridge/jsc/BridgeJSC.cpp
-
     css/CSSBorderImageValue.cpp
     css/CSSCanvasValue.cpp
     css/CSSCharsetRule.cpp
@@ -632,6 +470,7 @@ SET(WebCore_SOURCES
     css/CSSImportRule.cpp
     css/CSSInheritedValue.cpp
     css/CSSInitialValue.cpp
+    css/CSSLineBoxContainValue.cpp
     css/CSSMediaRule.cpp
     css/CSSMutableStyleDeclaration.cpp
     css/CSSOMUtils.cpp
@@ -649,6 +488,7 @@ SET(WebCore_SOURCES
     css/CSSSegmentedFontFace.cpp
     css/CSSSelector.cpp
     css/CSSSelectorList.cpp
+    css/CSSStyleApplyProperty.cpp
     css/CSSStyleDeclaration.cpp
     css/CSSStyleRule.cpp
     css/CSSStyleSelector.cpp
@@ -679,7 +519,6 @@ SET(WebCore_SOURCES
     css/WebKitCSSTransformValue.cpp
 
     dom/ActiveDOMObject.cpp
-    dom/AsyncScriptRunner.cpp
     dom/Attr.cpp
     dom/Attribute.cpp
     dom/BeforeTextInsertedEvent.cpp
@@ -722,6 +561,7 @@ SET(WebCore_SOURCES
     dom/ErrorEvent.cpp
     dom/Event.cpp
     dom/EventContext.cpp
+    dom/EventDispatcher.cpp
     dom/EventNames.cpp
     dom/EventTarget.cpp
     dom/EventQueue.cpp
@@ -760,6 +600,7 @@ SET(WebCore_SOURCES
     dom/ScriptableDocumentParser.cpp
     dom/ScriptElement.cpp
     dom/ScriptExecutionContext.cpp
+    dom/ScriptRunner.cpp
     dom/SelectElement.cpp
     dom/SelectorNodeList.cpp
     dom/SpaceSplitString.cpp
@@ -1038,10 +879,13 @@ SET(WebCore_SOURCES
     html/shadow/TextControlInnerElements.cpp
 
     inspector/ConsoleMessage.cpp
+    inspector/DOMNodeHighlighter.cpp
     inspector/InjectedScript.cpp
     inspector/InjectedScriptHost.cpp
+    inspector/InjectedScriptManager.cpp
     inspector/InspectorAgent.cpp
     inspector/InspectorApplicationCacheAgent.cpp
+    inspector/InspectorPageAgent.cpp
     inspector/InspectorBrowserDebuggerAgent.cpp
     inspector/InspectorCSSAgent.cpp
     inspector/InspectorClient.cpp
@@ -1063,10 +907,12 @@ SET(WebCore_SOURCES
     inspector/InspectorStyleSheet.cpp
     inspector/InspectorTimelineAgent.cpp
     inspector/InspectorValues.cpp
+    inspector/PageDebuggerAgent.cpp
     inspector/ScriptArguments.cpp
     inspector/ScriptCallFrame.cpp
     inspector/ScriptCallStack.cpp
     inspector/TimelineRecordFactory.cpp
+    inspector/WorkerDebuggerAgent.cpp
 
     loader/CrossOriginAccessControl.cpp
     loader/CrossOriginPreflightResultCache.cpp
@@ -1124,6 +970,7 @@ SET(WebCore_SOURCES
     loader/cache/MemoryCache.cpp
 
     loader/icon/IconDatabase.cpp
+    loader/icon/IconDatabaseBase.cpp
     loader/icon/IconLoader.cpp
     loader/icon/IconRecord.cpp
     loader/icon/PageURLRecord.cpp
@@ -1170,6 +1017,8 @@ SET(WebCore_SOURCES
     page/SpatialNavigation.cpp
     page/SuspendableTimer.cpp
     page/UserContentURLPattern.cpp
+    page/WebKitAnimation.cpp
+    page/WebKitAnimationList.cpp
     page/WindowFeatures.cpp
     page/WorkerNavigator.cpp
 
@@ -1184,6 +1033,7 @@ SET(WebCore_SOURCES
     platform/ContextMenuItem.cpp
     platform/ContentType.cpp
     platform/CrossThreadCopier.cpp
+    platform/DefaultLocalizationStrategy.cpp
     platform/DragData.cpp
     platform/DragImage.cpp
     platform/FileChooser.cpp
@@ -1479,6 +1329,7 @@ SET(WebCore_SOURCES
     storage/StorageNamespace.cpp
     storage/StorageNamespaceImpl.cpp
     storage/StorageSyncManager.cpp
+    storage/StorageTracker.cpp
 
     websockets/ThreadableWebSocketChannel.cpp
     websockets/WebSocket.cpp
@@ -1545,7 +1396,7 @@ SET(WebCore_USER_AGENT_STYLE_SHEETS
     ${WEBCORE_DIR}/css/html.css
     ${WEBCORE_DIR}/css/mathml.css
     ${WEBCORE_DIR}/css/mediaControls.css
-    ${WEBCORE_DIR}/css/mediaControlsGtk.css
+    ${WEBCORE_DIR}/css/mediaControlsEfl.css
     ${WEBCORE_DIR}/css/quirks.css
     ${WEBCORE_DIR}/css/svg.css
     ${WEBCORE_DIR}/css/view-source.css
@@ -1573,6 +1424,15 @@ IF (ENABLE_DATABASE)
     )
 ENDIF ()
 
+IF (ENABLE_DATA_TRANSFER_ITEMS)
+    LIST(APPEND WebCore_IDL_FILES
+    )
+    LIST(APPEND WebCore_SOURCES
+        dom/DataTransferItem.cpp
+        dom/StringCallback.cpp
+    )
+ENDIF ()
+
 IF (ENABLE_MATHML)
     LIST(APPEND WebCore_SOURCES
         mathml/MathMLElement.cpp
@@ -2087,42 +1947,26 @@ ENDIF ()
 
 # Modules that the bindings generator scripts may use
 SET(SCRIPTS_BINDINGS
-    ${WEBCORE_DIR}/bindings/scripts/CodeGenerator.pm
     ${WEBCORE_DIR}/bindings/scripts/IDLParser.pm
     ${WEBCORE_DIR}/bindings/scripts/IDLStructure.pm
     ${WEBCORE_DIR}/bindings/scripts/InFilesParser.pm
 )
 
-SET(IDL_INCLUDES "")
-FOREACH (_include ${WebCore_IDL_INCLUDES})
-    LIST(APPEND IDL_INCLUDES --include=${WEBCORE_DIR}/${_include})
-ENDFOREACH ()
-
-SET(FEATURE_DEFINES_JAVASCRIPT "LANGUAGE_JAVASCRIPT=1")
-FOREACH (_feature ${FEATURE_DEFINES})
-    SET(FEATURE_DEFINES_JAVASCRIPT "${FEATURE_DEFINES_JAVASCRIPT} ${_feature}")
-ENDFOREACH ()
-
-
-# Create JavaScript C++ code given an IDL input
-FOREACH (_file ${WebCore_IDL_FILES})
-    GET_FILENAME_COMPONENT (_name ${_file} NAME_WE)
-    ADD_CUSTOM_COMMAND(
-        OUTPUT  ${DERIVED_SOURCES_DIR}/JS${_name}.cpp ${DERIVED_SOURCES_DIR}/JS${_name}.h
-        MAIN_DEPENDENCY ${_file}
-        DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorJS.pm ${_file}
-        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator JS ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${WEBCORE_DIR}/${_file}
-        VERBATIM)
-    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/JS${_name}.cpp)
-ENDFOREACH ()
-
+INCLUDE(${WEBCORE_DIR}/UseJSC.cmake)
  
 # All Web Inspector generated files are created with this one call to CodeGeneratorInspector.pm
 ADD_CUSTOM_COMMAND(
+    OUTPUT ${DERIVED_SOURCES_DIR}/Inspector.idl
+    MAIN_DEPENDENCY inspector/Inspector.json
+    DEPENDS ${WEBCORE_DIR}/inspector/generate-inspector-idl ${WEBCORE_DIR}/inspector/Inspector.json
+    COMMAND ${PYTHON_EXECUTABLE} ${WEBCORE_DIR}/inspector/generate-inspector-idl -o ${DERIVED_SOURCES_DIR}/Inspector.idl ${WEBCORE_DIR}/inspector/Inspector.json
+    VERBATIM)
+
+ADD_CUSTOM_COMMAND(
     OUTPUT ${DERIVED_SOURCES_DIR}/InspectorBackendDispatcher.cpp ${DERIVED_SOURCES_DIR}/InspectorBackendDispatcher.h ${DERIVED_SOURCES_DIR}/InspectorFrontend.cpp ${DERIVED_SOURCES_DIR}/InspectorFrontend.h
-    MAIN_DEPENDENCY inspector/Inspector.idl
-    DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/inspector/CodeGeneratorInspector.pm inspector/Inspector.idl
-    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts -I${WEBCORE_DIR}/inspector ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator Inspector ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${WEBCORE_DIR}/inspector/Inspector.idl
+    MAIN_DEPENDENCY ${DERIVED_SOURCES_DIR}/Inspector.idl
+    DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/inspector/CodeGeneratorInspector.pm ${DERIVED_SOURCES_DIR}/Inspector.idl
+    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts -I${WEBCORE_DIR}/inspector ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator Inspector ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${DERIVED_SOURCES_DIR}/Inspector.idl
     VERBATIM)
 LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/InspectorBackendDispatcher.cpp ${DERIVED_SOURCES_DIR}/InspectorFrontend.cpp)
 
@@ -2263,6 +2107,15 @@ GENERATE_DOM_NAMES(XML ${WEBCORE_DIR}/xml/xmlattrs.in)
 LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/XMLNames.cpp)
 
 
+ADD_CUSTOM_COMMAND(
+    OUTPUT ${DERIVED_SOURCES_DIR}/WebKitVersion.h
+    MAIN_DEPENDENCY ${WEBKIT_DIR}/scripts/generate-webkitversion.pl
+    DEPENDS ${WEBKIT_DIR}/mac/Configurations/Version.xcconfig
+    COMMAND ${PERL_EXECUTABLE} ${WEBKIT_DIR}/scripts/generate-webkitversion.pl --config ${WEBKIT_DIR}/mac/Configurations/Version.xcconfig --outputDir ${DERIVED_SOURCES_DIR}
+    VERBATIM)
+LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/WebKitVersion.h)
+
+
 SET(WebCore_LIBRARIES
     ${JavaScriptCore_LIBRARY_NAME}
 )
diff --git a/Source/WebCore/CMakeListsEfl.txt b/Source/WebCore/CMakeListsEfl.txt
index ba7b554..8c19c19 100644
--- a/Source/WebCore/CMakeListsEfl.txt
+++ b/Source/WebCore/CMakeListsEfl.txt
@@ -13,6 +13,7 @@ LIST(APPEND WebCore_INCLUDE_DIRECTORIES
   "${WEBCORE_DIR}/accessibility/efl"
   "${WEBKIT_DIR}/efl/WebCoreSupport"
   "${WEBKIT_DIR}/efl/ewk"
+  "${DERIVED_SOURCES_DIR}"
 )
 
 LIST(APPEND WebCore_SOURCES
@@ -167,6 +168,12 @@ IF (WTF_USE_ICU_UNICODE)
   )
 ENDIF ()
 
+IF (ENABLE_GEOLOCATION)
+  LIST(APPEND WebCore_SOURCES
+    platform/efl/GeolocationServiceEfl.cpp
+  )
+ENDIF()
+
 IF (ENABLE_VIDEO)
   LIST(APPEND WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/graphics/gstreamer"
diff --git a/Source/WebCore/CMakeListsWinCE.txt b/Source/WebCore/CMakeListsWinCE.txt
index 01757a7..98e7410 100644
--- a/Source/WebCore/CMakeListsWinCE.txt
+++ b/Source/WebCore/CMakeListsWinCE.txt
@@ -24,8 +24,6 @@ LIST(APPEND WebCore_SOURCES
     page/win/EventHandlerWin.cpp
     page/wince/FrameWinCE.cpp
 
-    loader/icon/IconDatabaseNone.cpp
-
     rendering/RenderThemeWince.cpp
 
     plugins/PluginDatabase.cpp
@@ -60,6 +58,7 @@ LIST(APPEND WebCore_SOURCES
     platform/win/FileChooserWin.cpp
     platform/win/KeyEventWin.cpp
     platform/win/LanguageWin.cpp
+    platform/win/LocalizedStringsWin.cpp
     platform/win/PasteboardWin.cpp
     platform/win/PopupMenuWin.cpp
     platform/win/PlatformMouseEventWin.cpp
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 46a64cd..204f540 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,18167 @@
+2011-03-30  Martin Robinson  <mrobinson@igalia.com>
+
+        Try to fix the EFL build.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::paintThemePart): Use the new cairo_t accessor on the platform context.
+
+2011-03-30  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix wrong type assumptions in editing code. Move code
+        from ASSERTs to hard checks.
+        https://bugs.webkit.org/show_bug.cgi?id=57348
+
+        Test: editing/execCommand/remove-format-non-html-element-crash.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getRGBAFontColor):
+        (WebCore::ApplyStyleCommand::pushDownInlineStyleAroundNode):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::enclosingDeletableElement):
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::textDirection):
+        (WebCore::EditingStyle::prepareToApplyAt):
+        * editing/Editor.cpp:
+        (WebCore::Editor::textDirectionForSelection):
+        * editing/FormatBlockCommand.cpp:
+        (WebCore::FormatBlockCommand::elementForFormatBlockCommand):
+
+2011-03-30  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Speed up clipping in accelerated 2D canvas.
+        https://bugs.webkit.org/show_bug.cgi?id=57464
+
+        Instead of clearing the entire stencil buffer when removing clipping paths, we erase the path with a DECR stencil operation.
+        Covered by canvas/philip/tests/2d.path.clip.intersect.html, and others.
+
+        * platform/graphics/chromium/GLES2Canvas.cpp:
+        (WebCore::PathAndTransform::PathAndTransform):
+        New structure to keep track of the CTM at the time the clipping path was added.
+        (WebCore::GLES2Canvas::State::State):
+        Replace m_clippingEnabled with a count of total clipping paths.
+        (WebCore::GLES2Canvas::clearRect):
+        Check the total clipping path count, instead of m_clippingEnabled.
+        (WebCore::GLES2Canvas::fillPath):
+        (WebCore::GLES2Canvas::fillRect):
+        Perform state application after doing shadows.  This is necessary
+        since restore() may now leave clipping enabled.
+        (WebCore::GLES2Canvas::clipPath):
+        Explicitly specify the stencil operation as INCR.  Store the current
+        transformation when saving clipping paths.
+        (WebCore::GLES2Canvas::restore):
+        Don't clear the stencil buffer and re-draw active paths on each restore.
+        Erase the old paths with DECR.
+        (WebCore::GLES2Canvas::drawTexturedRect):
+        Check m_numClippingPaths instead of m_clippingEnabled.
+        (WebCore::GLES2Canvas::beginShadowDraw):
+        Perform state application when drawing hard shadows.
+        (WebCore::GLES2Canvas::endShadowDraw):
+        Check m_numClippingPaths instead of m_clippingEnabled.
+        (WebCore::GLES2Canvas::beginStencilDraw):
+        Make the stencil op a parameter to beginShadowDraw().
+        (WebCore::GLES2Canvas::applyClipping):
+        Compare against the total number of stencil paths, not just the ones in
+        the current state.
+        * platform/graphics/chromium/GLES2Canvas.h:
+        Make the stencil op a parameter to beginShadowDraw().
+
+2011-03-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move factory-like things in EventDispatcher::dispatchMouseEvent to a factory, clean up names and ordering.
+        https://bugs.webkit.org/show_bug.cgi?id=57419
+
+        Refactoring, covered by existing tests.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::dispatchMouseEvent): Reordered and clarified names.
+        * dom/MouseEvent.cpp:
+        (WebCore::MouseEvent::create): Added a new factory method that takes PlatformMouseEvent.
+        * dom/MouseEvent.h: Added decl.
+
+2011-03-30  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Missing DOM bindings for a ping
+        https://bugs.webkit.org/show_bug.cgi?id=51955
+
+        Test: fast/dom/ping-attribute-dom-binding.html
+
+        * html/HTMLAnchorElement.idl:
+        * html/HTMLAreaElement.idl:
+
+2011-03-30  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Dirk Schulze.
+
+        [Cairo] Better separate the concerns of GraphicsContextCairo
+        https://bugs.webkit.org/show_bug.cgi?id=55150
+
+        Add a PlatformContextCairo which right now stores the cairo_t* for a
+        GraphicsContextCairo. Later patches will move logic for tracking ContextShadow
+        and image masking layers into this PlatformContextCairo class.
+
+        No new tests. This patch is only a code cleanup.
+
+        * GNUmakefile.am:
+        * platform/graphics/GraphicsContext.h: The platform context is no longer a
+        cairo_t, but our new class the PlatformContextCairo.
+        * platform/graphics/cairo/ContextShadowCairo.cpp: Updated to reflect new class.j
+        * platform/graphics/cairo/FontCairo.cpp: Ditto.
+        * platform/graphics/cairo/GradientCairo.cpp: Ditto.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp: Mostly mechanical
+        changes which now reference platformContext()->cr() to get the cairo_t.
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h: Now hold the
+        PlatformContextCairo instead of the cairo_t.
+        * platform/graphics/cairo/ImageBufferCairo.cpp: Update to reflect new class.
+        * platform/graphics/cairo/ImageCairo.cpp: Ditto.
+        * platform/graphics/cairo/PathCairo.cpp: Ditto.
+        * platform/graphics/cairo/PlatformContextCairo.cpp: Added.
+        * platform/graphics/cairo/PlatformContextCairo.h: Added.
+        * platform/graphics/gtk/FontGtk.cpp: Update to reflect new class.
+        * platform/graphics/gtk/IconGtk.cpp: Ditto.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp: Now fill out
+        m_data with a private section containing the platform context instead of
+        just a cairo_t.
+        * platform/gtk/RenderThemeGtk.cpp: Update to reflect new class.
+        * platform/gtk/WidgetRenderingContext.cpp: Ditto.
+        (WebCore::WidgetRenderingContext::~WidgetRenderingContext): Ditto.
+        * plugins/gtk/PluginViewGtk.cpp: Ditto.
+
+2011-03-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r82465.
+
+        * CMakeListsWinCE.txt:
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Update Windows production build logic for new production configurations
+        https://bugs.webkit.org/show_bug.cgi?id=57494
+
+        * WebCore.vcproj/QTMovieWinProduction.vsprops:
+        * WebCore.vcproj/WebCore.make:
+        * WebCore.vcproj/WebCoreProduction.vsprops:
+
+2011-03-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        WebKit2: Attempting to view css file from url causes it to download
+        <rdar://problem/9102611>
+        https://bugs.webkit.org/show_bug.cgi?id=57501
+
+        * WebCore.exp.in:
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeUnsupportedTextMIMETypes):
+        (WebCore::initializeMIMETypeRegistry):
+        (WebCore::MIMETypeRegistry::isUnsupportedTextMIMEType):
+        (WebCore::MIMETypeRegistry::getUnsupportedTextMIMETypes):
+        * platform/MIMETypeRegistry.h:
+        Add set of unsupported text MIME types, taken from WebKit/mac.
+
+2011-03-30  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Crash when closing "Add Bookmark" dialog using the Enter Key
+        https://bugs.webkit.org/show_bug.cgi?id=57294
+        <rdar://problem/9044756>
+
+        Protect the FrameView in EventHandler::keyEvent, like we do in other EventHandler
+        functions that could destroy the frame.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::keyEvent):
+
+2011-03-30  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82463.
+        http://trac.webkit.org/changeset/82463
+        https://bugs.webkit.org/show_bug.cgi?id=57482
+
+        Assertion failure in Node::rendererIsEditable on multiple
+        editing tests (Requested by aroben|meeting on #webkit).
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EUnicodeBidi):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+
+2011-03-24  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QNetworkReplyHandler refactoring: signal sequence.
+        https://bugs.webkit.org/show_bug.cgi?id=57049
+
+        This is the first step in QNetworkReplyHandler. The main objective here is to create simple invariants:
+
+            1 - that the signals metadatachanged, readyRead and finished will come in this order.
+            2 - that signals metadatachanged and finished will be called exactly once.
+
+        Having these invariants further simplifications will be possible and will come in future patches.
+
+        Class QNetworkReplyWrapper was created to handle QNetworkReply object. To connect to the signals of it
+        instead of connecting to the signals of QNetworkReply is what guarantees the sequence of the signals.
+        QNetworkReplyWrapper will be used in future to perform mime type sniffing before sending
+        metadatachanged signal.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyWrapper::QNetworkReplyWrapper):
+        (WebCore::QNetworkReplyWrapper::~QNetworkReplyWrapper):
+        (WebCore::QNetworkReplyWrapper::release):
+        (WebCore::QNetworkReplyWrapper::resetConnections):
+        (WebCore::QNetworkReplyWrapper::receiveMetaData):
+        (WebCore::QNetworkReplyWrapper::didReceiveFinished):
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::resetState):
+        (WebCore::QNetworkReplyHandler::release):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::redirect):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::sendNetworkRequest):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        (WebCore::QNetworkReplyWrapper::reply):
+        (WebCore::QNetworkReplyWrapper::redirectionTargetUrl):
+        (WebCore::QNetworkReplyWrapper::encoding):
+        (WebCore::QNetworkReplyWrapper::advertisedMimeType):
+        (WebCore::QNetworkReplyHandler::reply):
+
+2011-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Rename Windows configuration Release_LTCG to Production for clarity
+        https://bugs.webkit.org/show_bug.cgi?id=57465
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/QTMovieWinProduction.vsprops: Copied from Source/WebCore/WebCore.vcproj/QTMovieWinReleaseLTCG.vsprops.
+        * WebCore.vcproj/QTMovieWinReleaseLTCG.vsprops: Removed.
+        * WebCore.vcproj/WebCore.sln:
+        * WebCore.vcproj/WebCore.submit.sln:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+        * WebCore.vcproj/WebCoreProduction.vsprops: Copied from Source/WebCore/WebCore.vcproj/WebCoreReleaseLTCG.vsprops.
+        * WebCore.vcproj/WebCoreReleaseLTCG.vsprops: Removed.
+
+2011-03-30  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Anders Carlsson.
+        
+        ASSERT(cookieStorageAdapter) when calling stopObservingCookieChanges after WebProcess has crashed
+        https://bugs.webkit.org/show_bug.cgi?id=57477
+        <rdar://problem/9178751>
+        
+        If someone has called startObservingCookieChanges, and the WebProcess crashes and restarts, the UIProcess
+        will call stopObservingCookieChanges when cookieStorageAdapter is nil.
+        
+        The assert is wrong when the web process crashes, and there is no harm in dispatching a message to nil,
+        so remove the assert.
+        
+        * platform/network/mac/CookieStorageMac.mm:
+        (WebCore::stopObservingCookieChanges):
+
+2011-03-30  Sam Weinig  <sam@webkit.org>
+
+        Fix Leopard build.
+
+        * platform/DefaultLocalizationStrategy.cpp:
+        (WebCore::DefaultLocalizationStrategy::contextMenuItemTagLookUpInDictionary):
+
+2011-03-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add default localization strategy that can be shared by WebKit1 and WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=57406
+
+        Currently, only WebKit2 uses this default strategy, but WebKit1 should be able
+        to adopt it soon.
+
+        * platform/DefaultLocalizationStrategy.cpp: Copied from Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp.
+        (WebCore::DefaultLocalizationStrategy::DefaultLocalizationStrategy):
+        * platform/DefaultLocalizationStrategy.h: Copied from Source/WebKit2/WebProcess/WebCoreSupport/WebPlatformStrategies.h.
+        Copy the implementation of the Localization strategy from WebKit2 into a shared default strategy.
+
+        * platform/LocalizedStrings.cpp:
+        (WebCore::localizedString):
+        Add default implementation of localization bottleneck function.
+
+        * platform/LocalizedStrings.h:
+        Add localization macros here, instead of defining them in the above layer.
+
+        * platform/PlatformStrategies.cpp:
+        (WebCore::PlatformStrategies::createLocalizationStrategy):
+        * platform/PlatformStrategies.h:
+        Add default implementation of strategy creation function which creates the default strategy.
+
+        * platform/win/LocalizedStringsWin.cpp: Copied from Source/WebCore/platform/mac/LocalizedStringsMac.mm.
+        (WebCore::localizedString):
+        Add stub for windows, this will be update to pull from the bundle in a follow up patch.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Add new files.
+
+2011-03-30  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        CSS: Slow parsing of rgb() with percent values
+        https://bugs.webkit.org/show_bug.cgi?id=16708
+
+        Implement fast-path parsing for percentage color values.
+
+        Gain ~30% speedup on  http://canvex.lazyilluminati.com/misc/3d.html
+
+        Relanding with rounding fix after it was rolled out in r82315.
+
+        * css/CSSParser.cpp:
+        (WebCore::checkForValidDouble): Extend to return the number of characters forming a valid double.
+        (WebCore::parseDouble): Function for parsing double values if they are valid.
+        (WebCore::parseColorIntOrPercentage): Extend parseColorInt to deal with percentage values.
+        (WebCore::parseAlphaValue): Use the new functions.
+        (WebCore::CSSParser::parseColor): Ditto.
+
+2011-03-30  Ofri Wolfus  <ofri@dhcp-172-28-40-178.tlv.corp.google.com>
+
+        Reviewed by Eric Seidel.
+
+        Add support for parsing unicode-bidi: -webkit-plaintext.
+        https://bugs.webkit.org/show_bug.cgi?id=57457
+
+        Test: css3/unicode-bidi-plaintext-parse.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EUnicodeBidi):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+
+2011-03-30  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Remove unused variables in GraphicsContext::fillRect()
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect):
+
+2011-03-30  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION(r82419): New pixel test failure fast/box-shadow/basic-shadows.html
+        https://bugs.webkit.org/show_bug.cgi?id=57442
+
+        When checking the position of the inline iterator in the logicallyLastRun, we should not consider BR as text.
+
+        No new tests as existing test covers this case.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::reachedEndOfTextRenderer):
+
+2011-03-30  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        AX: GTK: ARIA role is not respected on <p> <label> <div> and <form>
+        https://bugs.webkit.org/show_bug.cgi?id=47636
+
+        Define new roles in WebCore and map them to ATK accordingly.
+
+        Test: platform/gtk/accessibility/aria-roles-unignored.html
+
+        * accessibility/AccessibilityObject.h: Added new roles to
+        represent paragraphs, labels, forms and div sections.
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        Return ParagraphRole, LabelRole, FormRole and DivRole when needed
+        for the GTK platform only.
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (WebCore::AccessibilityObject::allowsTextRanges): Consider the new
+        roles now that those kind of nodes won't return true to isGroup().
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkRole): Map new WebCore roles to ATK Roles.
+        (webkit_accessible_get_role): Remove code to define roles for
+        paragraphs, labels, forms and divs based on node's tag name.
+
+        Update mappings for the Mac platform.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (createAccessibilityRoleMap): Add explicit mappings from the new
+        roles introduced to NSAccessibilityGroupRole.
+
+2011-03-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Build fix for Efl and Qt Win.
+
+        * inspector/PageDebuggerAgent.cpp: removed ENABLE(WORKERS) guard from code that has nothing to do with workers.
+
+2011-03-30  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: audit run never completes, fails in DOMAgent.js
+        https://bugs.webkit.org/show_bug.cgi?id=57349
+
+        - assure document is present before calling DOMAgent.querySelectAll()
+
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+
+2011-03-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Build fix.
+
+        * UseJSC.cmake: fix typo PageDebugServer -> PageScriptDebugServer
+
+2011-03-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: split debugger agent into Page and Worker-specific ones
+        https://bugs.webkit.org/show_bug.cgi?id=57345
+
+        ScriptDebugServer and InspectorDebuggerAgent contain only functionality common
+        for Worker and Page debugger. All specifics is moved into Page/WorkerScriptDebugServer
+        and Page/WorkerDebuggerAgent.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * UseJSC.cmake:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        * bindings/js/PageScriptDebugServer.cpp: Added.
+        (WebCore::toPage):
+        (WebCore::PageScriptDebugServer::shared):
+        (WebCore::PageScriptDebugServer::PageScriptDebugServer):
+        (WebCore::PageScriptDebugServer::~PageScriptDebugServer):
+        (WebCore::PageScriptDebugServer::addListener):
+        (WebCore::PageScriptDebugServer::removeListener):
+        (WebCore::PageScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::PageScriptDebugServer::getListenersForGlobalObject):
+        (WebCore::PageScriptDebugServer::didPause):
+        (WebCore::PageScriptDebugServer::didContinue):
+        (WebCore::PageScriptDebugServer::didRemoveLastListener):
+        (WebCore::PageScriptDebugServer::setJavaScriptPaused):
+        * bindings/js/PageScriptDebugServer.h: Added.
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::sourceParsed):
+        (WebCore::ScriptDebugServer::dispatchFunctionToListeners):
+        (WebCore::ScriptDebugServer::createCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::updateCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::pauseIfNeeded):
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/js/WorkerScriptDebugServer.cpp: Added.
+        (WebCore::WorkerScriptDebugServer::WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::addListener):
+        (WebCore::WorkerScriptDebugServer::removeListener):
+        * bindings/js/WorkerScriptDebugServer.h: Added.
+        (WebCore::WorkerScriptDebugServer::~WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::WorkerScriptDebugServer::getListenersForGlobalObject):
+        (WebCore::WorkerScriptDebugServer::didPause):
+        (WebCore::WorkerScriptDebugServer::didContinue):
+        * bindings/v8/PageScriptDebugServer.cpp: Added.
+        (WebCore::retrieveFrame):
+        (WebCore::PageScriptDebugServer::shared):
+        (WebCore::PageScriptDebugServer::PageScriptDebugServer):
+        (WebCore::PageScriptDebugServer::addListener):
+        (WebCore::PageScriptDebugServer::removeListener):
+        (WebCore::PageScriptDebugServer::setClientMessageLoop):
+        (WebCore::PageScriptDebugServer::getDebugListenerForContext):
+        (WebCore::PageScriptDebugServer::runMessageLoopOnPause):
+        (WebCore::PageScriptDebugServer::quitMessageLoopOnPause):
+        * bindings/v8/PageScriptDebugServer.h: Added.
+        (WebCore::PageScriptDebugServer::setEnabled):
+        (WebCore::PageScriptDebugServer::ClientMessageLoop::~ClientMessageLoop):
+        (WebCore::PageScriptDebugServer::~PageScriptDebugServer):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::setPauseOnNextStatement):
+        (WebCore::ScriptDebugServer::breakProgram):
+        (WebCore::ScriptDebugServer::continueProgram):
+        (WebCore::ScriptDebugServer::stepIntoStatement):
+        (WebCore::ScriptDebugServer::stepOverStatement):
+        (WebCore::ScriptDebugServer::stepOutOfFunction):
+        (WebCore::ScriptDebugServer::editScriptSource):
+        (WebCore::toScriptDebugServer):
+        (WebCore::ScriptDebugServer::breakProgramCallback):
+        (WebCore::ScriptDebugServer::v8DebugEventCallback):
+        (WebCore::ScriptDebugServer::handleV8DebugEvent):
+        (WebCore::ScriptDebugServer::isPaused):
+        * bindings/v8/ScriptDebugServer.h:
+        * bindings/v8/WorkerScriptDebugServer.cpp: Added.
+        (WebCore::WorkerScriptDebugServer::WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::addListener):
+        (WebCore::WorkerScriptDebugServer::removeListener):
+        * bindings/v8/WorkerScriptDebugServer.h: Added.
+        (WebCore::WorkerScriptDebugServer::~WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::getDebugListenerForContext):
+        (WebCore::WorkerScriptDebugServer::runMessageLoopOnPause):
+        (WebCore::WorkerScriptDebugServer::quitMessageLoopOnPause):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::currentCallFrameCallback):
+        * inspector/InjectedScriptHost.h:
+        (WebCore::InjectedScriptHost::init):
+        (WebCore::InjectedScriptHost::debuggerAgent):
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::enable):
+        (WebCore::InspectorDebuggerAgent::disable):
+        (WebCore::InspectorDebuggerAgent::setBreakpointsActive):
+        (WebCore::InspectorDebuggerAgent::removeBreakpoint):
+        (WebCore::InspectorDebuggerAgent::continueToLocation):
+        (WebCore::InspectorDebuggerAgent::resolveBreakpoint):
+        (WebCore::InspectorDebuggerAgent::editScriptSource):
+        (WebCore::InspectorDebuggerAgent::schedulePauseOnNextStatement):
+        (WebCore::InspectorDebuggerAgent::cancelPauseOnNextStatement):
+        (WebCore::InspectorDebuggerAgent::resume):
+        (WebCore::InspectorDebuggerAgent::stepOver):
+        (WebCore::InspectorDebuggerAgent::stepInto):
+        (WebCore::InspectorDebuggerAgent::stepOut):
+        (WebCore::InspectorDebuggerAgent::setPauseOnExceptionsState):
+        (WebCore::InspectorDebuggerAgent::didPause):
+        (WebCore::InspectorDebuggerAgent::breakProgram):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::disable):
+        (WebCore::InspectorProfilerAgent::enable):
+        (WebCore::InspectorProfilerAgent::startUserInitiatedProfiling):
+        * inspector/PageDebuggerAgent.cpp: Added.
+        (WebCore::PageDebuggerAgent::create):
+        (WebCore::PageDebuggerAgent::PageDebuggerAgent):
+        (WebCore::PageDebuggerAgent::~PageDebuggerAgent):
+        (WebCore::PageDebuggerAgent::startListeningScriptDebugServer):
+        (WebCore::PageDebuggerAgent::stopListeningScriptDebugServer):
+        (WebCore::PageDebuggerAgent::scriptDebugServer):
+        * inspector/PageDebuggerAgent.h: Added.
+        * inspector/WorkerDebuggerAgent.cpp: Added.
+        (WebCore::WorkerDebuggerAgent::create):
+        (WebCore::WorkerDebuggerAgent::WorkerDebuggerAgent):
+        (WebCore::WorkerDebuggerAgent::~WorkerDebuggerAgent):
+        (WebCore::WorkerDebuggerAgent::startListeningScriptDebugServer):
+        (WebCore::WorkerDebuggerAgent::stopListeningScriptDebugServer):
+        (WebCore::WorkerDebuggerAgent::scriptDebugServer):
+        * inspector/WorkerDebuggerAgent.h: Added.
+
+2011-03-30  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Clicking below last line of right-to-left editable text that puts caret in the wrong place
+        https://bugs.webkit.org/show_bug.cgi?id=38087
+
+        Moving getLogical[Start/End]BoxWithNode to RootInlineBox and using it in positionForPointWithInlineChildren
+        instead of lastLeafChild, which wasn't correct in the RTL case.
+
+        Test: editing/selection/click-below-rtl-text.html
+
+        * editing/visible_units.cpp:
+        (WebCore::logicalStartPositionForLine): Moved to RootInlineBox.
+        (WebCore::logicalEndPositionForLine): Ditto.
+        * editing/visible_units.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionForPointWithInlineChildren): Useing getLogicalEndBoxWithNode instead
+        of lastLeafChild.
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::getLogicalStartBoxWithNode): Moved and refactored.
+        (WebCore::RootInlineBox::getLogicalEndBoxWithNode): Ditto.
+        * rendering/RootInlineBox.h:
+
+2011-03-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Rollout r82438 and r82436.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * UseJSC.cmake:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        * bindings/js/PageScriptDebugServer.cpp: Removed.
+        * bindings/js/PageScriptDebugServer.h: Removed.
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::shared):
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::addListener):
+        (WebCore::ScriptDebugServer::removeListener):
+        (WebCore::ScriptDebugServer::hasListenersInterestedInPage):
+        (WebCore::toPage):
+        (WebCore::ScriptDebugServer::sourceParsed):
+        (WebCore::ScriptDebugServer::dispatchFunctionToListeners):
+        (WebCore::ScriptDebugServer::setJavaScriptPaused):
+        (WebCore::ScriptDebugServer::createCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::updateCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::pauseIfNeeded):
+        (WebCore::ScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::ScriptDebugServer::didAddListener):
+        (WebCore::ScriptDebugServer::didRemoveListener):
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/js/WorkerScriptDebugServer.cpp: Removed.
+        * bindings/js/WorkerScriptDebugServer.h: Removed.
+        * bindings/v8/PageScriptDebugServer.cpp: Removed.
+        * bindings/v8/PageScriptDebugServer.h: Removed.
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::retrieveFrame):
+        (WebCore::ScriptDebugServer::shared):
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::addListener):
+        (WebCore::ScriptDebugServer::removeListener):
+        (WebCore::ScriptDebugServer::setPauseOnNextStatement):
+        (WebCore::ScriptDebugServer::breakProgram):
+        (WebCore::ScriptDebugServer::continueProgram):
+        (WebCore::ScriptDebugServer::stepIntoStatement):
+        (WebCore::ScriptDebugServer::stepOverStatement):
+        (WebCore::ScriptDebugServer::stepOutOfFunction):
+        (WebCore::ScriptDebugServer::editScriptSource):
+        (WebCore::ScriptDebugServer::setEnabled):
+        (WebCore::ScriptDebugServer::breakProgramCallback):
+        (WebCore::ScriptDebugServer::v8DebugEventCallback):
+        (WebCore::ScriptDebugServer::handleV8DebugEvent):
+        (WebCore::ScriptDebugServer::didResume):
+        * bindings/v8/ScriptDebugServer.h:
+        (WebCore::ScriptDebugServer::pageCreated):
+        (WebCore::ScriptDebugServer::ClientMessageLoop::~ClientMessageLoop):
+        (WebCore::ScriptDebugServer::setClientMessageLoop):
+        * bindings/v8/WorkerScriptDebugServer.cpp: Removed.
+        * bindings/v8/WorkerScriptDebugServer.h: Removed.
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::currentCallFrameCallback):
+        * inspector/InjectedScriptHost.h:
+        (WebCore::InjectedScriptHost::init):
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::create):
+        (WebCore::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::enable):
+        (WebCore::InspectorDebuggerAgent::disable):
+        (WebCore::InspectorDebuggerAgent::setBreakpointsActive):
+        (WebCore::InspectorDebuggerAgent::removeBreakpoint):
+        (WebCore::InspectorDebuggerAgent::continueToLocation):
+        (WebCore::InspectorDebuggerAgent::resolveBreakpoint):
+        (WebCore::InspectorDebuggerAgent::editScriptSource):
+        (WebCore::InspectorDebuggerAgent::schedulePauseOnNextStatement):
+        (WebCore::InspectorDebuggerAgent::cancelPauseOnNextStatement):
+        (WebCore::InspectorDebuggerAgent::resume):
+        (WebCore::InspectorDebuggerAgent::stepOver):
+        (WebCore::InspectorDebuggerAgent::stepInto):
+        (WebCore::InspectorDebuggerAgent::stepOut):
+        (WebCore::InspectorDebuggerAgent::setPauseOnExceptionsState):
+        (WebCore::InspectorDebuggerAgent::didPause):
+        (WebCore::InspectorDebuggerAgent::breakProgram):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::disable):
+        (WebCore::InspectorProfilerAgent::enable):
+        (WebCore::InspectorProfilerAgent::startUserInitiatedProfiling):
+        * inspector/PageDebuggerAgent.cpp: Removed.
+        * inspector/PageDebuggerAgent.h: Removed.
+        * inspector/WorkerDebuggerAgent.cpp: Removed.
+        * inspector/WorkerDebuggerAgent.h: Removed.
+
+2011-03-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Fix compilation on Windows and EFL.
+
+        * CMakeLists.txt:
+        * bindings/js/JSBindingsAllInOne.cpp:
+
+2011-03-30  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: split debugger agent into Page and Worker-specific ones
+        https://bugs.webkit.org/show_bug.cgi?id=57345
+
+        ScriptDebugServer and InspectorDebuggerAgent contain only functionality common
+        for Worker and Page debugger. All specifics is moved into Page/WorkerScriptDebugServer
+        and Page/WorkerDebuggerAgent.
+
+        * GNUmakefile.am:
+        * UseJSC.cmake:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::currentCallFrame):
+        * bindings/js/PageScriptDebugServer.cpp: Added.
+        (WebCore::toPage):
+        (WebCore::PageScriptDebugServer::shared):
+        (WebCore::PageScriptDebugServer::PageScriptDebugServer):
+        (WebCore::PageScriptDebugServer::~PageScriptDebugServer):
+        (WebCore::PageScriptDebugServer::addListener):
+        (WebCore::PageScriptDebugServer::removeListener):
+        (WebCore::PageScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::PageScriptDebugServer::getListenersForGlobalObject):
+        (WebCore::PageScriptDebugServer::didPause):
+        (WebCore::PageScriptDebugServer::didContinue):
+        (WebCore::PageScriptDebugServer::didRemoveLastListener):
+        (WebCore::PageScriptDebugServer::setJavaScriptPaused):
+        * bindings/js/PageScriptDebugServer.h: Added.
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::sourceParsed):
+        (WebCore::ScriptDebugServer::dispatchFunctionToListeners):
+        (WebCore::ScriptDebugServer::createCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::updateCallFrameAndPauseIfNeeded):
+        (WebCore::ScriptDebugServer::pauseIfNeeded):
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/js/WorkerScriptDebugServer.cpp: Added.
+        (WebCore::WorkerScriptDebugServer::WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::addListener):
+        (WebCore::WorkerScriptDebugServer::removeListener):
+        * bindings/js/WorkerScriptDebugServer.h: Added.
+        (WebCore::WorkerScriptDebugServer::~WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::WorkerScriptDebugServer::getListenersForGlobalObject):
+        (WebCore::WorkerScriptDebugServer::didPause):
+        (WebCore::WorkerScriptDebugServer::didContinue):
+        * bindings/v8/PageScriptDebugServer.cpp: Added.
+        (WebCore::retrieveFrame):
+        (WebCore::PageScriptDebugServer::shared):
+        (WebCore::PageScriptDebugServer::PageScriptDebugServer):
+        (WebCore::PageScriptDebugServer::addListener):
+        (WebCore::PageScriptDebugServer::removeListener):
+        (WebCore::PageScriptDebugServer::setClientMessageLoop):
+        (WebCore::PageScriptDebugServer::getDebugListenerForContext):
+        (WebCore::PageScriptDebugServer::runMessageLoopOnPause):
+        (WebCore::PageScriptDebugServer::quitMessageLoopOnPause):
+        * bindings/v8/PageScriptDebugServer.h: Added.
+        (WebCore::PageScriptDebugServer::setEnabled):
+        (WebCore::PageScriptDebugServer::ClientMessageLoop::~ClientMessageLoop):
+        (WebCore::PageScriptDebugServer::~PageScriptDebugServer):
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ScriptDebugServer):
+        (WebCore::ScriptDebugServer::setPauseOnNextStatement):
+        (WebCore::ScriptDebugServer::breakProgram):
+        (WebCore::ScriptDebugServer::continueProgram):
+        (WebCore::ScriptDebugServer::stepIntoStatement):
+        (WebCore::ScriptDebugServer::stepOverStatement):
+        (WebCore::ScriptDebugServer::stepOutOfFunction):
+        (WebCore::ScriptDebugServer::editScriptSource):
+        (WebCore::toScriptDebugServer):
+        (WebCore::ScriptDebugServer::breakProgramCallback):
+        (WebCore::ScriptDebugServer::v8DebugEventCallback):
+        (WebCore::ScriptDebugServer::handleV8DebugEvent):
+        (WebCore::ScriptDebugServer::isPaused):
+        * bindings/v8/ScriptDebugServer.h:
+        * bindings/v8/WorkerScriptDebugServer.cpp: Added.
+        (WebCore::WorkerScriptDebugServer::WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::addListener):
+        (WebCore::WorkerScriptDebugServer::removeListener):
+        * bindings/v8/WorkerScriptDebugServer.h: Added.
+        (WebCore::WorkerScriptDebugServer::~WorkerScriptDebugServer):
+        (WebCore::WorkerScriptDebugServer::getDebugListenerForContext):
+        (WebCore::WorkerScriptDebugServer::runMessageLoopOnPause):
+        (WebCore::WorkerScriptDebugServer::quitMessageLoopOnPause):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::currentCallFrameCallback):
+        * inspector/InjectedScriptHost.h:
+        (WebCore::InjectedScriptHost::init):
+        (WebCore::InjectedScriptHost::debuggerAgent):
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::enable):
+        (WebCore::InspectorDebuggerAgent::disable):
+        (WebCore::InspectorDebuggerAgent::setBreakpointsActive):
+        (WebCore::InspectorDebuggerAgent::removeBreakpoint):
+        (WebCore::InspectorDebuggerAgent::continueToLocation):
+        (WebCore::InspectorDebuggerAgent::resolveBreakpoint):
+        (WebCore::InspectorDebuggerAgent::editScriptSource):
+        (WebCore::InspectorDebuggerAgent::schedulePauseOnNextStatement):
+        (WebCore::InspectorDebuggerAgent::cancelPauseOnNextStatement):
+        (WebCore::InspectorDebuggerAgent::resume):
+        (WebCore::InspectorDebuggerAgent::stepOver):
+        (WebCore::InspectorDebuggerAgent::stepInto):
+        (WebCore::InspectorDebuggerAgent::stepOut):
+        (WebCore::InspectorDebuggerAgent::setPauseOnExceptionsState):
+        (WebCore::InspectorDebuggerAgent::didPause):
+        (WebCore::InspectorDebuggerAgent::breakProgram):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::disable):
+        (WebCore::InspectorProfilerAgent::enable):
+        (WebCore::InspectorProfilerAgent::startUserInitiatedProfiling):
+        * inspector/PageDebuggerAgent.cpp: Added.
+        (WebCore::PageDebuggerAgent::create):
+        (WebCore::PageDebuggerAgent::PageDebuggerAgent):
+        (WebCore::PageDebuggerAgent::~PageDebuggerAgent):
+        (WebCore::PageDebuggerAgent::startListeningScriptDebugServer):
+        (WebCore::PageDebuggerAgent::stopListeningScriptDebugServer):
+        (WebCore::PageDebuggerAgent::scriptDebugServer):
+        * inspector/PageDebuggerAgent.h: Added.
+        * inspector/WorkerDebuggerAgent.cpp: Added.
+        (WebCore::WorkerDebuggerAgent::create):
+        (WebCore::WorkerDebuggerAgent::WorkerDebuggerAgent):
+        (WebCore::WorkerDebuggerAgent::~WorkerDebuggerAgent):
+        (WebCore::WorkerDebuggerAgent::startListeningScriptDebugServer):
+        (WebCore::WorkerDebuggerAgent::stopListeningScriptDebugServer):
+        (WebCore::WorkerDebuggerAgent::scriptDebugServer):
+        * inspector/WorkerDebuggerAgent.h: Added.
+
+2011-03-30  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Make the getStylesForNode result "styleAttributes" value an array rather than a map
+        https://bugs.webkit.org/show_bug.cgi?id=57440
+
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getStylesForNode):
+        (WebCore::InspectorCSSAgent::buildArrayForAttributeStyles):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.getStylesAsync):
+
+2011-03-30  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Fix a last-second ASSERT in previous change that was wrong.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setTitle):
+
+2011-03-30  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        RTL:  Directionality always reset on hard line break
+        https://bugs.webkit.org/show_bug.cgi?id=23124
+
+        No longer clearing all BidiContexts when we hit a hard line break.
+        Instead, directionality applied by DOM elements is preserved by
+        reconstructing the context stack ignoring those that didn't come
+        from the DOM.
+
+        Test: fast/text/international/bidi-br-as-paragraph-separator.html
+
+        * platform/text/BidiContext.cpp:
+        (WebCore::BidiContext::createUncached):
+        (WebCore::BidiContext::create):
+        (WebCore::copyContextAndRebaselineLevel): Helper to make a copy of a context
+        and recalculate its bidi level.
+        (WebCore::BidiContext::copyStackRemovingUnicodeEmbeddingContexts): Returns the top of
+        a BidiContext stack that's equivalent but without contexts from Unicode directional
+        characters.
+        (WebCore::operator==): Now takes into account embedding source.
+        * platform/text/BidiContext.h:
+        (WebCore::BidiContext::source): Enum to specify whether an embedded
+        bidirectional control came from the DOM/Style or Unicode characters
+        (WebCore::BidiContext::BidiContext):
+        * platform/text/BidiResolver.h:
+        (WebCore::BidiEmbedding::BidiEmbedding): An embedding is now a direction
+        and a hint about where it came from so we can differentiate DOM directions
+        from unicode direction control characters.
+        (WebCore::BidiEmbedding::direction):
+        (WebCore::BidiEmbedding::source):
+        (WebCore::::embed): Now takes a source as well as a direction.
+        (WebCore::::commitExplicitEmbedding):
+        (WebCore::::createBidiRunsForLine):
+        * rendering/InlineIterator.h:
+        (WebCore::bidiNext):
+        (WebCore::bidiFirst):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::determineStartPosition):
+
+2011-03-30  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        JavaMethod should not expose JavaString in its API
+        https://bugs.webkit.org/show_bug.cgi?id=55765
+
+        - Factors out a JavaMethod interface which does not use JNI types.
+          This will allow the Java bridge to be used with objects that
+          don't use JNI directly. The existing jobject-backed
+          implementation is moved to a new JavaMethodJobject class which
+          implements the interface.
+        - Use WTF::String in place of JavaString in the API, as JavaString
+          exposes JNI types in its interface.
+        - Remove the method ID as it uses JNI types.
+
+        No new tests, refactoring only.
+
+        * Android.jscbindings.mk:
+        * Android.v8bindings.mk:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bridge/jni/JavaMethod.h:
+        * bridge/jni/JavaMethodJobject.cpp:
+        (JavaMethodJobject::JavaMethodJobject):
+        (JavaMethodJobject::~JavaMethodJobject):
+        (appendClassName):
+        (JavaMethodJobject::signature):
+        * bridge/jni/JavaMethodJobject.h: Copied from Source/WebCore/bridge/jni/JavaMethod.h.
+        (JSC::Bindings::JavaMethodJobject::name):
+        (JSC::Bindings::JavaMethodJobject::returnTypeClassName):
+        (JSC::Bindings::JavaMethodJobject::parameterAt):
+        (JSC::Bindings::JavaMethodJobject::returnType):
+        (JSC::Bindings::JavaMethodJobject::isStatic):
+        (JSC::Bindings::JavaMethodJobject::numParameters):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        (JavaClass::JavaClass):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/v8/JavaClassV8.cpp:
+        (JavaClass::JavaClass):
+        * bridge/jni/v8/JavaInstanceV8.cpp:
+        (JavaInstance::invokeMethod):
+
+2011-03-30  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        clean up Document's handling of title changes
+        https://bugs.webkit.org/show_bug.cgi?id=57433
+
+        Document::setTitle has two entry points:
+        1) from DOM bindings, like document.title="foo"
+        2) from title tags, like <title>foo</title> in HTML
+
+        Split these two code paths to make the code easier to follow.
+        Also, replace the repeated pattern of
+            m_rawTitle = "foo"; updateTitle();
+        with
+            updateTitle("foo");
+
+        * dom/Document.cpp:
+        (WebCore::Document::updateTitle):
+        (WebCore::Document::setTitle):
+        (WebCore::Document::setTitleElement):
+        (WebCore::Document::removeTitle):
+        * dom/Document.h:
+        * html/HTMLTitleElement.cpp:
+        (WebCore::HTMLTitleElement::insertedIntoDocument):
+        (WebCore::HTMLTitleElement::childrenChanged):
+        * svg/SVGTitleElement.cpp:
+        (WebCore::SVGTitleElement::insertedIntoDocument):
+        (WebCore::SVGTitleElement::childrenChanged):
+
+2011-03-30  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        BreakBlockQuoteCommand assumes all li tags have list item renderers
+        https://bugs.webkit.org/show_bug.cgi?id=57253
+
+        Checking that the renderers of li nodes are actually RenderListItems
+        before treating them as such.
+
+        Test: editing/execCommand/crash-breaking-blockquote-with-list.html
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockQuoteCommand::doApply):
+
+2011-03-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: fixing typo in the inspector front-end.
+
+        Web Inspector: REGRESSION: Broken live edit errors handling
+        https://bugs.webkit.org/show_bug.cgi?id=57436
+
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype._didEditScriptSource):
+
+2011-03-30  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Left/Right borders/padding/margins are not always added correctly when rendering multiline inline boxes with bidi elements
+        https://bugs.webkit.org/show_bug.cgi?id=9272
+
+
+        Also fixes https://bugs.webkit.org/show_bug.cgi?id=47210 and https://bugs.webkit.org/show_bug.cgi?id=8392.
+
+        Change how we decide if an InlineFlowBox is the last one for its renderer. Use the position of resolver's logicallyLastRun
+        to decide if there is more text in the next line.
+
+        Tests: fast/borders/rtl-border-01.html
+               fast/borders/rtl-border-02.html
+               fast/borders/rtl-border-03.html
+               fast/borders/rtl-border-04.html
+               fast/borders/rtl-border-05.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::isAnsectorAndWithinBlock):
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        * rendering/InlineFlowBox.h:
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::constructLine):
+        (WebCore::reachedEndOfTextRenderer):
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2011-03-29  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION (r68976): Incorrect bidi rendering in SVG text
+        https://bugs.webkit.org/show_bug.cgi?id=53980
+
+        Deconvolute SVGTextLayoutEngine code, which was confusing due to the simultaneous processing of the rendered text
+        in visual and logical order. Added several helper methods to make the code more readable.
+
+        Fix Unicode directional formatting characters support, now works as expected.
+
+        Test: svg/text/bidi-embedded-direction.svg
+
+        * editing/visible_units.cpp: Refactor getLeafBoxesInLogicalOrder(), move to InlineFlowBox.
+        (WebCore::getLogicalStartBoxAndNode): Use new collectLeafBoxesInLogicalOrder() method in InlineFlowBox.
+        (WebCore::getLogicalEndBoxAndNode): Ditto.
+        * rendering/InlineFlowBox.cpp: Add new helper function, that returns a list of all leaf boxes in logical order.
+        (WebCore::InlineFlowBox::collectLeafBoxesInLogicalOrder):
+        * rendering/InlineFlowBox.h:
+        * rendering/svg/RenderSVGText.cpp: Actually trigger reordering the x/y/dx/dy/rotate value lists, if needed.
+        (WebCore::RenderSVGText::RenderSVGText):
+        (WebCore::RenderSVGText::layout):
+        * rendering/svg/RenderSVGText.h: Ditto.
+        (WebCore::RenderSVGText::layoutAttributes):
+        (WebCore::RenderSVGText::needsReordering):
+        * rendering/svg/SVGRootInlineBox.cpp: Use new InlineFlowBox::collectLeafBoxesINLogicalOrder(), with a custom "inline box reverse" implementation,
+                                              which not only reverses the order of InlineBoxes, but also the order of the x/y/dx/dy/rotate value lists, if needed.
+        (WebCore::SVGRootInlineBox::computePerCharacterLayoutInformation):
+        (WebCore::SVGRootInlineBox::layoutCharactersInTextBoxes):
+        (WebCore::swapItems):
+        (WebCore::reverseInlineBoxRangeAndValueListsIfNeeded):
+        (WebCore::SVGRootInlineBox::reorderValueLists):
+        * rendering/svg/SVGRootInlineBox.h:
+        * rendering/svg/SVGTextLayoutAttributes.cpp: Store RenderSVGInlineText* pointer, where we belong to.
+        (WebCore::SVGTextLayoutAttributes::SVGTextLayoutAttributes):
+        (WebCore::SVGTextLayoutAttributes::dump):
+        * rendering/svg/SVGTextLayoutAttributes.h:
+        (WebCore::SVGTextLayoutAttributes::context):
+        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp: Pass RenderSVGInlineText* object when creating SVGTextLayoutAttributes.
+        (WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributesForTextSubtree):
+        (WebCore::SVGTextLayoutAttributesBuilder::propagateLayoutAttributes):
+        * rendering/svg/SVGTextLayoutAttributesBuilder.h:
+        * rendering/svg/SVGTextLayoutEngine.cpp: Rewrite & cleanup the main layout algorithm, to be less confusing.
+        (WebCore::SVGTextLayoutEngine::SVGTextLayoutEngine):
+        (WebCore::SVGTextLayoutEngine::updateRelativePositionAdjustmentsIfNeeded):
+        (WebCore::SVGTextLayoutEngine::recordTextFragment):
+        (WebCore::SVGTextLayoutEngine::currentLogicalCharacterAttributes):
+        (WebCore::SVGTextLayoutEngine::currentLogicalCharacterMetrics):
+        (WebCore::SVGTextLayoutEngine::currentVisualCharacterMetrics):
+        (WebCore::SVGTextLayoutEngine::advanceToNextLogicalCharacter):
+        (WebCore::SVGTextLayoutEngine::advanceToNextVisualCharacter):
+        (WebCore::SVGTextLayoutEngine::layoutTextOnLineOrPath):
+        * rendering/svg/SVGTextLayoutEngine.h:
+
+2011-03-30  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Not reviewed trivial change.
+
+        Web Inspector: Remove unnecessary function arguments after r82281.
+        https://bugs.webkit.org/show_bug.cgi?id=57327
+
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::didCommitLoad):
+        (WebCore::InspectorAgent::domContentLoadedEventFired):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::domContentLoadedEventFiredImpl):
+        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
+
+2011-03-30  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        H1 element should have different default style if it is in HTML5 sectioning elements.
+        https://bugs.webkit.org/show_bug.cgi?id=52693
+
+        Test: fast/css/h1-in-section-elements.html
+
+        * css/html.css: Add font-size and margin declarations to follow HTML5 specification.
+        (:-webkit-any(article,aside,nav,section) h1):
+        (:-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1):
+        (:-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1):
+        (:-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1):
+        (:-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1):
+
+2011-03-29  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=57408
+        webkit-min-device-pixel-ratio media query doesn't work post-SnowLeopard 
+        -and corresponding-
+        <rdar://problem/8665411>
+
+        * platform/mac/PlatformScreenMac.mm:
+        (WebCore::windowScaleFactor):
+        (WebCore::toUserSpace):
+        (WebCore::toDeviceSpace):
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Rename BidiResolver::eor and sor to m_eor and m_sor to match modern style
+        https://bugs.webkit.org/show_bug.cgi?id=57369
+
+        I considered renaming these to m_endOfRun and m_startOfRun but decided
+        that was too verbose for now (given how often they're used).  I suspect
+        with a bit more refactoring we'll find they're not used very often and can be renamed
+        if so desired.
+
+        * platform/text/BidiResolver.h:
+        (WebCore::::appendRun):
+        (WebCore::::checkDirectionInLowerRaiseEmbeddingLevel):
+        (WebCore::::lowerExplicitEmbeddingLevel):
+        (WebCore::::raiseExplicitEmbeddingLevel):
+        (WebCore::::createBidiRunsForLine):
+        * rendering/InlineIterator.h:
+        (WebCore::InlineBidiResolver::appendRun):
+
+2011-03-29  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Remove exact retained size request in detailed heap snapshots.
+        https://bugs.webkit.org/show_bug.cgi?id=57351
+
+        * bindings/js/ScriptHeapSnapshot.h:
+        * bindings/v8/ScriptHeapSnapshot.cpp:
+        * bindings/v8/ScriptHeapSnapshot.h:
+        * inspector/Inspector.json:
+        * inspector/InspectorProfilerAgent.cpp:
+        * inspector/InspectorProfilerAgent.h:
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGenericObjectNode):
+        (WebInspector.HeapSnapshotGenericObjectNode.prototype.get data):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotView.prototype._mouseClickInContainmentGrid):
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Split more logic out from createBidiRunsForLine for readability
+        https://bugs.webkit.org/show_bug.cgi?id=57341
+
+        I marked reorderRunsFromLevels inline, but it probably doesn't actually need to (or want to) be.
+        This lops another large hunk off of reorderRunsFromLevels further reducing the size and complexity.
+
+        * platform/text/BidiResolver.h:
+        (WebCore::::reorderRunsFromLevels):
+        (WebCore::::createBidiRunsForLine):
+
+2011-03-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Make validation message bubble testable
+        https://bugs.webkit.org/show_bug.cgi?id=57290
+
+        Introduce a setting for validation message timer so that we can configure
+        how long we show a validation message bubble.
+
+        Test: fast/forms/validation-message-appearance.html
+
+        * html/ValidationMessage.cpp:
+        (WebCore::ValidationMessage::setMessageDOMAndStartTimer):
+          Don't set a timer if the timer magnification value is 0 or negative.
+          Otherwise, hides the bubble length * magnification / 1000 seconds.
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Initialize the timer magnification value.
+        * page/Settings.h:
+        (WebCore::Settings::setValidationMessageTimerMagnification): Added.
+        (WebCore::Settings::validationMessageTimerMaginification): Added.
+
+2011-03-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Remove the extraneous declaration I accidentally added in r82376.
+
+        * dom/MouseEvent.h: Removed createSimulated decl.
+
+2011-03-29  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Compositor crash with show-layer-borders flag
+        https://bugs.webkit.org/show_bug.cgi?id=57292
+
+        Synchronize the debug border color/width with other properties to ensure the appropriate
+        CCLayerImpl exists.  Code is only exercised with a debugging command line flag so no layout
+        test.
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::pushPropertiesTo):
+        (WebCore::LayerChromium::setBorderColor):
+        (WebCore::LayerChromium::setBorderWidth):
+        * platform/graphics/chromium/LayerChromium.h:
+
+2011-03-29  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Teach the preload scanner about &lt;input type=image&gt;
+        https://bugs.webkit.org/show_bug.cgi?id=57404
+
+        I did a very rough sample of the top 50 web pages to see how many of each
+        HTML resource type they include:
+        img src: 1,359
+        script src: 276
+        link href: 256
+        iframe src: 104
+        input src: 50
+        embed src: 37
+        @import: 13
+        object data: 11
+
+        Based on this, it seems worthwhile to preload inputs and iframes (possibly embed).
+        This patch only does inputs.
+
+        Test: fast/preloader/input.html
+
+        * html/parser/HTMLPreloadScanner.cpp:
+        (WebCore::HTMLNames::PreloadTask::PreloadTask):
+        (WebCore::HTMLNames::PreloadTask::processAttributes):
+        (WebCore::HTMLNames::PreloadTask::inputTypeAttributeIsImage):
+        (WebCore::HTMLNames::PreloadTask::preload):
+
+2011-03-29  Luke Macpherson   <macpherson@chromium.org>
+
+        Reviewed by David Levin.
+
+        Improve the massive switch statement in CSSStyleSelector::applyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=56288
+
+        No new tests are needed because no new functionality exposed.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        Asserted that cases implemented in the CSSStyleApplyProperty lookup table are unreachable.
+        Updated comment.
+
+2011-03-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Introduce SimulatedMouseEvent and teach EventDispatcher how to use it.
+        https://bugs.webkit.org/show_bug.cgi?id=57402
+
+        No functional changes, covered by existing tests.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::dispatchSimulatedClick): Changed to use SimulatedMouseEvent.
+        (WebCore::EventDispatcher::dispatchMouseEvent): Combined two dispatchMouseEvent methods
+            into one, now that simulated-click events don't need one.
+        * dom/EventDispatcher.h: Updated decls.
+        * dom/MouseEvent.cpp:
+        (WebCore::SimulatedMouseEvent::create): Added.
+        (WebCore::SimulatedMouseEvent::~SimulatedMouseEvent): Added.
+        (WebCore::SimulatedMouseEvent::SimulatedMouseEvent): Added.
+        * dom/MouseEvent.h: Made constructor protected.
+
+2011-03-29  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * WebCore.exp.in:
+
+2011-03-29  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        JavaInstance should not use jvalue in its API
+        https://bugs.webkit.org/show_bug.cgi?id=57019
+
+        This change updates JavaInstance for V8 to use JavaValue, rather than
+        jvalue, in its API. This will allow us to create an API for
+        JavaInstance that is independent of JNI, to allow it to be
+        implemented on platforms that do not use JNI directly.
+
+        Refactoring only, no new tests.
+
+        * bridge/jni/v8/JavaInstanceV8.cpp:
+        (JavaInstance::invokeMethod):
+        (JavaInstance::getField):
+        * bridge/jni/v8/JavaInstanceV8.h:
+        * bridge/jni/v8/JavaNPObjectV8.cpp:
+        (JSC::Bindings::JavaNPObjectInvoke):
+        (JSC::Bindings::JavaNPObjectGetProperty):
+        * bridge/jni/v8/JavaValueV8.h:
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Rename BidiResolver::last to m_last to match modern style
+        https://bugs.webkit.org/show_bug.cgi?id=57367
+
+        * platform/text/BidiResolver.h:
+        (WebCore::::lowerExplicitEmbeddingLevel):
+        (WebCore::::raiseExplicitEmbeddingLevel):
+        (WebCore::::createBidiRunsForLine):
+
+2011-03-29  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        SVGComponentTransferFunctionElement should validate type
+        https://bugs.webkit.org/show_bug.cgi?id=56960
+
+        Test: svg/filters/feComponentTransfer-style-crash.xhtml
+
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        (WebCore::SVGComponentTransferFunctionElement::svgAttributeChanged):
+        * svg/SVGComponentTransferFunctionElement.h:
+
+2011-03-29  Thomas Klausner  <tk@giga.or.at>
+
+        Reviewed by David Levin.
+
+        png-1.5 fixes
+        https://bugs.webkit.org/show_bug.cgi?id=54406
+
+        Fix compilation with png-1.5: struct members were hidden, and
+        a new API to terminate data processing was added (especially for
+        WebKit).
+
+        Compilation fixes, so no new tests.
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2011-03-29  Gavin Peters  <gavinp@chromium.org>
+
+        Reviewed by Tony Gentilcore.
+
+        Add beforeload to icon and prefetch link rel types
+        https://bugs.webkit.org/show_bug.cgi?id=56424
+
+        Over in https://lists.webkit.org/pipermail/webkit-dev/2011-February/016034.html , a webkit-dev
+        thread, I've discussed my hopes for the link element, and adding the link header.  This
+        change helps improve the link header by making it participate in the beforeload event in
+        two more important cases.
+
+        Tests: fast/dom/HTMLLinkElement/prefetch-beforeload.html
+               http/tests/misc/link-rel-icon-beforeload.html
+               webarchive/test-link-rel-icon-beforeload.html
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::checkBeforeLoadEvent):
+        (WebCore::HTMLLinkElement::process):
+        * html/HTMLLinkElement.h:
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Rename BidiResolver::current to BidiResolver::m_current to match modern style
+        https://bugs.webkit.org/show_bug.cgi?id=57363
+
+        I was very confused by current until I realized it was a member variable.
+        I also did m_reachedEndOfLine since that was small.
+
+        * platform/text/BidiResolver.h:
+        (WebCore::BidiResolver::position):
+        (WebCore::BidiResolver::setPosition):
+        (WebCore::BidiResolver::increment):
+        (WebCore::::createBidiRunsForLine):
+
+2011-03-29  Geoff Pike  <gpike@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        In HitTestResult objects, initialize the ListHashSet<RefPtr<Node> >
+        lazily.  In my informal testing it seems to be used hardly at all, so
+        it's wasteful to create it eagerly.  Initializing a ListHashSet
+        is expensive because a ListHashSet initially has space for 256
+        elements, and that space is memset to 0.
+
+        This change should improve performance but have no impact on
+        correctness.  On x86-64, for example, the change cuts the
+        cost of HitTestResult(IntPoint()) in EventHandler::mouseMoved()
+        from ~1700 cycles to ~300 cycles.
+
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::HitTestResult): copy *m_rectBasedTestResult if m_rectBasedTestResult isn't 0
+        (WebCore::HitTestResult::operator=): copy *m_rectBasedTestResult if m_rectBasedTestResult isn't 0
+        (WebCore::HitTestResult::addNodeToRectBasedTestResult): use mutableRectBasedTestResult() rather than m_rectBasedTestResult
+        (WebCore::HitTestResult::append): append *(other.m_rectBasedTestResult) if other.m_rectBasedTestResult isn't 0
+        * rendering/HitTestResult.h:
+        (WebCore::HitTestResult::rectBasedTestResult): Add a typedef for ListHashSet<RefPtr<Node> > to ease readability.  Change m_rectBasedTestResult from ListHashSet<RefPtr<Node> > to an OwnPtr of same.  Modify rectBasedTestResult() and add mutableRectBasedTestResult().
+
+2011-03-29  Timothy Hatcher  <timothy@apple.com>
+
+        Update the order of the context menu to better match AppKit on Mac.
+
+        <rdar://problem/9054893>
+
+        Reviewed by John Sullivan.
+
+        * English.lproj/Localizable.strings: Updated.
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::populate): Update the order of items on Mac.
+        * platform/LocalizationStrategy.h:
+        * platform/LocalizedStrings.cpp:
+        (WebCore::contextMenuItemTagLookUpInDictionary): Added argument for selected string.
+        * platform/LocalizedStrings.h:
+        * platform/android/LocalizedStringsAndroid.cpp:
+        (WebCore::contextMenuItemTagLookUpInDictionary): Ditto.
+        * platform/brew/LocalizedStringsBrew.cpp:
+        (WebCore::contextMenuItemTagLookUpInDictionary): Ditto.
+        * platform/efl/LocalizedStringsEfl.cpp:
+        (WebCore::contextMenuItemTagLookUpInDictionary): Ditto.
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::contextMenuItemTagLookUpInDictionary): Ditto.
+        * platform/haiku/LocalizedStringsHaiku.cpp:
+        (WebCore::contextMenuItemTagLookUpInDictionary): Ditto.
+        * platform/wx/LocalizedStringsWx.cpp:
+        (WebCore::contextMenuItemTagLookUpInDictionary): Ditto.
+
+2011-03-29  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Chris Marrin and Ken Russell.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57248
+        Occlusion issues with WebGL in Safari
+
+        The depth buffer on Safari ports was being set up with a
+        maximum of 16 bits. Now we use a combined 24/8 depth/stencil
+        buffer on Mac ports.
+
+        No new tests as this is the setting for a particular port. Other
+        ports may use different defaults.
+
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::validateAttributes):
+        - use Extensions3D to test for depth and multisample extensions
+          rather than querying OpenGL directly.
+        (WebCore::GraphicsContext3D::reshape):
+        - use a 24bit depth buffer when the extension is enabled.
+
+2011-03-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Sorted XCode project. It's gotten quite out of sorts.
+
+        * WebCore.xcodeproj/project.pbxproj: Ran sort-XCode-project-file.
+
+2011-03-29  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        DatasetDOMStringMap::item and ::contains copies attribute name string
+        https://bugs.webkit.org/show_bug.cgi?id=55645
+
+        Change propertyNameMatchesAttributeName to match without creating a copy
+        of the string.
+
+        * dom/DatasetDOMStringMap.cpp:
+        (WebCore::propertyNameMatchesAttributeName):
+
+2011-03-29  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed rollout r82282, part of r82288, r82298.
+
+        * css/CSSParser.cpp:
+        (WebCore::parseColorInt):
+        (WebCore::isValidDouble):
+        (WebCore::parseAlphaValue):
+        (WebCore::CSSParser::parseColor):
+
+2011-03-25  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=55981
+        Second round of clean-ups, aimed at supporting GTK with the
+        same unified FontPlatformData header.  This version removes
+        some unneeded WinCairo code, and aligns the WinCairo and
+        GTK ports to reduce code duplication.
+
+        * WebCore.vcproj/WebCore.vcproj: Get rid of a dangling reference
+          to an old WinCairo file.
+        * platform/graphics/FontPlatformData.h: Remove unneeded member
+          for m_fontFace, which is a member of m_scaledFont.  Switch to
+          standard Cairo hashing.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::scaledFont):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+        * platform/graphics/win/FontCacheWin.cpp: Update to no longer use
+          the unnecessary fontFace() accessor.
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/win/FontCustomPlatformDataCairo.cpp:
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        (WebCore::FontPlatformData::platformDataInit):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::platformDataAssign):
+        (WebCore::FontPlatformData::platformIsEqual):
+        * platform/graphics/win/FontPlatformDataWin.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2011-03-29  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Inline worker powered by blob URL does not work with files URL even if
+        allowFileAccessFromFileURLs is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=56063
+
+        Test: fast/files/workers/inline-worker-via-blob-url.html
+
+        * fileapi/BlobURL.cpp: Removed unneeded getOrigin() method.
+        * fileapi/BlobURL.h: Removed unneeded getOrigin() method.
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin): Extended the logic to handle
+        filesystem URL also to blob URL. Also fixed the problem that m_isUnique
+        is incorrectly set for blob and filesystem URLs.
+        (WebCore::SecurityOrigin::create): Removed the special logic for blob URL
+        since we use the same logic in SecurityOrigin constructor as filesystem
+        URL.
+        (WebCore::SecurityOrigin::canRequest): Removed the special logic for blob
+        URL since it is not needed with the fix in SecurityOrigin constructor.
+
+2011-03-29  Timothy Hatcher  <timothy@apple.com>
+
+        Update WebCore Localizable.strings to contain WebCore, WebKit/mac and WebKit2 strings.
+
+        https://webkit.org/b/57354
+
+        Reviewed by Sam Weinig.
+
+        * English.lproj/Localizable.strings: Updated.
+        * StringsNotToBeLocalized.txt: Removed. To hard to maintain in WebCore.
+        * platform/network/cf/LoaderRunLoopCF.h: Remove a single quote in an #error so
+        extract-localizable-strings does not complain about unbalanced single quotes.
+
+2011-03-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82295 and r82300.
+        http://trac.webkit.org/changeset/82295
+        http://trac.webkit.org/changeset/82300
+        https://bugs.webkit.org/show_bug.cgi?id=57380
+
+        This patch breaks compile on Chromium (Requested by
+        abarth|gardener on #webkit).
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkRole):
+        (webkit_accessible_get_role):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+
+2011-03-29  Anders Carlsson  <andersca@apple.com>
+
+        Fix clang build.
+
+        * platform/text/BidiResolver.h:
+        (WebCore::::createBidiRunsForLine):
+
+2011-03-29  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Use per-configuration vsprops in WebCore to avoid WebKitVSPropsRedirectionDir removal by MSVC IDE
+        https://bugs.webkit.org/show_bug.cgi?id=57378
+
+        Visual Studio's IDE was removing instances of $(WebKitVSPropsRedirectionDir) from
+        InheritedPropertySheet rules in our vcproj files when the vcproj was edited from within
+        the IDE. To avoid this, add a separate vsprops file for each project configuration that
+        contains the required inherited property sheets.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/QTMovieWinDebug.vsprops: Added.
+        * WebCore.vcproj/QTMovieWinDebugAll.vsprops: Added.
+        * WebCore.vcproj/QTMovieWinDebugCairoCFLite.vsprops: Added.
+        * WebCore.vcproj/QTMovieWinRelease.vsprops: Added.
+        * WebCore.vcproj/QTMovieWinReleaseCairoCFLite.vsprops: Added.
+        * WebCore.vcproj/QTMovieWinReleaseLTCG.vsprops: Added.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreDebug.vsprops: Added.
+        * WebCore.vcproj/WebCoreDebugAll.vsprops: Added.
+        * WebCore.vcproj/WebCoreDebugCairoCFLite.vsprops: Added.
+        * WebCore.vcproj/WebCoreRelease.vsprops: Added.
+        * WebCore.vcproj/WebCoreReleaseCairoCFLite.vsprops: Added.
+        * WebCore.vcproj/WebCoreReleaseLTCG.vsprops: Added.
+
+2011-03-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/9194927> REGRESSION (r81691): Page at www.mondaynote.com lays out incorrectly
+        
+        Back out the optimization that stopped when it hit the first float. This was an incorrect optimization
+        and can't be done without more work.
+
+        Added fast/block/float/float-forced-below-other-floats.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Start to clean up BidiResolver::createBidiRunsForLine so that mere mortals can understand it
+        https://bugs.webkit.org/show_bug.cgi?id=57338
+
+        I'm attempting to break createBidiRunsForLine into understandable pieces
+        so that we can tell what it's actually doing.  Our implementation of the
+        unicode bidi algorithm is slightly different from the spec in that we
+        run it per-line (instead of over the entire paragraph at once).  This is
+        great for performance (our implementation is resumable), but it makes
+        things a bit tricky to understand.  Splitting createBidiRunsForLine into
+        pieces should help make our UBA implementation more readable.
+
+        * platform/text/BidiResolver.h:
+        (WebCore::::updateStatusLastFromCurrentDirection):
+        (WebCore::::createBidiRunsForLine):
+
+2011-03-29  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [Gtk] Consistent crash from Google/ARIA combobox click
+        https://bugs.webkit.org/show_bug.cgi?id=55883
+
+        Do not call to firstChild() to avoid entering into infinite loops.
+
+        This would happen when current item is a WebCore Group and some of
+        its children have either role 'option' or 'menuitem'. Other than
+        that the logic behind that call to firstChild() seems to be no
+        longer needed so it's safe to remove it.
+
+        Test: platform/gtk/accessibility/aria-options-and-menuitems-crash.html
+
+        * accessibility/gtk/AccessibilityObjectAtk.cpp:
+        (WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):
+        Remove call to firsChild, which was leading to crashes sometimes.
+
+2011-03-29  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        AX: GTK: ARIA role is not respected on <p> <label> <div> and <form>
+        https://bugs.webkit.org/show_bug.cgi?id=47636
+
+        Define new roles in WebCore and map them to ATK accordingly.
+
+        Test: platform/gtk/accessibility/aria-roles-unignored.html
+
+        * accessibility/AccessibilityObject.h: Added new roles to
+        represent paragraphs, labels, forms and div sections.
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+        Return ParagraphRole, LabelRole, FormRole and DivRole when needed.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkRole): Map new WebCore roles to ATK Roles.
+        (webkit_accessible_get_role): Remove code to define roles for
+        paragraphs, labels, forms and divs based on node's tag name.
+
+        Update mappings for the Mac platform.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (createAccessibilityRoleMap): Add explicit mappings from the new
+        roles introduced to NSAccessibilityGroupRole.
+
+2011-03-29  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed build fix. Remove ASSERT hitting consitently on GTK.
+
+        * rendering/InlineIterator.h:
+        (WebCore::InlineIterator::moveToStartOf):
+
+2011-03-29  Darin Adler  <darin@apple.com>
+
+        Fix some just-introduced build failures.
+
+        * WebCore.pro: Correct spelling of filename.
+
+        * css/CSSParser.cpp:
+        (WebCore::parseColorIntOrPercentage): Fix double/int conversion that fails to compile
+        on Leopard. Also renamed one local variabel.
+
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::didCommitLoad): Removed unused argument names to avoid warning.
+        (WebCore::InspectorAgent::domContentLoadedEventFired): Ditto.
+
+2011-03-29  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        CSS: Slow parsing of rgb() with percent values
+        https://bugs.webkit.org/show_bug.cgi?id=16708
+
+        Implement fast-path parsing for percentage color values.
+
+        Gain ~30% speedup on http://canvex.lazyilluminati.com/misc/3d.html.
+
+        * css/CSSParser.cpp:
+        (WebCore::checkForValidDouble): Extend to return the number of characters forming a valid double.
+        (WebCore::parseDouble): Function for parsing double values if they are valid.
+        (WebCore::parseColorIntOrPercentage): Extend parseColorInt to deal with percentage values.
+        (WebCore::parseAlphaValue): Use the new functions.
+        (WebCore::CSSParser::parseColor): Ditto.
+
+2011-03-29  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: extract InspectorPageAgent from InspectorAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=57327
+
+        There are page related methods and inspector related methods in InspectorAgent.
+        It would be nice to extract page specific methods for future usage the rest of methods in workers debugger.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/Inspector.json:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::restoreInspectorStateFromCookie):
+        (WebCore::InspectorAgent::didClearWindowObjectInWorld):
+        (WebCore::InspectorAgent::setFrontend):
+        (WebCore::InspectorAgent::disconnectFrontend):
+        (WebCore::InspectorAgent::didCommitLoad):
+        (WebCore::InspectorAgent::domContentLoadedEventFired):
+        * inspector/InspectorAgent.h:
+        (WebCore::InspectorAgent::pageAgent):
+        * inspector/InspectorPageAgent.cpp: Added.
+        (WebCore::InspectorPageAgent::create):
+        (WebCore::InspectorPageAgent::InspectorPageAgent):
+        (WebCore::InspectorPageAgent::setFrontend):
+        (WebCore::InspectorPageAgent::clearFrontend):
+        (WebCore::InspectorPageAgent::addScriptToEvaluateOnLoad):
+        (WebCore::InspectorPageAgent::removeAllScriptsToEvaluateOnLoad):
+        (WebCore::InspectorPageAgent::reloadPage):
+        (WebCore::InspectorPageAgent::openInInspectedWindow):
+        (WebCore::InspectorPageAgent::setUserAgentOverride):
+        (WebCore::buildObjectForCookie):
+        (WebCore::buildArrayForCookies):
+        (WebCore::InspectorPageAgent::getCookies):
+        (WebCore::InspectorPageAgent::deleteCookie):
+        (WebCore::InspectorPageAgent::inspectedURLChanged):
+        (WebCore::InspectorPageAgent::restore):
+        (WebCore::InspectorPageAgent::didCommitLoad):
+        (WebCore::InspectorPageAgent::domContentEventFired):
+        (WebCore::InspectorPageAgent::loadEventFired):
+        (WebCore::InspectorPageAgent::didClearWindowObjectInWorld):
+        (WebCore::InspectorPageAgent::applyUserAgentOverride):
+        * inspector/InspectorPageAgent.h: Added.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::connectFrontend):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didClearWindowObjectInWorldImpl):
+        (WebCore::InspectorInstrumentation::applyUserAgentOverrideImpl):
+        (WebCore::InspectorInstrumentation::domContentLoadedEventFiredImpl):
+        (WebCore::InspectorInstrumentation::loadEventFiredImpl):
+        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
+        (WebCore::InspectorInstrumentation::retrievePageAgent):
+        * inspector/InspectorInstrumentation.h:
+        * inspector/InstrumentingAgents.h:
+        (WebCore::InstrumentingAgents::InstrumentingAgents):
+        (WebCore::InstrumentingAgents::inspectorPageAgent):
+        (WebCore::InstrumentingAgents::setInspectorPageAgent):
+        * inspector/front-end/AuditsPanel.js:
+        (WebInspector.AuditsPanel.prototype._reloadResources):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype._deleteCookie):
+        (WebInspector.Cookies.getCookiesAsync):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onReload):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkDataGridNode.prototype._openInNewTab):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.FrameResourceTreeElement.prototype.ondblclick):
+        * inspector/front-end/WorkersSidebarPane.js:
+        (WebInspector.WorkersSidebarPane.prototype.setInstrumentation):
+        * inspector/front-end/inspector.js:
+        (WebInspector.openResource):
+        (WebInspector.documentKeyDown):
+
+2011-03-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57276
+        
+        Add optimizations to make the vertical placement of boxes much faster. Whenever a box is added
+        to a line, compare it with the parent box. If we can determine that the child box has the exact
+        same height and baseline position as the parent box, then we keep a boolean flag set called
+        descendantsHaveSameLineHeightAndBaseline(). If the box is different for any reason then we clear the
+        flag up the line box parent chain.
+
+        When it comes time to do computeLogicalboxHeights, we can avoid recurring into the children of
+        a box whose descendants all have the same position. When we do placeBoxesInBlockDirection, we
+        can do a simplified recursion that just calls adjustBlockDirectionPosition to offset the boxes
+        without doing anything else.
+        
+        Because of the quirks mode rule of only shrinking boxes with no immediate text children, we need
+        to track whether a box has text descendants now as well.  When we avoid doing the recursion
+        this flag tells us whether the collection of boxes should have an effect on the ascent and descent
+        of the line in quirks mode.
+ 
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::addToLine):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::InlineFlowBox):
+        (WebCore::InlineFlowBox::hasTextDescendants):
+        (WebCore::InlineFlowBox::descendantsHaveSameLineHeightAndBaseline):
+        (WebCore::InlineFlowBox::clearDescendantsHaveSameLineHeightAndBaseline):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::createLineBoxes):
+        (WebCore::RenderBlock::constructLine):
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Remove a bunch of duplicate code by adding some InlineIterator helper methods
+        https://bugs.webkit.org/show_bug.cgi?id=57326
+
+        Once I started adding these it became clear how much crazy duplicated code
+        we had due to treating InlineIterator as a struct and accessing its
+        members directly.  We can't quite make the members private yet since
+        findNextLineBreak still splits out the members.  But this change
+        makes the code much cleaner.
+
+        * rendering/InlineIterator.h:
+        (WebCore::InlineIterator::clear):
+        (WebCore::InlineIterator::moveToStartOf):i
+        (WebCore::InlineIterator::moveTo):
+        (WebCore::InlineIterator::increment):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::tryHyphenating):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Clean up bidiNext by abstracting repeated code
+        https://bugs.webkit.org/show_bug.cgi?id=57335
+
+        I also added a comment to explain what bidiNext is actually doing.
+        This whole area of code is confusing but need not be.
+
+        * rendering/InlineIterator.h:
+        (WebCore::embedCharFromDirection):
+        (WebCore::notifyResolverEnteredObject):
+        (WebCore::notifyResolverWillExitObject):
+        (WebCore::bidiNext):
+        (WebCore::bidiFirst):
+
+2011-03-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Support external CSS stylesheet freeflow text editing
+        https://bugs.webkit.org/show_bug.cgi?id=54397
+
+        In this implementation, Ctrl/Cmd-S commits the current changes into the model.
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.createResourceView):
+        (WebInspector.CSSSourceFrameDelegateForResourcesPanel):
+        (WebInspector.CSSSourceFrameDelegateForResourcesPanel.prototype.canEditScriptSource):
+        (WebInspector.CSSSourceFrameDelegateForResourcesPanel.prototype.editScriptSource):
+        (WebInspector.CSSSourceFrameDelegateForResourcesPanel.prototype.editScriptSource.handleInfos):
+        (WebInspector.CSSSourceFrameDelegateForResourcesPanel.prototype._saveStyleSheet):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._applyDiffMarkup):
+        (WebInspector.FrameResourceTreeElement.prototype._contentChanged):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._createTextViewer):
+
+2011-03-29  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        playbackRate should not be set to defaultPlaybackRate in play()
+        https://bugs.webkit.org/show_bug.cgi?id=55943
+
+        Test: media/video-playbackrate.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::playbackRate): No need to ask the media engine for the current
+            rate, we already have the current value cached.
+        (WebCore::HTMLMediaElement::playInternal): Don't reset the engine's playback rate to 
+            the default rate.
+        (WebCore::HTMLMediaElement::togglePlayState): Do reset the engine's playback rate to 
+            the default rate before triggering playback.
+        * manual-tests/media-default-playback-rate.html: Added.
+
+2011-03-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove specialization of EventDispatcher with inversion of control.
+        https://bugs.webkit.org/show_bug.cgi?id=57285
+
+        Since some events have extra logic around their dispatch, allow them
+        to dispatch themselves and specialize the logic. This change only
+        converts KeyboardEvent to this model.
+
+        No functional change, covered by existing tests.
+
+        * dom/Event.cpp:
+        (WebCore::Event::dispatch): Added.
+        * dom/Event.h: Updated decls.
+        * dom/EventDispatcher.cpp:
+        (WebCore::EventDispatcher::dispatchEvent): Changed to ask event to dispatch
+            itself.
+        * dom/EventDispatcher.h: Updated decls.
+        * dom/KeyboardEvent.cpp:
+        (WebCore::KeyboardEvent::dispatch): Added, moving code from EventDispatcher.
+        * dom/KeyboardEvent.h: Updated decls.
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchKeyEvent): Changed to use the new ways.
+
+2011-03-29  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: InspectorDOMAgent has unnecessary dependency from InspectorAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=57329
+
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::setFrontend):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspect):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::setFrontend):
+        (WebCore::InspectorDOMAgent::handleMousePress):
+        (WebCore::InspectorDOMAgent::inspect):
+        (WebCore::InspectorDOMAgent::focusNode):
+        (WebCore::InspectorDOMAgent::highlight):
+        (WebCore::InspectorDOMAgent::hideHighlight):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::create):
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Rename InlineIterator::pos to m_pos to match modern style
+        https://bugs.webkit.org/show_bug.cgi?id=57342
+
+        Somehow I failed to upload this one earlier, no wonder later patches didn't apply.
+
+        * rendering/InlineIterator.h:
+        (WebCore::InlineIterator::InlineIterator):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        (WebCore::InlineIterator::increment):
+        (WebCore::InlineIterator::current):
+        (WebCore::InlineBidiResolver::appendRun):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::checkMidpoints):
+        (WebCore::RenderBlock::appendRunsForObject):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+        (WebCore::tryHyphenating):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-03-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: document BrowserDebugger agent.
+        https://bugs.webkit.org/show_bug.cgi?id=57331
+
+        * inspector/Inspector.json:
+
+2011-03-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Fix handling of the CSSAgent.setStyleSheetText() results in CSSStyleModel.js
+        https://bugs.webkit.org/show_bug.cgi?id=56310
+
+        Instead of stylesheet ids, CSSAgent.getAllStyleSheets() now returns metainfo objects containing
+        "styleSheetId", "sourceURL", "disabled", and "title" fields. The latter three are not returned
+        by CSSAgent.getStyleSheet() anymore.
+
+        Test: inspector/styles/get-set-stylesheet-text.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getAllStyleSheets):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheet):
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheetInfo):
+        * inspector/InspectorStyleSheet.h:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.styleSheetCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.allStylesCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged.callback):
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype._onRevert):
+        (WebInspector.CSSStyleSheet):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+
+2011-03-29  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement text-align:match-parent as -webkit-match-parent.
+        https://bugs.webkit.org/show_bug.cgi?id=50951
+
+        Add support to the CSS parser.
+
+        Tests: fast/css/text-align-webkit-match-parent-parse.html
+               fast/css/text-align-webkit-match-parent.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Rename InlineIterator::nextBreakablePosition to m_nextBreakablePosition to match modern style
+        https://bugs.webkit.org/show_bug.cgi?id=57323
+
+        All of these m_nextBreakablePosition = -1 could probably be replaced with
+        some new methods.  But I'll do that in a separate change.  Clearly
+        m_nextBreakablePosition is just a cached value which should be cleared
+        at the right times.  I suspect we may even fail to clear it sometimes when
+        we should due to the current used of direct access instead of smarter functions.
+
+        * rendering/InlineIterator.h:
+        (WebCore::InlineIterator::InlineIterator):
+        (WebCore::InlineIterator::increment):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::tryHyphenating):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-03-29  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Add WebCore::copyCertificateToData() on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57296
+
+        Create a new win directory in platform/cf and add CertificateCFWin.cpp and CertificateCFWin.h to it.
+
+        * WebCore.vcproj/WebCore.vcproj: Added CertificateCFWin.cpp and CertificateCFWin.h.
+        * WebCore.vcproj/copyForwardingHeaders.cmd: Copy all header files in \platform\cf\win\.
+        * platform/cf/win: Added.
+        * platform/cf/win/CertificateCFWin.cpp: Added.
+        (WebCore::deallocCertContext): Added.
+        (WebCore::createCertContextDeallocator): Added.
+        (WebCore::copyCertificateToData): Added.
+        * platform/cf/win/CertificateCFWin.h: Added.
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Rename InlineIterator::block to m_block to match modern style
+        https://bugs.webkit.org/show_bug.cgi?id=57321
+
+        I could have made m_block private, since it's only accessed in
+        one place outside of InlineIterator (for an ASSERT).  But I chose
+        not to do so in this change.
+
+        * rendering/InlineIterator.h:
+        (WebCore::InlineIterator::InlineIterator):
+        (WebCore::InlineIterator::increment):
+        (WebCore::InlineBidiResolver::appendRun):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-03-29  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Incorrect offset of svg <use> element which is in <symbol> element
+        https://bugs.webkit.org/show_bug.cgi?id=57318
+
+        When webkit expanded a svg <symbol> element in the shadow tree it
+        would clone the children of the <symbol>. The children may contain
+        SVGShadowTreeContainerElement which was expanded from svg <use>
+        element. But the clone operation would clone a
+        SVGShadowTreeContainerElement as a svg <g> element. This resulted
+        that updateContainerOffset wouldn't update offset for those elements
+        which were expand from <use> elements.
+
+        This patch implements cloneElementWithoutAttributesAndChildren for
+        SVGShadowTreeContainerElement to make the container clone itself
+        correctly.
+
+        Test: svg/custom/use-in-symbol-with-offset.svg
+
+        * rendering/svg/SVGShadowTreeElements.cpp:
+        (WebCore::SVGShadowTreeContainerElement::cloneElementWithoutAttributesAndChildren):
+        * rendering/svg/SVGShadowTreeElements.h:
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Rename InlineIterator::obj to m_obj to match modern style
+        https://bugs.webkit.org/show_bug.cgi?id=57319
+
+        I started this rename after confusion in InlineBidiResolver::appendRun.
+        (Which uses an "obj" local in InlineIterator.h.  It's not actually
+        masking m_obj because it's a separate class, but I didn't realize
+        that at the time because it's in InlineIterator.h which is itself confusing!)
+
+        * rendering/InlineIterator.h:
+        (WebCore::InlineIterator::InlineIterator):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        (WebCore::InlineIterator::increment):
+        (WebCore::InlineIterator::atEnd):
+        (WebCore::InlineIterator::current):
+        (WebCore::InlineIterator::direction):
+        (WebCore::InlineBidiResolver::appendRun):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::checkMidpoints):
+        (WebCore::RenderBlock::appendRunsForObject):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+        (WebCore::skipNonBreakingSpace):
+        (WebCore::RenderBlock::requiresLineBox):
+        (WebCore::RenderBlock::skipTrailingWhitespace):
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+        (WebCore::tryHyphenating):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-03-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: document Timeline domain, make timeline event types of type string.
+        https://bugs.webkit.org/show_bug.cgi?id=57299
+
+        * inspector/Inspector.json:
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::pushGCEventRecords):
+        (WebCore::InspectorTimelineAgent::start):
+        (WebCore::InspectorTimelineAgent::stop):
+        (WebCore::InspectorTimelineAgent::willCallFunction):
+        (WebCore::InspectorTimelineAgent::didCallFunction):
+        (WebCore::InspectorTimelineAgent::willDispatchEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::didInstallTimer):
+        (WebCore::InspectorTimelineAgent::didRemoveTimer):
+        (WebCore::InspectorTimelineAgent::willFireTimer):
+        (WebCore::InspectorTimelineAgent::didFireTimer):
+        (WebCore::InspectorTimelineAgent::willChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::didChangeXHRReadyState):
+        (WebCore::InspectorTimelineAgent::willLoadXHR):
+        (WebCore::InspectorTimelineAgent::didLoadXHR):
+        (WebCore::InspectorTimelineAgent::willEvaluateScript):
+        (WebCore::InspectorTimelineAgent::didEvaluateScript):
+        (WebCore::InspectorTimelineAgent::didScheduleResourceRequest):
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::willReceiveResourceData):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceData):
+        (WebCore::InspectorTimelineAgent::willReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didReceiveResourceResponse):
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        (WebCore::InspectorTimelineAgent::didMarkTimeline):
+        (WebCore::InspectorTimelineAgent::didMarkDOMContentEvent):
+        (WebCore::InspectorTimelineAgent::didMarkLoadEvent):
+        (WebCore::InspectorTimelineAgent::addRecordToTimeline):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::TimelineRecordEntry::TimelineRecordEntry):
+        * inspector/front-end/TimelineAgent.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.get _recordStyles):
+        (WebInspector.TimelinePanel.prototype._createEventDivider):
+        (WebInspector.TimelinePanel.prototype._findParentRecord):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelineDispatcher.prototype.started):
+        (WebInspector.TimelineDispatcher.prototype.stopped):
+        (WebInspector.TimelineDispatcher.prototype.eventRecorded):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):
+
+2011-03-29  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Fixing live edits tests on chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=57316
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.editScriptSource):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._handleSave.didEditScriptSource):
+        (WebInspector.SourceFrame.prototype._handleSave):
+        (WebInspector.SourceFrameDelegate.prototype.editScriptSource):
+
+2011-03-29  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: fix call frames positions in formatted scripts.
+        https://bugs.webkit.org/show_bug.cgi?id=57036
+
+        Introduce PresentationCallFrame class that encapsulates source mapping details from UI components.
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update.didGetSourceLocation):
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.prototype.set selectedCallFrame):
+        (WebInspector.CallStackSidebarPane.prototype._placardSelected):
+        (WebInspector.CallStackSidebarPane.prototype._contextMenu):
+        (WebInspector.CallStackSidebarPane.prototype._copyStackTrace):
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype._didEditScriptSource):
+        (WebInspector.DebuggerModel.prototype.get debuggerPausedDetails):
+        (WebInspector.DebuggerModel.prototype._pausedScript):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype.editScriptSource.didEditScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.editScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.toggleFormatSourceFiles):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerPaused):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerResumed):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype.get selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype._reset):
+        (WebInspector.PresenationCallFrame): Call frame wrapper for UI.
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused.else.didGetSourceLocation):
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype._debuggerResumed):
+        (WebInspector.ScriptsPanel.prototype._sourceFrameLoaded):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected.didGetSourceLocation):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.SourceFile.prototype.get content):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._createTextViewer):
+        (WebInspector.SourceFrame.prototype.setExecutionLine):
+        (WebInspector.SourceFrame.prototype.clearExecutionLine):
+        (WebInspector.SourceFrame.prototype._showPopup.showObjectPopup):
+        (WebInspector.SourceFrame.prototype._showPopup):
+
+2011-03-29  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for execCommand("Delete") with an empty selection.
+        https://bugs.webkit.org/show_bug.cgi?id=56652
+
+        Test: editing/execCommand/delete-empty-container.html
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::makeEditableRootEmpty): Add check for root element.
+
+2011-03-29  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Refactor HeapSnapshot-related code to
+        make sure we don't return big amounts of data to forms.
+        https://bugs.webkit.org/show_bug.cgi?id=57227
+
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotGridNode.prototype.populateChildren):
+        (WebInspector.HeapSnapshotGenericObjectNode.prototype.get _countPercent):
+        (WebInspector.HeapSnapshotObjectNode):
+        (WebInspector.HeapSnapshotObjectNode.prototype._createProvider):
+        (WebInspector.HeapSnapshotInstanceNode):
+        (WebInspector.HeapSnapshotInstanceNode.prototype._createProvider):
+        (WebInspector.HeapSnapshotConstructorNode.prototype._createNodesProvider):
+        (WebInspector.HeapSnapshotConstructorNode.prototype.get _countPercent):
+        (WebInspector.HeapSnapshotDiffNode.prototype._createNodesProvider.createProvider):
+        (WebInspector.HeapSnapshotDiffNode.prototype._createNodesProvider):
+        (WebInspector.HeapSnapshotDominatorObjectNode.prototype._createProvider):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.HeapSnapshotContainmentDataGrid.prototype.setDataSource):
+        (WebInspector.HeapSnapshotDominatorsDataGrid.prototype.setDataSource):
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshotNode.prototype.get dominatorIndex):
+        (WebInspector.HeapSnapshotNode.prototype.get retainers):
+        (WebInspector.HeapSnapshot):
+        (WebInspector.HeapSnapshot.prototype.get _allNodes):
+        (WebInspector.HeapSnapshot.prototype.get nodeCount):
+        (WebInspector.HeapSnapshot.prototype.get rootNodeIndex):
+        (WebInspector.HeapSnapshot.prototype.hasId):
+        (WebInspector.HeapSnapshot.prototype.get nodeIds):
+        (WebInspector.HeapSnapshot.prototype._retainersForNode):
+        (WebInspector.HeapSnapshot.prototype._buildRetainers):
+        (WebInspector.HeapSnapshot.prototype._buildAggregates):
+        (WebInspector.HeapSnapshot.prototype._buildAggregatesIndexes):
+        (WebInspector.HeapSnapshot.prototype._buildIdsList):
+        (WebInspector.HeapSnapshot.prototype._buildNodeIndex):
+        (WebInspector.HeapSnapshotFilteredOrderedIterator):
+        (WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.next):
+        (WebInspector.HeapSnapshotEdgesProvider):
+        (WebInspector.HeapSnapshotNodesProvider):
+
+2011-03-29  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Fix detailed heap snapshots UI.
+        https://bugs.webkit.org/show_bug.cgi?id=57235
+
+        Fix two problems:
+          1. Text color of grid cells under selection needs to be white, otherwise it's unreadable for some colors;
+          2. Long strings need to be truncated in grid, their contents can be shown on hover.
+
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotView.prototype._getHoverAnchor):
+        (WebInspector.DetailedHeapshotView.prototype._showStringContentPopup):
+        * inspector/front-end/heapProfiler.css:
+        (.detailed-heapshot-view .console-formatted-string):
+        (.detailed-heapshot-view .data-grid tr.selected *):
+        (.detailed-heapshot-view .data-grid:focus tr.selected *):
+
+2011-03-29  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Highlight visible lines first
+        https://bugs.webkit.org/show_bug.cgi?id=57013
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorChunkedPanel.prototype._findFirstVisibleChunkNumber):
+        (WebInspector.TextEditorChunkedPanel.prototype._findVisibleChunks):
+        (WebInspector.TextEditorChunkedPanel.prototype._findFirstVisibleLineNumber.compareLineRowOffsetTops):
+        (WebInspector.TextEditorChunkedPanel.prototype._findFirstVisibleLineNumber):
+        (WebInspector.TextEditorMainPanel.prototype._paintScheduledLines):
+        (WebInspector.TextEditorMainPanel.prototype._paintLines):
+        (WebInspector.TextEditorMainPanel.prototype._paintLineChunks):
+        (WebInspector.TextEditorMainPanel.prototype._paintLine):
+        (WebInspector.TextEditorMainChunk.prototype.set expanded):
+
+2011-03-29  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Relative mouse coordinates recalculated for each target
+        https://bugs.webkit.org/show_bug.cgi?id=57130
+
+        Calculate relative coordinates lazily for mouse events instead of doing
+        it for each target. Speeds up dispatching of mouse events in deep dom
+        structures significantly, O(n^2) to O(n).
+
+        Also fixes https://bugs.webkit.org/show_bug.cgi?id=34973
+
+        Tests: fast/events/mouse-relative-position.html
+               perf/mouse-event.html
+
+        * dom/Event.cpp:
+        (WebCore::Event::setTarget):
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::MouseRelatedEvent):
+        (WebCore::MouseRelatedEvent::initCoordinates):
+        (WebCore::pageZoomFactor):
+        (WebCore::MouseRelatedEvent::receivedTarget):
+        (WebCore::MouseRelatedEvent::computeRelativePosition):
+        (WebCore::MouseRelatedEvent::layerX):
+        (WebCore::MouseRelatedEvent::layerY):
+        (WebCore::MouseRelatedEvent::offsetX):
+        (WebCore::MouseRelatedEvent::offsetY):
+        * dom/MouseRelatedEvent.h:
+        * dom/UIEvent.cpp:
+        (WebCore::UIEvent::layerX):
+        (WebCore::UIEvent::layerY):
+        * dom/UIEvent.h:
+
+2011-03-29  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        getComputedStyle counterIncrement crash @ WebCore::counterToCSSValue
+        https://bugs.webkit.org/show_bug.cgi?id=57266
+
+        Add null check to counterToCSSValue.
+
+        Test: fast/css/getComputedStyle/counterIncrement-without-counter.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::counterToCSSValue):
+
+2011-03-29  Gavin Peters  <gavinp@chromium.org>
+
+        Reviewed by Tony Gentilcore.
+
+        Implement onerror events for <link rel=prefetch>
+        https://bugs.webkit.org/show_bug.cgi?id=57182
+
+        These events are equired on link elements, see
+        http://dev.w3.org/html5/spec/Overview.html#the-link-element
+
+        After a discussion in WebKit-dev about the direction of prefetch in the loader, and about a path
+        to adding the Link header, we decided to look at making onerror, onload and onbeforeload events
+        more uniformly supported.  See the thread at
+        https://lists.webkit.org/pipermail/webkit-dev/2011-February/016034.html .
+
+        It turned out that part of adding onerror for link prefetch was to make the top CachedResource less
+        abstract.  It was pure virtual until prefetch became the first consumer to use an unspecialised
+        implementation, and this CL continues that by adding a default checkNotify method to it.  As it
+        happens there were already two subclasses using what amounted to the generic checkNotify, so I
+        also removed those, buying us some code cleanup with the change.
+
+        Test: fast/dom/HTMLLinkElement/prefetch-onerror.html
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::parseMappedAttribute):
+        (WebCore::HTMLLinkElement::onloadTimerFired):
+        (WebCore::HTMLLinkElement::notifyFinished):
+        * loader/cache/CachedImage.cpp:
+        * loader/cache/CachedImage.h:
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::checkNotify):
+        (WebCore::CachedResource::data):
+        (WebCore::CachedResource::error):
+        * loader/cache/CachedResource.h:
+        * loader/cache/CachedScript.cpp:
+        * loader/cache/CachedScript.h:
+
+2011-03-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Add support for parsing unicode-bidi: -webkit-isolate
+        https://bugs.webkit.org/show_bug.cgi?id=57181
+
+        Test: css3/unicode-bidi-insolate-parse.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EUnicodeBidi):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyleConstants.h:
+
+2011-03-29  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r82193.
+
+        * platform/wince/FileSystemWinCE.cpp:
+        (WebCore::openTemporaryFile):
+
+2011-03-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82198.
+        http://trac.webkit.org/changeset/82198
+        https://bugs.webkit.org/show_bug.cgi?id=57304
+
+        Broke Chromium Win build. (Requested by dave_levin on
+        #webkit).
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2011-03-28  Ofri Wolfus  <ofri@google.com>
+
+        Reviewed by Eric Seidel.
+
+        RTL: Select elements with a size attribute are always left aligned.
+        https://bugs.webkit.org/show_bug.cgi?id=50928
+
+        Added support for alignment in RenderListBox.
+
+        Test: fast/forms/listbox-bidi-align.html
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::itemOffsetForAlignment):
+        (WebCore::RenderListBox::paintItemForeground): Add support for alignment and directionality.
+
+2011-03-28  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Change TextureMapperVideoLayer to TextureMapperMediaLayer
+        https://bugs.webkit.org/show_bug.cgi?id=57142
+
+        TextureMapperMediaLayer is a better name here because both video and plugins use this layer.
+        Remove ENABLE(VIDEO) guard.
+
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        * platform/graphics/qt/MediaPlayerPrivateQt.h:
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        (WebCore::GraphicsLayerTextureMapper::setContentsToMedia):
+        * platform/graphics/texmap/TextureMapperNode.h:
+        * platform/graphics/texmap/TextureMapperPlatformLayer.h:
+        (WebCore::TextureMapperMediaLayer::layerType):
+
+2011-03-28  Thomas Klausner  <tk@giga.or.at>
+
+        Reviewed by David Levin.
+
+        png-1.5 fixes
+        https://bugs.webkit.org/show_bug.cgi?id=54406
+
+        Fix compilation with png-1.5: struct members were hidden, and
+        a new API to terminate data processing was added (especially for
+        WebKit).
+
+        Compilation fixes, so no new tests.
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2011-03-28  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Adam Barth.
+
+        Replace fprintf(stderr, ...) with LOG_ERROR
+        https://bugs.webkit.org/show_bug.cgi?id=57216
+
+        LOG_ERROR is a better choice here.
+
+        * bridge/jni/v8/JavaClassV8.cpp:
+        (JavaClass::JavaClass):
+
+2011-03-28  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        Add a new JavaValue to type to represent a Java value in the Java bridge
+        https://bugs.webkit.org/show_bug.cgi?id=57022
+
+        This change introduces a new JavaValue type and uses it in place of jvalue
+        in the conversions to and from JavaNPObject used in the V8 Java bridge.
+
+        Refactoring only, no new tests.
+
+        * WebCore.gypi:
+        * bridge/jni/JNIUtility.cpp:
+        (JSC::Bindings::javaTypeFromClassName):
+        (JSC::Bindings::signatureFromJavaType):
+        (JSC::Bindings::getJNIField):
+        (JSC::Bindings::callJNIMethod):
+        * bridge/jni/JavaType.h:
+        * bridge/jni/v8/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertNPVariantToJavaValue):
+        (JSC::Bindings::convertJavaValueToNPVariant):
+        (JSC::Bindings::jvalueToJavaValue):
+        (JSC::Bindings::javaValueToJvalue):
+        * bridge/jni/v8/JNIUtilityPrivate.h:
+        * bridge/jni/v8/JavaNPObjectV8.cpp:
+        (JSC::Bindings::JavaNPObjectInvoke):
+        (JSC::Bindings::JavaNPObjectGetProperty):
+        * bridge/jni/v8/JavaValueV8.h: Added.
+        (JSC::Bindings::JavaValue::JavaValue):
+
+2011-03-28  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use String instead of CString as return value of openTemporaryFile
+        https://bugs.webkit.org/show_bug.cgi?id=55332
+
+        We usually store all paths as UTF-16. Do this for temporary files too.
+
+        * WebCore.exp.in
+        * platform/FileSystem.h:
+        * platform/android/FileSystemAndroid.cpp:
+        * platform/brew/FileSystemBrew.cpp:
+        * platform/efl/FileSystemEfl.cpp:
+        * platform/gtk/FileSystemGtk.cpp:
+        * platform/haiku/FileSystemHaiku.cpp:
+        * platform/mac/FileSystemMac.mm:
+        * platform/qt/FileSystemQt.cpp:
+        * platform/win/FileSystemWin.cpp:
+        * platform/wince/FileSystemWinCE.cpp:
+        * platform/wx/FileSystemWx.cpp:
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::destroyStream):
+        * plugins/PluginStream.h:
+
+2011-03-28  Jeff Johnson  <opendarwin@lapcatsoftware.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: empty, non-functional window
+        https://bugs.webkit.org/show_bug.cgi?id=56354
+
+        Check whether DOM local storage is enabled
+        before attempting to access window.localStorage.
+
+        No new tests.
+
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings.prototype.findSettingForAllProjects):
+        (WebInspector.Settings.prototype._get):
+        (WebInspector.Settings.prototype._set):
+
+2011-03-28  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=57286 Alternative fix for: 
+        Horizontal scroller stops appearing after going Forward
+        -and corresponding-
+        <rdar://problem/9026946>
+
+        This patch rolls out revision 79053 and fixes the same bug in a  better way.
+
+        New function resetScrollbarsAndClearContentsSize() calls resetScrollbars() and then 
+        sets the contents size to 0. This is called when a document is going into the page 
+        cache.
+        * dom/Document.cpp:
+        (WebCore::Document::setInPageCache):
+        (WebCore::FrameView::resetScrollbarsAndClearContentsSize):
+
+        Roll-out of 79053.
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::layout):
+        * page/FrameView.h:
+
+2011-03-28  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        fix style sharing with :any and sibling selectors
+        https://bugs.webkit.org/show_bug.cgi?id=57211
+
+        Test: fast/css/sibling-selectors.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::collectFeaturesFromList):
+
+2011-03-27  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        fix :-webkit-any(:last-child)
+        https://bugs.webkit.org/show_bug.cgi?id=57207
+
+        We were passing the wrong arguments to checkSelector. Also, we were not
+        passing through the encounteredLink bool.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * css/CSSStyleSelector.h:
+
+2011-03-27  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        fix :-webkit-any(:last-child)
+        https://bugs.webkit.org/show_bug.cgi?id=57207
+
+        We were passing the wrong arguments to checkSelector. Also, we were not
+        passing through the encounteredLink bool.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * css/CSSStyleSelector.h:
+
+2011-03-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r82152): fast/dom/HTMLAnchorElement/set-href-attribute-pathname.html
+        https://bugs.webkit.org/show_bug.cgi?id=57291
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::parse): Instead of considering URLs with
+        credentials but no host invalid, consider them to have a host
+        ending in @ (which fails down the line)/
+
+2011-03-28  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix some problems of the appearance of form validation message bubble.
+        https://bugs.webkit.org/show_bug.cgi?id=57208
+
+        No new tests. Validation message bubble appearance is not testable
+        because it depends on a timer.
+
+        * css/html.css:
+        (::-webkit-validation-bubble):
+        (::-webkit-validation-bubble-message):
+        (::-webkit-validation-bubble-arrow):
+        (::-webkit-validation-bubble-arrow-clipper):
+          - Explicitly set margin, padding, and color.
+          - Make the shadow darker.
+          - Make the background color darker.
+          - Make opacity larger.
+          - Make the border color lighter.
+          - Add inset shadows
+          - Change the implementation of an arrow.
+            Stop making a right triangle by the border trick.
+            Use -webkit-transform instead.
+          - Make min-width workable by changing display property of
+            -webkit-validation-bubble to "inline-block".
+        * html/ValidationMessage.cpp:
+        (WebCore::ValidationMessage::buildBubbleTree):
+          Change the node structure. Before this change, -webkit-validation-bubble
+          had three DIVs inside. After this change, it has two DIVs;
+          -webkit-validation-bubble-arrow-clipper and
+          -webkit-validation-bubble-message, and
+          -webkit-validation-bubble-arrow-clipper contains
+          -webkit-validation-bubble-arrow.
+
+2011-03-28  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION: Can't enter pasted with context or Edit menu text in search or address field in the browser.
+        https://bugs.webkit.org/show_bug.cgi?id=57275
+        <rdar://problem/8246691>
+
+        We need to classify cut and paste actions as user typing actions even when
+        the action is triggered by a context menu selection to
+        allow the propagation of the textDidChangeInTextField event.
+
+        * editing/EditorCommand.cpp:
+        The following methods have been modified to properly set up
+        the UserTypingGestureAction when the command source is the
+        menu or a key binding sequence.
+        (WebCore::executeCut):
+        (WebCore::executePaste):
+        (WebCore::executePasteAndMatchStyle):
+        (WebCore::executePasteAsPlainText):
+        (WebCore::executeDelete):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected): Changed to
+        call execute command instead of referring to the specific method in
+        the editor class.
+
+2011-03-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        instanceof Array test fails when using iframes
+        https://bugs.webkit.org/show_bug.cgi?id=17250
+
+        Update for new function and date apis
+
+        Test: fast/js/js-constructors-use-correct-global.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsDateOrNull):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::initializeJSFunction):
+
+2011-03-28  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=57124 When the scroller style is 
+        changed via delegate method, the page needs a full relayout and repaint
+        -and corresponding-
+        <rdar://problem/9059129>
+
+        Call into WebKitSystemInterface to associate the new painter with the existing 
+        painter controller. Reset the scrollbar frame rects to the new thickness -- normally 
+        this only happens when a scrollbar is created, so we have to reset the thickness 
+        here to pick up the new theme thickness. Finally, force a full relayout and style 
+        recall with setNeedsRecalcStyleInAllFrames()
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollbarPainterControllerDelegate scrollerImpPair:updateScrollerStyleForNewRecommendedScrollerStyle:]):
+
+        setNeedsRecalcStyleInAllFrames() used to be a static method in Settings.cpp. This 
+        patch moves it to be a member function on Page so that it can be called from 
+        FrameView when the scrollbar style changes.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setNeedsRecalcStyleInAllFrames):
+        * page/FrameView.h:
+        * page/Page.cpp:
+        (WebCore::Page::setNeedsRecalcStyleInAllFrames):
+        * page/Page.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::setStandardFontFamily):
+        (WebCore::Settings::setFixedFontFamily):
+        (WebCore::Settings::setSerifFontFamily):
+        (WebCore::Settings::setSansSerifFontFamily):
+        (WebCore::Settings::setCursiveFontFamily):
+        (WebCore::Settings::setFantasyFontFamily):
+        (WebCore::Settings::setMinimumFontSize):
+        (WebCore::Settings::setMinimumLogicalFontSize):
+        (WebCore::Settings::setDefaultFontSize):
+        (WebCore::Settings::setDefaultFixedFontSize):
+        (WebCore::Settings::setTextAreasAreResizable):
+        (WebCore::Settings::setAuthorAndUserStylesEnabled):
+        (WebCore::Settings::setFontRenderingMode):
+        (WebCore::Settings::setAcceleratedCompositingEnabled):
+        (WebCore::Settings::setShowDebugBorders):
+        (WebCore::Settings::setShowRepaintCounter):
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::setNeedsRecalcStyleInAllFrames):
+
+2011-03-28  Dirk Pranke  <dpranke@chromium.org>
+
+        RS=Tony Chang.
+
+        r81977 moved FontPlatformData.h from
+        WebCore/platform/graphics/cocoa to platform/graphics. This
+        change updates the chromium build accordingly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57281
+
+        * platform/graphics/chromium/CrossProcessFontLoading.mm:
+
+2011-03-28  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Darin Adler.
+
+        MediaPlayerPrivateAVFoundation should report that it supportsFullScreen()
+        https://bugs.webkit.org/show_bug.cgi?id=57249
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::supportsFullscreen):
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+
+2011-03-28  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AVFoundation can indeed support full screen.
+
+        MediaPlayerPrivateAVFoundation should report that it supportsFullScreen()
+        https://bugs.webkit.org/show_bug.cgi?id=57249
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::supportsFullscreen): Return true if using
+            the new full screen APIs.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+
+2011-03-28  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        http streams don't always display video with AVFoundation backend
+        https://bugs.webkit.org/show_bug.cgi?id=57203
+
+        No new tests, we don't currently have tests for http live streams. Changes verified manually.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::MediaPlayer): Initialize m_shouldPrepareToRender.
+        (WebCore::MediaPlayer::loadWithNextMediaEngine): Call prepareForRendering on new engine
+            if m_shouldPrepareToRender is set.
+        (WebCore::MediaPlayer::prepareForRendering): Set m_shouldPrepareToRender.
+        * platform/graphics/MediaPlayer.h:
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::isReadyForVideoSetup): Don't return true until
+            m_isAllowedToRender has been set.
+        (WebCore::MediaPlayerPrivateAVFoundation::prepareForRendering): Always call setUpVideoRendering,
+            it has logic to figure out when setup is required.
+        (WebCore::MediaPlayerPrivateAVFoundation::updateStates): Call setUpVideoRendering when we aren't
+            using the preferred rendering mode because if we get a file's metadata between the
+            time supportsAcceleratedRendering() and paint() are called, we will allocate a software
+            renderer even when we prefer a layer backed renderer.
+        (WebCore::MediaPlayerPrivateAVFoundation::movieLoadType): Return "unknown" until we have metadata.
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h:
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::cancelLoad): Use itemKVOProperties() instead of
+            an explicit list of key path names.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerForURL): Ditto.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::beginLoadingMetadata): metadataKeyNames renamed
+            to assetMetadataKeyNames, return an NSArray instead of a CFArrayRef since that is what the
+            callers need.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::platformDuration): Return the duration of the 
+            player item, not the asset, because AVAsset.duration always returns an indefinite time
+            for all streaming files.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::assetStatus): metadataKeyNames renamed
+            to assetMetadataKeyNames.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::paintCurrentFrameInContext): Do nothing until
+            metadata is available.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::paint): Ditto.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::tracksChanged): Split size calculation logic off
+            into sizeChanged().
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::sizeChanged): New. Use AVPlayerItem.presentationSize
+            until tracks is non-NULL so we have a size as early as possible.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::assetMetadataKeyNames): Renamed from metadataKeyNames.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::itemKVOProperties): New, return an array of
+            KVO observable properties.
+        (-[WebCoreAVFMovieObserver observeValueForKeyPath:ofObject:change:context:]): Respond to 
+            presentationSize change.
+
+2011-03-28  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Search field focus ring is missing
+        https://bugs.webkit.org/show_bug.cgi?id=57270
+        <rdar://problem/8765555>
+
+        Add an _automaticFocusRingDisabled method which returns YES.
+
+        * platform/mac/ThemeMac.mm:
+        (-[WebCoreFlippedView _automaticFocusRingDisabled]):
+
+2011-03-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move more events to EventDispatcher.
+        https://bugs.webkit.org/show_bug.cgi?id=57247
+
+        No functional changes, covered by existing tests.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::eventTargetRespectingSVGTargetRules): Made a static function,
+            since it's not used anywhere outside of the EventDispatcher.
+        (WebCore::EventDispatcher::dispatchScopedEvent): Moved from Node.cpp.
+        (WebCore::EventDispatcher::dispatchKeyEvent): Ditto.
+        (WebCore::EventDispatcher::dispatchWheelEvent): Ditto.
+        (WebCore::EventDispatcher::dispatchEvent): Changed to use eventTargetRespectingSVGTargetRules
+            as a static function.
+        * dom/EventDispatcher.h: Updated decls.
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchScopedEvent): Replaced with calling EventDispatcher.
+        (WebCore::Node::dispatchKeyEvent): Ditto.
+        (WebCore::Node::dispatchWheelEvent): Ditto.
+
+2011-03-28  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix for <rdar://problem/9112694> REGRESSION (r79411): "Check grammar with spelling" context menu doesn't check as you type
+        https://bugs.webkit.org/show_bug.cgi?id=57173
+
+        Test: editing/spelling/grammar.html
+
+        * WebCore.exp.in: Add symbol for new selectionStartHasMarkerFor method.
+        * editing/Editor.cpp:
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges): Every use of paragraph is specific to spelling or grammar, 
+         so to avoid confusion, we should explicitly use spellingParagraph or grammarParagraph.  In the case of this bug, 
+         when we're consider ambiguous boundary characters (characters that could indicate word boundaries, but are used 
+         in the middle of words too, like apostrophes), we should use the use the spellingParagraph since the spellingParagraph 
+         is the only one operated on when this information is used.
+         (WebCore::Editor::selectionStartHasMarkerFor): Changed from selectionStartHasSpellingMarkerFor so it can check for grammar as well as spelling.
+        * editing/Editor.h:
+
+2011-03-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/8895977> REGRESSION: multicol crashes with positioned elements
+        https://bugs.webkit.org/show_bug.cgi?id=48983
+
+        Test: fast/multicol/paginated-layer-crash.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintPaginatedChildLayer): Bring the logic for finding pagintating layers
+        into sync with updatePagination() after r68069.
+        (WebCore::RenderLayer::hitTestPaginatedChildLayer): Ditto.
+
+2011-03-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler' .
+
+        URLSs with non-empty username but empty hostname treat first path segment as hostname, potentially enabling XSS
+        https://bugs.webkit.org/show_bug.cgi?id=57220
+
+        Test: http/tests/uri/username-with-no-hostname.html
+
+        * platform/KURL.cpp:
+        (WebCore::hostPortIsEmptyButUserPassIsNot):
+        (WebCore::KURL::parse):
+
+2011-03-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        script-src should block inline event handlers
+        https://bugs.webkit.org/show_bug.cgi?id=57212
+
+        I considered wrapping this into the canExecute check, but that approach
+        would require passing that function a bunch of context information to
+        behave correctly once we add support for the "options" directive that
+        re-enables these features.
+
+        Test: http/tests/security/contentSecurityPolicy/script-src-none-inline-event.html
+
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::initializeJSFunction):
+            - This function was a mess.  I couldn't resist cleaning it up a
+              bunch.  Notice that we ASSERT at the beginning of the function
+              that scriptExecutionContext is a document and that both ways of
+              getting the global object are the same when document->frame() is
+              non-zero because the document must be active and there is a
+              one-to-one relation between Frames and active Documents.
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers):
+        * page/ContentSecurityPolicy.h:
+
+2011-03-28  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adam Roben.
+
+        ResourceError::certificate() should return a PCCERT_CONTEXT
+        https://bugs.webkit.org/show_bug.cgi?id=57262
+
+        * platform/network/cf/ResourceError.h: certificate() now returns a PCCERT_CONTEXT.
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::certificate): Added.
+
+2011-03-28  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser and Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57221, memory corruption/crashes when positioned objects
+        occur at the end of a line.
+        
+        The old code and new code for dealing with a trailing space object midpoint manipulated a raw
+        array instead of the Vector. Otherwise this corruption would have been caught prior to check-in.
+        
+        I have patched the code to only go through the Vector and to make it handle the case that led to
+        the corruption. Trailing positioned objects can occur both prior to and following the trailing space
+        object's midpoint, so we have to be prepared to deal with both cases.
+        
+        This is already tested by fast/block/positioning/052.html, and that test now properly progresses
+        like the other positioning tests did.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-03-28  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Steve Block.
+
+        V8IDBKeyCustom.cpp does not compile with INDEXED_DATABASE disabled
+        https://bugs.webkit.org/show_bug.cgi?id=57100
+
+        Close the ENABLE guard and the namespace in the right order.
+
+        No new tests, just cleanup.
+
+        * bindings/v8/custom/V8IDBAnyCustom.cpp:
+        * bindings/v8/custom/V8IDBKeyCustom.cpp:
+
+2011-03-28  Jeff Miller  <jeffm@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Include certificate when sending a WebCore::ResourceError to UI process on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=57195
+
+        Add support for tracking the certificate in WebCore::ResourceError.
+
+        * platform/network/ResourceErrorBase.cpp:
+        (WebCore::ResourceErrorBase::copy): Call platformCopy() to copy platform-specific fields.
+        * platform/network/ResourceErrorBase.h:
+        (WebCore::ResourceErrorBase::platformCopy): Added.
+        * platform/network/cf/ResourceError.h: Added constructor that takes certificate data, shadowed platformCopy, added m_certificate.
+        (WebCore::ResourceError::certificate): Added.
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::ResourceError): Added constructor that takes certificate data.
+        (WebCore::ResourceError::platformLazyInit): Read any certificate from the userInfo dictionary.
+        (WebCore::ResourceError::platformCopy): Copy m_certificate.
+        (WebCore::ResourceError::cfError): Add any certificate data to the userInfo dictionary in the CFErrorRef.
+
+2011-03-28  Jessie Berlin  <jberlin@apple.com>
+
+        Rubber-stamped by Adam Roben.
+
+        Add an extra newline to the end of the generated Inspector.idl file so that it does not
+        trigger the Windows "no newline at at end of file" warning.
+
+        * inspector/generate-inspector-idl:
+
+2011-03-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Buildfix after r82125.
+
+        [Qt] QtWebKit will not compile with QT_ASCII_CAST_WARNINGS enabled
+        https://bugs.webkit.org/show_bug.cgi?id=57087
+
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp: Convert all char* to QString explicitly.
+        (WebCore::MediaPlayerPrivateQt::getSupportedTypes):
+        (WebCore::MediaPlayerPrivateQt::commitLoad):
+
+2011-03-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r82099.
+        http://trac.webkit.org/changeset/82099
+        https://bugs.webkit.org/show_bug.cgi?id=57245
+
+        Breaks live edits tests on chromium. (Requested by pfeldman on
+        #webkit).
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.editScriptSource):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._handleSave):
+        (WebInspector.SourceFrameDelegate.prototype.editScriptSource):
+
+2011-03-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: brush up and rename debugger domain functions.
+        https://bugs.webkit.org/show_bug.cgi?id=57240
+
+        * inspector/Inspector.json:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::setFrontend):
+        (WebCore::InspectorAgent::postWorkerNotificationToFrontend):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setBreakpointsActive):
+        (WebCore::InspectorDebuggerAgent::setBreakpointByUrl):
+        (WebCore::InspectorDebuggerAgent::setBreakpoint):
+        (WebCore::InspectorDebuggerAgent::removeBreakpoint):
+        (WebCore::InspectorDebuggerAgent::editScriptSource):
+        (WebCore::InspectorDebuggerAgent::setPauseOnExceptionsState):
+        (WebCore::InspectorDebuggerAgent::didParseSource):
+        (WebCore::InspectorDebuggerAgent::failedToParseSource):
+        (WebCore::InspectorDebuggerAgent::didPause):
+        (WebCore::InspectorDebuggerAgent::didContinue):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpointBySourceId):
+        (WebInspector.DebuggerModel.prototype.removeBreakpoint):
+        (WebInspector.DebuggerModel.prototype._didEditScriptSource):
+        (WebInspector.DebuggerDispatcher.prototype.paused):
+        (WebInspector.DebuggerDispatcher.prototype.resumed):
+        (WebInspector.DebuggerDispatcher.prototype.scriptParsed):
+        (WebInspector.DebuggerDispatcher.prototype.scriptFailedToParse):
+        (WebInspector.DebuggerDispatcher.prototype.breakpointResolved):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.toggleBreakpointsClicked):
+        * inspector/front-end/inspector.js:
+        (WebInspector.didCreateWorker):
+        (WebInspector.didDestroyWorker):
+
+2011-03-28  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/57239> Use forward class declaration instead of including header
+
+        Reviewed by Dan Bernstein.
+
+        Adding a "using namespace WebCore;" statement in a header may
+        cause issues when <WebCore/Length.h> is included before
+        <CoreText/CoreText.h>.
+
+        Length.h defines the LengthType enum with a 'Fixed' value.
+        CoreText.h includes MacTypes.h, which has a
+        "typedef SInt32 Fixed;" statement, and then CoreText.h includes
+        other headers that also use 'Fixed', but expect the typedef to
+        be defined, not the enum.  If another header includes
+        "using namespace WebCore;" before CoreText.h, the
+        following compiler errors result (paths abbreviated):
+
+            CoreText.framework/Headers/SFNTLayoutTypes.h:689: error: reference to 'Fixed' is ambiguous
+            MacTypes.h:184: error: candidates are: typedef SInt32 Fixed
+            Length.h:37: error:                 WebCore::LengthType WebCore::Fixed
+            SFNTLayoutTypes.h:689: error: 'Fixed' does not name a type
+
+        * platform/mac/HTMLConverter.h: Use forward declaration of
+        DocumentLoader class instead of including header.  Remove the
+        unused "using namespace WebCore;" statement.
+
+2011-03-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduce EventDispatcher, the new common way to fire events.
+        https://bugs.webkit.org/show_bug.cgi?id=57168
+
+        The goal here is two-fold:
+        1) reduce the need to randomly sprinkle guards around the dispatch code
+        by creating a well-scoped abstraction for dispatching events.
+        2) create a place where fiddly event-related things like creating event
+        contexts for ancestors can be done lazily.
+
+        Additionally, with all the free-standing static functions, this code was
+        just begging to come out of Node.cpp.
+
+        The first step is a near-mechanical extraction of mouse-related events
+        from Node.cpp to EventDispatcher. For now, the call sites are just
+        replaced with invoking EventDispatcher. Later, we can remove these methods
+        from Node.
+
+        Refactoring, no functional changes.
+
+        * Android.mk: Added EventDispatcher to build system.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * dom/DOMAllInOne.cpp: Ditto.
+        * dom/EventDispatcher.cpp: Added.
+        * dom/EventDispatcher.h: Added.
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchScopedEvent): Replaced to use EventDispatcher.
+        (WebCore::Node::dispatchEvent): Ditto.
+        (WebCore::Node::dispatchMouseEvent): Ditto.
+        (WebCore::Node::dispatchSimulatedClick): Ditto.
+        * dom/Node.h: Updated decls.
+
+2011-03-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/9003382> Incomplete repaint of overflow in flipped lines writing modes
+        https://bugs.webkit.org/show_bug.cgi?id=57197
+
+        Tests: fast/repaint/overflow-flipped-writing-mode-block.html
+               fast/repaint/overflow-flipped-writing-mode-table.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paint): Flip the overflow rect before testing for intersection
+        with the damage rect.
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paint): Made the intersection check more like the one in
+        RenderBlock::paint().
+
+2011-03-28  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        move directionOfEnclosingBlock() to be global so that it could be reused.
+        https://bugs.webkit.org/show_bug.cgi?id=57233.
+
+        Provide global function directionOfEnclosingBlock(Node*) so that it could be
+        reused in SelectionController and other functionalities that need enclosing
+        block's direcionality, such as moving caret by word in visual order.
+      
+        No new functionality, so no new tests.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::directionOfEnclosingBlock):
+        * editing/htmlediting.cpp:
+        (WebCore::directionOfEnclosingBlock):
+        * editing/htmlediting.h:
+
+2011-03-28  Jarkko Sakkinen  <jarkko.j.sakkinen@gmail.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] fast/canvas/webgl/context-attributes-alpha-depth-stencil-antialias.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=56825
+
+        Fixes for context attribute handling:
+        - Initialize depth and stencil buffer depending on whether they
+        are enabled in context attributes.
+        - Always enable depth buffer when stencil buffer is enabled.
+        - Disable stencil buffer on OpenGL ES 2.0
+        - Cleaned up clutter code from initialization. Made code paths 
+        more sane.
+        - Clear mask is now set correctly in reshape().
+
+        Tests: fast/canvas/webgl/context-attributes-alpha-depth-stencil-antialias.html
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::isValid):
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3DInternal::reshape):
+        (WebCore::GraphicsContext3DInternal::paint):
+        (WebCore::GraphicsContext3DInternal::getProcAddress):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::GraphicsContext3D::bindFramebuffer):
+
+2011-03-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: rename network domain events from didHappenSomething to somethingHappened.
+        https://bugs.webkit.org/show_bug.cgi?id=57226
+
+        * inspector/Inspector.json:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::willSendRequest):
+        (WebCore::InspectorResourceAgent::markResourceAsCached):
+        (WebCore::InspectorResourceAgent::didReceiveResponse):
+        (WebCore::InspectorResourceAgent::didReceiveContentLength):
+        (WebCore::InspectorResourceAgent::didFinishLoading):
+        (WebCore::InspectorResourceAgent::didFailLoading):
+        (WebCore::InspectorResourceAgent::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorResourceAgent::setInitialContent):
+        (WebCore::InspectorResourceAgent::didCommitLoad):
+        (WebCore::InspectorResourceAgent::frameDetachedFromParent):
+        (WebCore::InspectorResourceAgent::didCreateWebSocket):
+        (WebCore::InspectorResourceAgent::willSendWebSocketHandshakeRequest):
+        (WebCore::InspectorResourceAgent::didReceiveWebSocketHandshakeResponse):
+        (WebCore::InspectorResourceAgent::didCloseWebSocket):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype.requestWillBeSent):
+        (WebInspector.NetworkDispatcher.prototype.resourceMarkedAsCached):
+        (WebInspector.NetworkDispatcher.prototype.responseReceived):
+        (WebInspector.NetworkDispatcher.prototype.dataReceived):
+        (WebInspector.NetworkDispatcher.prototype.loadingFinished):
+        (WebInspector.NetworkDispatcher.prototype.loadingFailed):
+        (WebInspector.NetworkDispatcher.prototype.resourceLoadedFromMemoryCache):
+        (WebInspector.NetworkDispatcher.prototype.frameDetached):
+        (WebInspector.NetworkDispatcher.prototype.initialContentSet):
+        (WebInspector.NetworkDispatcher.prototype.frameNavigated):
+        (WebInspector.NetworkDispatcher.prototype.webSocketCreated):
+        (WebInspector.NetworkDispatcher.prototype.webSocketWillSendHandshakeRequest):
+        (WebInspector.NetworkDispatcher.prototype.webSocketHandshakeResponseReceived):
+        (WebInspector.NetworkDispatcher.prototype.webSocketClosed):
+
+2011-03-28  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        WebInspector: [Chromium] Delete native CPU profiles and heap snapshots on binding disposal.
+        https://bugs.webkit.org/show_bug.cgi?id=57099
+
+        * bindings/v8/ScriptHeapSnapshot.cpp:
+        (WebCore::ScriptHeapSnapshot::~ScriptHeapSnapshot):
+        * bindings/v8/ScriptHeapSnapshot.h:
+        * bindings/v8/ScriptProfile.cpp:
+        (WebCore::ScriptProfile::~ScriptProfile):
+        * bindings/v8/ScriptProfile.h:
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::resetState):
+
+2011-03-24  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: fix console messages positions in formatted scripts.
+        https://bugs.webkit.org/show_bug.cgi?id=57010
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype.toggleFormatSourceFiles):
+        (WebInspector.DebuggerPresentationModel.prototype.addConsoleMessage.didRequestMapping):
+        (WebInspector.DebuggerPresentationModel.prototype.addConsoleMessage):
+        (WebInspector.DebuggerPresentationModel.prototype.clearConsoleMessages):
+        (WebInspector.DebuggerPresentationModel.prototype._reset):
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.ResourceTreeModel.prototype.addConsoleMessage):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.addConsoleMessage):
+        (WebInspector.ScriptsPanel.prototype.clearConsoleMessages):
+        (WebInspector.ScriptsPanel.prototype._consoleMessageAdded):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype._sourceFrameLoaded):
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.SourceFile):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.addMessage):
+        (WebInspector.SourceFrame.prototype._addExistingMessagesToSource):
+        (WebInspector.SourceFrame.prototype.addMessageToSource):
+
+2011-03-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: refactor ResourceTreeModel to remove poor dependencies.
+        https://bugs.webkit.org/show_bug.cgi?id=57186
+
+        - ResourceTreeModel is now event target (Object)
+        - There is no ResourceTreeModel -> UI dependencies
+        - NetworkManager -> ResourceTreeModel dependencies has been removed
+        - NetworkManager is no longer dealing with the resources tree, it is only responsible for network events
+        - ResourceTreeModel requests tree structure from the backend separately
+        - Cached resources tree payload is now limited to url and type (no headers involved)
+        - Resources tree is being rendered lazily upon request from the panel.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::resourceContent):
+        (WebCore::InspectorResourceAgent::resourceContentBase64):
+        (WebCore::buildObjectForFrameTree):
+        (WebCore::InspectorResourceAgent::enable):
+        (WebCore::InspectorResourceAgent::getCachedResources):
+        (WebCore::InspectorResourceAgent::getResourceContent):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::resourceStyleSheetText):
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub.prototype.sendMessageToBackend):
+        (.WebInspector.InspectorFrontendHostStub.prototype.loadSessionSetting):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkManager):
+        (WebInspector.NetworkManager.prototype.frontendReused):
+        (WebInspector.NetworkManager.prototype.requestContent):
+        (WebInspector.NetworkDispatcher):
+        (WebInspector.NetworkDispatcher.prototype.didReceiveResponse):
+        (WebInspector.NetworkDispatcher.prototype.didLoadResourceFromMemoryCache):
+        (WebInspector.NetworkDispatcher.prototype.frameDetachedFromParent):
+        (WebInspector.NetworkDispatcher.prototype.didCommitLoadForFrame):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel):
+        (WebInspector.NetworkPanel.prototype._updateSummaryBar):
+        (WebInspector.NetworkPanel.prototype._onFrameCommitLoad):
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.ResourceTreeModel):
+        (WebInspector.ResourceTreeModel.prototype.frontendReused):
+        (WebInspector.ResourceTreeModel.prototype._processCachedResources):
+        (WebInspector.ResourceTreeModel.prototype._addOrUpdateFrame):
+        (WebInspector.ResourceTreeModel.prototype.frames):
+        (WebInspector.ResourceTreeModel.prototype.subframes):
+        (WebInspector.ResourceTreeModel.prototype.resources):
+        (WebInspector.ResourceTreeModel.prototype._onCommitLoad):
+        (WebInspector.ResourceTreeModel.prototype._onFrameDetachedFromParent):
+        (WebInspector.ResourceTreeModel.prototype._onResourceUpdated):
+        (WebInspector.ResourceTreeModel.prototype._addResourceToFrame):
+        (WebInspector.ResourceTreeModel.prototype.resourceForURL):
+        (WebInspector.ResourceTreeModel.prototype._bindResourceURL):
+        (WebInspector.ResourceTreeModel.prototype._clearChildFramesAndResources):
+        (WebInspector.ResourceTreeModel.prototype._clearResources):
+        (WebInspector.ResourceTreeModel.prototype._callForFrameResources):
+        (WebInspector.ResourceTreeModel.prototype._unbindResourceURL):
+        (WebInspector.ResourceTreeModel.prototype._addFramesRecursively):
+        (WebInspector.ResourceTreeModel.prototype._createResource):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.show):
+        (WebInspector.ResourcesPanel.prototype._populateResourceTree.populateFrame):
+        (WebInspector.ResourcesPanel.prototype._populateResourceTree):
+        (WebInspector.ResourcesPanel.prototype._frameAdded):
+        (WebInspector.ResourcesPanel.prototype._frameDetached):
+        (WebInspector.ResourcesPanel.prototype._resourceAdded):
+        (WebInspector.ResourcesPanel.prototype._frameNavigated):
+        (WebInspector.FrameTreeElement.prototype.setTitles):
+        * inspector/front-end/inspector.js:
+        (WebInspector.frontendReused):
+
+2011-03-27  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebKit's behavior for text-align inherit differs from other browsers
+        https://bugs.webkit.org/show_bug.cgi?id=56377
+
+        The bug was caused by WebKit's resolving text-align: start and text-align: end too early.
+        As discussed on the bug, when text-align: start and text-align: end are inherited by descendent nodes,
+        the alignment of the text in those nodes should be determined based on the directionality of the text,
+        not by the directionality of the ancestor node from which text-align property is inherited.
+
+        Fixed the bug by introducing new enum values to ETextAlign: TASTART and TAEND. These two values will
+        align text to the left in a LTR context and to the right in a RTL context respectively.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added the support for TASTART and TAEND.
+        (WebCore::CSSPrimitiveValue::operator ETextAlign): Ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): No longer processes CSSValueStart and CSSValueEnd.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::localCaretRect): Added the support for TASTART and TAEND.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): Added the support for TASTART and TAEND.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::localCaretRect): Ditto.
+        * rendering/style/RenderStyle.h: ETextAlign now has 10 values and requires 4 bits.
+        * rendering/style/RenderStyleConstants.h: Added TASTART and TAEND to ETextAlign.
+
+2011-03-28  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: fix breakpoints positions in formatted scripts.
+        https://bugs.webkit.org/show_bug.cgi?id=56931
+
+        Add async requestMapping method to SourceFile interface as required for populating
+        breakpoints sidebar pane when in "format all scripts" mode.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.continueToLine):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpoint.didRequestSourceMapping):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded.didRequestSourceMapping):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame.didRequestSourceMapping):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.PresentationBreakpoint): Breakpoint wrapper for UI.
+        (WebInspector.PresentationBreakpoint.prototype.get sourceFileId):
+        (WebInspector.PresentationBreakpoint.prototype.get lineNumber):
+        (WebInspector.PresentationBreakpoint.prototype.get condition):
+        (WebInspector.PresentationBreakpoint.prototype.get enabled):
+        (WebInspector.PresentationBreakpoint.prototype.get url):
+        (WebInspector.PresentationBreakpoint.prototype.get resolved):
+        (WebInspector.PresentationBreakpoint.prototype.loadSnippet):
+        * inspector/front-end/ScriptFormatter.js:
+        (WebInspector.ScriptFormatter.prototype.formatContent.didFormatChunks):
+        (WebInspector.ScriptFormatter.prototype.formatContent):
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.SourceFile.prototype.requestSourceMapping):
+        (WebInspector.FormattedSourceFile.prototype.requestSourceMapping):
+        (WebInspector.FormattedSourceFile.prototype._didRequestContent):
+        (WebInspector.SourceMapping):
+        (WebInspector.SourceMapping.prototype.scriptLocationToSourceLocation):
+        (WebInspector.SourceMapping.prototype.sourceLocationToScriptLocation):
+        (WebInspector.FormattedSourceMapping):
+        (WebInspector.FormattedSourceMapping.prototype.scriptLocationToSourceLocation):
+        (WebInspector.FormattedSourceMapping.prototype.sourceLocationToScriptLocation):
+        (WebInspector.FormattedSourceMapping.prototype._convertPosition):
+
+2011-03-28  Nancy Piedra  <nancy.piedra@nokia.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        This patch fixes linking errors on Qt Webkit Windows MinGW builds.
+        This patch sets the BUILDING_WEBKIT & QT_MAKEDLL macros so that
+        QWEBKIT_EXPORT is defined as follows:
+        #define QWEBKIT_EXPORT Q_DECL_EXPORT
+
+        No new tests needed since only changing .pro file.
+
+        * WebCore.pro:
+
+2011-03-28  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: source frame should show the error to user when live edit is failed
+        https://bugs.webkit.org/show_bug.cgi?id=57002
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.editScriptSource):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._handleSave.didSaveScriptSource):
+        (WebInspector.SourceFrame.prototype._handleSave):
+        (WebInspector.SourceFrameDelegate.prototype.editScriptSource):
+
+2011-03-26  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Expose the AtkValue interface for WAI-ARIA sliders
+        https://bugs.webkit.org/show_bug.cgi?id=56655
+
+        Implement AtkValue interface for WAI-ARIA sliders.
+
+        Test: platform/gtk/accessibility/aria-slider-required-attributes.html
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification): Emit the
+        'property-change::accessible-value' signal when needed.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (core): New, returns a core object from an AtkValue.
+        (webkitAccessibleValueGetCurrentValue): New, implements AtkValue.
+        (webkitAccessibleValueGetMaximumValue): Ditto.
+        (webkitAccessibleValueGetMinimumValue): Ditto.
+        (webkitAccessibleValueSetCurrentValue): Ditto.
+        (webkitAccessibleValueGetMinimumIncrement): Ditto.
+        (atkValueInterfaceInit): Ditto.
+        (GetAtkInterfaceTypeFromWAIType): Add ATK_TYPE_VALUE.
+        (getInterfaceMaskFromObject): Set the WAI_VALUE bit for sliders.
+
+2011-03-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Assigning location.path to something that doesn't start with / mangles the authority
+        https://bugs.webkit.org/show_bug.cgi?id=57209
+        <rdar://problem/9195132>
+        
+        Tests: http/tests/uri/assign-path-with-leading-slash.html
+               http/tests/uri/assign-path-without-leading-slash.html
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::setPath): If the new path does not have a leading slash, add one.
+
+2011-03-28  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Extract functions to update logical width from computeInlineDirectionPositionsForLine
+        https://bugs.webkit.org/show_bug.cgi?id=57213
+
+        Extracted updateLogicalWidthForLeftAlignedBlock, updateLogicalWidthForRightAlignedBlock,
+        and updateLogicalWidthForCenterAlignedBlock from computeInlineDirectionPositionsForLine.
+
+        They are used to update logical widths, logical left, and total logical width for left,
+        right, and center aligned blocks.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::updateLogicalWidthForLeftAlignedBlock):
+        (WebCore::updateLogicalWidthForRightAlignedBlock):
+        (WebCore::updateLogicalWidthForCenterAlignedBlock):
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+
+2011-03-28  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Refactor duplicate code in HTMLTextElement
+        https://bugs.webkit.org/show_bug.cgi?id=57215
+
+        * html/HTMLTitleElement.cpp:
+        (WebCore::HTMLTitleElement::childrenChanged):
+        This method did an equivalent loop to the text() method on
+        the same object.
+
+2011-03-27  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Don't call WebSocket::didClose() more than once.
+        https://bugs.webkit.org/show_bug.cgi?id=57081
+
+        If WebSocket close() is called, and connection is established, then
+        it will call didClose() that resets m_channel to 0.
+        After that, when connection is closed, WebSocketChannel will call
+        didClose for the WebSocket instance.
+
+        Call WebSocketChannel::disconnect() before m_channel = 0 to make sure
+        WebSocketChannel suppress the second didClose().
+
+        Test: http/tests/websocket/tests/close-unref-websocket.html
+
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didClose):
+
+2011-03-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix script-src redirect handling
+        https://bugs.webkit.org/show_bug.cgi?id=57196
+
+        Resource-loading requirements in CSP apply to each hop in the redirect
+        chain.  To make that work properly, we need to move enforcement into
+        the loader.  Fortunately, we already have a choke-point in the loader
+        for enforcing this kind of policy.
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::requestScript):
+        * html/parser/HTMLDocumentParser.cpp:
+        * html/parser/HTMLDocumentParser.h:
+        * html/parser/HTMLScriptRunnerHost.h:
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::canRequest):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::allowScriptFromSource):
+        * page/ContentSecurityPolicy.h:
+
+2011-03-27  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Full Screen: disable keyboard access by default
+        https://bugs.webkit.org/show_bug.cgi?id=56684
+
+        Pass whether keyboard access was requested up to ChromeClient when asking
+        if fullscreen mode is supported.
+
+        * dom/Document.cpp:
+        (WebCore::Document::webkitRequestFullScreenForElement):
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::supportsFullscreenForElement):
+
+2011-03-27  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [CMake] Generate WebKitVersion.h
+        https://bugs.webkit.org/show_bug.cgi?id=57128
+
+        This file will be used for the user agent string by the CMake based ports.
+
+        * CMakeLists.txt:
+
+2011-03-27  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57170  Fix last elements
+        in an enum to remove a trailing comma. Sun Studio 12 CC errors out.
+
+        Compile fix only, no actual code change.
+
+        * dom/ExceptionCode.h:
+        * editing/EditorInsertAction.h:
+        * loader/FrameLoaderTypes.h:
+        * platform/PlatformKeyboardEvent.h:
+        * platform/ScrollTypes.h:
+        * platform/graphics/BitmapImage.h:
+        * platform/image-decoders/ImageDecoder.h:
+        * platform/network/ProtectionSpace.h:
+        * platform/network/ResourceHandleClient.h:
+        * platform/network/ResourceRequestBase.h:
+        * platform/text/TextCodec.h:
+
+2011-03-27  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Text on path positioning at zero startOffset
+        https://bugs.webkit.org/show_bug.cgi?id=56245
+
+        Since for length 0 no previous point is set, choose epsilon
+        length to get normal at starting point of the path.
+
+        Test: svg/text/text-path-middle-align.svg
+
+        * platform/graphics/Path.cpp:
+        (WebCore::Path::normalAngleAtLength):
+
+2011-03-27  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57151, patch derived from set
+        created by Thiago Macieria in bug https://bugs.webkit.org/show_bug.cgi?id=24932
+
+        Fix compile issue on Solaris 10/Sun Studio 12 regarding ambiguity on ?: functions
+
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::thisObject):
+
+2011-03-26  Jer Noble  <jer.noble@apple.com>
+
+        Unreviewed build fix.
+
+        Fix a bug which was causing the "skip back" button to be missing, causing 
+        the media layout tests to fail.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+
+2011-03-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/9180716> REGRESSION (r80582): Angle bracket rendered upright in vertical mode
+        https://bugs.webkit.org/show_bug.cgi?id=57169
+
+        Test: fast/blockflow/fallback-orientation.html
+
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter): If the font has vertical glyphs, use it, rather
+        than continuing down the fallback list.
+
+2011-03-26  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Follow-up fix for crash with giant inline stylesheets - actually don't crash, and add test
+        https://bugs.webkit.org/show_bug.cgi?id=56150
+
+        Test: fast/css/giant-stylesheet-crash.html
+
+        * dom/StyleElement.cpp:
+        (WebCore::StyleElement::process):
+
+2011-03-22  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Media controls must use full screen style when in new full screen mode.
+        https://bugs.webkit.org/show_bug.cgi?id=56851
+
+        Add new full screen styles for the full screen media elements.
+
+        * DerivedSources.make: Add fullScreenQuickTime.css.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * css/CSSStyleSelector.cpp: Removed loadFullScreenRulesIfNeeded().
+        (WebCore::CSSStyleSelector::CSSStyleSelector): Ditto.
+        (WebCore::CSSStyleSelector::styleForElement): Load full screen rules 
+            if needed.
+        * css/fullscreenQuickTime.css: Added.
+        * css/mediaControls.css:
+        * html/shadow/MediaControls.cpp:
+        (WebCore::isFullScreen): Added.
+        (WebCore::MediaControls::create): Add new full screen volume controls.
+        (WebCore::MediaControls::updateStyle): Ditto.
+        (WebCore::MediaControls::update): Ditto.
+        (WebCore::MediaControls::updateVolumeSliderContainer): Ditto.
+        (WebCore::MediaControls::forwardEvent): Ditto.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlFullscreenVolumeSliderElement::MediaControlFullscreenVolumeSliderElement): Added.
+        (WebCore::MediaControlFullscreenVolumeSliderElement::create): Added.
+        (WebCore::MediaControlFullscreenVolumeSliderElement::shadowPseudoId): Added.
+        (WebCore::MediaControlFullscreenVolumeMinButtonElement::MediaControlFullscreenVolumeMinButtonElement): Addet
+        (WebCore::MediaControlFullscreenVolumeMinButtonElement::create): Added.
+        (WebCore::MediaControlFullscreenVolumeMinButtonElement::defaultEventHandler): Added.
+        (WebCore::MediaControlFullscreenVolumeMinButtonElement::shadowPseudoId): Added.
+        (WebCore::MediaControlFullscreenVolumeMaxButtonElement::MediaControlFullscreenVolumeMaxButtonElement): Added.
+        (WebCore::MediaControlFullscreenVolumeMaxButtonElement::create): Added.
+        (WebCore::MediaControlFullscreenVolumeMaxButtonElement::defaultEventHandler): Added.
+        (WebCore::MediaControlFullscreenVolumeMaxButtonElement::shadowPseudoId): Added.
+        * rendering/MediaControlElements.h:
+            Added m_overridePosition.
+        (WebCore::MediaControlVolumeSliderContainerElement::setOverridesPosition): Added.
+        * rendering/MediaControlElements.h:
+        (WebCore::MediaControlVolumeSliderContainerElement::overridesPosition): Added.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::extraFullScreenStyleSheet): Added.
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::extraFullScreenStyleSheet): Added.
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart): Render seek forward and backward 
+            buttons.
+
+2011-03-26  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        RenderMedia should obey the view's flattening bit.
+        https://bugs.webkit.org/show_bug.cgi?id=57156
+
+        Paint the current frame in software when the associated FrameView
+        has its flattening bit set.
+
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::paintReplaced):
+
+2011-03-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed build fix for !ENABLE(DOM_STORAGE).
+
+        * storage/StorageTracker.cpp:
+            Added #if ENABLE(DOM_STORAGE) like in the other storage files.
+
+2011-03-26  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Remove GraphicsLayerTextureMapper::nativeLayer
+        https://bugs.webkit.org/show_bug.cgi?id=57141
+
+        GraphicsLayer::nativeLayer was removed in r73380.
+
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.h:
+
+2011-03-26  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Teach Content Security Policy how to parse source-list
+        https://bugs.webkit.org/show_bug.cgi?id=54799
+
+        This patch is larger than I would like, but I wasn't sure how to make
+        it any smaller while still being reasonably testable.  I've left out
+        some features (such as host wildcarding and 'self') so I can add them
+        in later patches with tests.
+
+        Test: http/tests/security/contentSecurityPolicy/source-list-parsing.html
+
+        * bindings/ScriptControllerBase.cpp:
+        * dom/ScriptElement.cpp:
+        * html/parser/HTMLDocumentParser.cpp:
+        * loader/FrameLoader.cpp:
+            - Add include explicitly now that we're not spamming the include
+              everywhere.
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+            - We need to pass the SecurityOrigin object to
+              ContentSecurityPolicy so that it can resolve implicit parts of
+              source patterns, such as the scheme.
+        * dom/Document.h:
+            - Forward declare ContentSecurityPolicy rather than including the
+              header.  Technically this could be a separate change, but I was
+              getting annoyed at the world re-builds.
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::skipExactly):
+        (WebCore::skipUtil):
+        (WebCore::skipWhile):
+            - Clean up these parser helper functions.  We might consider moving
+              them to a more general location.  They're very helpful for
+              writing secure HTTP header parsers.
+        (WebCore::CSPSource::CSPSource):
+            - New class to represent one source in a source-list.
+        (WebCore::CSPSource::matches):
+        (WebCore::CSPSource::schemeMatches):
+        (WebCore::CSPSource::hostMatches):
+        (WebCore::CSPSource::portMatches):
+        (WebCore::CSPSource::isSchemeOnly):
+            - Currently we represent scheme-only sources using with an empty
+              m_host.  Another approach I considered was using another bool,
+              but that seemed slighly messier.
+        (WebCore::CSPSourceList::CSPSourceList):
+            - CSPSourceList doesn't need to ref SecurityOrigin because
+              CSPSourceList is owned by ContentSecurityPolicy, which holds a
+              ref.
+        (WebCore::CSPSourceList::parse):
+        (WebCore::CSPSourceList::matches):
+        (WebCore::CSPSourceList::parseSource):
+        (WebCore::CSPSourceList::parseScheme):
+        (WebCore::CSPSourceList::parseHost):
+        (WebCore::CSPSourceList::parsePort):
+            - A basic "segment and recurse" parser.  This parser causes us to
+              take more branches than we need, but I don't think we need to
+              squeeze every last ouch of performance out of this parser.  This
+              approach is more simple than some of the other approaches I
+              tried.
+        (WebCore::CSPSourceList::addSourceSelf):
+        (WebCore::CSPDirective::CSPDirective):
+        (WebCore::CSPDirective::allows):
+        (WebCore::ContentSecurityPolicy::ContentSecurityPolicy):
+        (WebCore::ContentSecurityPolicy::parse):
+        (WebCore::ContentSecurityPolicy::parseDirective):
+        (WebCore::ContentSecurityPolicy::addDirective):
+            - I couldn't resist re-writing this parser to use the helper
+              functions and to match the style of the source-list parser.
+        * page/ContentSecurityPolicy.h:
+        (WebCore::ContentSecurityPolicy::create):
+            - Accept a SecurityOrigin context object.
+
+2011-03-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed EFL and WinCE build fix for r81977.
+
+        * platform/graphics/FontPlatformData.h:
+
+2011-03-26  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r82000.
+
+        * platform/wince/FileSystemWinCE.cpp:
+        (WebCore::openFile): Added missing function.
+
+2011-03-25  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, don't use the new FPD implementation yet, until we can merge ours with it.
+
+        * platform/graphics/FontPlatformData.h:
+
+2011-03-25  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        MediaPlayerPrivateQuickTimeVisualContext should use the Application Cache during load.
+        https://bugs.webkit.org/show_bug.cgi?id=57047
+
+        No new tests.
+        
+        When loading a URL, checkk osee if the Appplication Cache has a version of that URL
+        stored; if so, use the local path to that cached media instead of the remote URL.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::loadInternal):
+        * platform/graphics/win/QTMovie.cpp:
+        (QTMovie::loadPath):
+        * platform/graphics/win/QTMovie.h:
+
+2011-03-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/9134330> Missing expansion before ideograph at the beginning or end of a text run
+        https://bugs.webkit.org/show_bug.cgi?id=57106
+
+        Test: fast/text/justify-ideograph-leading-expansion.html
+
+        * platform/graphics/TextRun.h:
+        Replaced TrailingExpansionBehavior enum with ExpansionBehavior flags.
+        (WebCore::TextRun::TextRun): Constructors now take an expansionBehavior parameter.
+        (WebCore::TextRun::allowsLeadingExpansion): Added this accessor.
+        (WebCore::TextRun::allowsTrailingExpansion): Changed to use the m_expansionBehavior member.
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::WidthIterator): Initialize m_isAfterExpansion from the TextRun, allowing
+        leading expansion when appropriate.
+        (WebCore::WidthIterator::advance): Moved the last-glyph-in-run check to only apply to expansion
+        after the glyph, not expansion before the glyph, since that is not trailing expansion. Added code
+        to handle expansion before the first glyph.
+        * platform/graphics/mac/ComplexTextController.cpp:
+        (WebCore::ComplexTextController::ComplexTextController): Initialize m_afterExpansion from the
+        TextRun, allowing leading expansion when appropriate. Set m_runWidthSoFar to the leading expansion.
+        (WebCore::ComplexTextController::offsetForPosition): Account for leading expansion.
+        (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Similar to WidthIterator::advance()
+        * platform/graphics/mac/ComplexTextController.h: Added m_leadingExpansion member variable.
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox): Renamed m_hasSelectedChildren to m_hasSelectedChildrenOrCanHaveLeadingExpansion
+        to reflect the use of this bit by InlineTextBox.
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::selectionRect): Replaced calls to trailingExpansionBehavior() with expansionBehavior().
+        (WebCore::InlineTextBox::paint): Ditto.
+        (WebCore::InlineTextBox::paintSelection): Ditto.
+        (WebCore::InlineTextBox::paintCompositionBackground): Ditto.
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker): Ditto.
+        (WebCore::InlineTextBox::paintTextMatchMarker): Ditto.
+        (WebCore::InlineTextBox::computeRectForReplacementMarker): Ditto.
+        (WebCore::InlineTextBox::offsetForPosition): Ditto.
+        (WebCore::InlineTextBox::positionForOffset): Ditto.
+        * rendering/InlineTextBox.h:
+        (WebCore::InlineTextBox::canHaveLeadingExpansion): Added this accessor.
+        (WebCore::InlineTextBox::setCanHaveLeadingExpansion): Ditto.
+        (WebCore::InlineTextBox::expansionBehavior): Replaced trailingExpansionBehavior() with this function,
+        which also considers canHaveLeadingExpansion().
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): Call setCanHaveLeadingExpansion() on
+        text boxes that can have leading expansion. Avoid negative expansion.
+        * rendering/RootInlineBox.cpp:
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::hasSelectedChildren): Updated for renaming of the flag.
+        (WebCore::RootInlineBox::setHasSelectedChildren): Ditto.
+
+2011-03-23  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        MediaPlayerPrivateAVFoundation should use the Application Cache during load.
+        https://bugs.webkit.org/show_bug.cgi?id=56997
+
+        No new tests.
+
+        When loading a URL, check to see if the Application Cache has a version of that URL
+        stored; if so, use the local path to that cached media instead of the remote URL.
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::prepareToPlay): Check to see if the media should be loaded
+            from the application cache.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h:
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h:
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerForURL):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerForCacheResource): Added.
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayer): Split out from createAVPlayerForURL.
+
+2011-03-25  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57122. Solaris 10/SunStudio 12 expect
+        both sides of a ?: operation to have the same types.  Extracted from original
+        https://bugs.webkit.org/show_bug.cgi?id=24932, patch 13 of 17, and originally
+        created by Thiago Macieira.
+
+        fixes a compile issue on Solaris 10/SunStudio 12
+
+        * loader/DocumentLoader.h:
+        (WebCore::DocumentLoader::serverRedirectSourceForHistory):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::load):
+        (WebCore::FrameLoader::loadWithNavigationAction):
+
+2011-02-03  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        MediaPlayerPrivateQTKit should use the Application Cache during load.        
+        https://bugs.webkit.org/show_bug.cgi?id=53818
+
+        No new tests.
+
+        When loading a URL, check to see if the Application Cache has a version of that URL
+        stored; if so, use that data instead of the remote URL.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateQTKit::commonMovieAttributes):
+        (WebCore::MediaPlayerPrivateQTKit::createQTMovie):
+        (WebCore::MediaPlayerPrivateQTKit::loadInternal):
+
+2011-03-25  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Move draw implementations to CCLayerImpl for everything except content layers
+        https://bugs.webkit.org/show_bug.cgi?id=56793
+
+        Moves the implementation of the layer's draw() function from LayerChromium subclasses to CCLayerImpl subclasses for
+        all layer types except content layers.  This gets us closer to decoupling the composite step itself from updating the layers.
+
+        The biggest change in this patch is adding a set of CCLayerImpl subclasses to implement the different drawing routines
+        and moving the code from each XXXLayerChromium to CCXXXLayerImpl.  In order to render from the CCLayerImpl side all state
+        needed at draw time also has to be synchronized, which is performed in pushPropertiesTo().
+
+        On the LayerRendererChromium side there are a few changes.  I've split the updateContents calls on LayerChromiums into two operations
+        tentatively named 'paintContentsIfNeeded' and 'updateCompositorResources'.  paintContents() is used for any code that calls into WebKit in order to generate
+        new pixel data.  It's expected that this call may take a long period of time and may involve "odd" side effects.  updateCompositorResources() is used for
+        code that needs to update the compositor's texture data or other state.  It is not expected that this callback will take long (since it's just inserting
+        commands into the GL command stream, ideally) and this call is expected to have access to the compositor's context, unlike paintContents().
+
+        The updateAndDrawLayers cycle now looks like this:
+        1.) update the root content layer
+        2.) update the root layer scrollbars
+        3.) for each LayerChromium in tree order:
+          a.) ensure a CCLayerImpl of the correct type exists for this layer
+          b.) push all draw time properties from the LayerChromium to the CCLayerImpl
+          c.) construct the appropriate draw transforms, render surfaces and render surface z-order sublayer lists
+        4.) for each LayerChromium in tree order, paint the layer's contents
+        5.) for each LayerChromium in tree order, update the associate compositor resources (textures, etc)
+        6.) draw the root layer and its scrollbars
+        7.) for each CCLayerImpl in render surface order, draw it
+
+        Step 3 should really happen after step 5, but right now painting a content layer requires knowledge of the render surface properties and draw transforms
+        in order to paint.  We also currently push layer properties from LayerChromium->CCLayerImpls twice now - once at 3.b and once after 5 so we can pick
+        up any texture updates.  This will also get fixed when the paint dependency on render surfaces is resolved.
+
+        I haven't modified the root layer or content layers in order to minimize conflicts with the other pending work in that area.
+
+        Tests: compositing/
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/Canvas2DLayerChromium.cpp:
+        (WebCore::Canvas2DLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/Canvas2DLayerChromium.h:
+        * platform/graphics/chromium/CanvasLayerChromium.cpp:
+        (WebCore::CanvasLayerChromium::createCCLayerImpl):
+        (WebCore::CanvasLayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/CanvasLayerChromium.h:
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::requiresClippedUpdateRect):
+        (WebCore::ContentLayerChromium::paintContentsIfDirty):
+        (WebCore::ContentLayerChromium::updateCompositorResources):
+        (WebCore::ContentLayerChromium::bindContentsTexture):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerChromium::paintContentsIfDirty):
+        * platform/graphics/chromium/ImageLayerChromium.h:
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        (WebCore::LayerChromium::cleanupResources):
+        (WebCore::LayerChromium::setLayerRenderer):
+        (WebCore::LayerChromium::setName):
+        (WebCore::LayerChromium::pushPropertiesTo):
+        (WebCore::LayerChromium::dumpLayer):
+        (WebCore::LayerChromium::createCCLayerImpl):
+        (WebCore::LayerChromium::createCCLayerImplIfNeeded):
+        (WebCore::LayerChromium::ccLayerImpl):
+        (WebCore::LayerChromium::layerRenderer):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::paintContentsIfDirty):
+        (WebCore::LayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::updateLayers):
+        (WebCore::LayerRendererChromium::updatePropertiesAndRenderSurfaces):
+        (WebCore::LayerRendererChromium::paintContentsRecursive):
+        (WebCore::LayerRendererChromium::updateCompositorResourcesRecursive):
+        (WebCore::LayerRendererChromium::drawLayer):
+        (WebCore::LayerRendererChromium::initializeSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore::LayerRendererChromium::canvasLayerProgram):
+        (WebCore::LayerRendererChromium::pluginLayerProgram):
+        (WebCore::LayerRendererChromium::videoLayerRGBAProgram):
+        (WebCore::LayerRendererChromium::videoLayerYUVProgram):
+        * platform/graphics/chromium/PluginLayerChromium.cpp:
+        (WebCore::PluginLayerChromium::createCCLayerImpl):
+        (WebCore::PluginLayerChromium::setTextureId):
+        (WebCore::PluginLayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/PluginLayerChromium.h:
+        (WebCore::PluginLayerChromium::textureId):
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::createCCLayerImpl):
+        (WebCore::VideoLayerChromium::updateCompositorResources):
+        (WebCore::VideoLayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::updateCompositorResources):
+        * platform/graphics/chromium/WebGLLayerChromium.h:
+        * platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp: Copied from Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp.
+        (WebCore::CCCanvasLayerImpl::CCCanvasLayerImpl):
+        (WebCore::CCCanvasLayerImpl::~CCCanvasLayerImpl):
+        (WebCore::CCCanvasLayerImpl::draw):
+        (WebCore::CCCanvasLayerImpl::dumpLayerProperties):
+        * platform/graphics/chromium/cc/CCCanvasLayerImpl.h: Copied from Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h.
+        (WebCore::CCCanvasLayerImpl::create):
+        (WebCore::CCCanvasLayerImpl::setTextureId):
+        (WebCore::CCCanvasLayerImpl::setPremultipliedAlpha):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::descendantsDrawsContent):
+        (WebCore::CCLayerImpl::updateCompositorResources):
+        (WebCore::CCLayerImpl::writeIndent):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::setAnchorPoint):
+        (WebCore::CCLayerImpl::setAnchorPointZ):
+        (WebCore::CCLayerImpl::setMasksToBounds):
+        (WebCore::CCLayerImpl::setOpacity):
+        (WebCore::CCLayerImpl::setPosition):
+        (WebCore::CCLayerImpl::setPreserves3D):
+        (WebCore::CCLayerImpl::setSublayerTransform):
+        (WebCore::CCLayerImpl::setTransform):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.cpp: Copied from Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp.
+        (WebCore::CCPluginLayerImpl::CCPluginLayerImpl):
+        (WebCore::CCPluginLayerImpl::~CCPluginLayerImpl):
+        (WebCore::CCPluginLayerImpl::draw):
+        (WebCore::CCPluginLayerImpl::dumpLayerProperties):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.h: Copied from Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h.
+        (WebCore::CCPluginLayerImpl::create):
+        (WebCore::CCPluginLayerImpl::setTextureId):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp: Added.
+        (WebCore::CCVideoLayerImpl::CCVideoLayerImpl):
+        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
+        (WebCore::CCVideoLayerImpl::setTexture):
+        (WebCore::CCVideoLayerImpl::draw):
+        (WebCore::CCVideoLayerImpl::drawYUV):
+        (WebCore::CCVideoLayerImpl::drawRGBA):
+        (WebCore::CCVideoLayerImpl::dumpLayerProperties):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h: Copied from Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h.
+        (WebCore::CCVideoLayerImpl::create):
+        (WebCore::CCVideoLayerImpl::setSkipsDraw):
+        (WebCore::CCVideoLayerImpl::setFrameFormat):
+
+2011-03-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Allow defineOwnProperty to work on DOMObjects
+        https://bugs.webkit.org/show_bug.cgi?id=57129
+
+        As other engines are allowing defineOwnProperty to be applied
+        to host objects there's no reason for us to retain this
+        restriction.
+
+        * bindings/js/JSDOMWrapper.cpp:
+        * bindings/js/JSDOMWrapper.h:
+
+2011-03-25  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        AC_QuickTime.js uses the common <object>/<embed> paradigm to embed the 
+        QuickTime plug-in in web pages. r70748 removed our mapping of classids 
+        to MIME types, which causes WebKit to fall back from the object to the 
+        embed tag when QuickTime is embedded by this script. The script emits 
+        the following embed tag to embed a QuickTime movie with a poster frame: 
+
+        <embed src="poster-frame.png" target="quicktimeplayer" href="movie.mov"> 
+
+        The expectation is that a QuickTime plug-in is instantiated to display the 
+        poster frame, since QuickTime registers for many common image MIME 
+        types. This is how Gecko behaves for embed. However, WebKit prefers to 
+        use its native image rendering for image embeds, in which case no movie 
+        is played when the poster frame is clicked. 
+
+        Fix this by changing embed to check for a plug-in that can handle the 
+        image type before rendering the image natively. This matches Gecko. 
+
+        Test: plugins/embed-prefers-plugins-for-images.html
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::HTMLEmbedElement):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::HTMLObjectElement):
+        (WebCore::HTMLObjectElement::parametersForPlugin):
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::HTMLPlugInImageElement):
+        (WebCore::HTMLPlugInImageElement::isImageType):
+        (WebCore::HTMLPlugInImageElement::wouldLoadAsNetscapePlugin):
+        * html/HTMLPlugInImageElement.h:
+        (WebCore::HTMLPlugInImageElement::shouldPreferPlugInsForImages):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::objectContentType):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::resourceWillUsePlugin):
+        (WebCore::SubframeLoader::requestPlugin):
+        (WebCore::SubframeLoader::requestObject):
+        (WebCore::SubframeLoader::shouldUsePlugin):
+        * loader/SubframeLoader.h:
+
+2011-03-23  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Application Cache should save audio/ and video/ mime types as flat files
+        https://bugs.webkit.org/show_bug.cgi?id=53784
+        <rdar://problem/8932473>
+
+        No new tests, as this behavior is not possible to test without changes to the MediaPlayer engines.
+
+        Store certain mime types as flat files alongside the Application Cache database.
+        This requires plumbing the saved file path from ApplicationCacheStorage through
+        to ApplicationCacheResource.
+
+        (WebCore::ApplicationCacheStorage::openDatabase): Modify the CacheResourceData schema and
+            add a new DeletedCacheResources table, add a new CacheResourceDataDeleted trigger.
+        (WebCore::ApplicationCacheStorage::store): Add the new path data when adding new rows in 
+            CacheResourceData, and store media resources as flat files.
+        (WebCore::ApplicationCacheStorage::loadCache): Pull the "path" column from CacheResourceData
+            when loading cache items.
+        (WebCore::ApplicationCacheStorage::remove): Call checkForDeletedResources.
+        (WebCore::ApplicationCacheStorage::empty): Ditto.
+        (WebCore::ApplicationCacheStorage::storeCopyOfCache): Ditto.
+        (WebCore::ApplicationCacheStorage::deleteCacheGroup): Ditto.
+        (WebCore::ApplicationCacheStorage::checkForDeletedResources): Walk through DeletedCacheResourceData
+            looking for entries with non-empty "path" columns; if found, delete.
+        (WebCore::ApplicationCacheStorage::flatFileAreaSize): Walk through CacheResourceData rows
+            and sum the file size of those rows with flat file storage.
+        (WebCore::ApplicationCacheStorage::verifySchemaVersion): Call deleteTables() instead of 
+            clearAllTables() directly.
+        (WebCore::ApplicationCacheStorage::deleteTables): Call empty() before deleting the tables,
+            so that flat files get deleted.
+        (WebCore::ApplicationCacheStorage::shouldStoreResourceAsFlatFile): Added.
+        (WebCore::ApplicationCacheStorage::writeDataToUniqueFileInDirectory): Added.
+        * loader/appcache/ApplicationCacheStorage.h:
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::openFile): Implement openFile on Windows.
+
+2011-03-24  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56909
+        
+        Add a simplified normal flow layout path optimization for overflow recomputation
+        and for positioned objects inside relative positioned containers.
+
+        Currently there is an optimized code path for positioned objects, but as soon as
+        we encounter a normal flow object in the containing block chain, we lose the
+        optimization.
+
+        This patch adds a new type of style difference called SimplifiedLayout that is
+        returned when only overflow needs to be recomputed. Whenever a transform changes,
+        this is the hint returned now instead of a full layout.
+        
+        In addition, when positioned objects need layout and start marking up the
+        containing block chain, we now propagate the fact that the layout is simplified
+        all the way up to the root, even when we encounter normal flow containing
+        blocks.
+        
+        The layoutOnlyPositionedObjects function has been renamed to simplifiedLayout()
+        and is now used for all of these cases (in addition to what it handled before).
+        
+        The simplified layout optimization (even in ToT) did not work correctly when
+        static distances needed to be recomputed. In order to make static distance
+        computations work with simplified layout, positioned objects now always compute
+        their static offsets, even if they explicitly specify left/top.  That way normal
+        flow layout never has to re-run when the positioned object moves.  This makes
+        movement of a positioned object along a single non-auto axis much faster when the
+        other axis is auto. Because this code kicked in more often for absolutely positioned
+        objects whose original display was inline, I went ahead and fixed the trailing space
+        issue with those objects.  This causes a bunch of layout tests to progress.
+
+        Added fast/block/positioning/static-inline-position-dynamic.html and trailing-space-test.html.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        (WebCore::RenderBlock::simplifiedNormalFlowLayout):
+        (WebCore::RenderBlock::simplifiedLayout):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::setStaticPositions):
+        (WebCore::RenderBlock::findNextLineBreak):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::positionLineBox):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleWillChange):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        (WebCore::RenderObject::adjustStyleDifference):
+        (WebCore::RenderObject::setStyle):
+        (WebCore::RenderObject::styleDidChange):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::needsLayout):
+        (WebCore::RenderObject::needsPositionedMovementLayoutOnly):
+        (WebCore::RenderObject::needsSimplifiedNormalFlowLayout):
+        (WebCore::RenderObject::setNeedsLayout):
+        (WebCore::RenderObject::setChildNeedsLayout):
+        (WebCore::RenderObject::setNeedsSimplifiedNormalFlowLayout):
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+
+2011-03-25  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix the GTK+ build until we can implement the new cross-platform
+        FontPlatformData.h bits.
+
+        * platform/graphics/FontPlatformData.h: Include the proper old font headers.
+        (WebCore::FontPlatformData::FontPlatformData): Eliminate GTK+ specific bits of this file
+        which reference our obsolete font implementation.
+        (WebCore::FontPlatformData::hash): Ditto.
+
+2011-03-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Brian Weinstein.
+
+        Microsoft Windows Presentation Foundation (WPF) plug-in complains about missing xpcom.dll
+        https://bugs.webkit.org/show_bug.cgi?id=57119
+        <rdar://problem/9054148>
+        
+        This plug-in from Microsoft links against xpcom.dll, which is a Firefox-specific DLL
+        not available in WebKit. The plug-in is fairly widespread, since it was included in
+        a Windows Update push at one point.
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::isPluginBlacklisted): Blacklist npwpf.dll.
+
+2011-03-25  Tony Chang  <tony@chromium.org>
+
+        Try to fix the chromium mac build.
+        We used the mac FontPlatformData on chromium mac.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/graphics/FontPlatformData.h:
+
+2011-03-25  Tony Chang  <tony@chromium.org>
+
+        Build fix:
+        have chromium and qt use the correct FontPlatformData.h
+        https://bugs.webkit.org/show_bug.cgi?id=57115
+
+        * platform/graphics/FontPlatformData.h:
+
+2011-03-25  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=57057 Overlay scrollbars in overflow 
+        areas paint behind positive z-index content
+        -and corresponding-
+        <rdar://problem/9070500>
+
+        Since overlay scrollbars don't clip the scrollable content like other scrollbars do, 
+        the only way to get them to paint on top of all possible scrollable content is to 
+        make them paint on top of everything. To do this, this patch adds a second trip 
+        through the layer tree if it contains overlay scrollbars that need painting.
+
+        After calling paint() on the rootLayer, call paintOverlayScrollers() if 
+        containsDirtyOverlayScrollbars() is true. 
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+
+        RenderLayer has two new member variable. m_containsDirtyOverlayScrollbars is a bool 
+        that is set on the root layer when it has child layers that need overlay scrollbars 
+        to be painted. m_cachedOverlayScrollbarOffset is an IntPoint to cache the tx and ty 
+        of the overlay scrollbars on the first (normal) pass through the layer tree. This 
+        prevents us from having to re-enter the render tree during the second (overlay-only) 
+        pass. Finally, there is also a new paint flag: PaintLayerPaintingOverlayScrollbars.
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::containsDirtyOverlayScrollbars):
+        (WebCore::RenderLayer::setContainsDirtyOverlayScrollbars):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::paintOverflowControls):
+        (WebCore::RenderLayer::paintOverlayScrollbars):
+        (WebCore::RenderLayer::paintLayer):
+
+2011-03-25  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebKit2: Need to be able to set and get the Cookie Storage Policy.
+        https://bugs.webkit.org/show_bug.cgi?id=50780
+
+        * platform/network/cf/CookieStorageCFNet.cpp:
+        (WebCore::privateCookieStorage):
+        Rename privateBrowsingCookieStorage to privateCookieStorage.
+        (WebCore::currentCookieStorage):
+        Ditto.
+        (WebCore::setCurrentCookieStorage):
+        Ditto.
+        (WebCore::setCookieStoragePrivateBrowsingEnabled):
+        Ditto.
+        (WebCore::defaultCookieStorage):
+        Return the default cookie storage.
+        (WebCore::privateBrowsingCookieStorage):
+        Return privateCookieStorage().get()
+        * platform/network/cf/CookieStorageCFNet.h:
+
+2011-03-25  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Text field "onchange" event is triggered if actual value unchanged
+        https://bugs.webkit.org/show_bug.cgi?id=36314
+
+        Change RenderTextControl::subtreeHasChanged to only return true if the
+        subtree has changed since the last event was triggered.
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::insertedIntoDocument):
+        (WebCore::HTMLTextFormControlElement::dispatchFormControlChangeEvent):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLTextFormControlElement::setTextAsOfLastFormControlChangeEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+        (WebCore::HTMLInputElement::setValue):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setValue):
+        (WebCore::HTMLTextAreaElement::setNonDirtyValue):
+
+2011-03-25  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Clean up FontPlatformData structure so that a single implementation
+        is used across all ports.  This first patch works for the Windows
+        build (both CG and WinCairo), and Cocoa.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/FontPlatformData.cpp: Added.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        * platform/graphics/FontPlatformData.h: Added.
+        (WebCore::toCTFontRef):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::hfont):
+        (WebCore::FontPlatformData::useGDI):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::cgFont):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::setSize):
+        (WebCore::FontPlatformData::syntheticBold):
+        (WebCore::FontPlatformData::syntheticOblique):
+        (WebCore::FontPlatformData::isColorBitmapFont):
+        (WebCore::FontPlatformData::orientation):
+        (WebCore::FontPlatformData::textOrientation):
+        (WebCore::FontPlatformData::widthVariant):
+        (WebCore::FontPlatformData::setOrientation):
+        (WebCore::FontPlatformData::scaledFont):
+        (WebCore::FontPlatformData::fontFace):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::operator==):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+        * platform/graphics/cg/FontPlatformData.h: Removed.
+        * platform/graphics/cocoa/FontPlatformData.h: Removed.
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore::~FontPlatformData):
+        (WebCore::FontPlatformData::platformDataInit):
+        (WebCore::FontPlatformData::platformDataAssign):
+        * platform/graphics/win/FontPlatformDataCGWin.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::platformDataInit):
+        (WebCore::FontPlatformData::platformDataAssign):
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::platformDataInit):
+        (WebCore::FontPlatformData::platformDataAssign):
+        * platform/graphics/win/FontPlatformDataWin.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/graphics/win/cairo/FontPlatformData.h: Removed.
+
+2011-03-25  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Pasteboard data's RTF data doesn't always include URLs via NSLinkAttributeName.
+        https://bugs.webkit.org/show_bug.cgi?id=57107
+        <rdar://problem/9084267>
+
+        If the selection is at the beginning of content inside an anchor tag
+        we move the selection start to include the anchor.
+        
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection): Modified to change the selection
+        start according to the new rule.
+
+2011-03-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: refactor Network domain's frame tree API
+        https://bugs.webkit.org/show_bug.cgi?id=57103
+
+        * inspector/Inspector.json:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::buildObjectForFrameResource):
+        (WebCore::buildObjectForCachedResource):
+        (WebCore::InspectorResourceAgent::willSendRequest):
+        (WebCore::InspectorResourceAgent::didLoadResourceFromMemoryCache):
+        (WebCore::buildObjectForFrame):
+        (WebCore::buildObjectForFrameTree):
+        (WebCore::InspectorResourceAgent::didCommitLoad):
+        (WebCore::InspectorResourceAgent::enable):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkManager.prototype.requestContent):
+        (WebInspector.NetworkDispatcher):
+        (WebInspector.NetworkDispatcher.prototype.willSendRequest):
+        (WebInspector.NetworkDispatcher.prototype.didReceiveResponse):
+        (WebInspector.NetworkDispatcher.prototype.didLoadResourceFromMemoryCache):
+        (WebInspector.NetworkDispatcher.prototype.frameDetachedFromParent):
+        (WebInspector.NetworkDispatcher.prototype.didCommitLoadForFrame):
+        (WebInspector.NetworkDispatcher.prototype.didCreateWebSocket):
+        (WebInspector.NetworkDispatcher.prototype._appendRedirect):
+        (WebInspector.NetworkDispatcher.prototype._addFramesRecursively):
+        (WebInspector.NetworkDispatcher.prototype._createResource):
+        * inspector/front-end/ResourceTreeModel.js:
+        (WebInspector.ResourceTreeModel.prototype.addOrUpdateFrame):
+        (WebInspector.ResourceTreeModel.prototype.didCommitLoadForFrame):
+        (WebInspector.ResourceTreeModel.prototype._clearChildFramesAndResources):
+        (WebInspector.ResourceTreeModel.prototype._clearResources):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.addOrUpdateFrame):
+        (WebInspector.ResourcesPanel.prototype.addResourceToFrame):
+
+2011-03-25  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION(r77257): Only first page of a document is printed
+        https://bugs.webkit.org/show_bug.cgi?id=56958
+
+        Test: printing/page-count-layout-overflow.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::forceLayoutForPagination): Moved clearing of overflow
+            to the right place.
+
+2011-03-25  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QtWebKit will not compile with QT_ASCII_CAST_WARNINGS enabled
+        https://bugs.webkit.org/show_bug.cgi?id=57087
+
+        Use explicit conversion for string to avoid depending on the default codec
+        installed by the user code.
+
+        * bridge/qt/qt_pixmapruntime.cpp:
+        (JSC::Bindings::QtPixmapToDataUrlMethod::invoke):
+        (JSC::Bindings::QtPixmapInstance::valueOf):
+        * platform/qt/LanguageQt.cpp:
+        (WebCore::platformDefaultLanguage):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::initializeGtk):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::getPluginDisplay):
+
+2011-03-25  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        rename Node::isContentEditable and all call sites to rendererIsEditable
+        https://bugs.webkit.org/show_bug.cgi?id=54290
+
+        This is part of the effort to separate JS API HTMLElement isContentEditable from
+        internal Node::rendererIsEditable.
+
+        Code refactoring. No new tests.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * dom/Document.cpp:
+        (WebCore::acceptsEditingFocus):
+        * dom/Node.cpp:
+        (WebCore::Node::rendererIsEditable):
+        (WebCore::Node::shouldUseInputMethod):
+        (WebCore::Node::canStartSelection):
+        (WebCore::Node::rootEditableElement):
+        * dom/Node.h:
+        (WebCore::Node::isContentEditable):
+        (WebCore::Node::rendererIsEditable):
+        (WebCore::Node::rendererIsRichlyEditable):
+        * dom/Position.cpp:
+        (WebCore::nextRenderedEditable):
+        (WebCore::previousRenderedEditable):
+        (WebCore::Position::atEditingBoundary):
+        (WebCore::Position::parentEditingBoundary):
+        (WebCore::Position::upstream):
+        (WebCore::Position::downstream):
+        (WebCore::Position::isCandidate):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::isCandidate):
+        * editing/AppendNodeCommand.cpp:
+        (WebCore::AppendNodeCommand::AppendNodeCommand):
+        (WebCore::AppendNodeCommand::doApply):
+        (WebCore::AppendNodeCommand::doUnapply):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::containsNonEditableRegion):
+        (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange):
+        (WebCore::ApplyStyleCommand::removeInlineStyleFromElement):
+        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+        (WebCore::enclosingDeletableElement):
+        * editing/DeleteFromTextNodeCommand.cpp:
+        (WebCore::DeleteFromTextNodeCommand::doApply):
+        (WebCore::DeleteFromTextNodeCommand::doUnapply):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeNode):
+        * editing/Editor.cpp:
+        (WebCore::Editor::canDeleteRange):
+        (WebCore::Editor::markMisspellingsOrBadGrammar):
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance):
+        * editing/FormatBlockCommand.cpp:
+        (WebCore::enclosingBlockToSplitTreeTo):
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::outdentParagraph):
+        * editing/InsertIntoTextNodeCommand.cpp:
+        (WebCore::InsertIntoTextNodeCommand::doApply):
+        (WebCore::InsertIntoTextNodeCommand::doUnapply):
+        * editing/InsertNodeBeforeCommand.cpp:
+        (WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand):
+        (WebCore::InsertNodeBeforeCommand::doApply):
+        (WebCore::InsertNodeBeforeCommand::doUnapply):
+        * editing/JoinTextNodesCommand.cpp:
+        (WebCore::JoinTextNodesCommand::doApply):
+        (WebCore::JoinTextNodesCommand::doUnapply):
+        * editing/MergeIdenticalElementsCommand.cpp:
+        (WebCore::MergeIdenticalElementsCommand::doApply):
+        (WebCore::MergeIdenticalElementsCommand::doUnapply):
+        * editing/RemoveNodeCommand.cpp:
+        (WebCore::RemoveNodeCommand::doApply):
+        (WebCore::RemoveNodeCommand::doUnapply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::selectFrameElementInParentIfFullySelected):
+        (WebCore::SelectionController::setSelectionFromNone):
+        * editing/SplitElementCommand.cpp:
+        (WebCore::SplitElementCommand::executeApply):
+        (WebCore::SplitElementCommand::doUnapply):
+        * editing/SplitTextNodeCommand.cpp:
+        (WebCore::SplitTextNodeCommand::doApply):
+        (WebCore::SplitTextNodeCommand::doUnapply):
+        (WebCore::SplitTextNodeCommand::doReapply):
+        * editing/SplitTextNodeContainingElementCommand.cpp:
+        (WebCore::SplitTextNodeContainingElementCommand::doApply):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::canonicalPosition):
+        * editing/WrapContentsInDummySpanCommand.cpp:
+        (WebCore::WrapContentsInDummySpanCommand::doUnapply):
+        (WebCore::WrapContentsInDummySpanCommand::doReapply):
+        * editing/htmlediting.cpp:
+        (WebCore::highestEditableRoot):
+        (WebCore::lowestEditableAncestor):
+        (WebCore::isEditablePosition):
+        (WebCore::isRichlyEditablePosition):
+        (WebCore::firstEditablePositionAfterPositionInRoot):
+        (WebCore::extendRangeToWrappingNodes):
+        (WebCore::enclosingNodeWithTag):
+        (WebCore::enclosingNodeOfType):
+        (WebCore::highestEnclosingNodeOfType):
+        (WebCore::canMergeLists):
+        * editing/visible_units.cpp:
+        (WebCore::previousLeafWithSameEditability):
+        (WebCore::previousLinePosition):
+        (WebCore::nextLeafWithSameEditability):
+        (WebCore::nextLinePosition):
+        (WebCore::startOfParagraph):
+        (WebCore::endOfParagraph):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::supportsFocus):
+        (WebCore::HTMLAnchorElement::defaultEventHandler):
+        (WebCore::HTMLAnchorElement::setActive):
+        (WebCore::HTMLAnchorElement::canStartSelection):
+        (WebCore::HTMLAnchorElement::treatLinkAsLiveForEventType):
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::supportsFocus):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::supportsFocus):
+        (WebCore::HTMLElement::isContentEditable):
+        (WebCore::HTMLElement::contentEditable):
+        * html/HTMLElement.h:
+        * page/DragController.cpp:
+        (WebCore::DragController::operationForLoad):
+        (WebCore::DragController::canProcessDrag):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        (WebCore::EventHandler::selectCursor):
+        * page/FocusController.cpp:
+        (WebCore::relinquishesEditingFocus):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::isContentEditable):
+        * rendering/RenderBlock.cpp:
+        (WebCore::positionForPointRespectingEditingBoundaries):
+        (WebCore::RenderBlock::hasLineIfEmpty):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::addOverflowFromInlineChildren):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::canBeProgramaticallyScrolled):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createVisiblePosition):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::isEditableLeaf):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::supportsFocus):
+
+2011-03-25  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Crash when a wbr element is inserted inside mroot
+        https://bugs.webkit.org/show_bug.cgi?id=56352
+
+        Test: mathml/wbr-in-mroot-crash.html
+
+        * rendering/mathml/RenderMathMLRoot.cpp:
+        (WebCore::RenderMathMLRoot::layout): Look for the first box model child of the first
+        child, instead of just assuming.
+
+2011-03-25  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        XML Viewer: extensions can't render original XML
+        https://bugs.webkit.org/show_bug.cgi?id=56263
+
+        Added source xml to transformed document, renamed onload function.
+
+        * xml/XMLTreeViewer.cpp:
+        (WebCore::XMLTreeViewer::transformDocumentToTreeView):
+        * xml/XMLViewer.xsl:
+
+2011-03-25  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Get rid of the invalid string conversion with ::fromAscii()
+        https://bugs.webkit.org/show_bug.cgi?id=57102
+
+        Replace ::fromAscii() with ::fromLatin1() to make sure the codec does not depend on the user code.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookies):
+        (WebCore::cookieRequestHeaderFieldValue):
+
+2011-03-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81953.
+        http://trac.webkit.org/changeset/81953
+        https://bugs.webkit.org/show_bug.cgi?id=57096
+
+        "inspector test breakage: part 2/2" (Requested by apavlov on
+        #webkit).
+
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getAllStyles):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheet):
+        * inspector/InspectorStyleSheet.h:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.styleSheetCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.allStylesCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged.callback):
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype._onRevert):
+        (WebInspector.CSSStyleSheet):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+
+2011-03-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Fix handling of the CSSAgent.setStyleSheetText() results in CSSStyleModel.js
+        https://bugs.webkit.org/show_bug.cgi?id=56310
+
+        Instead of stylesheet ids, CSSAgent.getAllStyleSheets() now returns metainfo objects containing
+        "styleSheetId", "sourceURL", "disabled", and "title" fields. The latter three are not returned
+        by CSSAgent.getStyleSheet() anymore.
+
+        Test: inspector/styles/get-set-stylesheet-text.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getAllStyleSheets):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheet):
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheetInfo):
+        * inspector/InspectorStyleSheet.h:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.styleSheetCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.allStylesCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged.callback):
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype._onRevert):
+        (WebInspector.CSSStyleSheet):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+
+2011-03-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: extension server should not convert all resources to HAR when there are no extensions.
+        https://bugs.webkit.org/show_bug.cgi?id=57044
+
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._notifyResourceFinished):
+        (WebInspector.ExtensionServer.prototype._hasSubscribers):
+
+2011-03-25  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG <use> element performance improvement
+        https://bugs.webkit.org/show_bug.cgi?id=57077
+
+        SVG <use> element was expanding nesting <use> and <symbol> elements
+        in an inefficient way. After it expanded an <use> or a <symbol>
+        element it would restart expanding from the shadow tree root.
+        This behavior was leading about 160 millions of calls to
+        expandUseElementInShadowTree or expandSymbolElementInShadowTree for
+        a single shadow tree which is illustrated by
+        http://upload.wikimedia.org/wikipedia/commons/4/4e/Sierpinski_carpet_6.svg.
+        But the effective calls, which really expand <use> or <symbol>
+        elements, were about 5200; others were passing-by calls, which are
+        recursively down to the children.
+
+        This patch is altering the expanding path to reduce the passing-by
+        calls. It will expand elements in sibling chain where there is an
+        effective call, because the effective call replaces element which is
+        expanded and the replacement results lose of the sibling chain of
+        the replaced on the upper recursion stack. With this patch the
+        passing-by calls are reduced from about 160 millions to about 30
+        thousands.
+
+        No functionality change, no new tests.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::expandUseElementsInShadowTree):
+        (WebCore::SVGUseElement::expandSymbolElementsInShadowTree):
+        * svg/SVGUseElement.h:
+
+2011-03-25  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Kent Tamura.
+
+        Makes keygen support autofocus attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=57091
+
+        Test: fast/forms/autofocus-keygen.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::attach):
+
+2011-03-24  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Add sound / mute button to MediaControl UI
+        https://bugs.webkit.org/show_bug.cgi?id=56726
+
+        Add sound / mute button to MediaControl UI.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::edjeGroupFromFormType):
+        (WebCore::RenderThemeEfl::emitMediaButtonSignal):
+        (WebCore::RenderThemeEfl::paintMediaMuteButton):
+        * platform/efl/RenderThemeEfl.h:
+
+2011-03-24  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Introduce WTF HexNumber.h
+        https://bugs.webkit.org/show_bug.cgi?id=56099
+
+        Introduce a set of functions that ease converting from a bye or a number to a hex string,
+        replacing several of these conversions and String::format("%x") usages all over WebCore.
+
+        * ForwardingHeaders/wtf/HexNumber.h: Added.
+        * css/CSSOMUtils.cpp:
+        (WebCore::serializeCharacterAsCodePoint):
+        * css/CSSParser.cpp:
+        (WebCore::quoteCSSString):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::createReadableStringFromBinary):
+        * platform/FileSystem.cpp:
+        (WebCore::encodeForFileName):
+        * platform/KURL.cpp:
+        (WebCore::appendEscapedChar):
+        * platform/UUID.cpp:
+        (WebCore::createCanonicalUUIDString):
+        * platform/graphics/Color.cpp:
+        (WebCore::Color::serialized):
+        * platform/network/FormDataBuilder.cpp:
+        (WebCore::FormDataBuilder::encodeStringAsFormData):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::quoteAndEscapeNonPrintables):
+
+2011-03-24  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/9146716> REGRESSION: ~10 MB increase in memory under CachedScripts
+        Add back a call to destroy decoded data after access.  Keep the SourceProviderCache 
+        around as long as their are still clients to use it.
+
+        No new tests because there is no change in behavior.  Current tests pass.
+
+        * loader/cache/CachedScript.cpp:
+        (WebCore::CachedScript::script):
+        (WebCore::CachedScript::destroyDecodedData):
+
+2011-03-24  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57073
+        Rework the AtomicHTMLConstructor to reserve space for attributes based on the size of the attribute list.
+        Saves 1.5 MB on Membuster.
+
+        No new tests because there was no change in behavior.  Current tests pass.
+
+        * html/parser/HTMLToken.h:
+        (WebCore::AtomicHTMLToken::AtomicHTMLToken):
+        (WebCore::AtomicHTMLToken::initializeAttributes):
+
+2011-03-24  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81916 and r81917.
+        http://trac.webkit.org/changeset/81916
+        http://trac.webkit.org/changeset/81917
+        https://bugs.webkit.org/show_bug.cgi?id=57071
+
+        broke a test on platforms that do not have QuickTime installed
+        (Requested by estes on #webkit).
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::HTMLEmbedElement):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::HTMLObjectElement):
+        (WebCore::HTMLObjectElement::parametersForPlugin):
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::HTMLPlugInImageElement):
+        (WebCore::HTMLPlugInImageElement::isImageType):
+        (WebCore::HTMLPlugInImageElement::wouldLoadAsNetscapePlugin):
+        * html/HTMLPlugInImageElement.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::objectContentType):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::resourceWillUsePlugin):
+        (WebCore::SubframeLoader::requestObject):
+        (WebCore::SubframeLoader::shouldUsePlugin):
+        * loader/SubframeLoader.h:
+
+2011-03-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Eliminate Node::dispatchGenericEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=57045
+
+        No functional change, covered by existing tests.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchEvent): Combined with the body of dispatchGenericEvent,
+            removed unnecessary extra refs and a stale comment.
+        * dom/Node.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent): Changed to use dispatchEvent.
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::sendSVGLoadEventIfPossible): Ditto.
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::dispatchEvent): Ditto. The code here still
+            works thanks to SVG-aware retargeting in Node.
+
+2011-03-24  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        web audio: Properly sample-rate convert audio assets in chromium port
+        https://bugs.webkit.org/show_bug.cgi?id=56980
+
+        No new tests since audio API is not yet implemented.
+
+        * WebCore.gypi:
+        * platform/audio/AudioBus.cpp:
+        (WebCore::AudioBus::createBySampleRateConverting):
+        (WebCore::AudioBus::createByMixingToMono):
+        * platform/audio/AudioBus.h:
+        * platform/audio/HRTFKernel.cpp:
+        (WebCore::extractAverageGroupDelay):
+        (WebCore::HRTFKernel::HRTFKernel):
+        * platform/audio/SincResampler.cpp:
+        * platform/audio/chromium/AudioBusChromium.cpp:
+        (WebCore::AudioBus::loadPlatformResource):
+        (WebCore::createBusFromInMemoryAudioFile):
+
+2011-03-24  Rik Cabanier  <cabanier@adobe.com>
+
+        Reviewed by David Hyatt.
+
+        REGRESSION (r81625): fast/css/percentage-non-integer.html fails on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=56829
+
+        Test: fast/css/percentage-non-integer.html
+
+        * platform/Length.h:
+        (WebCore::Length::calcValue):
+        (WebCore::Length::calcMinValue):
+        (WebCore::Length::calcFloatValue):
+
+2011-03-24  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [Chromium] Vertical Japanese text is not displayed on Snow Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=56962
+
+        Make Snow Leopard check added by r80740 into a runtime check for
+        Chromium, since it uses the same binary on both Leopard and Snow Leopard.
+
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::hasBrokenCTFontGetVerticalTranslationsForGlyphs):
+        (WebCore::showGlyphsWithAdvances):
+
+2011-03-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57058
+        Hookup the UIProcess WebIconDatabase to a WebCore::IconDatabase as its implementation
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::synchronousLoadDecisionForIconURL): Only add the DocumentLoader to the set if it's non-zero.
+        (WebCore::IconDatabase::IconDatabase): Add more logging.
+        (WebCore::IconDatabase::performURLImport): Dispatch the "didFinishURLImport" client callback using the following 3 methods.
+        (WebCore::FinishedURLImport::FinishedURLImport):
+        (WebCore::FinishedURLImport::performWork):
+        (WebCore::IconDatabase::dispatchDidFinishURLImportOnMainThread):
+
+        * loader/icon/IconDatabase.h:
+        (WebCore::IconDatabase::create): Expose a PassOwnPtr<> creator.
+
+        * WebCore.exp.in:
+
+2011-03-23  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Application Cache should save audio/ and video/ mime types as flat files
+        https://bugs.webkit.org/show_bug.cgi?id=53784
+        <rdar://problem/8932473>
+
+        No new tests.
+
+        ApplicationCacheResource::create() now takes an additional "path" parameter.  To facilitate 
+        extracting this path information, two functions in ApplicationCacheHost have been made public.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): Pass along new "path" parameter.
+        (WebCore::ApplicationCacheGroup::didFail): Ditto.
+        * loader/appcache/ApplicationCacheHost.h:
+        (WebCore::ApplicationCacheHost::shouldLoadResourceFromApplicationCache): Made public.
+        (WebCore::ApplicationCacheHost::getApplicationCacheFallbackResource): Made public.
+        * loader/appcache/ApplicationCacheResource.cpp:
+        (WebCore::ApplicationCacheResource::ApplicationCacheResource): Add new "path" parameter.
+        * loader/appcache/ApplicationCacheResource.h:
+        (WebCore::ApplicationCacheResource::create): Ditto.
+        (WebCore::ApplicationCacheResource::path): New accessor.
+
+2011-03-24  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r70748): latest nightly builds kills AC_QuickTime.js
+        https://bugs.webkit.org/show_bug.cgi?id=49016
+
+        AC_QuickTime.js uses the common <object>/<embed> paradigm to embed the
+        QuickTime plug-in in web pages. r70748 removed our mapping of classids
+        to MIME types, which causes WebKit to fall back from the object to the
+        embed tag when QuickTime is embedded by this script. The script emits
+        the following embed tag to embed a QuickTime movie with a poster frame:
+
+        <embed src="poster-frame.png" target="quicktimeplayer" href="movie.mov">
+
+        The expectation is that a QuickTime plug-in is instantiated to display the
+        poster frame, since QuickTime registers for many common image MIME
+        types. This is how Gecko behaves for embed. However, WebKit prefers to
+        use its native image rendering for image embeds, in which case no movie
+        is played when the poster frame is clicked.
+
+        Fix this by changing embed to check for a plug-in that can handle the
+        image type before rendering the image natively. This matches Gecko.
+
+        Test: fast/images/embed-image-plugins-disabled.html
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parametersForPlugin):
+        * html/HTMLPlugInImageElement.cpp:
+        (WebCore::HTMLPlugInImageElement::HTMLPlugInImageElement):
+        (WebCore::HTMLPlugInImageElement::isImageType):
+        (WebCore::HTMLPlugInImageElement::wouldLoadAsNetscapePlugin):
+        * html/HTMLPlugInImageElement.h:
+        (WebCore::HTMLPlugInImageElement::preferPluginsForImages):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::objectContentType):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::defaultObjectContentType):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::resourceWillUsePlugin):
+        (WebCore::SubframeLoader::requestPlugin):
+        (WebCore::SubframeLoader::requestObject):
+        (WebCore::SubframeLoader::shouldUsePlugin):
+        * loader/SubframeLoader.h:
+
+2011-03-24  Mike Reed  <reed@google.com>
+
+        Reviewed by James Robinson.
+
+        Move lifetime management of grContext from a global to being
+        per-SharedGraphicsContext3D, which correctly is 1:1 with the
+        underlying opengl context.
+        https://bugs.webkit.org/show_bug.cgi?id=54330
+
+        No new tests. Existing <canvas> tests exercise this:
+
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        (WebCore::DrawingBuffer::DrawingBuffer):
+        (WebCore::DrawingBuffer::~DrawingBuffer):
+        (WebCore::DrawingBuffer::publishToPlatformLayer):
+        (WebCore::DrawingBuffer::setGrContext):
+        * platform/graphics/gpu/DrawingBuffer.h:
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::SharedGraphicsContext3D):
+        (WebCore::SharedGraphicsContext3D::~SharedGraphicsContext3D):
+        (WebCore::SharedGraphicsContext3D::getGrContext):
+        * platform/graphics/gpu/SharedGraphicsContext3D.h:
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::~PlatformContextSkia):
+        (WebCore::PlatformContextSkia::setSharedGraphicsContext3D):
+
+2011-03-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Untangle dependency between event ancestor chain computation and InspectorDOMAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=57050
+
+        Inspector's list of event listeners does not need to invoke Node::getEventListeners,
+        because it simply wants to collect all ancestors and never uses EventContext bits.
+
+        No functional change, covered by existing tests.
+
+        * dom/Node.cpp:
+        (WebCore::getEventAncestors): Converted into a static function.
+        (WebCore::Node::dispatchGenericEvent): Changed to pass node to getEventAncestors.
+        * dom/Node.h: Removed decl, moved EventDispatchBehavior enum inside.
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode): Replaced the call
+            to getEventAncestors with a simple ancestor traversal loop.
+
+2011-03-24  Adam Klein  <adamk@chromium.org>
+
+        Reviewed by David Levin.
+
+        [fileapi] Make FileError and FileException accessible from WorkerContext
+        https://bugs.webkit.org/show_bug.cgi?id=57041
+
+        * workers/WorkerContext.idl:
+
+2011-03-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Remove legacy version of findPlainText.
+        https://bugs.webkit.org/show_bug.cgi?id=57056
+
+        * editing/TextIterator.cpp:
+        * editing/TextIterator.h:
+        Remove legacy overload of findPlainText that doesn't
+        take an options parameter.
+
+2011-03-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Ensure that all compilation takes place within a dynamic global object scope
+        https://bugs.webkit.org/show_bug.cgi?id=57054
+
+        * bindings/js/JSErrorHandler.cpp:
+        (WebCore::JSErrorHandler::handleEvent):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent): Updated for signature change.
+
+2011-03-24  John Bauman  <jbauman@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        preserveDrawingBuffer=true is ignored
+        https://bugs.webkit.org/show_bug.cgi?id=56987
+
+        Add code to the V8 and JSC bindings to support grabbing the value of
+        preserveDrawingBuffer from the input context attributes. Also, in
+        WebGLRenderingContext use the WebGLContextAttributes that were input
+        directly, not those from the GraphicsContext3D which could have been
+        changed.
+
+        No new tests, as this can't be tested with DRT. However, this works
+        when tested manually.
+
+        * bindings/js/JSHTMLCanvasElementCustom.cpp:
+        (WebCore::JSHTMLCanvasElement::getContext):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::V8HTMLCanvasElement::getContextCallback):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::clearIfComposited):
+        (WebCore::WebGLRenderingContext::paintRenderingResultsToCanvas):
+
+2011-03-24  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebKit2:Services menu item to convert selected Simplified/Traditional Chinese Text is not working.
+        https://bugs.webkit.org/show_bug.cgi?id=56975
+        <rdar://problem/8915066>
+        
+        Adding support in WebCore to implement readSelectionFromPasteboard
+        to support Mac OS X services from WebKit2.
+
+        * WebCore.exp.in:
+        * editing/Editor.h:
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::readSelectionFromPasteboard): Added entry point
+        to call the paste functions with the specified pasteboard.
+
+2011-03-24  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Inspector does not show correct transfer size for synchronous requests
+        https://bugs.webkit.org/show_bug.cgi?id=56951
+
+        Fixed transfer size for synchronous load.
+
+        Test: http/tests/inspector/network/network-size-sync.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::sendRemainingDelegateMessages):
+        * loader/ResourceLoadNotifier.h:
+
+2011-03-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=57030
+        REGRESSION (r81782): http/tests/inspector/extensions-resources-redirect.html sometimes crashes WebKit2's 
+        web process while handling a WebIconDatabaseProxy::ReceivedIconLoadDecision message
+
+        The callback objects had some bogus ASSERTs and missed a relevant null check. If a callback was waiting on
+        a message back from the UIProcess, but was invalidated from within the WebProcess in the meantime, it's
+        perfectly valid to attempt to performCallback() after the callback function pointer has been cleared.
+
+        * loader/icon/IconDatabaseBase.h:
+        (WebCore::EnumCallback::performCallback):
+        (WebCore::EnumCallback::invalidate):
+        (WebCore::EnumCallback::EnumCallback):
+        (WebCore::ObjectCallback::performCallback):
+        (WebCore::ObjectCallback::invalidate):
+        (WebCore::ObjectCallback::ObjectCallback):
+
+2011-03-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Dictionary text extraction is not correctly detecting word boundaries on bing.com
+        <rdar://problem/9078569>
+        https://bugs.webkit.org/show_bug.cgi?id=56995
+
+        * WebCore.exp.in:
+        Add some editing related exports needed by WebKit2.
+
+2011-03-24  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION (r80231): Bad cast in HTMLTreeBuilder with closed </form> tags
+        https://bugs.webkit.org/show_bug.cgi?id=56836
+
+        During fragment parsing, HTMLConstructionSite holds a reference to the
+        fragment context's closest form ancestor. If a misnested form end tag is
+        then encountered as the first node of the fragment, we will check to see
+        if a corresponding form start tag is in scope even though no such tag
+        exists. This led to isScope() walking the HTMLElementStack all the way
+        to the root DocumentFragment and attempting to cast it to Element*.
+
+        Fix this by ensuring that the inScope() family of functions operate in
+        terms of ContainerNodes to account for the fragment case.
+
+        Test: fast/parser/fragment-closest-form-ancestor.html
+
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLNames::isRootNode):
+        (WebCore::HTMLNames::isScopeMarker):
+        (WebCore::HTMLNames::isTableScopeMarker):
+        (WebCore::HTMLNames::isTableBodyScopeMarker):
+        (WebCore::HTMLNames::isTableRowScopeMarker):
+        (WebCore::HTMLElementStack::hasOnlyHTMLElementsInScope):
+        (WebCore::HTMLElementStack::inScope):
+
+2011-03-24  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Repeated copy and paste-in-place operation results in increasingly verbose HTML.
+        <rdar://problem/8690506>
+        https://bugs.webkit.org/show_bug.cgi?id=56874
+        
+        When we calculate the style to apply at the insertion point we compare the initial
+        style at the insertion point against the style calculated at the span we wrap the
+        copied markup fragment with. We could end up with a series of unnecessary spans
+        to remove the initial style that simply grow our markup.
+        The consists in moving the insertion point outside any inline element that could
+        affect the fragment being inserted when we are not pasting and matching the style.
+
+        Test: editing/pasteboard/paste-text-with-style.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::isInlineNodeWithStyle): Added.
+        (WebCore::ReplaceSelectionCommand::doApply): Added logic to change the insertion
+        point according to the new rules.
+
+2011-03-24  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] When we render WebGL offscreen, color conversion cost a lot of CPU cycles
+        https://bugs.webkit.org/show_bug.cgi?id=40884
+
+        The software fallback is now only needed for corner cases like a manual rendering
+        of the page to QImage.
+
+        Keeping the image with the last pixel values is no longer needed. Removing it reduce the
+        performance for real-time rendering on software surface, but this case should no longer be
+        supported.
+
+        The conversion from OpenGL color space and coordinates is done manually for performance. This
+        also fix the bug of the inverted X axis due to the transformation.
+
+        The tests and benchmarks are done through Qt API tests.
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::swapBgrToRgb):
+        (WebCore::GraphicsContext3DInternal::paint):
+        (WebCore::GraphicsContext3D::reshape):
+
+2011-03-24  Nat Duca  <nduca@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] Remove bool that forces compositor HUD to always be enabled
+        https://bugs.webkit.org/show_bug.cgi?id=57034
+
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.h:
+        (WebCore::CCHeadsUpDisplay::enabled):
+
+2011-03-24  Nat Duca  <nduca@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Add traceEvents to compositor
+        https://bugs.webkit.org/show_bug.cgi?id=56965
+
+        * WebCore.gypi:
+        * platform/chromium/TraceEvent.h: Added.
+        (WebCore::internal::ScopeTracer::ScopeTracer):
+        (WebCore::internal::ScopeTracer::~ScopeTracer):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::updateRootLayerContents):
+        (WebCore::LayerRendererChromium::updateRootLayerScrollbars):
+        (WebCore::LayerRendererChromium::updateLayers):
+        (WebCore::LayerRendererChromium::drawLayers):
+        (WebCore::LayerRendererChromium::finish):
+        (WebCore::LayerRendererChromium::present):
+        * platform/graphics/chromium/LayerTilerChromium.cpp:
+        (WebCore::LayerTilerChromium::update):
+
+2011-03-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: render XHRs matching JSON regex as JSON.
+        https://bugs.webkit.org/show_bug.cgi?id=57035
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/NetworkItemView.js:
+        (WebInspector.NetworkItemView):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.LocalJSONObject.prototype.get description.switch.case):
+        (WebInspector.LocalJSONObject.prototype.get description):
+        (WebInspector.LocalJSONObject.prototype._concatenate):
+        (WebInspector.LocalJSONObject.prototype.getProperties):
+        (WebInspector.LocalJSONObject.prototype._children):
+        * inspector/front-end/ResourceJSONView.js: Added.
+        (WebInspector.ResourceJSONView):
+        (WebInspector.ResourceJSONView.parseJSON.WebInspector.ResourceJSONView.prototype.hasContent):
+        (WebInspector.ResourceJSONView.parseJSON.WebInspector.ResourceJSONView.prototype.show):
+        (WebInspector.ResourceJSONView.parseJSON.WebInspector.ResourceJSONView.prototype._initialize):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        (.resource-view.json):
+        * inspector/front-end/inspector.html:
+
+2011-03-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Move media controls subtree creation into one method.
+        https://bugs.webkit.org/show_bug.cgi?id=56969
+
+        Mechanical move, no changes in functionality.
+
+        The purpose of this patch is to align existing code closer with its
+        future version, when MediaControls is an element whose tree is created
+        at the instantiation.
+
+        * html/shadow/MediaControls.cpp:
+        (WebCore::MediaControls::create): Added, consolidating all subtree generation logic into one place.
+        (WebCore::MediaControls::update): Replaced methods with one call.
+        * html/shadow/MediaControls.h: Updated decls.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::create): Moved setting of attributes here.
+        (WebCore::MediaControlVolumeSliderElement::create): Ditto.
+
+2011-03-24  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Use proper string method to generate webloc string.
+        https://bugs.webkit.org/show_bug.cgi?id=57028
+        <rdar://problem/9181955>
+
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::getWebLocData):
+
+2011-03-24  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=32821
+        Fix conditionals which had an int for one case and a pointer for another.
+        Fix is similar to https://bugs.webkit.org/show_bug.cgi?id=56198
+
+        No new tests. Fix compilation on Solaris 10 with SunStudio 12 C++
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::valueForShadow):
+
+2011-03-24  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: provide live edit callback to source frame delegate.
+        https://bugs.webkit.org/show_bug.cgi?id=57003
+
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.editScriptSource):
+        (WebInspector.DebuggerModel.prototype._didEditScriptSource):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype.canEditScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.editScriptSource.didEditScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.editScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._updateBreakpointsAfterLiveEdit):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptForSourceFileId):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
+        (WebInspector.SourceFrameDelegateForScriptsPanel):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.canEditScriptSource):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.editScriptSource):
+
+2011-03-24  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        Regression: WebKit does not build with Python 3 following 56807
+        https://bugs.webkit.org/show_bug.cgi?id=56923
+
+        The module string does not have the function replace in Python 3. The str.replace function
+        can do the same operation in this case and works with the versions 2 and 3.
+
+        * inspector/generate-inspector-idl:
+
+2011-03-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: brush up Network agent API.
+        https://bugs.webkit.org/show_bug.cgi?id=57001
+
+        * inspector/Inspector.json:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::willSendRequestImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::willSendRequest):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::buildObjectForResourceRequest):
+        (WebCore::buildObjectForResourceResponse):
+        (WebCore::buildObjectForCachedResource):
+        (WebCore::InspectorResourceAgent::willSendRequest):
+        (WebCore::InspectorResourceAgent::willSendWebSocketHandshakeRequest):
+        (WebCore::InspectorResourceAgent::didReceiveWebSocketHandshakeResponse):
+        (WebCore::InspectorResourceAgent::setExtraHeaders):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createResourceReceiveResponseData):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype._updateResourceWithRequest):
+        (WebInspector.NetworkDispatcher.prototype._updateResourceWithResponse):
+        (WebInspector.NetworkDispatcher.prototype._updateResourceWithCachedResource):
+        (WebInspector.NetworkDispatcher.prototype.willSendRequest):
+        (WebInspector.NetworkDispatcher.prototype.didReceiveWebSocketHandshakeResponse):
+        (WebInspector.NetworkDispatcher.prototype.didCloseWebSocket):
+        * inspector/front-end/Resource.js:
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::assignIdentifierToInitialRequest):
+        (WebCore::ResourceLoadNotifier::dispatchWillSendRequest):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::createResourceHandle):
+
+2011-03-11  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        JNIType is not specific to JNI so should be renamed
+        https://bugs.webkit.org/show_bug.cgi?id=56197
+
+        This patch renames JNIType to JavaType, renames the values of
+        the enum, and moves it out of JNIUtility.h to its own file.
+        Also renames the corresponding JavaField and JavaMethod getters.
+
+        No new tests, refactoring only.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bridge/jni/JNIUtility.cpp:
+        (JSC::Bindings::javaTypeFromClassName):
+        (JSC::Bindings::signatureFromJavaType):
+        (JSC::Bindings::javaTypeFromPrimitiveType):
+        (JSC::Bindings::getJNIField):
+        (JSC::Bindings::callJNIMethod):
+        * bridge/jni/JNIUtility.h:
+        * bridge/jni/JavaMethod.cpp:
+        (JavaMethod::JavaMethod):
+        (JavaMethod::signature):
+        * bridge/jni/JavaMethod.h:
+        (JSC::Bindings::JavaMethod::returnTypeClassName):
+        (JSC::Bindings::JavaMethod::returnType):
+        * bridge/jni/JavaType.h: Copied from Source/WebCore/bridge/jni/JavaMethod.h.
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::toString):
+        * bridge/jni/jni_objc.mm:
+        (JSC::Bindings::dispatchJNICall):
+        * bridge/jni/jsc/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertArrayInstanceToJavaArray):
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jsc/JNIUtilityPrivate.h:
+        * bridge/jni/jsc/JavaArrayJSC.cpp:
+        (JavaArray::setValueAt):
+        (JavaArray::valueAt):
+        * bridge/jni/jsc/JavaClassJSC.cpp:
+        * bridge/jni/jsc/JavaFieldJSC.cpp:
+        (JavaField::JavaField):
+        (JavaField::dispatchValueFromInstance):
+        (JavaField::valueFromInstance):
+        (JavaField::dispatchSetValueToInstance):
+        (JavaField::setValueToInstance):
+        * bridge/jni/jsc/JavaFieldJSC.h:
+        (JSC::Bindings::JavaField::typeClassName):
+        (JSC::Bindings::JavaField::type):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/v8/JNIUtilityPrivate.cpp:
+        (JSC::Bindings::convertNPVariantToJValue):
+        (JSC::Bindings::convertJValueToNPVariant):
+        * bridge/jni/v8/JNIUtilityPrivate.h:
+        * bridge/jni/v8/JavaFieldV8.cpp:
+        (JavaField::JavaField):
+        * bridge/jni/v8/JavaFieldV8.h:
+        (JSC::Bindings::JavaField::typeClassName):
+        (JSC::Bindings::JavaField::type):
+        * bridge/jni/v8/JavaInstanceV8.cpp:
+        (JavaInstance::invokeMethod):
+        (JavaInstance::getField):
+        * bridge/jni/v8/JavaNPObjectV8.cpp:
+        (JSC::Bindings::JavaNPObjectInvoke):
+        (JSC::Bindings::JavaNPObjectGetProperty):
+
+2011-03-24  Ojan Vafai  <ojan@chromium.org>
+
+        Was being a little braindead when I committed this.
+        Only simple selectors are allowed, but sibling selectors
+        are sibling selectors.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::collectFeaturesFromList):
+
+2011-03-23  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Kent Tamura.
+
+        Spellcheck feature specific symbols should be defined.
+        https://bugs.webkit.org/show_bug.cgi?id=56818
+        
+        * Introduced USE(UNIFIED_TEXT_CHECKING), USE(GRAMMAR_CHECKING) and USE(AUTOMATIC_TEXT_REPLACEMENT)
+        * Replaced a part of of BUILDING_ON_* conditionals with them.
+
+        Note that small amount of code path on Editor.cpp is now compiled under USE(GRAMMAR_CHECKING)
+        because these code path is already built under non-Mac ports and
+        Keeping them buildable for such platforms reduces the build breakage risk.
+        These path is guarded by Settings thus should never get reached.
+
+        No new tests. No behavioral change.
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/Editor.cpp:
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::Editor::isSelectionUngrammatical):
+        (WebCore::Editor::guessesForUngrammaticalSelection):
+        (WebCore::Editor::guessesForMisspelledOrUngrammaticalSelection):
+        (WebCore::Editor::markMisspellingsAfterTypingToWord):
+        (WebCore::Editor::markMisspellingsOrBadGrammar):
+        (WebCore::Editor::markBadGrammar):
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        (WebCore::Editor::changeBackToReplacedString):
+        (WebCore::Editor::markMisspellingsAndBadGrammar):
+        * editing/Editor.h:
+        * editing/TextCheckingHelper.cpp:
+        (WebCore::TextCheckingHelper::findFirstMisspellingOrBadGrammar):
+        (WebCore::TextCheckingHelper::findFirstGrammarDetail):
+        (WebCore::TextCheckingHelper::findFirstBadGrammar):
+        (WebCore::TextCheckingHelper::isUngrammatical):
+        (WebCore::TextCheckingHelper::guessesForMisspelledOrUngrammaticalRange):
+        (WebCore::TextCheckingHelper::markAllBadGrammar):
+        * loader/EmptyClients.h:
+        * platform/text/TextCheckerClient.h:
+        * platform/text/TextChecking.h: Added.
+
+2011-03-23  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Force to make validation bubble DIV position:absolute
+        https://bugs.webkit.org/show_bug.cgi?id=56901
+
+        Test: fast/forms/interactive-validation-crash-by-style-override.html
+
+        * html/ValidationMessage.cpp:
+        (WebCore::ValidationMessage::buildBubbleTree): Add position:absolute
+          because we need to move the validation message to a good position.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::addChild):
+
+2011-03-23  Mike Lawther  <mikelawther@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        flex/bison tokens and grammar for CSS calc
+        https://bugs.webkit.org/show_bug.cgi?id=54412
+
+        Tests: css3/calc/calc-errors.html
+               css3/calc/minmax-errors.html
+               css3/calc/simple-calcs.html
+               css3/calc/simple-minmax.html
+
+        * css/CSSGrammar.y:
+        * css/CSSParserValues.cpp:
+        (WebCore::CSSParserValueList::insertValueAt):
+        (WebCore::CSSParserValueList::extend):
+        * css/CSSParserValues.h:
+        * css/tokenizer.flex:
+
+2011-03-23  Adam Klein  <adamk@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix resolveLocalFileSystemURL (and sync version) error codes to match the spec
+        https://bugs.webkit.org/show_bug.cgi?id=56961
+
+        See error code listing in the Files & Directories spec:
+        http://dev.w3.org/2009/dap/file-system/file-dir-sys.html#widl-LocalFileSystemSync-resolveLocalFileSystemSyncURL
+
+        Note that the spec currently only specifies errors for the sync
+        version; I've used the same codes for the async version.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::resolveLocalFileSystemURL):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::resolveLocalFileSystemURL):
+        (WebCore::WorkerContext::resolveLocalFileSystemSyncURL):
+
+2011-03-23  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Hook up new AppKit autocorrection UI with WK2.
+        https://bugs.webkit.org/show_bug.cgi?id=56055
+        <rdar://problem/8947463>
+
+        This patch is to enable WK2 to utilize autocorrection UI on Mac OS X. It contains following
+        major changes:
+
+        1. All but one autocorrection related message is synchronous. Since dismissing autocorrection
+        panel can potentially cause editing to occur, a synchronous dismissCorrectionPanelSoon() function
+        is introduced to ensure all editing commands occur in correct order.
+
+        2. Additional condition variable is needed to implement dismissCorrectionPanelSoon().
+        To improve maintainability, CorrectionPanel class is introduced to manage the
+        internal state related to correction panel. This change is applied to both WK1 and WK2.
+
+        3. EditorClient::isShowingCorrectionPanel() has been removed. The original purpose is to allow
+        editor to know when to handle ESC key event. Now this is handled internally in AppKit, so
+        EditorClient::isShowingCorrectionPanel() isn't necessary anymore.
+
+        4. The Editor* argument in EditorClient::showCorrectionPanel() has been removed, since we can
+        access object via WebView or WKView.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsAfterTypingToWord):
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        (WebCore::Editor::correctionPanelTimerFired):
+        (WebCore::Editor::dismissCorrectionPanel):
+        (WebCore::Editor::dismissCorrectionPanelSoon):
+        (WebCore::Editor::applyAutocorrectionBeforeTypingIfAppropriate):
+        * editing/Editor.h:
+        * editing/EditorCommand.cpp:
+        (WebCore::createCommandMap):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyEditorClient::showCorrectionPanel):
+        (WebCore::EmptyEditorClient::dismissCorrectionPanelSoon):
+        * manual-tests/autocorrection/close-window-when-correction-is-shown.html: Added.
+        * page/EditorClient.h:
+
+2011-03-22  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        move :not over to using selectorList instead of simpleSelector
+        https://bugs.webkit.org/show_bug.cgi?id=56894
+
+        Saves memory and simplifies code.
+
+        No new tests since existing tests cover this code.
+
+        * css/CSSGrammar.y:
+        Also removed extranenous calls to updateLastSelectorLineAndPosition in
+        simple_selector_list. These happened to work, but are only actually
+        needed in selector_list.
+        * css/CSSParserValues.h:
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::specificityForOneSelector):
+        Removed null-check. The parser null-checks, I don't see why we need to here.
+        (WebCore::CSSSelector::selectorText):
+        Ditto.
+        (WebCore::CSSSelector::setArgument):
+        (WebCore::CSSSelector::isSimple):
+        * css/CSSSelector.h:
+        * css/CSSSelectorList.cpp:
+        (WebCore::forEachTagSelector):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        (WebCore::collectFeaturesFromSelector):
+        (WebCore::collectFeaturesFromList):
+
+2011-03-23  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        Made sure that renderers displaying counters are invalidated upon
+        counter destruction.
+
+        Assertion and incorrect rendering of counters.
+        https://bugs.webkit.org/show_bug.cgi?id=56896
+
+        Test: fast/css/counters/2displays.html
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::~CounterNode):
+        Added to make sure that its display renderers are always reset when
+        the node is deleted.
+        (WebCore::CounterNode::resetRenderers):
+        Fixed bug that would prevent reset of second and subsequent
+        display renderers.
+        * rendering/CounterNode.h:
+        * rendering/RenderCounter.cpp:
+        (WebCore::destroyCounterNodeWithoutMapRemoval):
+        removed unnecessary calls to resetRenderers() as the CounterNode
+        destructor takes care of that now.
+
+2011-03-23  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        WebKit2: Need API to manage the Media Cache
+        https://bugs.webkit.org/show_bug.cgi?id=56878
+        <rdar://problem/9082503>
+
+        Add functions that need to be exported.
+
+        * WebCore.exp.in:
+
+2011-03-23  Robert Kroeger  <rjkroege@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Correct use of ENABLE() Macro
+
+        In http://trac.webkit.org/changeset/81618, I mis-used the ENABLE()
+        macro. This patch corrects.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56964
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::handleTouchEvent):
+        * page/EventHandler.h:
+
+2011-03-23  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Scrubbing <video> with HTTP Live Stream resizes element to 0x0
+        https://bugs.webkit.org/show_bug.cgi?id=55702
+
+        QTKit will occasionally set the natural size of a QTMovie to 0x0 while scrubbing
+        an HTTP Live Stream.  So we will cache the last valid value returned by QTKit
+        and use that as our naturalSize until a new valid value is returned.
+
+        Unfortunately, QTKit will also fail to generate a notification when the natural size
+        changes, so we are forced to cache the natural size from within naturalSize(), which
+        is a const function, necessitating a const_cast to set m_cachedNaturalSize.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h: Added m_cachedNaturalSize.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateQTKit::MediaPlayerPrivateQTKit): Initialize m_cachedNaturalSize.
+        (WebCore::MediaPlayerPrivateQTKit::naturalSize): 
+
+2011-03-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+        Removed a stray parenthesis.
+
+2011-03-23  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        REGRESSION: Infinite recursion in recursiveCheckLoadComplete()/checkLoadCompleteForThisFrame()/stopLoading()
+        https://bugs.webkit.org/show_bug.cgi?id=56978
+        <rdar://problem/9041670>
+
+        No new tests, because there is no known way to reproduce.
+
+        Removed strange code that was trying to stop a non-loading provisional document loader and
+        even its subframes (?!). Added assertions to catch it if we can actually be loading here in
+        some sense.
+        Rewrote a condition for clarity - starting with r43148, it was acting as an opposite of a
+        recursion guard (but that didn't cause immediate problems then).
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+
+2011-03-23  Brady Eidson  <beidson@apple.com>
+
+        Attempt to fix the build for platforms that have the icon database 
+        disabled but still provide settings API for it...?
+
+        * loader/icon/IconDatabase.h:
+        (WebCore::IconDatabase::defaultDatabaseFilename):
+
+2011-03-23  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * WebCore.exp.in: Export the new version of IconDatabase::open.
+
+2011-03-23  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change IconDatabase opening to allow for arbitrary filenames
+        https://bugs.webkit.org/show_bug.cgi?id=56977
+
+        * WebCore.exp.in:
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        * loader/icon/IconDatabase.h:
+        * loader/icon/IconDatabaseBase.cpp:
+        (WebCore::IconDatabaseBase::open):
+        * loader/icon/IconDatabaseBase.h:
+        * loader/icon/IconDatabaseClient.h:
+
+2011-03-23  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by James Robinson.
+
+        [chromium] WebGLRenderingContext and other DOMWindow properties should remain if WebGL is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=56947
+
+        Removed the RuntimeEnabledFeatures setting for WebGL and the
+        EnabledAtRuntime extended attribute from the WebGL-related
+        properties on the DOMWindow. WebGL support is now controlled
+        exclusively through the page's Settings.
+
+        No new tests; tested manually in Chromium with --disable-webgl
+        command line argument and blacklist.
+
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        * page/DOMWindow.idl:
+
+2011-03-23  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81802.
+        http://trac.webkit.org/changeset/81802
+        https://bugs.webkit.org/show_bug.cgi?id=56963
+
+        Broke a layout test, and this fix is not trivial. (Requested
+        by dhyatt on #webkit).
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleWillChange):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        (WebCore::RenderObject::adjustStyleDifference):
+        (WebCore::RenderObject::setStyle):
+        (WebCore::RenderObject::styleDidChange):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::needsLayout):
+        (WebCore::RenderObject::needsPositionedMovementLayoutOnly):
+        (WebCore::RenderObject::setNeedsLayout):
+        (WebCore::RenderObject::setChildNeedsLayout):
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+
+2011-03-23  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by David Hyatt.
+
+        REGRESSION(81035): crash in RenderDetails::removeChild
+        https://bugs.webkit.org/show_bug.cgi?id=56773
+
+        Test: fast/html/details-children-merge-crash.html
+
+        Preventing merging of RenderDetails's anonymous children.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::canMergeContiguousAnonymousBlocks):
+
+        Fixing RenderDetails::removeChild and cleaning m_marker in RenderDetails::destroy.
+
+        * rendering/RenderDetails.cpp:
+        (WebCore::RenderDetails::destroy):
+        (WebCore::RenderDetails::removeChild):
+
+2011-03-23  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Preserve unicode-bidi:bidi-override in anonymous block.
+        https://bugs.webkit.org/show_bug.cgi?id=21440
+
+        unicode-bidi:bidi-override should be preserved in anonymous block
+        according to http://www.w3.org/TR/CSS21/visuren.html#propdef-unicode-bidi.
+
+        Introduce a helper function RenderStyle()::createAnonymousStyle() which
+        creates a default RenderStyle, inherits the inherited style from parent,
+        and inherit unicode-bidi:bidi-override from parent.
+        And replace the style creation when anonymous block is created.
+
+        Note: the TABLE releated anonymous blocks are untouched, including:
+        TABLE, TABLE_CELL, TABLE_ROW, TABLE_ROW_GROUP anonymous blocks created in
+        RenderObject, RenderTable, RenderTableRow, and RenderTableSection,
+        due to the expected behavior is not clear.
+        Please refer to https://bugs.webkit.org/show_bug.cgi?id=56594.
+        
+        Test: fast/css/bidi-override-in-anonymous-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::RenderBlock::removeChild):
+        (WebCore::RenderBlock::createAnonymousBlock):
+        (WebCore::RenderBlock::createAnonymousColumnsBlock):
+        (WebCore::RenderBlock::createAnonymousColumnSpanBlock):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        * rendering/RenderRubyRun.cpp:
+        (WebCore::RenderRubyRun::createRubyBase):
+        (WebCore::RenderRubyRun::staticCreateRubyRun):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::createAnonymousStyle):
+        * rendering/style/RenderStyle.h:
+
+2011-03-23  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56909
+        
+        Add a simplified normal flow layout path optimization for overflow recomputation
+        and for positioned objects inside relative positioned containers.
+
+        Currently there is an optimized code path for positioned objects, but as soon as
+        we encounter a normal flow object in the containing block chain, we lose the
+        optimization.
+
+        This patch adds a new type of style difference called SimplifiedLayout that is
+        returned when only overflow needs to be recomputed. Whenever opacity changes or
+        a transform changes, this is the hint returned now instead of a full layout.
+        
+        In addition, when positioned objects need layout and start marking up the
+        containing block chain, we now propagate the fact that the layout is simplified
+        all the way up to the root, even when we encounter normal flow containing
+        blocks.
+        
+        The layoutOnlyPositionedObjects function has been renamed to simplifiedLayout()
+        and is now used for all of these cases (in addition to what it handled before).
+        
+        No new tests, since existing tests covered this very well (especially the opacity
+        and transforms repaint tests in fast/repaint).
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::simplifiedNormalFlowLayout):
+        (WebCore::RenderBlock::simplifiedLayout):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleWillChange):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        (WebCore::RenderObject::adjustStyleDifference):
+        (WebCore::RenderObject::setStyle):
+        (WebCore::RenderObject::styleDidChange):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::needsLayout):
+        (WebCore::RenderObject::needsPositionedMovementLayoutOnly):
+        (WebCore::RenderObject::needsSimplifiedNormalFlowLayout):
+        (WebCore::RenderObject::setNeedsLayout):
+        (WebCore::RenderObject::setChildNeedsLayout):
+        (WebCore::RenderObject::setNeedsSimplifiedNormalFlowLayout):
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+
+2011-03-23  Tyler Close  <tjclose@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Fix ambiguous method call in V8 IDL generated code for DOMStringList callback parameter
+        https://bugs.webkit.org/show_bug.cgi?id=56950
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/test/CPP/WebDOMTestCallback.cpp:
+        (WebDOMTestCallback::callbackWithStringList):
+        * bindings/scripts/test/CPP/WebDOMTestCallback.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp:
+        (webkit_dom_test_callback_callback_with_string_list):
+        * bindings/scripts/test/GObject/WebKitDOMTestCallback.h:
+        * bindings/scripts/test/JS/JSTestCallback.cpp:
+        (WebCore::JSTestCallback::callbackWithStringList):
+        * bindings/scripts/test/JS/JSTestCallback.h:
+        * bindings/scripts/test/ObjC/DOMTestCallback.h:
+        * bindings/scripts/test/ObjC/DOMTestCallback.mm:
+        (-[DOMTestCallback callbackWithStringList:]):
+        * bindings/scripts/test/TestCallback.idl:
+        * bindings/scripts/test/V8/V8TestCallback.cpp:
+        (WebCore::V8TestCallback::callbackWithStringList):
+        * bindings/scripts/test/V8/V8TestCallback.h:
+
+2011-03-23  Cris Neckar  <cdn@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add refptr for widget. Mutations can happen within the event handler.
+        https://bugs.webkit.org/show_bug.cgi?id=56774
+
+        Test: plugins/change-widget-and-click-crash.html
+
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::defaultEventHandler):
+
+2011-03-23  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Add combine text cast checks since style property is insufficient
+        in telling object types.
+        https://bugs.webkit.org/show_bug.cgi?id=56358
+
+        Test: fast/text/input-box-text-fragment-combine-text-crash.html
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::computeInlinePreferredLogicalWidths):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::widthFromCache):
+
+2011-03-23  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] "Unwavering" HTML5 game freezes the web page.
+        https://bugs.webkit.org/show_bug.cgi?id=56944
+
+        For canvas's getImageData() API, we don't want to make a deep-copy of
+        the pixels, which is the case on Qt's "raster" graphics system.
+
+        To work around this, we trick QPixmap::toImage() into giving us the
+        QPixmap's backing QImage by temporarily pointing the paint engine to
+        a null paint device.
+
+        * platform/graphics/qt/ImageBufferData.h:
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBufferData::toQImage): Added, returns the
+        ImageBufferData as a QImage, avoiding a backend deep-copy if possible.
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        (WebCore::getImageData):
+
+2011-03-23  Viet-Trung Luu  <viettrungluu@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Add FormatPlainText to WebClipboard::Format enumeration.
+        https://bugs.webkit.org/show_bug.cgi?id=56868
+
+        Chromium's WebClipboard::isFormatAvailable() will be correspondingly
+        extended.
+
+        * platform/chromium/PasteboardPrivate.h: Add corresponding enum entry.
+            This part of the change is inert and should have no effect.
+
+2011-03-23  Tyler Close  <tjclose@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        run-bindings-tests reference files are out of sync with CodeGenerator*.pm
+        https://bugs.webkit.org/show_bug.cgi?id=56934
+
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::JSTestInterfaceConstructor::createStructure):
+        (WebCore::JSTestInterfaceConstructor::JSTestInterfaceConstructor):
+        (WebCore::JSTestInterface::createPrototype):
+        * bindings/scripts/test/JS/JSTestInterface.h:
+        (WebCore::JSTestInterface::createStructure):
+        (WebCore::JSTestInterfacePrototype::createStructure):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
+        (WebCore::JSTestMediaQueryListListenerConstructor::createStructure):
+        (WebCore::JSTestMediaQueryListListenerConstructor::JSTestMediaQueryListListenerConstructor):
+        (WebCore::JSTestMediaQueryListListener::createPrototype):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
+        (WebCore::JSTestMediaQueryListListener::createStructure):
+        (WebCore::JSTestMediaQueryListListenerPrototype::createStructure):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::JSTestObjConstructor::createStructure):
+        (WebCore::JSTestObjConstructor::JSTestObjConstructor):
+        (WebCore::JSTestObj::createPrototype):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore::JSTestObj::createStructure):
+        (WebCore::JSTestObjPrototype::createStructure):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::createStructure):
+        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::JSTestSerializedScriptValueInterfaceConstructor):
+        (WebCore::JSTestSerializedScriptValueInterface::createPrototype):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
+        (WebCore::JSTestSerializedScriptValueInterface::createStructure):
+        (WebCore::JSTestSerializedScriptValueInterfacePrototype::createStructure):
+        * bindings/scripts/test/V8/V8TestCallback.cpp:
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore::V8TestInterface::wrapSlow):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore::V8TestMediaQueryListListener::wrapSlow):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::V8TestObj::wrapSlow):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore::V8TestSerializedScriptValueInterface::wrapSlow):
+
+2011-03-23  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Antonio Gomes.
+
+        Clean up: Rename HTMLFrameSetElement::{noresize, frameborder, and frameBorderSet}
+        to conform to the WebKit Code style guidelines
+        https://bugs.webkit.org/show_bug.cgi?id=56871
+
+        No functionality changed. So, no new tests.
+
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::HTMLFrameSetElement):
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        (WebCore::HTMLFrameSetElement::attach):
+        (WebCore::HTMLFrameSetElement::defaultEventHandler):
+        * html/HTMLFrameSetElement.h:
+        (WebCore::HTMLFrameSetElement::hasFrameBorder):
+        (WebCore::HTMLFrameSetElement::noResize):
+
+2011-03-23  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Replace height with logicalHeight when removing items from
+        gPercentHeightDescendantMap so that it is writing mode aware.
+        https://bugs.webkit.org/show_bug.cgi?id=56902
+
+        Test: fast/block/percent-height-descendant-not-removed-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::destroy):
+        (WebCore::RenderBox::styleDidChange):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+
+2011-03-23  Anders Carlsson  <andersca@apple.com>
+
+        Fix clang build.
+
+        * inspector/DOMNodeHighlighter.cpp:
+        Remove an unused function.
+
+2011-03-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add asynchronous load decision call to WebKit2 IconDatabase
+        https://bugs.webkit.org/show_bug.cgi?id=56887
+
+        Clear the callback when it's made:
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::continueIconLoadWithDecision):
+
+        Don't load icons when using new-style icon database if in private browsing:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::continueIconLoadWithDecision):
+        
+        Enhance the IconDatabase callbacks to have an ID and inherit from a common base:
+        * loader/icon/IconDatabaseBase.h:
+        (WebCore::CallbackBase::~CallbackBase):
+        (WebCore::CallbackBase::callbackID):
+        (WebCore::CallbackBase::CallbackBase):
+        (WebCore::CallbackBase::context):
+        (WebCore::CallbackBase::generateCallbackID):
+        (WebCore::EnumCallback::performCallback):
+        (WebCore::EnumCallback::EnumCallback):
+        (WebCore::ObjectCallback::performCallback):
+        (WebCore::ObjectCallback::ObjectCallback):
+
+2011-03-21  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: move scripts concatenation logic to SourceFile.
+        https://bugs.webkit.org/show_bug.cgi?id=56756
+
+        * inspector/front-end/ScriptsPanel.js:
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.SourceFile.prototype._requestContent):
+        (WebInspector.SourceFile.prototype._loadResourceContent):
+        (WebInspector.SourceFile.prototype._loadAndConcatenateScriptsContent):
+        (WebInspector.SourceFile.prototype._concatenateScriptsContent):
+
+2011-03-23  Leandro Gracia Gil  <leandrogracia@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Media Stream API: add a flag to RuntimeEnabledFeatures.
+        https://bugs.webkit.org/show_bug.cgi?id=56921
+
+        Add a flag to RuntimeEnabledFeatures to check if the Media Stream API is enabled at runtime.
+
+        Tests for the Media Stream API will be provided by the bug 56587.
+
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::mediaStreamEnabled):
+        (WebCore::RuntimeEnabledFeatures::setMediaStreamEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitGetUserMediaEnabled):
+
+2011-03-23  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        Modified RenderCounter::originalText() to correctly attach
+        the created counter to the before/after container even when
+        that is not the RenderCounter's direct parent.
+
+        CSS 2.1 failure: various before-after-* tests fail
+        https://bugs.webkit.org/show_bug.cgi?id=47207
+
+        Test: fast/css/counters/complex-before.html
+
+        * rendering/RenderCounter.cpp:
+        (WebCore::RenderCounter::originalText):
+
+2011-03-23  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Add play / pause button to media control
+        https://bugs.webkit.org/show_bug.cgi?id=55463
+
+        Add play|pause button to media control.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::edjeGroupFromFormType):
+        (WebCore::RenderThemeEfl::emitMediaButtonSignal): Added.
+        (WebCore::RenderThemeEfl::paintMediaPlayButton):
+        * platform/efl/RenderThemeEfl.h:
+
+2011-03-23  Aparna Nandyal  <aparna.nand@wipro.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QtWebKit rendering problem when maximizing and doing a back
+        https://bugs.webkit.org/show_bug.cgi?id=56669
+
+        Contents of the page are not re-sized on going back after
+        maximizing. ContentsResized() is not getting called. Hence old
+        document width and height are used. Corrected this behaviour by 
+        calling setBoundsSize() which calls contentsSize(). 
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+
+2011-03-21  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: add support for formating source files in debugger presentation model.
+        https://bugs.webkit.org/show_bug.cgi?id=56558
+
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.reset):
+        (WebInspector.DebuggerModel.prototype.get scripts):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript):
+        (WebInspector.DebuggerPresentationModel.prototype._refreshBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype.toggleFormatSourceFiles):
+        (WebInspector.DebuggerPresentationModel.prototype.continueToLine):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype._sourceFileForScript):
+        (WebInspector.DebuggerPresentationModel.prototype._reset):
+        * inspector/front-end/ScriptFormatter.js:
+        (WebInspector.ScriptFormatter.prototype.formatContent.didFormatChunks):
+        (WebInspector.ScriptFormatter.prototype.formatContent):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype._toggleFormatSourceFiles):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/SourceFile.js:
+        (WebInspector.SourceFile.prototype.scriptLocationToSourceLocation):
+        (WebInspector.SourceFile.prototype.sourceLocationToScriptLocation):
+        (WebInspector.FormattedSourceFile):
+        (WebInspector.FormattedSourceFile.prototype.scriptLocationToSourceLocation):
+        (WebInspector.FormattedSourceFile.prototype.sourceLocationToScriptLocation):
+        (WebInspector.FormattedSourceFile.prototype._didRequestContent):
+
+2011-03-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: use unsigned char instead of char when storing script source
+        https://bugs.webkit.org/show_bug.cgi?id=56920
+
+        * bindings/v8/DebuggerScript.js:
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ensureDebuggerScriptCompiled):
+        * inspector/InjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::injectedScriptSource):
+        * inspector/InjectedScriptSource.js: whitespace change to trigger compilation
+        * inspector/xxd.pl:
+        * xml/XMLViewer.xsl:
+
+2011-03-23  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: move node searching and node highlight related methods from InspectorAgent to InspectorDOMAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=56912
+
+        The next functions were moved:
+            setSearchingForNode
+            highlightDOMNode
+            hideDOMNodeHighlight
+            highlightFrame
+            hideFrameHighlight
+            mouseDidMoveOverElement
+            handleMousePress
+
+        The code which does real highlight in Graphic context was moved to new files DOMNodeHighlighter.*
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/DOMNodeHighlighter.cpp: Added.
+        (WebCore::DOMNodeHighlighter::DrawNodeHighlight):
+        * inspector/DOMNodeHighlighter.h: Added.
+        * inspector/Inspector.json:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::~InspectorAgent):
+        (WebCore::InspectorAgent::inspectedPageDestroyed):
+        (WebCore::InspectorAgent::disconnectFrontend):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::drawNodeHighlight):
+        (WebCore::InspectorController::hideHighlight):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::~InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::clearFrontend):
+        (WebCore::InspectorDOMAgent::handleMousePress):
+        (WebCore::InspectorDOMAgent::mouseDidMoveOverElement):
+        (WebCore::InspectorDOMAgent::searchingForNodeInPage):
+        (WebCore::InspectorDOMAgent::setSearchingForNode):
+        (WebCore::InspectorDOMAgent::highlight):
+        (WebCore::InspectorDOMAgent::highlightDOMNode):
+        (WebCore::InspectorDOMAgent::highlightFrame):
+        (WebCore::InspectorDOMAgent::hideHighlight):
+        (WebCore::InspectorDOMAgent::drawNodeHighlight):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::hideDOMNodeHighlight):
+        (WebCore::InspectorDOMAgent::hideFrameHighlight):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::mouseDidMoveOverElementImpl):
+        (WebCore::InspectorInstrumentation::handleMousePressImpl):
+        * inspector/InstrumentingAgents.h:
+        (WebCore::InstrumentingAgents::InstrumentingAgents):
+        (WebCore::InstrumentingAgents::inspectorAgent):
+        (WebCore::InstrumentingAgents::setInspectorAgent):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.setSearchingForNode):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.FrameTreeElement.prototype.onselect):
+        (WebInspector.FrameTreeElement.prototype.set hovered):
+        * inspector/front-end/inspector.js:
+        (WebInspector.highlightDOMNode):
+
+2011-03-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Rollout r81768 which broke compilation on Win.
+
+        * xml/XMLTreeViewer.cpp:
+        (WebCore::XMLTreeViewer::transformDocumentToTreeView):
+        * xml/XMLViewer.xsl:
+
+2011-03-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: remove unnecessary reinterpret_cast in XMLTreeViewer
+        https://bugs.webkit.org/show_bug.cgi?id=56919
+
+        * xml/XMLTreeViewer.cpp:
+        (WebCore::XMLTreeViewer::transformDocumentToTreeView):
+        * xml/XMLViewer.xsl: whitespace change to trigger compilation.
+
+2011-03-21  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: move content loading logic to a new SourceFile class.
+        https://bugs.webkit.org/show_bug.cgi?id=56748
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.requestSourceFileContent):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript.contentChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptSourceChanged):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        * inspector/front-end/SourceFile.js: Added.
+        (WebInspector.SourceFile):
+        (WebInspector.SourceFile.prototype.addScript):
+        (WebInspector.SourceFile.prototype.requestContent):
+        (WebInspector.SourceFile.prototype.forceLoadContent):
+        (WebInspector.SourceFile.prototype.reload):
+        (WebInspector.SourceFile.prototype._requestContent):
+        (WebInspector.SourceFile.prototype._loadResourceContent):
+        (WebInspector.SourceFile.prototype._loadScriptContent):
+        (WebInspector.SourceFile.prototype._loadAndConcatenateScriptsContent):
+        (WebInspector.SourceFile.prototype._didRequestContent):
+        (WebInspector.SourceFile.prototype._hasPendingResource):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2011-03-23  Pavel Podivilov  <podivilov@chromium.org>
+
+        Unreviewed, fix compilation broken by r81758.
+
+        * xml/XMLTreeViewer.cpp:
+        (WebCore::XMLTreeViewer::transformDocumentToTreeView):
+
+2011-03-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: define array types properly in the Inspector.json
+        https://bugs.webkit.org/show_bug.cgi?id=56915
+
+        * inspector/Inspector.json:
+        * inspector/generate-inspector-idl:
+
+2011-03-23  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Web Inspector: compile DebuggerScript.js into DebuggerScriptSource.h
+        https://bugs.webkit.org/show_bug.cgi?id=56843
+
+        * inspector/front-end/WebKit.qrc:
+
+2011-03-23  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Add a star while editing a source code
+        https://bugs.webkit.org/show_bug.cgi?id=56743
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.setScriptSourceIsBeingEdited):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.setScriptSourceIsBeingEdited):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._startEditing):
+        (WebInspector.SourceFrame.prototype._registerShortcuts):
+        (WebInspector.SourceFrame.prototype._handleSave):
+        (WebInspector.SourceFrame.prototype._handleRevertEditing):
+        (WebInspector.SourceFrameDelegate.prototype.setScriptSourceIsBeingEdited):
+
+2011-03-23  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Scrolling and navigation is not smooth on a script with many long lines
+        https://bugs.webkit.org/show_bug.cgi?id=56559
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorChunkedPanel.prototype._expandChunks):
+        (WebInspector.TextEditorMainPanel.prototype._expandChunks):
+        (WebInspector.TextEditorMainPanel.prototype._highlightDataReady):
+        (WebInspector.TextEditorMainPanel.prototype._schedulePaintLines):
+        (WebInspector.TextEditorMainPanel.prototype._paintScheduledLines):
+        (WebInspector.TextEditorMainPanel.prototype._restorePaintLinesOperationsCredit):
+        (WebInspector.TextEditorMainPanel.prototype._paintLines):
+        (WebInspector.TextEditorMainPanel.prototype._paintLine):
+        (WebInspector.TextEditorMainPanel.prototype._applyDomUpdates):
+
+2011-03-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [V8] Web Inspector: compile DebuggerScript.js into DebuggerScriptSource.h
+        https://bugs.webkit.org/show_bug.cgi?id=56843
+
+        DebuggerScript.js is now translated into a char[] array before inspector compilation.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::ensureDebuggerScriptCompiled):
+        * bindings/v8/ScriptDebugServer.h:
+        * inspector/InjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::injectedScriptSource):
+        * inspector/InjectedScriptSource.js: whitespace change to trigger InjectedScriptSource.h generation.
+        * inspector/xxd.pl:
+
+2011-03-23  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 32-bit build.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::initializeNewContext):
+
+2011-03-22  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Ojan Vafai.
+
+        [chromium] skia image encoders should use <wtf/Vector.h>
+        https://bugs.webkit.org/show_bug.cgi?id=56893
+
+        No new tests. Covered by existing canvas.toDataURL tests.
+
+        * platform/image-encoders/skia/JPEGImageEncoder.h:
+        * platform/image-encoders/skia/PNGImageEncoder.h:
+
+2011-03-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Move the cellWidthChanged bit out of RenderObject and back down into RenderTableCell in order to
+        free up a bit for another performance optimization I have planned.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::setHasColumns):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::RenderTableCell):
+        * rendering/RenderTableCell.h:
+        (WebCore::RenderTableCell::cellWidthChanged):
+        (WebCore::RenderTableCell::setCellWidthChanged):
+
+2011-03-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56892
+        
+        Adding floats to an empty block is O(n^2). 
+
+        If you just add floats back to back to an empty block, the addition is essentially O(n^2)
+        once the floats move below your current line position.  This is because we repeatedly ask for the
+        available width for the line from scratch every time we add a float, regardless of whether the
+        float even vertically intersected our current line position.
+        
+        Change positionNewFloatOnLine to update left and right line offsets intelligently and to only
+        do it based off the single new float that just got added.
+        
+        This fix cuts the IE MazeSolver time in half.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionNewFloatOnLine):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-03-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=56890 It is possible to calculate a 
+        NaN value for "value" in ScrollbarThemeMac::paint()
+        -and corresponding-
+        <rdar://problem/9160621>
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+
+2011-03-17  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        webkit should implement -moz-any selector (as -webkit-any obviously)
+        https://bugs.webkit.org/show_bug.cgi?id=38095
+
+        For now, match the Mozilla implementation with respect to specificity
+        and only allowing simple selectors. Both of these are likely to change
+        pending discussion on www-style@. 
+
+        Tests: fast/css/pseudo-any.html
+               fast/dom/SelectorAPI/unknown-pseudo.html
+
+        * css/CSSGrammar.y:
+        Create simple_selector_list. This is exactly like selector_list
+        except it only allows simple selectors and creates a new vector
+        instead of a reusable one since there can be multiple in one rule.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::~CSSParser):
+        (WebCore::CSSParser::lex):
+        (WebCore::CSSParser::createFloatingSelectorVector):
+        (WebCore::CSSParser::sinkFloatingSelectorVector):
+        * css/CSSParser.h:
+        * css/CSSParserValues.cpp:
+        (WebCore::CSSParserSelector::adoptSelectorVector):
+        * css/CSSParserValues.h:
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::specificityForOneSelector):
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::nameToPseudoTypeMap):
+        (WebCore::CSSSelector::extractPseudoType):
+        (WebCore::CSSSelector::selectorText):
+        (WebCore::CSSSelector::setSelectorList):
+        (WebCore::CSSSelector::RareData::RareData):
+        (WebCore::CSSSelector::RareData::~RareData):
+        These need to be moved into the cpp file so that we can
+        have an OwnPtr<CSSSelectorList> in CSSSelector::RareData.
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::selectorList):
+        * css/CSSSelectorList.cpp:
+        (WebCore::forEachTagSelector):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        (WebCore::collectFeaturesFromSelector):
+        * css/tokenizer.flex:
+
+2011-03-22  John Bauman  <jbauman@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Add support for preserveDrawingBuffer context creation attribute
+        https://bugs.webkit.org/show_bug.cgi?id=56431
+
+        For the accelerated compositing case, only prepare the texture if it
+        has been updated since the last composite. For the non-accelerated case, make sure to
+        grab a copy of the image buffer and paint from that if the backbuffer
+        would be cleared.
+
+        In both cases, make sure to clear the context's backbuffer before the
+        first operation that uses it.
+
+        No new tests. It seems to be difficult/impossible to trigger an early
+        compositing operation in DumpRenderTree, making this hard to
+        test automatically. However, Chromium and Safari (Mac) have been
+        tested manually on the webgl conformance test for this.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paint):
+        (WebCore::HTMLCanvasElement::makePresentationCopy):
+        (WebCore::HTMLCanvasElement::clearPresentationCopy):
+        * html/HTMLCanvasElement.h:
+        * html/canvas/WebGLContextAttributes.cpp:
+        (WebCore::WebGLContextAttributes::preserveDrawingBuffer):
+        (WebCore::WebGLContextAttributes::setPreserveDrawingBuffer):
+        * html/canvas/WebGLContextAttributes.h:
+        * html/canvas/WebGLContextAttributes.idl:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::initializeNewContext):
+        (WebCore::WebGLRenderingContext::markContextChanged):
+        (WebCore::WebGLRenderingContext::clearIfComposited):
+        (WebCore::WebGLRenderingContext::markLayerComposited):
+        (WebCore::WebGLRenderingContext::paintRenderingResultsToCanvas):
+        (WebCore::WebGLRenderingContext::paintRenderingResultsToImageData):
+        (WebCore::WebGLRenderingContext::clear):
+        (WebCore::WebGLRenderingContext::clearColor):
+        (WebCore::WebGLRenderingContext::clearDepth):
+        (WebCore::WebGLRenderingContext::clearStencil):
+        (WebCore::WebGLRenderingContext::colorMask):
+        (WebCore::WebGLRenderingContext::disable):
+        (WebCore::WebGLRenderingContext::drawArrays):
+        (WebCore::WebGLRenderingContext::drawElements):
+        (WebCore::WebGLRenderingContext::enable):
+        (WebCore::WebGLRenderingContext::readPixels):
+        * html/canvas/WebGLRenderingContext.h:
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::Attributes::Attributes):
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::updateContentsIfDirty):
+        (WebCore::WebGLLayerChromium::textureUpdated):
+        (WebCore::WebGLLayerChromium::setContext):
+        * platform/graphics/chromium/WebGLLayerChromium.h:
+        * platform/graphics/mac/GraphicsContext3DMac.mm
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::GraphicsContext3D::prepareTexture):
+        (WebCore::GraphicsContext3D::activeTexture):
+        (WebCore::GraphicsContext3D::bindTexture):
+        (WebCore::GraphicsContext3D::markContextChanged):
+        (WebCore::GraphicsContext3D::markLayerComposited):
+        (WebCore::GraphicsContext3D::layerComposited):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3D::markLayerComposited):
+        (WebCore::GraphicsContext3D::markContextChanged):
+        (WebCore::GraphicsContext3D::layerComposited):
+
+2011-03-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER.
+        <rdar://problem/8944718> 
+
+        * DerivedSources.make:
+        Remove generation of HeaderDetection.h.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Remove HeaderDetection.h.
+
+        * platform/mac/ScrollAnimatorMac.h:
+        * platform/mac/ScrollAnimatorMac.mm:
+        * platform/mac/ScrollbarThemeMac.h:
+        * platform/mac/ScrollbarThemeMac.mm:
+        Replace use of USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER with USE(WK_SCROLLBAR_PAINTER).
+
+2011-03-22  Victoria Kirst  <vrk@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Properly reset VideoLayerChromium textures after lost renderer context
+        https://bugs.webkit.org/show_bug.cgi?id=56514
+
+        The VideoLayerChromium textures were still mapped to the old
+        renderer's context when LayerRendererChromium was being recreated
+        i.e. when GPU process is killed. This patch allows VideoLayerChromium
+        it recreate textures in the new context when the old renderer is lost.
+        Patch also does a bit of refactoring and code clean-up.
+
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::~VideoLayerChromium):
+        (WebCore::VideoLayerChromium::cleanupResources):
+        (WebCore::VideoLayerChromium::updateContentsIfDirty):
+        (WebCore::VideoLayerChromium::allocateTexturesIfNeeded):
+        (WebCore::VideoLayerChromium::computeVisibleSize):
+        (WebCore::VideoLayerChromium::drawYUV):
+        (WebCore::VideoLayerChromium::drawRGBA):
+        (WebCore::VideoLayerChromium::resetFrameParameters):
+        (WebCore::VideoLayerChromium::saveCurrentFrame):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+
+2011-03-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP build should export the headers needed by WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=56883
+
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+            - Export a couple more headers.
+            - Remove FIXME comments for things we've already fixed.
+
+2011-03-22  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add +[WebApplicationCache getOriginsWithCache]
+        https://bugs.webkit.org/show_bug.cgi?id=56722
+
+        Added test that exercises WebCore API to get origins with application cache.
+
+        Test: http/tests/appcache/origins-with-appcache.html
+
+        * loader/appcache/ApplicationCacheStorage.cpp: 
+        (WebCore::ApplicationCacheStorage::getOriginsWithCache):
+        * loader/appcache/ApplicationCacheStorage.h:
+
+2011-03-22  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        Introduced double linkage between a CounterNode and its display renderer.
+
+        use of freed pointer in WebCore::RenderCounter::originalText()
+        https://bugs.webkit.org/show_bug.cgi?id=56065
+
+        No new tests. This bug could only be reproduced manually by
+        refreshing the page during load at a critical point.
+        See bug attachment for testing.
+
+        * rendering/CounterNode.cpp:
+        Introduced new member "m_owner" to store the renderer that has the
+        style directives that produce the CounterNode.
+        Repurposed m_renderer to reffer to the RenderCounter that shows the
+        CounterNode.
+        (WebCore::CounterNode::CounterNode):
+        Updated member initialization.
+        (WebCore::CounterNode::create):
+        (WebCore::CounterNode::addRenderer):
+        (WebCore::CounterNode::removeRenderer):
+        Introduced to manage the renderer list associated wit this CounterNode.
+        (WebCore::CounterNode::resetRenderers):
+        This is the old resetRenderer. Renamed to take into account that there may be
+        more than one renderer to a CounterNode.
+        (WebCore::CounterNode::resetThisAndDescendantsRenderers):
+        This is the old resetRenderers renamed for clarity.
+        (WebCore::CounterNode::recount):
+        (WebCore::CounterNode::insertAfter):
+        (WebCore::CounterNode::removeChild):
+        No functional changes.
+        (WebCore::showTreeAndMark):
+        Added flushing to ensure that the output is complete.
+        * rendering/CounterNode.h:
+        (WebCore::CounterNode::owner):
+        Renamed from renderer()
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        Fixed comments. No functional changes.
+        (WebCore::RenderCounter::~RenderCounter):
+        Made sure that the CounterNode that this renderers displays is
+        detached from this.
+        (WebCore::RenderCounter::originalText):
+        (WebCore::RenderCounter::invalidate):
+        Changed to maintain the bidirectional relationship with the displayed CounterNode.
+        Also made "invalidate" private as it should be used only by CounterNode.
+        (WebCore::destroyCounterNodeWithoutMapRemoval):
+        (WebCore::RenderCounter::destroyCounterNodes):
+        (WebCore::RenderCounter::destroyCounterNode):
+        (WebCore::updateCounters):
+        No change, just kept code in line with the changes above.
+        (showCounterRendererTree):
+        Added fflush to ensure complete display.
+        * rendering/RenderCounter.h:
+        * rendering/RenderObjectChildList.cpp:
+        * rendering/RenderObjectChildList.h:
+        Removed unneeded invalidateCounters related functions.
+
+2011-03-22  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56242
+        Interrupted accelerated animations/transitions were causing
+        subsequent animations to not start (because they were stuck
+        waiting for a response from the compositing layer). I renamed
+        the instance variable that indicates whether or not to
+        notify animations of start time, from m_waitingForStartTimeResponse
+        to m_waitingForAsyncStartNotification, so that it makes more sense.
+        The actual bug fix was changing the logic so that the flag is reset
+        when the list of waiting animations becomes empty. I mistakenly committed
+        the bad logic in r81613.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        - Always set paused time as we enter the paused state
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::endAnimationUpdate):
+        (WebCore::AnimationControllerPrivate::receivedStartTimeResponse):
+        (WebCore::AnimationControllerPrivate::addToAnimationsWaitingForStartTimeResponse):
+        (WebCore::AnimationControllerPrivate::removeFromAnimationsWaitingForStartTimeResponse):
+        - reset the waiting flag when the list is empty (rather than not empty)
+        (WebCore::AnimationControllerPrivate::startTimeResponse):
+        * page/animation/AnimationControllerPrivate.h:
+        - rename m_waitingForStartTimeResponse to m_waitingForAsyncStartNotification
+
+2011-03-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8648311> and https://bugs.webkit.org/show_bug.cgi?id=56876
+        WK2 Icon DB: Expand IconDatabaseClient interface and move it to the main thread
+
+        * loader/icon/IconDatabase.cpp:
+        Add a dummy client implementation for non-Mac, non-Win ports:
+        (WebCore::DefaultIconDatabaseClient::performImport):
+        (WebCore::DefaultIconDatabaseClient::didImportIconURLForPageURL):
+        (WebCore::DefaultIconDatabaseClient::didImportIconDataForPageURL):
+        (WebCore::DefaultIconDatabaseClient::didChangeIconForPageURL):
+        (WebCore::DefaultIconDatabaseClient::didRemoveAllIcons):
+        (WebCore::DefaultIconDatabaseClient::didFinishURLImport):
+        (WebCore::defaultClient):
+
+        Either call the client directly when on the main thread, or use the dispatch functions below
+        if on the background thread:
+        (WebCore::IconDatabase::setIconDataForIconURL):
+        (WebCore::IconDatabase::setIconURLForPageURL):
+        (WebCore::IconDatabase::performURLImport):
+        (WebCore::IconDatabase::readFromDatabase):
+        (WebCore::IconDatabase::removeAllIconsOnThread):
+
+        Add a very targeted WorkItem interface for dispatching client calls on the main thread:
+        (WebCore::ClientWorkItem::ClientWorkItem):
+        (WebCore::ClientWorkItem::~ClientWorkItem):
+        (WebCore::ImportedIconURLForPageURLWorkItem::ImportedIconURLForPageURLWorkItem):
+        (WebCore::ImportedIconURLForPageURLWorkItem::~ImportedIconURLForPageURLWorkItem):
+        (WebCore::ImportedIconURLForPageURLWorkItem::performWork):
+        (WebCore::ImportedIconDataForPageURLWorkItem::ImportedIconDataForPageURLWorkItem):
+        (WebCore::ImportedIconDataForPageURLWorkItem::~ImportedIconDataForPageURLWorkItem):
+        (WebCore::ImportedIconDataForPageURLWorkItem::performWork):
+        (WebCore::RemovedAllIconsWorkItem::RemovedAllIconsWorkItem):
+        (WebCore::RemovedAllIconsWorkItem::performWork):
+        (WebCore::performWorkItem):
+
+        Use the client WorkItem interface to perform these callbacks on the main thread:
+        (WebCore::IconDatabase::dispatchDidImportIconURLForPageURLOnMainThread):
+        (WebCore::IconDatabase::dispatchDidImportIconDataForPageURLOnMainThread):
+        (WebCore::IconDatabase::dispatchDidRemoveAllIconsOnMainThread):
+        * loader/icon/IconDatabase.h:
+        * loader/icon/IconDatabaseClient.h:
+
+2011-03-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56869
+        
+        Make horizontal writing mode a bit on RenderObject with a fast inlined method for access. This should be
+        a little faster than having to access the information from the RenderStyle's sub-structure.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::addOverflowFromChildren):
+        (WebCore::RenderBlock::computeOverflow):
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        (WebCore::RenderBlock::setLogicalLeftForChild):
+        (WebCore::RenderBlock::setLogicalTopForChild):
+        (WebCore::RenderBlock::layoutPositionedObjects):
+        (WebCore::RenderBlock::paintColumnRules):
+        (WebCore::RenderBlock::paintColumnContents):
+        (WebCore::RenderBlock::flipFloatForWritingMode):
+        (WebCore::blockDirectionOffset):
+        (WebCore::inlineDirectionOffset):
+        (WebCore::RenderBlock::logicalRectToPhysicalRect):
+        (WebCore::RenderBlock::inlineSelectionGaps):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::addIntrudingFloats):
+        (WebCore::RenderBlock::hitTestColumns):
+        (WebCore::positionForPointRespectingEditingBoundaries):
+        (WebCore::RenderBlock::positionForPointWithInlineChildren):
+        (WebCore::RenderBlock::positionForPoint):
+        (WebCore::RenderBlock::columnRectAt):
+        (WebCore::RenderBlock::adjustPointToColumnContents):
+        (WebCore::RenderBlock::adjustRectForColumns):
+        (WebCore::RenderBlock::flipForWritingModeIncludingColumns):
+        (WebCore::RenderBlock::adjustForColumns):
+        (WebCore::RenderBlock::lastLineBoxBaseline):
+        (WebCore::RenderBlock::nextPageLogicalTop):
+        (WebCore::RenderBlock::adjustForUnsplittableChild):
+        (WebCore::RenderBlock::adjustLinePositionForPagination):
+        (WebCore::RenderBlock::collapsedMarginBeforeForChild):
+        (WebCore::RenderBlock::collapsedMarginAfterForChild):
+        (WebCore::RenderBlock::marginStartForChild):
+        (WebCore::RenderBlock::marginEndForChild):
+        (WebCore::RenderBlock::setMarginStartForChild):
+        (WebCore::RenderBlock::setMarginEndForChild):
+        (WebCore::RenderBlock::marginValuesForChild):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::logicalWidthForChild):
+        (WebCore::RenderBlock::logicalHeightForChild):
+        (WebCore::RenderBlock::logicalTopForChild):
+        (WebCore::RenderBlock::logicalRightOffsetForContent):
+        (WebCore::RenderBlock::logicalLeftOffsetForContent):
+        (WebCore::RenderBlock::logicalTopForFloat):
+        (WebCore::RenderBlock::logicalBottomForFloat):
+        (WebCore::RenderBlock::logicalLeftForFloat):
+        (WebCore::RenderBlock::logicalRightForFloat):
+        (WebCore::RenderBlock::logicalWidthForFloat):
+        (WebCore::RenderBlock::setLogicalTopForFloat):
+        (WebCore::RenderBlock::setLogicalLeftForFloat):
+        (WebCore::RenderBlock::setLogicalHeightForFloat):
+        (WebCore::RenderBlock::setLogicalWidthForFloat):
+        (WebCore::RenderBlock::xPositionForFloatIncludingMargin):
+        (WebCore::RenderBlock::yPositionForFloatIncludingMargin):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::createLineBoxes):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::checkFloatsInCleanLine):
+        (WebCore::setStaticPositions):
+        (WebCore::RenderBlock::findNextLineBreak):
+        (WebCore::RenderBlock::beforeSideVisualOverflowForLine):
+        (WebCore::RenderBlock::afterSideVisualOverflowForLine):
+        (WebCore::RenderBlock::beforeSideLayoutOverflowForLine):
+        (WebCore::RenderBlock::afterSideLayoutOverflowForLine):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::marginStart):
+        (WebCore::RenderBox::marginEnd):
+        (WebCore::RenderBox::setMarginStart):
+        (WebCore::RenderBox::setMarginEnd):
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::logicalScroll):
+        (WebCore::RenderBox::computeLogicalWidth):
+        (WebCore::RenderBox::computeLogicalHeight):
+        (WebCore::RenderBox::availableLogicalHeightUsing):
+        (WebCore::RenderBox::containingBlockLogicalWidthForPositioned):
+        (WebCore::RenderBox::containingBlockLogicalHeightForPositioned):
+        (WebCore::RenderBox::computePositionedLogicalWidth):
+        (WebCore::computeLogicalLeftPositionedOffset):
+        (WebCore::RenderBox::computePositionedLogicalHeight):
+        (WebCore::computeLogicalTopPositionedOffset):
+        (WebCore::RenderBox::computePositionedLogicalWidthReplaced):
+        (WebCore::RenderBox::computePositionedLogicalHeightReplaced):
+        (WebCore::RenderBox::addLayoutOverflow):
+        (WebCore::RenderBox::flipForWritingMode):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::updateBoxModelInfoFromStyle):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        (WebCore::RenderObject::styleWillChange):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isHorizontalWritingMode):
+        (WebCore::RenderObject::setHorizontalWritingMode):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paddingTop):
+        (WebCore::RenderTableCell::paddingBottom):
+        (WebCore::RenderTableCell::paddingLeft):
+        (WebCore::RenderTableCell::paddingRight):
+        (WebCore::RenderTableCell::scrollbarsChanged):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::RootInlineBox):
+        (WebCore::RootInlineBox::lineSelectionGap):
+        (WebCore::RootInlineBox::verticalPositionForBox):
+
+2011-03-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Incorrect rendering of composited element with negative z-index child
+        https://bugs.webkit.org/show_bug.cgi?id=56846
+        
+        When a composited element has a child with negative z-index, we make
+        a separate layer for that element's foreground content. This layer
+        was positioned incorrectly (but the content happened to paint at
+        the right location), resulting in right/bottom clipping.
+        
+        Fix this, remove the little-used graphicsLayerToContentsCoordinates()
+        contentsToGraphicsLayerCoordinates() methods, and optimize incremental
+        repaints in the foreground and mask layers.
+
+        Tests: compositing/geometry/foreground-layer.html
+               compositing/geometry/repaint-foreground-layer.html
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::setNeedsDisplayInRect): Cull repaints
+        which fall outside the layer bounds, so callers don't have to,
+        and to avoid unnecessary layer commits.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): If
+        we have a foreground layer inside a clipping layer, the foreground
+        layer's offset is zero, since the clipping layer is its parent.
+        
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect): Use
+        offsetFromRenderer() directly instead of contentsToGraphicsLayerCoordinates().
+        Also do incremental repaints of the foreground and mask layers.
+        
+        (WebCore::RenderLayerBacking::paintContents): It was incorrect to always
+        use compositedBounds() to compute the painting offset, since that's
+        per-RenderLayerBacking, but a single RenderLayerBacking can have different
+        GraphicsLayers with different offsets (e.g. the foreground layer).
+        Instead, use offsetFromRenderer(), which gives has the correct offset.
+
+        * rendering/RenderLayerBacking.h: Remove unused methods.
+
+2011-03-22  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Use default-output instead of default-input to get hardware sample-rate
+        https://bugs.webkit.org/show_bug.cgi?id=56858
+
+        No new tests since audio API is not yet implemented.
+
+        * platform/audio/mac/AudioDestinationMac.cpp:
+        (WebCore::AudioDestination::hardwareSampleRate):
+
+2011-03-22  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Implement -connection:didReceiveDataArray: NSURLConnection delegate method
+        https://bugs.webkit.org/show_bug.cgi?id=56838
+
+        Add experimental support for the didReceiveDataArray callback on
+        NSURLConnection. A RessourceHandleClient indicates its ability to
+        handle this callback by returning true from supportsDataArray() method.
+        Currently only SubresourceLoader uses this so we get the benefit for
+        CSS, JS and image loads. For other clients we call didReceiveData with
+        the CFData contents as before.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/ResourceLoader.h:
+        * loader/SubresourceLoader.h:
+        (WebCore::SubresourceLoader::supportsDataArray):
+        * loader/cf/SubresourceLoaderCF.cpp: Added.
+        (WebCore::SubresourceLoader::didReceiveDataArray):
+        * loader/mac/ResourceLoaderMac.mm:
+        (WebCore::ResourceLoader::didReceiveDataArray):
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::clear):
+        (WebCore::SharedBuffer::buffer):
+        * platform/SharedBuffer.h:
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::append):
+        (WebCore::SharedBuffer::copyDataArrayAndClear):
+        * platform/network/ResourceHandleClient.h:
+        (WebCore::ResourceHandleClient::supportsDataArray):
+        (WebCore::ResourceHandleClient::didReceiveDataArray):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveDataArray:]):
+
+2011-03-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Make it possible to build JavaScriptCore and WebCore gyp builds outside of Source
+        https://bugs.webkit.org/show_bug.cgi?id=56867
+
+        This should make it possible to build the gyp-generated WebCore.xcodeproj
+        from a WebCore directory outside of Source.
+
+        * gyp/WebCore.gyp:
+        * gyp/run-if-exists.sh: Added.
+        * gyp/update-info-plist.sh: Added.
+
+2011-03-22  Anders Carlsson  <andersca@apple.com>
+
+        Fix WebKit2 build.
+
+        * WebCore.exp.in:
+        Export a symbol needed by WebKit2.
+
+2011-03-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add the remaining steps to WebCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56864
+
+        These steps match the normal build.  After this patch, I believe the
+        WebCore GYP build is complete.
+
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+        * gyp/copy-inspector-resources.sh: Added.
+
+2011-03-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=56856 RenderListBox needs to be 
+        added to Page::scrollableAreaSet()
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::RenderListBox):
+        (WebCore::RenderListBox::~RenderListBox):
+        * rendering/RenderListBox.h:
+        (WebCore::RenderListBox::disconnectFromPage):
+
+2011-03-22  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add high-quality band-limited audio resampling algorithm
+        https://bugs.webkit.org/show_bug.cgi?id=56692
+
+        No new tests since audio API is not yet implemented.
+
+        * platform/audio/SincResampler.cpp: Added.
+        (WebCore::SincResampler::SincResampler):
+        (WebCore::SincResampler::initializeKernel):
+        (WebCore::SincResampler::consumeSource):
+        (WebCore::SincResampler::process):
+        * platform/audio/SincResampler.h: Added.
+
+2011-03-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP build should build without help from normal WebCore build
+        https://bugs.webkit.org/show_bug.cgi?id=56860
+
+        Before this patch, the WebCore GYP build wasn't generating the derived
+        sources quite right because the ENABLE macros were not being
+        communicated to the "Derived Sources" target.
+
+        This patch also adds the "Copy Forwarding and ICU Headers" as well as
+        the "Streamline Inspector Source" steps, which are present in the
+        normal build.  Unlike the normal build, these steps occur in a new
+        target, called "WebCore Support", which is less than aesthetically
+        beautiful.  Hopefully we'll be able to move them into the WebCore
+        target proper in the future, but that will likely require some GYP
+        changes.
+
+        This patch probably could have been broken down into a couple smaller
+        patches, but that doesn't seem necessary.
+
+        * WebCore.gypi:
+            - This file appears to no longer exist.
+        * gyp/WebCore.gyp:
+        * gyp/copy-forwarding-and-icu-headers.sh: Added.
+        * gyp/streamline-inspector-source.sh: Added.
+
+2011-03-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56859
+        
+        Floats in the floating object list occur in the order that they are positioned. This means
+        that for a given vertical offset, the last left object in the list that intersects that offset
+        will be the rightmost float. There is no need to check any previous floats, since they have to be
+        further left than that rightmost float. The same rules hold true for right-aligned floats.
+        
+        Change logicalLeft/RightOffsetForLine to iterate backwards instead of forwards and to stop the moment
+        they encounter a float that intersects the vertical range.
+        
+        This cuts the maze solving time for a 20x20 maze in the IE MazeSolver test in half.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+
+2011-03-22  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Dirk Schulze.
+
+        SVG displacement map should validate channel selections
+        https://bugs.webkit.org/show_bug.cgi?id=56794
+
+        Test: svg/filters/feDisplacementMap-crash-test.xhtml
+
+        * svg/SVGFEDisplacementMapElement.cpp:
+        (WebCore::SVGFEDisplacementMapElement::svgAttributeChanged):
+
+2011-03-22  Huahui Wu  <mediadependent@gmail.com>
+
+        Reviewed by Steve Block.
+
+        [Android] Update PlatformTouchEvent for android so it can pass IDs and states around.
+        https://bugs.webkit.org/show_bug.cgi?id=56763
+
+        No new tests as no new functionality is exposed.
+
+        * platform/PlatformTouchEvent.h:
+        * platform/android/PlatformTouchEventAndroid.cpp:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+
+2011-03-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Implement the CSS3 line-box-contain property. This property provides authors with more control over spacing between lines. For example,
+        you can fix the height of lines and cause all line contents to be ignored. You can make lines fit to glyphs. You can ignore leading and
+        fit to the font size. You can ignore replaced elements, etc.
+
+        Refactor the code in computeLogicalBoxHeights into helper methods on RootInlineBox. verticalPositionForBox moved over to RootInlineBox
+        so that it could be called from RenderBlockLineLayout. ascentAndDescentForBox is the new method that computes the appropriate box
+        height based off the block's line-box-contain value.
+        
+        GlyphOverflow can now have a computeBounds parameter set, in which case glyph bounds will be computed and stored in the overflow struct.
+        
+        RenderInline no longer returns 0 margins in the block direction, since line-box-contain can size around the margin box.
+        
+        Added new tests in fast/block/lineboxcontain
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::createLineBoxContainValue):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSLineBoxContainValue.cpp: Added.
+        (WebCore::CSSLineBoxContainValue::CSSLineBoxContainValue):
+        (WebCore::CSSLineBoxContainValue::cssText):
+        * css/CSSLineBoxContainValue.h: Added.
+        (WebCore::CSSLineBoxContainValue::create):
+        (WebCore::CSSLineBoxContainValue::value):
+        (WebCore::CSSLineBoxContainValue::isCSSLineBoxContainValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseLineBoxContain):
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValue.h:
+        (WebCore::CSSValue::isCSSLineBoxContainValue):
+        * css/CSSValueKeywords.in:
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::width):
+        * platform/graphics/Font.h:
+        (WebCore::GlyphOverflow::GlyphOverflow):
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::floatWidthForSimpleText):
+        * platform/graphics/mac/FontComplexTextMac.cpp:
+        (WebCore::Font::floatWidthForComplexText):
+        * platform/graphics/win/FontWin.cpp:
+        (WebCore::Font::floatWidthForComplexText):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        * rendering/InlineFlowBox.h:
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::marginLeft):
+        (WebCore::RenderInline::marginRight):
+        (WebCore::RenderInline::marginTop):
+        (WebCore::RenderInline::marginBottom):
+        (WebCore::RenderInline::marginBefore):
+        (WebCore::RenderInline::marginAfter):
+        * rendering/RenderInline.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::widthFromCache):
+        (WebCore::RenderText::width):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::alignBoxesInBlockDirection):
+        (WebCore::setAscentAndDescent):
+        (WebCore::RootInlineBox::ascentAndDescentForBox):
+        (WebCore::RootInlineBox::verticalPositionForBox):
+        (WebCore::RootInlineBox::includeLeadingForBox):
+        (WebCore::RootInlineBox::includeFontForBox):
+        (WebCore::RootInlineBox::includeGlyphsForBox):
+        (WebCore::RootInlineBox::includeMarginForBox):
+        (WebCore::RootInlineBox::fitsToGlyphs):
+        (WebCore::RootInlineBox::includesRootLineBoxFontOrLeading):
+        * rendering/RootInlineBox.h:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::lineBoxContain):
+        (WebCore::InheritedFlags::setLineBoxContain):
+        (WebCore::InheritedFlags::initialLineBoxContain):
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+
+2011-03-22  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81653.
+        http://trac.webkit.org/changeset/81653
+        https://bugs.webkit.org/show_bug.cgi?id=56839
+
+        Breaks fast/text/drawBidiText.html on Chromium. (Requested by
+        pfeldman on #webkit).
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground):
+
+2011-03-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Rolling out 81657, 81654, 81651 for breaking tests on chromium.
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/front-end/Database.js:
+        (WebInspector.DatabaseDispatcher.prototype.addDatabase):
+
+2011-03-21  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: [REGRESSION] scripts panel is broken when frontend is reopened.
+        https://bugs.webkit.org/show_bug.cgi?id=56747
+
+        Debugger should be enabled on front-end side to guarantee initialization sequence (resources come before scripts).
+
+        * inspector/Inspector.json:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::showProfilesPanel):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::showAndEnableDebugger):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setFrontend):
+        (WebCore::InspectorDebuggerAgent::clearFrontend):
+        * inspector/InspectorDebuggerAgent.h:
+
+2011-03-22  Jarkko Sakkinen  <jarkko.j.sakkinen@gmail.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] WebGL: renderbufferStorage() fails with internal format GL_RGBA4
+        https://bugs.webkit.org/show_bug.cgi?id=56824
+
+        On desktop OpenGL substitute in renderbufferStorage:
+        - GL_DEPTH24_STENCIL8 for GL_DEPTH_STENCIL
+        - GL_DEPTH_COMPONENT for GL_DEPTH_COMPONENT16
+        - GL_RGBA for GL_RGBA4 and GL_RGBA565
+        - GL_RGB for RGB5_A1.
+
+        Tests: fast/canvas/webgl/uninitialized-test.html
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::renderbufferStorage):
+
+2011-03-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Move volume slider positioning logic to a custom renderer.
+        https://bugs.webkit.org/show_bug.cgi?id=56498
+
+        No functional change, covered by existing tests.
+
+        * html/shadow/MediaControls.cpp:
+        (WebCore::MediaControls::updateVolumeSliderContainer): Removed positioning logic.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::RenderMediaVolumeSliderContainer::RenderMediaVolumeSliderContainer): Added.
+        (WebCore::RenderMediaVolumeSliderContainer::layout): Added.
+        (WebCore::MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement): Removed storing of coordinates.
+        (WebCore::MediaControlVolumeSliderContainerElement::createRenderer): Added.
+        (WebCore::MediaControlVolumeSliderContainerElement::styleForElement): Removed setting of coordinates.
+        * rendering/MediaControlElements.h: Changed corresponding decls.
+
+2011-03-22  Andrew Wason  <rectalogic@rectalogic.com>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] QWebPage with WebGL content crashes when rendering if no QWebView parent
+        https://bugs.webkit.org/show_bug.cgi?id=54138
+
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::getViewportGLWidget):
+         Check if we actually have a QWebPageClient before dereferencing it.
+
+2011-03-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: document DOM domain types and protocol methods.
+        https://bugs.webkit.org/show_bug.cgi?id=56807
+
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::wrapNode):
+        * inspector/InjectedScript.h:
+        * inspector/Inspector.json:
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::descriptionForDOMEvent):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::removeNode):
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._createTooltipForNode.resolvedNode):
+        (WebInspector.ElementsTreeElement.prototype._createTooltipForNode):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.nodeResolved):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject.resolveNode):
+
+2011-03-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Production configuration in GYP isn&apos;t set up correctly
+        https://bugs.webkit.org/show_bug.cgi?id=56786
+
+        Update WebCore.gyp with information mined from WebCore.xcodeproj.
+
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+
+2011-03-22  Ofri Wolfus  <ofri@google.com>
+
+        Reviewed by Eric Seidel.
+
+        RTL: Select elements with a size attribute are always left aligned.
+        https://bugs.webkit.org/show_bug.cgi?id=50928
+
+        Added support for alignment in RenderListBox.
+
+        Test: fast/forms/listbox-bidi-align.html
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground): Add support for alignment and directionality.
+
+2011-03-22  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        Clear autofilled flag when reseting a form
+        In service of https://code.google.com/p/chromium/issues/detail?id=70037
+        https://bugs.webkit.org/show_bug.cgi?id=56802
+
+        Test: fast/forms/reset-autofilled.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::reset): Clear the autofilled flag.
+
+2011-03-22  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: protocol cleanup. DatabaseAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=56815
+
+        see protocol metabug:
+        - All events should use notification wording, not command wording:
+
+        addDatabase was renamed to DatabaseOpened.
+
+        Test: inspector/protocol/database-agent.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/front-end/Database.js:
+        (WebInspector.DatabaseDispatcher.prototype.DatabaseOpened):
+
+2011-03-22  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: protocol cleanup. ConsoleAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=56806
+
+        renamed method: void setConsoleMessagesEnabled(in boolean enabled, out boolean newState); => void enable(out long expiredMessagesCount);
+        new method: disable()
+        deleted method: [event] void consoleMessageExpiredCountUpdate(out unsigned long count); delete it. The counter will be transfered as out argument of enable command.
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::updateRepeatCountInConsole):
+        * inspector/Inspector.json:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::enable):
+        (WebCore::InspectorConsoleAgent::disable):
+        * inspector/InspectorConsoleAgent.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.consoleMessageRepeatCountUpdated):
+        (WebInspector.ConsoleView.prototype.setConsoleMessageExpiredCount):
+        * inspector/front-end/inspector.js:
+
+2011-03-22  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION(r80096): Number type input unexpectedly rounds fractional values
+        https://bugs.webkit.org/show_bug.cgi?id=56367
+
+        Because the default value of the maximum fractional digits of NSNumberFormatter
+        and ICU NumberFormat is 3, the value 0.55555 is rounded to 0.556 in a
+        localized representation. This bug affects only in Mac and Chromium.
+
+        To fix this bug,
+         - Add "maximum fractional digits" parameter to formatLocalizedNumber(), and
+         - NumberInputType::visibleValue uses parseToDoubleForNumberTypeWithDecimalPlaces()
+          instead of parseToDoubleForNumberType().
+
+        No automated tests because the behavior is locale-dependent. This change
+        updates a manual test.
+
+        * html/NumberInputType.cpp:
+        (WebCore::NumberInputType::visibleValue):
+          Use parseToDoubleForNumberTypeWithDecimalPlaces() and passing fractional
+          part length to formatLocalizedNumber().
+        * manual-tests/input-number-localization.html:
+          Update the test to cover this change.
+        * platform/text/LocalizedNumber.h: Add a parameter to formatLocalizedNumber().
+        * platform/text/LocalizedNumberICU.cpp:
+        (WebCore::formatLocalizedNumber): Call setMaximumFractionalDigits().
+        * platform/text/LocalizedNumberNone.cpp:
+        (WebCore::formatLocalizedNumber):
+        * platform/text/mac/LocalizedNumberMac.mm:
+        (WebCore::formatLocalizedNumber): Call setMaximumFractionalDigits().
+
+2011-03-21  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Anonymous blocks need isRenderBlock cast check. Also, need
+        to allow display BOX for flexible boxes.
+        https://bugs.webkit.org/show_bug.cgi?id=56709
+
+        Test: accessibility/anchor-linked-anonymous-block-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::canMergeContiguousAnonymousBlocks): remove specific
+        fix in r81088 which is no longer needed.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isAnonymousBlock): Add isRenderBlock cast
+        check.
+
+2011-03-21  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Revert small change made in r78846 of replacing move with positionLineBox
+        in the adjusting position function for inline box.
+        https://bugs.webkit.org/show_bug.cgi?id=56300
+
+        The change in r78846 caused positioning line boxes during the step of adjusting
+        position for inline box, thereby causing line boxes to be nuked. This happens as
+        part of aligning boxes in block direction in RenderBlock::computeBlockDirectionPositionsForLine.
+        Later on, we do the positioning of line boxes again later in that function. This
+        causes use of removed inline box leading to crash. Also, it is unnecessary to do
+        this twice.
+
+        Tests: fast/inline/inline-box-adjust-position-crash.html
+               fast/inline/inline-box-adjust-position-crash2.html
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::adjustPosition):
+
+2011-03-21  Adam Klein  <adamk@chromium.org>
+
+        Reviewed by David Levin.
+
+        [fileapi] Add URI resolution support to WorkerContext
+        https://bugs.webkit.org/show_bug.cgi?id=55644
+
+        Tests: http/tests/filesystem/workers/resolve-url-sync.html
+               http/tests/filesystem/workers/resolve-url.html
+
+        * fileapi/LocalFileSystem.cpp:
+        (WebCore::LocalFileSystem::readFileSystem):
+        Add support for workers.
+        * fileapi/LocalFileSystem.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::resolveLocalFileSystemURL):
+        (WebCore::WorkerContext::resolveLocalFileSystemSyncURL):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+
+2011-03-21  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        XHR in Workers doesn't set the referrer correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=24683
+
+        Tests: http/tests/xmlhttprequest/workers/referer.html
+               http/tests/xmlhttprequest/workers/shared-worker-referer.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Fill in empty string for the outgoing referrer.
+        (WebCore::DocumentThreadableLoader::create): Added the ability to set the outgoing referrer.
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Ditto.
+        (WebCore::DocumentThreadableLoader::loadRequest): Ditto.
+        * loader/DocumentThreadableLoader.h: Ditto.
+        * loader/ResourceLoadScheduler.cpp:
+        (WebCore::ResourceLoadScheduler::scheduleSubresourceLoad): Ditto.
+        * loader/ResourceLoadScheduler.h: Ditto.
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create): Fixed bug (caught by the test) in last minute change done in previous check-in.
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader): Fill in the outgoing referrer.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge): Plumbing for the outgoing referrer.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader): Plumbing for the outgoing referrer.
+        * loader/WorkerThreadableLoader.h:
+
+2011-03-21  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Do not check the DocumentLoader's request cache policy
+        in determining whether we should force revalidation of a cached
+        subresource. If the main resource received headers telling it not
+        to cache, that policy will be propagated to subresources.
+
+        The previous behavior is left in behind a flag in Settings, since
+        QuickLook depends on it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=38690
+
+        Tests: http/tests/cache/post-redirect-get.php
+               http/tests/cache/post-with-cached-subresources.php
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::subresourceCachePolicy):
+        (WebCore::FrameLoader::loadPostRequest):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setUseQuickLookResourceCachingQuirks):
+        (WebCore::Settings::useQuickLookResourceCachingQuirks):
+
+2011-03-21  Rik Cabanier  <cabanier@adobe.com>
+
+        Reviewed by James Robinson.
+
+        bug 56052: percentages are incorrectly rounded in WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=56052
+
+        test: fast/css/percentage-non-integer.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::pageProperty):
+        * platform/Length.h:
+        (WebCore::Length::Length):
+        (WebCore::Length::operator*=):
+        (WebCore::Length::value):
+        (WebCore::Length::percent):
+        (WebCore::Length::setValue):
+        (WebCore::Length::calcValue):
+        (WebCore::Length::calcMinValue):
+        (WebCore::Length::isUndefined):
+        (WebCore::Length::isZero):
+        (WebCore::Length::isPositive):
+        (WebCore::Length::isNegative):
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        (WebCore::AutoTableLayout::computePreferredLogicalWidths):
+        (WebCore::AutoTableLayout::calcEffectiveLogicalWidth):
+        (WebCore::AutoTableLayout::layout):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+        (WebCore::FixedTableLayout::layout):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addCell):
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/style/BorderData.h:
+        (WebCore::BorderData::hasBorderRadius):
+
+2011-03-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add WebCoreExportFileGenerator to WebCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56778
+
+        This target mirrors the eponymous target from WebCore.xcodeproj.
+
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+        * generate-webcore-export-file-generator.sh: Added.
+
+2011-03-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebCore GYP build shouldn&apos;t crash on startup
+        https://bugs.webkit.org/show_bug.cgi?id=56776
+
+        Debug builds shouldn't define NDEBUG.  This same logic exists in the
+        project.pbxproj file.
+
+        * gyp/WebCore.gyp:
+
+2011-03-21  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Implement glue between DataTransferItems and the pasteboard.
+        https://bugs.webkit.org/show_bug.cgi?id=56330
+
+        Support retrieving clipboard data in a paste through DataTransferItems.
+
+        Test: editing/pasteboard/data-transfer-items.html
+
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::items):
+        * platform/chromium/DataTransferItemChromium.cpp:
+        (WebCore::DataTransferItemChromium::createFromPasteboard):
+        (WebCore::DataTransferItemChromium::create):
+        (WebCore::DataTransferItemChromium::DataTransferItemChromium):
+        (WebCore::DataTransferItemChromium::getAsString):
+        * platform/chromium/DataTransferItemChromium.h:
+        * platform/chromium/DataTransferItemsChromium.cpp:
+        (WebCore::DataTransferItemsChromium::addPasteboardItem):
+        * platform/chromium/DataTransferItemsChromium.h:
+
+2011-03-21  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX: showContextMenu not working in WK2
+        https://bugs.webkit.org/show_bug.cgi?id=56734
+
+        WebKit2 is not able to directly open a context menu because the UI is in the other process.
+        Instead the chrome client should be used. This also means implementing showContextMenu() in WebKit1
+        code.
+        
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityShowContextMenu]):
+
+2011-03-21  Robert Kroeger  <rjkroege@chromium.org>
+
+        Reviewed by Antonio Gomes.
+
+        Add Support to WebCore to optionally call a platform-specific gesture recognizer
+        https://bugs.webkit.org/show_bug.cgi?id=49345
+
+        Added an ability for the EventHandler to invoke an optional platform
+        specific gesture recognizer.
+
+        No tests added because the change should be functionally invisible.
+
+        * WebCore.gypi:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::handleTouchEvent):
+        * page/EventHandler.h:
+        * platform/PlatformGestureRecognizer.cpp: Added.
+        (WebCore::PlatformGestureRecognizer::PlatformGestureRecognizer):
+        (WebCore::PlatformGestureRecognizer::~PlatformGestureRecognizer):
+        (WebCore::PlatformGestureRecognizer::create):
+        * platform/PlatformGestureRecognizer.h: Added.
+
+2011-03-21  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Chris Marrin and Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56325
+        ASSERTION FAILED: paused() in AnimationBase::updateStateMachine()
+
+        AnimationBase had a custom linked-list/self-pointer for keeping
+        track of animations that needed to be notified of style updates
+        and start progress. This caused problems when AnimationBase was
+        destroyed, since the pointer wasn't managed in any way. I replaced
+        these pointers with HashSets and moved the code that removes animations
+        from the sets into AnimationControllerPrivate, where it belongs.
+        CompositeAnimation is also more careful to tell AnimationControllerPrivate
+        when it no longer needs to keep track of waiting animations.
+
+        This should stop the style updates being called on non-active animations
+        (which was the cause of the state machine error here) and should also
+        stop a few of the related flakey test failures and occasional crashes.
+
+        Test: animations/body-removal-crash.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::AnimationBase):
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::~AnimationBase):
+        - Remove the linked-list
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::addToAnimationsWaitingForStyle):
+        (WebCore::AnimationControllerPrivate::removeFromAnimationsWaitingForStyle):
+        (WebCore::AnimationControllerPrivate::styleAvailable):
+        (WebCore::AnimationControllerPrivate::addToAnimationsWaitingForStartTimeResponse):
+        (WebCore::AnimationControllerPrivate::removeFromAnimationsWaitingForStartTimeResponse):
+        (WebCore::AnimationControllerPrivate::startTimeResponse):
+        (WebCore::AnimationControllerPrivate::animationWillBeRemoved):
+        - New method to remove animations from the waiting lists
+        * page/animation/AnimationControllerPrivate.h:
+        - use a HashSet rather than an AnimationBase* pointer.
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::~CompositeAnimation):
+        (WebCore::CompositeAnimation::clearRenderer):
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        - remove the animations and transitions from the lists when we know
+          they are no longer active (rather than waiting for the AnimationBase
+          to do it when destructing)
+
+2011-03-21  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Stop inserting when the parent is removed
+        https://bugs.webkit.org/show_bug.cgi?id=56690
+
+        Tests: fast/dom/insertedIntoDocument-child.html
+               fast/dom/insertedIntoDocument-iframe.html
+               fast/dom/insertedIntoDocument-sibling.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertedIntoDocument):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::insertedIntoDocument):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::insertedIntoDocument):
+
+2011-03-07  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        SubresourceLoader should expose a way to set the outgoing referer/origin
+        https://bugs.webkit.org/show_bug.cgi?id=55903
+
+        No new tests as no new functionality is exposed.
+
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * loader/SubresourceLoader.h:
+
+2011-03-21  Daniel Sievers  <sievers@google.com>
+
+        Reviewed by Simon Fraser.
+
+        [Chromium] Make RenderAsTextBehavior and LayerTreeAsTextBehavior tweakable from the DumpRenderTree commandline
+        https://bugs.webkit.org/show_bug.cgi?id=56139
+
+        * WebCore.exp.in:
+        * WebCore.order:
+        * page/Frame.cpp:
+        (WebCore::Frame::layerTreeAsText):
+        * page/Frame.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::layerTreeAsText):
+        * rendering/RenderLayerCompositor.h:
+
+2011-03-21  Chang Shu  <cshu@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION (r79953): Can't type in MS Outlook 2011
+        https://bugs.webkit.org/show_bug.cgi?id=56665
+
+        r79953 removed the WebView level editablity which is persistent no matter whether
+        underlying document itself is changed and editability gets lost. The resolution is to
+        set this WebView editable value to WebCore. This avoids the callback from WebCore to
+        WebKit which was the main goal in r79953 to improve performance.
+
+        * WebCore.exp.in:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+        * dom/Node.cpp:
+        (WebCore::Node::isContentEditable):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelectionFromNone):
+        * page/DragController.cpp:
+        (WebCore::DragController::operationForLoad):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        * page/Page.h:
+        (WebCore::Page::setEditable):
+        (WebCore::Page::isEditable):
+
+2011-03-21  Eric Uhrhane <ericu@chromium.org>
+
+        Reviewed by David Levin.
+
+        [fileapi/chromium] Fetch platform path using GetMetadata before creating File from FileEntry*
+        https://bugs.webkit.org/show_bug.cgi?id=56704
+
+        * fileapi/DOMFileSystemSync.cpp
+        (DOMFileSystemSync::createFile)
+        (class GetPathHelper): Added, to look up path before creating File.
+        * fileapi/DOMFileSystem.cpp
+        (DOMFileSystem::createFile)
+        (GetPathCallback): Added, to look up path before creating File.
+        * platform/FileMetadata.h
+        (struct FileMetadata): Added new field platformPath.
+
+2011-03-21  Dominic Cooney  <dominicc@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        Establishes a V8 context before executing MediaQueryList callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=56166
+
+        MediaQueryList listener callbacks didn't establish a V8 context
+        before running script, causing crashes on C++-only
+        callstacks (such as user resizing, printing, etc.) I believe this
+        could also be contrived to execute media query list listener
+        callbacks across domain.
+
+        Test: fast/media/media-query-list-callback.html
+
+        * css/MediaQueryListListener.cpp:
+        (WebCore::MediaQueryListListener::queryChanged):
+
+2011-03-21  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Add QNetworkReplyHandler::wasAborted()
+
+        Instead of checking if the ResourceHandle is null everywhere,
+        use a wasAborted() method to make the code readable.
+
+        * platform/network/qt/QNetworkReplyHandler.h:
+        (WebCore::QNetworkReplyHandler::wasAborted):
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::redirect):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::uploadProgress):
+
+2011-03-21  Christian Dywan  <christian@lanedo.com>
+
+        Reviewed by Martin Robinson.
+
+        WebKitIconDatabase may trigger crash in cairoImageSurfaceToGdkPixbuf
+        https://bugs.webkit.org/show_bug.cgi?id=56201
+
+        * platform/graphics/gtk/ImageGtk.cpp: Don't attempt to make a pixbuf
+            if there is no image.
+
+2011-03-21  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] [Stable] AtkHypertext exposes wrong offsets for links placed inside <span> nodes
+        https://bugs.webkit.org/show_bug.cgi?id=56737
+
+        Only consider parent objects not ignoring accessibility.
+
+        * accessibility/gtk/WebKitAccessibleHyperlink.cpp:
+        (webkitAccessibleHyperlinkGetStartIndex): Look for the parent
+        object not ignoring accessibility for the current hyperlink.
+        (webkitAccessibleHyperlinkGetEndIndex): Ditto.
+
+2011-03-21  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Remove handling of QNetworkAccessManager::UnknownOperation
+
+        Now that Qt 4.7 is required we never have to fall back to UnknownOperation.
+        Custom verb requests are using CustomOperation already, so this was dead code.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::start):
+
+2011-03-21  Adam Roben  <aroben@apple.com>
+
+        Fix multiple-definition linker warnings on Windows
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude RenderSVGPath.cpp from the build, since it is
+        already being compiled via RenderingAllInOne.cpp. Let VS have its way with the rest of the
+        file.
+
+2011-03-21  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Clean up QNetworkReplyHandler::release()
+
+        Since QNetworkReplyHandler no longer uses queued connections to
+        the QNetworkReply, it's not necessary to mess with the event
+        queue when releasing a reply.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::abort):
+        (WebCore::QNetworkReplyHandler::release):
+
+2011-03-21  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Inspector does not always show correct transfer size (for compressed/chunked data)
+        https://bugs.webkit.org/show_bug.cgi?id=56691
+
+        Added transfer size support in inspector for compressed data.
+
+        Test: http/tests/inspector/network/network-size-chunked.html
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didReceiveContentLengthImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::didReceiveContentLength):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::didReceiveResponse):
+        (WebCore::InspectorResourceAgent::didReceiveContentLength):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype.didReceiveContentLength):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.get transferSize):
+        (WebInspector.Resource.prototype.increaseTransferSize):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::didReceiveData):
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveContentLength):
+        (WebCore::ResourceLoadNotifier::sendRemainingDelegateMessages):
+        * loader/ResourceLoadNotifier.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveData):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:]):
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::forwardData):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotChunkCallback):
+        * platform/network/win/ResourceHandleWin.cpp:
+        (WebCore::ResourceHandle::onRequestComplete):
+        (WebCore::ResourceHandle::fileLoadTimer):
+
+2011-03-21  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        Reviewed by Dirk Schulze.
+
+        symbol display <use> at wrong scale
+        https://bugs.webkit.org/show_bug.cgi?id=54538
+
+        SVG spec: http://www.w3.org/TR/SVG/struct.html#UseElement
+        Quotation for referenced <symbol>: "If attributes 'width'
+        and/or 'height' are provided on the 'use' element, then
+        these attributes will be transferred to the generated 'svg'."
+        Quotation for referenced <svg>: "If attributes 'width'
+        and/or 'height' are provided on the 'use' element, then
+        these values will override the corresponding attributes
+        on the 'svg' in the generated tree."
+        For above quotations, we should treat 'use' element as referencing
+        'use' element, just like Firefox 3.6 and Opera 11, instead of
+        corrensponding 'use' element.
+
+        Tests: svg/custom/use-transfer-width-height-properties-to-svg.svg
+               svg/custom/use-transfer-width-height-properties-to-svg1.svg
+               svg/custom/use-transfer-width-height-properties-to-svg2.svg
+               svg/custom/use-transfer-width-height-properties-to-symbol.svg
+               svg/custom/use-transfer-width-height-properties-to-symbol1.svg
+               svg/custom/use-transfer-width-height-properties-to-symbol2.svg
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::SVGElementInstance):
+        * svg/SVGElementInstance.h:
+        (WebCore::SVGElementInstance::create):
+        (WebCore::SVGElementInstance::correspondingUseElement):
+        (WebCore::SVGElementInstance::directUseElement):
+        (WebCore::SVGElementInstance::clearUseElements):
+        * svg/SVGUseElement.cpp:
+        (WebCore::updateContainerSize):
+        (WebCore::SVGUseElement::updateContainerSizes):
+        (WebCore::dumpInstanceTree):
+        (WebCore::SVGUseElement::detachInstance):
+        (WebCore::SVGUseElement::buildInstanceTree):
+
+2011-03-21  Jaehun Lim  <ljaehun.lim@samsung.com>
+
+        Reviewed by Pavel Feldman.
+
+        Fix build break when inspector is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=56735
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy): Add ENABLE(INSPECTOR).
+
+2011-03-21  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, GTK distcheck build fix.
+
+        * GNUmakefile.am:
+
+2011-03-21  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 51465 - chrome.dll!WebCore::RenderLayer::currentTransform
+        ReadAV@NULL (8968fc97874fa23b6799ff8f09c142e4)
+
+        Test: fast/css/webkit-empty-transform-preserve3d-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::layoutOverflowRectForPropagation): Mimicked the
+        rest of the code and check that the RenderBox has a layer to avoid
+        crashing on the layer() call.
+
+2011-03-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: move cookie processing and appcache from DOMAgent.js
+        https://bugs.webkit.org/show_bug.cgi?id=56713
+
+        * inspector/front-end/ApplicationCacheItemsView.js:
+        (WebInspector.ApplicationCacheDispatcher):
+        (WebInspector.ApplicationCacheDispatcher.getApplicationCachesAsync):
+        (WebInspector.ApplicationCacheDispatcher.prototype.updateApplicationCacheStatus):
+        (WebInspector.ApplicationCacheDispatcher.prototype.updateNetworkState):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.Cookies.buildCookiesFromString):
+        (WebInspector.Cookies.cookieMatchesResourceURL):
+        (WebInspector.Cookies.cookieDomainMatchesResourceDomain):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype.eventListeners):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype.update):
+
+2011-03-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: migrate Inspector.json to valid JSON types.
+        https://bugs.webkit.org/show_bug.cgi?id=56651
+
+        This change migrates inspector from long to int as
+        dom, storage, database and other id types.
+
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::inspectedNode):
+        (WebCore::InjectedScriptHost::databaseIdImpl):
+        (WebCore::InjectedScriptHost::storageIdImpl):
+        (WebCore::InjectedScriptHost::didCreateWorker):
+        (WebCore::InjectedScriptHost::didDestroyWorker):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptHost.idl:
+        * inspector/Inspector.json:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::highlightDOMNode):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::setDOMBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::removeDOMBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::descriptionForDOMEvent):
+        (WebCore::InspectorBrowserDebuggerAgent::hasBreakpoint):
+        * inspector/InspectorBrowserDebuggerAgent.h:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getStylesForNode):
+        (WebCore::InspectorCSSAgent::getInlineStyleForNode):
+        (WebCore::InspectorCSSAgent::getComputedStyleForNode):
+        (WebCore::InspectorCSSAgent::setPropertyText):
+        (WebCore::InspectorCSSAgent::toggleProperty):
+        (WebCore::InspectorCSSAgent::addRule):
+        (WebCore::InspectorCSSAgent::elementForId):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::count):
+        (WebCore::InspectorConsoleAgent::addInspectedNode):
+        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
+        * inspector/InspectorConsoleAgent.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::bind):
+        (WebCore::InspectorDOMAgent::unbind):
+        (WebCore::InspectorDOMAgent::assertNode):
+        (WebCore::InspectorDOMAgent::assertElement):
+        (WebCore::InspectorDOMAgent::assertHTMLElement):
+        (WebCore::InspectorDOMAgent::nodeToSelectOn):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::nodeForId):
+        (WebCore::InspectorDOMAgent::getChildNodes):
+        (WebCore::InspectorDOMAgent::querySelector):
+        (WebCore::InspectorDOMAgent::querySelectorAll):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::boundNodeId):
+        (WebCore::InspectorDOMAgent::setAttribute):
+        (WebCore::InspectorDOMAgent::removeAttribute):
+        (WebCore::InspectorDOMAgent::removeNode):
+        (WebCore::InspectorDOMAgent::setNodeName):
+        (WebCore::InspectorDOMAgent::getOuterHTML):
+        (WebCore::InspectorDOMAgent::setOuterHTML):
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        (WebCore::InspectorDOMAgent::resolveNode):
+        (WebCore::InspectorDOMAgent::pushNodeToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::loadEventFired):
+        (WebCore::InspectorDOMAgent::didInsertDOMNode):
+        (WebCore::InspectorDOMAgent::didRemoveDOMNode):
+        (WebCore::InspectorDOMAgent::didModifyDOMAttr):
+        (WebCore::InspectorDOMAgent::characterDataModified):
+        (WebCore::InspectorDOMAgent::didInvalidateStyleAttr):
+        (WebCore::InspectorDOMAgent::reportNodesAsSearchResults):
+        (WebCore::InspectorDOMAgent::copyNode):
+        (WebCore::InspectorDOMAgent::pushNodeByPathToFrontend):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageAgent.cpp:
+        (WebCore::InspectorDOMStorageAgent::getDOMStorageEntries):
+        (WebCore::InspectorDOMStorageAgent::setDOMStorageItem):
+        (WebCore::InspectorDOMStorageAgent::removeDOMStorageItem):
+        (WebCore::InspectorDOMStorageAgent::storageId):
+        (WebCore::InspectorDOMStorageAgent::getDOMStorageResourceForId):
+        * inspector/InspectorDOMStorageAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        * inspector/InspectorDOMStorageResource.h:
+        (WebCore::InspectorDOMStorageResource::id):
+        * inspector/InspectorDatabaseAgent.cpp:
+        (WebCore::InspectorDatabaseAgent::getDatabaseTableNames):
+        (WebCore::InspectorDatabaseAgent::executeSQL):
+        (WebCore::InspectorDatabaseAgent::databaseId):
+        (WebCore::InspectorDatabaseAgent::databaseForId):
+        * inspector/InspectorDatabaseAgent.h:
+        * inspector/InspectorDatabaseResource.cpp:
+        * inspector/InspectorDatabaseResource.h:
+        (WebCore::InspectorDatabaseResource::id):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setPauseOnExceptionsState):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::getExactHeapSnapshotNodeRetainedSize):
+        * inspector/InspectorProfilerAgent.h:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::identifierForInitialRequest):
+        (WebCore::InspectorResourceAgent::willSendRequest):
+        (WebCore::InspectorResourceAgent::markResourceAsCached):
+        (WebCore::InspectorResourceAgent::didReceiveResponse):
+        (WebCore::InspectorResourceAgent::didReceiveContentLength):
+        (WebCore::InspectorResourceAgent::didFinishLoading):
+        (WebCore::InspectorResourceAgent::didFailLoading):
+        (WebCore::InspectorResourceAgent::setInitialContent):
+        (WebCore::InspectorResourceAgent::didCreateWebSocket):
+        (WebCore::InspectorResourceAgent::willSendWebSocketHandshakeRequest):
+        (WebCore::InspectorResourceAgent::didReceiveWebSocketHandshakeResponse):
+        (WebCore::InspectorResourceAgent::didCloseWebSocket):
+        * inspector/generate-inspector-idl:
+
+2011-03-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: make frameId in network agent of type string, not unsigned long.
+        https://bugs.webkit.org/show_bug.cgi?id=56708
+
+        * inspector/Inspector.json:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::highlightFrame):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::pointerAsId):
+        (WebCore::buildObjectForDocumentLoader):
+        (WebCore::buildObjectForFrame):
+        (WebCore::InspectorResourceAgent::frameDetachedFromParent):
+        (WebCore::InspectorResourceAgent::frameForId):
+        (WebCore::InspectorResourceAgent::resourceContent):
+        * inspector/InspectorResourceAgent.h:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.addOrUpdateFrame):
+
+2011-03-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: expose object id as string, not JSON struct in the protocol.
+        https://bugs.webkit.org/show_bug.cgi?id=56681
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::inspect):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::V8InjectedScriptHost::inspectCallback):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::evaluateOn):
+        (WebCore::InjectedScript::evaluateOnCallFrame):
+        (WebCore::InjectedScript::getProperties):
+        (WebCore::InjectedScript::nodeForObjectId):
+        (WebCore::InjectedScript::setPropertyValue):
+        (WebCore::InjectedScript::releaseObject):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::inspectImpl):
+        * inspector/InjectedScriptHost.h:
+        * inspector/InjectedScriptManager.cpp:
+        (WebCore::InjectedScriptManager::injectedScriptForObjectId):
+        (WebCore::InjectedScriptManager::releaseObjectGroup):
+        * inspector/InjectedScriptManager.h:
+        * inspector/InjectedScriptSource.js:
+        * inspector/Inspector.json:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::clearConsoleMessages):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::pushNodeToFrontend):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::evaluateOn):
+        (WebCore::InspectorRuntimeAgent::getProperties):
+        (WebCore::InspectorRuntimeAgent::setPropertyValue):
+        (WebCore::InspectorRuntimeAgent::releaseObject):
+        (WebCore::InspectorRuntimeAgent::releaseObjectGroup):
+        * inspector/InspectorRuntimeAgent.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions.evaluatedProperties):
+        (WebInspector.ConsoleView.prototype.completions):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.releaseEvaluationResult):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.js:
+        (WebInspector.inspect):
+
+2011-03-20  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Rename ThreadSafeShared to ThreadSafeRefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=56714
+
+        No new tests. Exposes no new functionality.
+
+        * ForwardingHeaders/wtf/ThreadSafeRefCounted.h: Copied from ForwardingHeaders/wtf/ThreadSafeShared.h.
+        * ForwardingHeaders/wtf/ThreadSafeShared.h: Removed.
+        * bindings/v8/SerializedScriptValue.h:
+        * dom/Document.cpp:
+        * dom/default/PlatformMessagePortChannel.h:
+        * fileapi/FileThread.h:
+        * loader/ThreadableLoaderClientWrapper.h:
+        (WebCore::ThreadableLoaderClientWrapper::create):
+        (WebCore::ThreadableLoaderClientWrapper::clearClient):
+        (WebCore::ThreadableLoaderClientWrapper::done):
+        (WebCore::ThreadableLoaderClientWrapper::didSendData):
+        (WebCore::ThreadableLoaderClientWrapper::didReceiveResponse):
+        (WebCore::ThreadableLoaderClientWrapper::didReceiveData):
+        (WebCore::ThreadableLoaderClientWrapper::didReceiveCachedMetadata):
+        (WebCore::ThreadableLoaderClientWrapper::didFinishLoading):
+        (WebCore::ThreadableLoaderClientWrapper::didFail):
+        (WebCore::ThreadableLoaderClientWrapper::didFailRedirectCheck):
+        (WebCore::ThreadableLoaderClientWrapper::didReceiveAuthenticationCancellation):
+        (WebCore::ThreadableLoaderClientWrapper::ThreadableLoaderClientWrapper):
+        * page/SecurityOrigin.h:
+        * platform/CrossThreadCopier.h:
+        * platform/network/BlobData.h:
+        * platform/network/cf/SocketStreamHandle.h:
+        * storage/AbstractDatabase.h:
+        * storage/DatabaseAuthorizer.h:
+        * storage/DatabaseCallback.h:
+        * storage/DatabaseThread.h:
+        * storage/IDBCallbacks.h:
+        * storage/IDBCursorBackendInterface.h:
+        * storage/IDBDatabaseBackendInterface.h:
+        * storage/IDBFactoryBackendInterface.h:
+        * storage/IDBIndexBackendInterface.h:
+        * storage/IDBKey.h:
+        * storage/IDBKeyRange.h:
+        * storage/IDBObjectStoreBackendInterface.h:
+        * storage/IDBRequest.h:
+        * storage/IDBTransactionBackendInterface.h:
+        * storage/SQLError.h:
+        * storage/SQLResultSet.h:
+        * storage/SQLStatement.h:
+        * storage/SQLStatementCallback.h:
+        * storage/SQLStatementErrorCallback.h:
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCallback.h:
+        * storage/SQLTransactionErrorCallback.h:
+        * websockets/ThreadableWebSocketChannelClientWrapper.h:
+        * workers/DefaultSharedWorkerRepository.cpp:
+
+2011-03-20  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Clean up redirection logic in QNetworkReplyHandler
+        https://bugs.webkit.org/show_bug.cgi?id=56717
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        Use resetState() when constructing QNRH as well.
+
+        (WebCore::QNetworkReplyHandler::resetState):
+        Delete (deferred) the m_reply if one exists (only when redirecting.)
+
+        (WebCore::QNetworkReplyHandler::finish):
+        Return early when redirecting.
+
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::redirect):
+        Move the redirection logic from sendResponseIfNeeded() into a
+        separate redirect() method.
+
+2011-03-19  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Rename ignoreHttpError() to shouldIgnoreHttpError()
+
+        The function doesn't ignore anything, thus it shouldn't have an imperative name.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::shouldIgnoreHttpError):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2011-03-19  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Kill layer violation FIXME in ResourceHandleQt.
+
+        We were including qwebframe_p.h from WebKit/qt for no reason.
+
+        * platform/network/qt/ResourceHandleQt.cpp:
+
+2011-03-19  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Refactor handling of deferred loads
+        https://bugs.webkit.org/show_bug.cgi?id=56715
+
+        Split QNetworkReplyHandler's "load mode" into two parameters
+        instead of trying to fit the deferral mechanism into it.
+
+        Loads are now AsynchronousLoad (default) or SynchronousLoad (for sync XHR.)
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::setLoadingDeferred):
+        (WebCore::QNetworkReplyHandler::resumeDeferredLoad):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::start):
+        (WebCore::QNetworkReplyHandler::resetState):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        (WebCore::ResourceHandle::platformSetDefersLoading):
+
+2011-03-19  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        ApplicationCacheGroup is not obsolete after being deleted via ApplicationCacheStorage::deleteEntriesForOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=56415
+
+        To delete all Application Cache for an origin, we must obsolete all
+        in-memory cache groups for that origin. If a cache group isn't in memory,
+        then it must be deleted from disk. The previous implementation correctly
+        removed on-disk cache groups, but did not mark in-memory cache groups as obsolete.
+        This caused an assertion failure in ApplicationCacheStorage::cacheGroupDestroyed()
+        when the DocumentLoader was destroyed.
+
+        Test: http/tests/appcache/origin-delete.html
+
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::clearStorageID):
+        (WebCore::ApplicationCache::deleteCacheForOrigin):
+        * loader/appcache/ApplicationCache.h:
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::findInMemoryCacheGroup):
+        * loader/appcache/ApplicationCacheStorage.h:
+
+2011-03-19  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Add dummy GeolocationServiceEfl. cpp | h
+        https://bugs.webkit.org/show_bug.cgi?id=56710
+
+        Add dummy GeolocationServiceEfl.cpp | h to platform/efl.
+
+        * CMakeListsEfl.txt:
+        * platform/efl/GeolocationServiceEfl.cpp: Added.
+        (WebCore::GeolocationServiceEfl::create):
+        (WebCore::GeolocationServiceEfl::GeolocationServiceEfl):
+        (WebCore::GeolocationServiceEfl::~GeolocationServiceEfl):
+        (WebCore::GeolocationServiceEfl::startUpdating):
+        (WebCore::GeolocationServiceEfl::stopUpdating):
+        (WebCore::GeolocationServiceEfl::suspend):
+        (WebCore::GeolocationServiceEfl::resume):
+        (WebCore::GeolocationServiceEfl::lastPosition):
+        (WebCore::GeolocationServiceEfl::lastError):
+        * platform/efl/GeolocationServiceEfl.h: Added.
+
+2011-03-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed, rolling out r81551.
+        http://trac.webkit.org/changeset/81551
+        https://bugs.webkit.org/show_bug.cgi?id=55336
+
+        Broke some storage tests on Win32.
+
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::statFile):
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+        (WebCore::fileExists):
+
+2011-03-19  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        [Qt] Remove support for Qt 4.6
+        https://bugs.webkit.org/show_bug.cgi?id=56712
+
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::drawTextCommon):
+        (WebCore::Font::drawSimpleText):
+        (WebCore::Font::floatWidthForSimpleText):
+        (WebCore::Font::offsetForPositionForSimpleText):
+        (WebCore::Font::selectionRectForSimpleText):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::paint):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::getImageData):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::transform):
+        * platform/network/qt/DnsPrefetchHelper.h:
+        (WebCore::DnsPrefetchHelper::DnsPrefetchHelper):
+        (WebCore::DnsPrefetchHelper::lookup):
+        * platform/network/qt/NetworkStateNotifierPrivate.h:
+        * platform/network/qt/NetworkStateNotifierQt.cpp:
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::httpMethod):
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::ResourceRequest::toNetworkRequest):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintMediaSliderTrack):
+
+2011-03-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Use Win32 API to get file information
+        https://bugs.webkit.org/show_bug.cgi?id=55336
+
+        Use GetFileInformationByHandle() in favour over _wstat64(), GetFileSizeEx()
+        and GetFileAttributesEx() so we can share the code with WinCE.
+
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::createFileHandle):
+        (WebCore::getFileInformation):
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+        (WebCore::fileExists):
+
+2011-03-19  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Simplify GObjectEventListener
+        https://bugs.webkit.org/show_bug.cgi?id=56698
+
+        Get rid of special case for DOMWindow, since it's also an
+        EventTarget.
+
+        * bindings/gobject/GObjectEventListener.cpp:
+        (WebCore::GObjectEventListener::GObjectEventListener): remove
+        DOMWindow special casing.
+        (WebCore::GObjectEventListener::~GObjectEventListener): ditto.
+        (WebCore::GObjectEventListener::gobjectDestroyed):
+        * bindings/gobject/GObjectEventListener.h:
+        (WebCore::GObjectEventListener::addEventListener): ditto.
+        (WebCore::GObjectEventListener::removeEventListener): ditto.
+
+2011-03-19  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56195
+        Fix conditional which had an int for one case and a pointer for another.
+        Similar fix as https://bugs.webkit.org/show_bug.cgi?id=56198
+
+        No new tests. Fix compilation on Solaris 10 with Sun Studio C++
+
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::sendSVGLoadEventIfPossible):
+
+2011-03-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Rename WTF::StringHasher methods
+        https://bugs.webkit.org/show_bug.cgi?id=53532
+
+        Rename createHash to computeHash and createBlobHash to hashMemory.
+        Also add a using WTF::StringHasher in the header file.
+
+        * dom/Document.cpp:
+        (WebCore::FormElementKeyHash::hash):
+        * dom/QualifiedName.h:
+        (WebCore::hashComponents):
+        * dom/StyledElement.cpp:
+        (WebCore::MappedAttributeHash::hash):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::urlHostHash):
+        * page/SecurityOriginHash.h:
+        (WebCore::SecurityOriginHash::hash):
+        * platform/LinkHash.cpp:
+        (WebCore::visitedLinkHashInline):
+        * platform/cf/BinaryPropertyList.cpp:
+        (WebCore::IntegerArrayHash::hash):
+        * platform/cf/SchedulePair.h:
+        (WebCore::SchedulePairHash::hash):
+        * platform/graphics/FontCache.cpp:
+        (WebCore::computeHash):
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.h:
+        (WebCore::FontPlatformData::RefCountedHFONT::hash):
+        * platform/graphics/cocoa/FontPlatformData.h:
+        (WebCore::FontPlatformData::hash):
+        * platform/graphics/pango/FontPlatformData.h:
+        (WebCore::FontPlatformData::hash):
+        * platform/graphics/wince/FontPlatformData.cpp:
+        (WebCore::FixedSizeFontDataKeyHash::hash):
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::computeHash):
+        * platform/network/ProtectionSpaceHash.h:
+        (WebCore::ProtectionSpaceHash::hash):
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::hash):
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::hash):
+        * svg/properties/SVGAnimatedPropertyDescription.h:
+        (WebCore::SVGAnimatedPropertyDescriptionHash::hash):
+
+2011-03-18  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/56688> Fix clang static analyzer warning in WebCoreViewFactory.m
+
+        Reviewed by Anders Carlsson.
+
+        Fixes the following static analyzer warning:
+
+            Source/WebCore/page/mac/WebCoreViewFactory.m:45:5: warning: Returning 'self' while it is not set to the result of '[(super or self) init...]'
+                 return self;
+                 ^
+
+        * page/mac/WebCoreViewFactory.m:
+        (-[WebCoreViewFactory init]): Assign the result of [super init]
+        to self.
+
+2011-03-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebCore GYP build should build
+        https://bugs.webkit.org/show_bug.cgi?id=56696
+
+        After this patch, the WebCore GYP build successfully compiles and
+        links.  I haven't trying executing it yet.
+
+        * WebCore.gypi:
+            - DOMMouseEvent should be included as part of the Objective-C bindings.
+        * WebCore.xcodeproj/project.pbxproj:
+            - RenderSVGPath.cpp was mistakenly included directly in the project
+              instead of being built by RenderSVGAllInOne.
+        * gyp/WebCore.gyp:
+            - Exclude some more files from the build.  These files are absent
+              in the normal build.  I didn't see them earlier because the dead
+              code stripping was hiding them.  (They're probably unreferenced.)
+            - Switch to using RenderSVGAllInOne.  I'm not entirely sure if this
+              part of the patch is necessary, but it matches the normal build
+              more closely.
+        * platform/mac/WebCoreObjCExtras.mm:
+            - The normal build passes the -Wdeprecated-declarations flag when
+              compiling this file.  The GYP folks explicitly do not want to add
+              that feature to GYP, and there does not appear to be a way to
+              remove the deprecated call from this file.
+        * rendering/svg/RenderSVGAllInOne.cpp:
+            - Add RenderSVGPath.cpp, which was missing previously.
+
+2011-03-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebCore GYP build should (almost!) link
+        https://bugs.webkit.org/show_bug.cgi?id=56689
+
+        This patch is a grab-bag of small changes to bring the WebCore GYP
+        build down to two link errors or one compile error (take your pick).
+        We might need a GYP change to get this last file to compile, however.
+
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+
+2011-03-16  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Ojan Vafai.
+
+        Add a test for r81266 and fix HTML Editing for fallback contents in object element
+        https://bugs.webkit.org/show_bug.cgi?id=56505
+
+        The bug was caused by canHaveChildrenForEditing's always returning false even when
+        object element used fallback content. Fixed the bug by adding a check.
+
+        Test: editing/editability/ignored-content.html
+
+        * editing/htmlediting.cpp:
+        (WebCore::canHaveChildrenForEditing):
+
+2011-03-18  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION (r80231): Bad cast in HTMLTreeBuilder::processStartTag
+        https://bugs.webkit.org/show_bug.cgi?id=56380
+        
+        Fix two issues with parsing a fragment that has a foreign content
+        element as its context element. The first issue is that the parser will
+        initially be in the InForeignContentMode insertion mode when processing
+        the first tag in the fragment in this case so one call site needs to
+        change from currentElement() to currentNode(). The second issue is that
+        when we changed fragments from using a fake HTML root element to a
+        DocumentFragment we broke checks that assumed the root element was in
+        the HTML namespace. Fix this by claiming that the DocumentFragment is
+        also in the HTML namespace.
+
+        Test: fast/parser/fragment-foreign-content-context.html
+
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLNames::isForeignContentScopeMarker):
+        (WebCore::HTMLElementStack::hasOnlyHTMLElementsInScope):
+        * html/parser/HTMLElementStack.h:
+        (WebCore::isInHTMLNamespace):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken):
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+
+2011-03-18  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        REGRESSION(78846) [chromium] Justified text renders at incorrect offsets on windows
+        https://bugs.webkit.org/show_bug.cgi?id=56629
+
+        Preserves offsets as absolute floating point offsets and rounds to
+        advances at the last possible second.  I can't prove to myself that
+        this is sound but it seems to work on the test cases I've constructed.
+
+        Will probably change the pixel tests on chromium windows given that we
+        were horribly broken before this patch.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+
+2011-03-18  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION(81374, 81384): editing/deleting/5206311-1.html hits assertion on non-Mac platforms
+        https://bugs.webkit.org/show_bug.cgi?id=56599
+
+        Debug build fix.
+
+        * dom/Position.cpp:
+        (WebCore::Position::parentAnchoredEquivalent): If the original position was a position before a node,
+        then we can't necessarily instantiate a position inside the node.
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::toNormalizedRange): Even if s and e were not null, container nodes of s and e
+        could be null. Exit early in those cases as well.
+
+2011-03-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ObjC bindings to the WebCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56671
+
+        It turns out we generate a bunch of ObjC bindings files that we don't
+        actually build.  I've manually synced the list of ObjC derived source
+        files to match the existing list.  This brings us down to 19 link
+        errors.
+
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+
+2011-03-18  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Eric Seidel.
+
+        [CMAKE] Split JSC related configurations from WebCore/CMakeLists.txt
+        https://bugs.webkit.org/show_bug.cgi?id=56624
+
+        No new tests, just splitting jsc related configuration.
+
+        * CMakeLists.txt:
+        * UseJSC.cmake: Added.
+
+2011-03-16  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Implement GPU-accelerated shadows.
+        https://bugs.webkit.org/show_bug.cgi?id=56476
+
+        For hard shadows, we simply offset the CTM and draw in the shadow
+        color.  For soft shadows, we use a separable Gaussian convolution,
+        with a bilinear downsample and Mitchell-Netravali upsample in order to
+        preserve quality.
+
+        * WebCore.gypi:
+        Add BicubicShader and ConvolutionShader to the build.
+        * platform/graphics/chromium/GLES2Canvas.cpp:
+        (WebCore::GLES2Canvas::State::State):
+        Add shadow-related members to the GLES2Canvas::State
+        (WebCore::GLES2Canvas::State::shadowActive):
+        Add a helper function to know if shadows are active.
+        (WebCore::GLES2Canvas::clearRect):
+        (WebCore::GLES2Canvas::scissorClear):
+        Refactor the scissor clearing function out of clearRect().
+        (WebCore::GLES2Canvas::fillPath):
+        Add hook for shadow rendering in paths.  Bind framebuffer at this level.
+        (WebCore::GLES2Canvas::fillRect):
+        Add hook for shadow rendering in rects.  Bind framebuffer at this level.
+        (WebCore::GLES2Canvas::fillRectInternal):
+        Rename fillRect() -> fillRectInternal(), which does bind its vertex 
+        buffer, but does not bind the framebuffer.
+        (WebCore::GLES2Canvas::setShadowColor):
+        (WebCore::GLES2Canvas::setShadowOffset):
+        (WebCore::GLES2Canvas::setShadowBlur):
+        (WebCore::GLES2Canvas::setShadowsIgnoreTransforms):
+        Implement graphicsContext-style setters for shadow parameters.
+        (WebCore::GLES2Canvas::clipPath):
+        Call fillPathInternal(), not fillPath().
+        (WebCore::GLES2Canvas::restore):
+        (WebCore::GLES2Canvas::drawTexturedRect):
+        Bind the framebuffer at this level.  Do not bind vertices here (will
+        be done in drawTexturedQuad).
+        (WebCore::GLES2Canvas::drawTexturedRectTile):
+        drawQuad() -> drawTexturedQuad().
+        (WebCore::GLES2Canvas::convolveRect):
+        Implement one pass of a convolution filter (X or Y).
+        (WebCore::gauss):
+        (WebCore::buildKernel):
+        Some helper functions to build a Gaussian convolution kernel.
+        (WebCore::GLES2Canvas::drawTexturedQuad):
+        Rename drawQuad() -> drawTexturedQuad(), to be more clear.  Do not
+        bind the framebuffer at this level (it will be done higher).
+        (WebCore::GLES2Canvas::drawTexturedQuadMitchell):
+        Implement Mitchell-Netravali bicubic sampling, using BicubicShader.
+        (WebCore::GLES2Canvas::fillPathInternal):
+        Rename fillPath() -> fillPathInternal(), which does use quad vertices,
+        but does not bind the framebuffer or set the compositing mode.
+        (WebCore::GLES2Canvas::flipRect):
+        Implement a helper function to flip a rectangle in Y within the canvas.
+        (WebCore::GLES2Canvas::clearBorders):
+        Implement a helper function to clear an n-pixel border around a rect.
+        (WebCore::GLES2Canvas::beginShadowDraw):
+        Setup before drawing a primitive's shadow:  for hard shadows, just
+        offset the CTM by the shadow offset.  For soft shadows, bind to an
+        offscreen DrawingBuffer.
+        (WebCore::GLES2Canvas::endShadowDraw):
+        Tear-down after drawing a primitive's shadow:  for hard shadows, just
+        restore the CTM.  For soft shadows, downsample (if necessary), then
+        blur in X, blur in Y, upsample if necessary).
+        * platform/graphics/chromium/GLES2Canvas.h:
+        * platform/graphics/gpu/BicubicShader.cpp: Added.
+        (WebCore::BicubicShader::BicubicShader):
+        (WebCore::BicubicShader::create):
+        (WebCore::BicubicShader::use):
+        * platform/graphics/gpu/BicubicShader.h: Added.
+        Implement a bicubic image filtering shader.
+        * platform/graphics/gpu/ConvolutionShader.cpp: Added.
+        (WebCore::ConvolutionShader::ConvolutionShader):
+        (WebCore::ConvolutionShader::create):
+        (WebCore::ConvolutionShader::use):
+        * platform/graphics/gpu/ConvolutionShader.h: Added.
+        Implement a 1-dimensional convolution shader.  In order to minimize
+        texture samples, this shader is parameterized at compile time by the
+        width of the convolution kernel.
+        * platform/graphics/gpu/DrawingBuffer.h:
+        (WebCore::DrawingBuffer::colorBuffer):
+        Add an accessor to retrieve a DrawingBuffer's texture ID.
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::create):
+        (WebCore::SharedGraphicsContext3D::SharedGraphicsContext3D):
+        (WebCore::SharedGraphicsContext3D::useBicubicProgram):
+        (WebCore::SharedGraphicsContext3D::useConvolutionProgram):
+        Create BicubicShader and cMaxKernelWidth ConvolutionShader's (one for
+        each possible kernel width).
+        (WebCore::SharedGraphicsContext3D::getOffscreenBuffer):
+        Implement a simple cache of offscreen DrawingBuffers, integer-indexed.
+        This is done to minimize the VRAM usage:  only 2 buffers are used for
+        all canvases.
+        * platform/graphics/gpu/SharedGraphicsContext3D.h:
+        Add bicubic and convolution shader members, and useXXX() functions.
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        Hook into GraphicsContextSkia's platform shadow setters to set
+        parameters on GLES2Canvas.
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::canAccelerate):
+        Remove shadows (loopers) from the list of things we can't accelerate.
+
+2011-03-18  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove unused method FontFallbackList::fontDataForCharacters()
+        https://bugs.webkit.org/show_bug.cgi?id=56657
+
+        * platform/graphics/Font.h:
+        * platform/graphics/FontFallbackList.cpp:
+        * platform/graphics/FontFallbackList.h:
+
+2011-03-18  Andreas Kling  <kling@webkit.org>
+
+        Reverting accidental changes in r81498.
+
+2011-03-18  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: rename console agent events.
+        https://bugs.webkit.org/show_bug.cgi?id=56646
+
+        addConsoleMessage -> consoleMessage
+        updateConsoleMessageExpiredCount -> consoleMessageExpiredCountUpdate
+        updateConsoleMessageRepeatCount -> consoleMessageRepeatCountUpdate
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        (WebCore::ConsoleMessage::updateRepeatCountInConsole):
+        * inspector/Inspector.json:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.consoleMessage):
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.consoleMessageExpiredCountUpdate):
+        (WebInspector.ConsoleView.prototype._registerConsoleDomainDispatcher.dispatcher.consoleMessageRepeatCountUpdate):
+
+2011-03-18  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81487.
+        http://trac.webkit.org/changeset/81487
+        https://bugs.webkit.org/show_bug.cgi?id=56662
+
+        "Breaks inspector/styles/styles-add-blank-property.html"
+        (Requested by apavlov on #webkit).
+
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getAllStyles):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheet):
+        * inspector/InspectorStyleSheet.h:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.styleSheetCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.allStylesCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged.callback):
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype._onRevert):
+        (WebInspector.CSSStyleSheet):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+
+2011-03-18  Justin Novosad  <junov@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [Chromium] Canvas shadow is not working with drawImage
+        https://bugs.webkit.org/show_bug.cgi?id=55506
+
+        Patch also fixes shadow blur quality and color. 
+        Affects Chromium win/linux. Also fixes the following bugs:
+        https://bugs.webkit.org/show_bug.cgi?id=50112
+        https://bugs.webkit.org/show_bug.cgi?id=51989
+        https://bugs.webkit.org/show_bug.cgi?id=55410
+        No tests were added, impact is already covered by multiple layout tests.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+
+2011-03-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Fix handling of the CSSAgent.setStyleSheetText() results in CSSStyleModel.js
+        https://bugs.webkit.org/show_bug.cgi?id=56310
+
+        Instead of stylesheet ids, CSSAgent.getAllStyleSheets() now returns metainfo objects containing
+        "styleSheetId", "sourceURL", "disabled", and "title" fields. The latter three are not returned
+        by CSSAgent.getStyleSheet() anymore.
+
+        Test: inspector/styles/get-set-stylesheet-text.html
+
+        * inspector/Inspector.json:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getAllStyleSheets):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheet):
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheetInfo):
+        * inspector/InspectorStyleSheet.h:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.styleSheetCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.allStylesCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged.callback):
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype._onRevert):
+        (WebInspector.CSSStyleSheet):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+
+2011-03-18  David Keijser  <keijser@gmail.com> and Xan Lopez <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] On-demand event-listeners for DOM event signals
+        https://bugs.webkit.org/show_bug.cgi?id=49649
+
+        Add explicit EventTarget API to add/remove event listeners instead
+        of using GSignal, which due to internal limitations in glib makes
+        us preemptively add listeners for all event types.
+
+        * bindings/gobject/GObjectEventListener.cpp: add new
+        addEventListener/removeEventListener methods, and small
+        refactoring to store an EventTarget internally instead of a DOM
+        node, which is more generic and can be reused in more cases.
+        * bindings/gobject/GObjectEventListener.h: ditto.
+        * bindings/gobject/WebKitDOMEventTarget.cpp:
+        (webkit_dom_event_target_add_event_listener): new iface method to
+        add an event listener.
+        (webkit_dom_event_target_remove_event_listener): new iface method
+        to remove an event listener.
+        * bindings/gobject/WebKitDOMEventTarget.h: add new iface methods.
+        * bindings/scripts/CodeGeneratorGObject.pm: change code generation
+        accordingly.
+
+2011-03-18  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56425
+        More groundwork for WebKit2 IconDatabase
+
+        -Update the synchronous method names to be prefixed with "synchronous."
+        -Call asynchronous versions of the appropriate methods if the IconDatabase supports them.
+
+        Update icon database calls to be prefixed with "synchronous":
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create):
+        * loader/icon/IconDatabaseBase.h:
+        (WebCore::IconDatabaseBase::synchronousIconDataKnownForIconURL):
+        (WebCore::IconDatabaseBase::synchronousLoadDecisionForIconURL):
+        (WebCore::IconDatabaseBase::synchronousIconForPageURL):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::synchronousIconForPageURL):
+        (WebCore::IconDatabase::readIconForPageURLFromDisk):
+        (WebCore::IconDatabase::synchronousIconURLForPageURL):
+        (WebCore::IconDatabase::synchronousLoadDecisionForIconURL):
+        (WebCore::IconDatabase::synchronousIconDataKnownForIconURL):
+        * loader/icon/IconDatabase.h:
+        * loader/icon/IconDatabaseBase.cpp:
+        (WebCore::IconDatabaseBase::synchronousIconURLForPageURL):
+
+        Add nascent support for an asynchronous icon database mode:
+        * loader/icon/IconDatabaseBase.h:
+        (WebCore::EnumCallback::create):
+        (WebCore::EnumCallback::~EnumCallback):
+        (WebCore::EnumCallback::performCallback):
+        (WebCore::EnumCallback::invalidate):
+        (WebCore::EnumCallback::EnumCallback):
+        (WebCore::ObjectCallback::create):
+        (WebCore::ObjectCallback::~ObjectCallback):
+        (WebCore::ObjectCallback::performCallback):
+        (WebCore::ObjectCallback::invalidate):
+        (WebCore::ObjectCallback::ObjectCallback):
+        (WebCore::IconDatabaseBase::supportsAsynchronousMode):
+        (WebCore::IconDatabaseBase::loadDecisionForIconURL):
+        (WebCore::IconDatabaseBase::iconDataForIconURL):
+
+        Add interfaces to use the asynchronous versions of certain IconDatabase calls:
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::~DocumentLoader):
+        (WebCore::DocumentLoader::iconLoadDecisionAvailable):
+        (WebCore::iconLoadDecisionCallback):
+        (WebCore::DocumentLoader::getIconLoadDecisionForIconURL):
+        (WebCore::DocumentLoader::continueIconLoadWithDecision):
+        (WebCore::iconDataCallback):
+        (WebCore::DocumentLoader::getIconDataForIconURL):
+        * loader/DocumentLoader.h:
+
+        Break "startIconLoader" into two pieces so it can be used from both the synchronous and asynchronous 
+        icon database modes:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::iconLoadDecisionReceived):
+        (WebCore::FrameLoader::startIconLoader):
+        (WebCore::FrameLoader::continueIconLoadWithDecision):
+        * loader/FrameLoader.h:
+
+        * WebCore.exp.in:
+
+2011-03-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: add missing brace to the generated Inspector.idl.
+
+        * inspector/generate-inspector-idl:
+
+2011-03-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: migrate from Inspector.idl to InspectorAPI.json for protocol schema definition meta bug.
+        https://bugs.webkit.org/show_bug.cgi?id=56294
+
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
+        * inspector/Inspector.idl: Removed.
+        * inspector/Inspector.json: Added.
+        * inspector/generate-inspector-idl: Added.
+
+2011-03-18  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: implement inspector session storage.
+        https://bugs.webkit.org/show_bug.cgi?id=56643
+
+        We would like to enable debugger/profiler from frontend side only.
+        However, when user clicks "Start Debugging JavaScript" in Safari, we
+        need to enable debugger when frontend is opened or re-opened for the
+        same page. The idea is to store debugger-enabled setting in session
+        storage and check it on frontend load.
+
+        * inspector/InspectorFrontendClient.h:
+        (WebCore::InspectorFrontendClient::saveSessionSetting):
+        (WebCore::InspectorFrontendClient::loadSessionSetting):
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::saveSessionSetting):
+        (WebCore::InspectorFrontendHost::loadSessionSetting):
+        * inspector/InspectorFrontendHost.h:
+        * inspector/InspectorFrontendHost.idl:
+
+2011-03-18  Jarkko Sakkinen  <jarkko.j.sakkinen@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Enable GraphicsContext3D only when the window surface support OpenGL
+        https://bugs.webkit.org/show_bug.cgi?id=56555
+
+        Allow creation of WebGLRenderingContext in the HTMLCanvasElement
+        only if accelerated compositing is enabled. In GraphicsContext3D,
+        while blitting the surface check that viewport hasn't changed from
+        creation and painter is associated to the viewport.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3DInternal::getViewportGLWidget):
+        (WebCore::GraphicsContext3DInternal::paint):
+
+2011-03-17  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: extract content loading logic from scripts panel.
+        https://bugs.webkit.org/show_bug.cgi?id=55237
+
+        Encapsulate source files creation logic in debugger presentation model
+        to support source mappings in a pluggable way.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.sourceFile):
+        (WebInspector.DebuggerPresentationModel.prototype.requestSourceFileContent.else.didRequestSource):
+        (WebInspector.DebuggerPresentationModel.prototype.requestSourceFileContent):
+        (WebInspector.DebuggerPresentationModel.prototype._parsedScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._failedToParseScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript.else.resourceFinished):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript):
+        (WebInspector.DebuggerPresentationModel.prototype._ensureSourceFileAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._resourceForURL):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptSourceChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._sourceFileAdded):
+        (WebInspector.DebuggerPresentationModel.prototype.breakpointsForSourceFileId):
+        (WebInspector.DebuggerPresentationModel.prototype.findBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointRemoved):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointResolved):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype._actualLocationToSourceLocation):
+        (WebInspector.DebuggerPresentationModel.prototype.reset):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._sourceFileAdded):
+        (WebInspector.ScriptsPanel.prototype._showSourceFrame):
+        (WebInspector.ScriptsPanel.prototype._sourceFileChanged):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.requestContent):
+
+2011-03-18  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: console doesn&apos;t scroll when multiline expression is being evaluated
+        https://bugs.webkit.org/show_bug.cgi?id=56639
+
+        Always scoll in the console when command result is received.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.addMessage):
+
+2011-03-18  Adam Roben  <aroben@apple.com>
+
+        Fix a CFNumber leak seen on the leaks bot
+
+        Reviewed by Gavin Barraclough.
+
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::advanceCurrentStream): Use a RetainPtr to cause the CFNumber we allocate to be
+        released.
+
+2011-03-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add some of the remaining platform/mac files to WebCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56616
+
+        These files used to be hard, but are now magically easy.  76 link errors.
+
+        * gyp/WebCore.gyp:
+
+2011-03-17  Adam Klein  <adamk@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [filesystem] Rename toURI->toURL, resolveLocalFileSystemURI->resolveLocalFileSystemURL
+        https://bugs.webkit.org/show_bug.cgi?id=56502
+
+        * fileapi/Entry.idl:
+        * fileapi/EntryBase.cpp:
+        (WebCore::EntryBase::toURL):
+        * fileapi/EntryBase.h:
+        * fileapi/EntrySync.idl:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::resolveLocalFileSystemURL):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2011-03-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Update CSP directive parser to match spec
+        https://bugs.webkit.org/show_bug.cgi?id=56582
+
+        Brandon updated the CSP spec.  I've updated our implementation to
+        match.  In the process, I found a couple bugs in the spec, which I've
+        sent to the working group.  This patch assumes that the bugs will be
+        fixed in the way I suggested.  If they get fixed a different way, we
+        might need to update the parser again.
+
+        Test: http/tests/security/contentSecurityPolicy/directive-parsing.html
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::isDirectiveNameCharacter):
+        (WebCore::isDirectiveValueCharacter):
+        (WebCore::advanceUntil):
+        (WebCore::ContentSecurityPolicy::parse):
+        (WebCore::ContentSecurityPolicy::parseDirective):
+        * page/ContentSecurityPolicy.h:
+
+2011-03-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP build should have PrivateHeaders
+        https://bugs.webkit.org/show_bug.cgi?id=56604
+
+        I've manually verified that this produces the correct set of
+        PrivateHeaders (modulo the ForwardingHeaders and icu issue).
+        Unforunately, this patch breakes compile slightly, but I'll fix that
+        in a followup patch.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+
+2011-03-17  Victoria Kirst  <vrk@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Video colors have wrong brightness/contrast
+        https://bugs.webkit.org/show_bug.cgi?id=56598
+
+        This patch changes the YUV to RGB color conversion matrix
+        to have brighter whites and darker blacks in accordance to
+        the BT.601 standard.
+
+        * platform/graphics/chromium/ShaderChromium.cpp:
+        (WebCore::FragmentShaderYUVVideo::FragmentShaderYUVVideo):
+        (WebCore::FragmentShaderYUVVideo::init):
+        (WebCore::FragmentShaderYUVVideo::getShaderString):
+        * platform/graphics/chromium/ShaderChromium.h:
+        (WebCore::FragmentShaderYUVVideo::yuvAdjLocation):
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::drawYUV):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+
+2011-03-17  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Adam Barth.
+
+        RequestAnimationFrame callbacks prevent Document from being released on detach
+        https://bugs.webkit.org/show_bug.cgi?id=56607
+
+        * dom/Document.cpp:
+        (WebCore::Document::removedLastRef): Remove RequestAnimationFrame callbacks.
+        (WebCore::Document::detach): Ditto.
+
+2011-03-17  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=56596 Overlay scrollbars sometimes 
+        fail to appear
+        -and corresponding-
+        <rdar://problem/8953779>
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollbarPainterDelegate setUpAnimation:scrollerPainter:part:WebCore::animateAlphaTo:duration:]):
+
+2011-03-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/9052166> Emphasis marks appear over combined text rather than beside it
+        https://bugs.webkit.org/show_bug.cgi?id=56480
+
+        Test: fast/text/emphasis-combined-text.html
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::rotation): Added this helper.
+        (WebCore::InlineTextBox::paint): Paint a single emphasis mark beside the combined text,
+        centered vertically.
+
+2011-03-17  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Blob URL should not be allow to get created from the code running from data URI
+        https://bugs.webkit.org/show_bug.cgi?id=56600
+
+        Test: http/tests/fileapi/create-blob-url-from-data-url.html
+
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::createPublicBlobURL):
+        * fileapi/BlobURL.cpp:
+        (WebCore::BlobURL::createBlobURL):
+        * fileapi/EntryBase.cpp:
+        (WebCore::EntryBase::toURI):
+        * fileapi/FileReaderLoader.cpp:
+        (WebCore::FileReaderLoader::start):
+
+2011-03-17  Jeff Miller  <jeffm@apple.com>
+
+        Use a consistent set of file patterns in the svn:ignore property for all .xcodeproj directories, specifically:
+        
+        *.mode*
+        *.pbxuser
+        *.perspective*
+        project.xcworkspace
+        xcuserdata
+
+        * WebCore.xcodeproj: Modified property svn:ignore.
+        * manual-tests/NPN_Invoke/NPN_Invoke.xcodeproj: Modified property svn:ignore.
+
+2011-03-17  Sam Weinig  <sam@webkit.org>
+
+        Fix Mac build.
+
+        * WebCore.exp.in:
+        Add missing symbol.
+
+2011-03-17  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Adele Peterson and Enrica Casucci.
+
+        Assert that editing does not ignore position's anchorNode if position is an offset in anchor
+        https://bugs.webkit.org/show_bug.cgi?id=56027
+
+        Debug build fix.
+
+        * dom/Element.cpp:
+        (WebCore::Element::updateFocusAppearance): "this" can be an input element so can't always instantiate
+        a position inside the node. Call firstPositionInOrBeforeNode instead.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::positionAvoidingPrecedingNodes): Exit early when a node's content is ignored by editing instead
+        of just when the node is br.
+        * editing/htmlediting.cpp:
+        (WebCore::lastEditablePositionBeforePositionInRoot): The shadow ancestor node is usually an input element
+        so don't instantiate a position inside it. Call firstPositionInOrBeforeNode instead.
+
+2011-03-17  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81369.
+        http://trac.webkit.org/changeset/81369
+        https://bugs.webkit.org/show_bug.cgi?id=56579
+
+        breaks debugger test (Requested by podivilov on #webkit).
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype._parsedScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._failedToParseScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptSourceChanged):
+        (WebInspector.DebuggerPresentationModel.prototype.breakpointsForSourceFileId):
+        (WebInspector.DebuggerPresentationModel.prototype.findBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointRemoved):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointResolved):
+        (WebInspector.DebuggerPresentationModel.prototype._encodeSourceLocation):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype._actualLocationToSourceLocation):
+        (WebInspector.DebuggerPresentationModel.prototype.reset):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._parsedScriptSource):
+        (WebInspector.ScriptsPanel.prototype._failedToParseScriptSource):
+        (WebInspector.ScriptsPanel.prototype._scriptSourceChanged):
+        (WebInspector.ScriptsPanel.prototype._addScript):
+        (WebInspector.ScriptsPanel.prototype._resourceForURL):
+        (WebInspector.ScriptsPanel.prototype._resourceLoadingFinished):
+        (WebInspector.ScriptsPanel.prototype._addOptionToFilesSelectAndShowSourceFrameIfNeeded):
+        (WebInspector.ScriptsPanel.prototype._showSourceFrame):
+        (WebInspector.ScriptsPanel.prototype._recreateSourceFrame):
+        (WebInspector.ScriptsPanel.prototype._sourceFileIdForScript):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.requestContent):
+
+2011-03-17  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Assert that editing does not ignore position's anchorNode if position is an offset in anchor
+        https://bugs.webkit.org/show_bug.cgi?id=56027
+
+        Added the assertion in Position::Position and Position::moveToPosition. This assertion catches
+        places where we instantiate positions inside a node on which editingIgnoresContent returns true.
+
+        Test: editing/execCommand/button.html
+
+        * dom/Position.cpp:
+        (WebCore::Position::Position): Added an assertion.
+        (WebCore::Position::moveToPosition): Ditto.
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::operator Position): Avoid creating a position immediately below
+        a node whose content is ignored by editing. While this does not avoid creation of positions
+        inside ignored contents completely, it works in most cases. Filed the bug 56027 to resolve
+        the underlying problem. Without this change, the assertion hits in existing layout tests.
+        cannot be tested directly.
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Call firstPositionInOrBeforeNode
+        instead of firstPositionInNode because startNode may as well be a br element. Without this change,
+        the assertion hits in existing layout tests.
+        * editing/htmlediting.cpp:
+        (WebCore::canHaveChildrenForEditing): button is editable so content is not ignored. Added a test
+        for this.
+        * editing/visible_units.cpp:
+        (WebCore::previousBoundary): Added a FIXME.
+        (WebCore::startPositionForLine): Because br can also have an inline text box, checking that
+        startBox is an inline text box isn't an adequate to instantiate a position inside startNode.
+        Call startNode->isTextNode() instead. Without this change, the assertion hits in existing layout
+        tests.
+
+2011-03-17  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: extract content loading logic from scripts panel.
+        https://bugs.webkit.org/show_bug.cgi?id=55237
+
+        Encapsulate source files creation logic in debugger presentation model
+        to support source mappings in a pluggable way.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.sourceFile):
+        (WebInspector.DebuggerPresentationModel.prototype.requestSourceFileContent.else.didRequestSource):
+        (WebInspector.DebuggerPresentationModel.prototype.requestSourceFileContent):
+        (WebInspector.DebuggerPresentationModel.prototype._parsedScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._failedToParseScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript.else.resourceFinished):
+        (WebInspector.DebuggerPresentationModel.prototype._addScript):
+        (WebInspector.DebuggerPresentationModel.prototype._ensureSourceFileAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._resourceForURL):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptSourceChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._sourceFileAdded):
+        (WebInspector.DebuggerPresentationModel.prototype.breakpointsForSourceFileId):
+        (WebInspector.DebuggerPresentationModel.prototype.findBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointRemoved):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointResolved):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype._actualLocationToSourceLocation):
+        (WebInspector.DebuggerPresentationModel.prototype.reset):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._sourceFileAdded):
+        (WebInspector.ScriptsPanel.prototype._showSourceFrame):
+        (WebInspector.ScriptsPanel.prototype._sourceFileChanged):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.requestContent):
+
+2011-03-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: add types markup to the IDL, remove Value types from the protocol.
+        https://bugs.webkit.org/show_bug.cgi?id=56562
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::evaluate):
+        (WebCore::InjectedScript::evaluateOn):
+        (WebCore::InjectedScript::evaluateOnCallFrame):
+        (WebCore::InjectedScript::getProperties):
+        (WebCore::InjectedScript::setPropertyValue):
+        (WebCore::InjectedScript::callFrames):
+        (WebCore::InjectedScript::makeCall):
+        (WebCore::InjectedScript::makeObjectCall):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptSource.js:
+        (.):
+        * inspector/Inspector.idl:
+        * inspector/InspectorApplicationCacheAgent.cpp:
+        (WebCore::InspectorApplicationCacheAgent::getApplicationCaches):
+        * inspector/InspectorApplicationCacheAgent.h:
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::getStylesForNode):
+        (WebCore::InspectorCSSAgent::getInlineStyleForNode):
+        (WebCore::InspectorCSSAgent::getComputedStyleForNode):
+        (WebCore::InspectorCSSAgent::getStyleSheet):
+        (WebCore::InspectorCSSAgent::setPropertyText):
+        (WebCore::InspectorCSSAgent::toggleProperty):
+        (WebCore::InspectorCSSAgent::setRuleSelector):
+        (WebCore::InspectorCSSAgent::addRule):
+        * inspector/InspectorCSSAgent.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::resolveNode):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::editScriptSource):
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::currentCallFrames):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::identifierForInitialRequest):
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::evaluate):
+        (WebCore::InspectorRuntimeAgent::evaluateOn):
+        (WebCore::InspectorRuntimeAgent::getProperties):
+        (WebCore::InspectorRuntimeAgent::setPropertyValue):
+        * inspector/InspectorRuntimeAgent.h:
+        * inspector/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::buildInspectorArray):
+        * inspector/ScriptCallStack.h:
+        * inspector/TimelineRecordFactory.cpp:
+        (WebCore::TimelineRecordFactory::createGenericRecord):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkDispatcher.prototype._createResource):
+
+2011-03-17  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81350.
+        http://trac.webkit.org/changeset/81350
+        https://bugs.webkit.org/show_bug.cgi?id=56560
+
+        "Breaks twenty Chromium Webkit Win builder webkit_gpu_tests"
+        (Requested by apavlov on #webkit).
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/GLES2Canvas.cpp:
+        (WebCore::GLES2Canvas::State::State):
+        (WebCore::GLES2Canvas::clearRect):
+        (WebCore::GLES2Canvas::fillPath):
+        (WebCore::GLES2Canvas::fillRect):
+        (WebCore::GLES2Canvas::clipPath):
+        (WebCore::GLES2Canvas::restore):
+        (WebCore::GLES2Canvas::drawTexturedRect):
+        (WebCore::GLES2Canvas::drawTexturedRectTile):
+        (WebCore::GLES2Canvas::drawQuad):
+        * platform/graphics/chromium/GLES2Canvas.h:
+        * platform/graphics/gpu/BicubicShader.cpp: Removed.
+        * platform/graphics/gpu/BicubicShader.h: Removed.
+        * platform/graphics/gpu/ConvolutionShader.cpp: Removed.
+        * platform/graphics/gpu/ConvolutionShader.h: Removed.
+        * platform/graphics/gpu/DrawingBuffer.h:
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::create):
+        (WebCore::SharedGraphicsContext3D::SharedGraphicsContext3D):
+        * platform/graphics/gpu/SharedGraphicsContext3D.h:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::canAccelerate):
+
+2011-03-17  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Clean up Inspector strings.
+        https://bugs.webkit.org/show_bug.cgi?id=56557
+
+        * English.lproj/localizedStrings.js:
+
+2011-03-14  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: refactor event listener breakpoints.
+        https://bugs.webkit.org/show_bug.cgi?id=56305
+
+        - restore event listener breakpoints one by one instead of using setAllBrowserBreakpoints
+        - store event listener breakpoints in a separate separate setting
+        - move presentation-related code from BreakpointManager to EventListenerBreakpointsSidebarPane
+
+        Test: inspector/debugger/event-listener-breakpoints.html
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::setFrontend):
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::setEventListenerBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::removeEventListenerBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::pauseOnNativeEventIfNeeded):
+        (WebCore::InspectorBrowserDebuggerAgent::clear):
+        * inspector/InspectorBrowserDebuggerAgent.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.setEventListenerBreakpoint):
+        (WebInspector.BreakpointManager.prototype.removeEventListenerBreakpoint):
+        (WebInspector.BreakpointManager.prototype.breakpointViewForEventData):
+        (WebInspector.BreakpointManager.prototype._projectChanged):
+        (WebInspector.BreakpointManager.prototype._saveBreakpoints):
+        (WebInspector.BreakpointManager.prototype._validateBreakpoints):
+        (WebInspector.BreakpointManager.prototype._createDOMBreakpointId):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.EventListenerBreakpointsSidebarPane):
+        (WebInspector.EventListenerBreakpointsSidebarPane.eventNameForUI):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._createCategory):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._categoryCheckboxClicked):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._breakpointCheckboxClicked):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._setBreakpoint):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._removeBreakpoint):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._updateCategoryCheckbox):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype.highlightBreakpoint):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype.clearBreakpointHighlight):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._saveBreakpoints):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._restoreBreakpoints):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.prototype.setStatus):
+        (WebInspector.CallStackSidebarPane.prototype._domBreakpointHit):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype._clearInterface):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+
+2011-03-16  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Implement GPU-accelerated shadows.
+        https://bugs.webkit.org/show_bug.cgi?id=56476
+
+        For hard shadows, we simply offset the CTM and draw in the shadow
+        color.  For soft shadows, we use a separable Gaussian convolution,
+        with a bilinear downsample and Mitchell-Netravali upsample in order to
+        preserve quality.
+
+        * WebCore.gypi:
+        Add BicubicShader and ConvolutionShader to the build.
+        * platform/graphics/chromium/GLES2Canvas.cpp:
+        (WebCore::GLES2Canvas::State::State):
+        Add shadow-related members to the GLES2Canvas::State
+        (WebCore::GLES2Canvas::State::shadowActive):
+        Add a helper function to know if shadows are active.
+        (WebCore::GLES2Canvas::clearRect):
+        (WebCore::GLES2Canvas::scissorClear):
+        Refactor the scissor clearing function out of clearRect().
+        (WebCore::GLES2Canvas::fillPath):
+        Add hook for shadow rendering in paths.  Bind framebuffer at this level.
+        (WebCore::GLES2Canvas::fillRect):
+        Add hook for shadow rendering in rects.  Bind framebuffer at this level.
+        (WebCore::GLES2Canvas::fillRectInternal):
+        Rename fillRect() -> fillRectInternal(), which does bind its vertex 
+        buffer, but does not bind the framebuffer.
+        (WebCore::GLES2Canvas::setShadowColor):
+        (WebCore::GLES2Canvas::setShadowOffset):
+        (WebCore::GLES2Canvas::setShadowBlur):
+        (WebCore::GLES2Canvas::setShadowsIgnoreTransforms):
+        Implement graphicsContext-style setters for shadow parameters.
+        (WebCore::GLES2Canvas::clipPath):
+        Call fillPathInternal(), not fillPath().
+        (WebCore::GLES2Canvas::restore):
+        (WebCore::GLES2Canvas::drawTexturedRect):
+        Bind the framebuffer at this level.  Do not bind vertices here (will
+        be done in drawTexturedQuad).
+        (WebCore::GLES2Canvas::drawTexturedRectTile):
+        drawQuad() -> drawTexturedQuad().
+        (WebCore::GLES2Canvas::convolveRect):
+        Implement one pass of a convolution filter (X or Y).
+        (WebCore::gauss):
+        (WebCore::buildKernel):
+        Some helper functions to build a Gaussian convolution kernel.
+        (WebCore::GLES2Canvas::drawTexturedQuad):
+        Rename drawQuad() -> drawTexturedQuad(), to be more clear.  Do not
+        bind the framebuffer at this level (it will be done higher).
+        (WebCore::GLES2Canvas::drawTexturedQuadMitchell):
+        Implement Mitchell-Netravali bicubic sampling, using BicubicShader.
+        (WebCore::GLES2Canvas::fillPathInternal):
+        Rename fillPath() -> fillPathInternal(), which does use quad vertices,
+        but does not bind the framebuffer or set the compositing mode.
+        (WebCore::GLES2Canvas::flipRect):
+        Implement a helper function to flip a rectangle in Y within the canvas.
+        (WebCore::GLES2Canvas::clearBorders):
+        Implement a helper function to clear an n-pixel border around a rect.
+        (WebCore::GLES2Canvas::beginShadowDraw):
+        Setup before drawing a primitive's shadow:  for hard shadows, just
+        offset the CTM by the shadow offset.  For soft shadows, bind to an
+        offscreen DrawingBuffer.
+        (WebCore::GLES2Canvas::endShadowDraw):
+        Tear-down after drawing a primitive's shadow:  for hard shadows, just
+        restore the CTM.  For soft shadows, downsample (if necessary), then
+        blur in X, blur in Y, upsample if necessary).
+        * platform/graphics/chromium/GLES2Canvas.h:
+        * platform/graphics/gpu/BicubicShader.cpp: Added.
+        (WebCore::BicubicShader::BicubicShader):
+        (WebCore::BicubicShader::create):
+        (WebCore::BicubicShader::use):
+        * platform/graphics/gpu/BicubicShader.h: Added.
+        Implement a bicubic image filtering shader.
+        * platform/graphics/gpu/ConvolutionShader.cpp: Added.
+        (WebCore::ConvolutionShader::ConvolutionShader):
+        (WebCore::ConvolutionShader::create):
+        (WebCore::ConvolutionShader::use):
+        * platform/graphics/gpu/ConvolutionShader.h: Added.
+        Implement a 1-dimensional convolution shader.  In order to minimize
+        texture samples, this shader is parameterized at compile time by the
+        width of the convolution kernel.
+        * platform/graphics/gpu/DrawingBuffer.h:
+        (WebCore::DrawingBuffer::colorBuffer):
+        Add an accessor to retrieve a DrawingBuffer's texture ID.
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::create):
+        (WebCore::SharedGraphicsContext3D::SharedGraphicsContext3D):
+        (WebCore::SharedGraphicsContext3D::useBicubicProgram):
+        (WebCore::SharedGraphicsContext3D::useConvolutionProgram):
+        Create BicubicShader and cMaxKernelWidth ConvolutionShader's (one for
+        each possible kernel width).
+        (WebCore::SharedGraphicsContext3D::getOffscreenBuffer):
+        Implement a simple cache of offscreen DrawingBuffers, integer-indexed.
+        This is done to minimize the VRAM usage:  only 2 buffers are used for
+        all canvases.
+        * platform/graphics/gpu/SharedGraphicsContext3D.h:
+        Add bicubic and convolution shader members, and useXXX() functions.
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        Hook into GraphicsContextSkia's platform shadow setters to set
+        parameters on GLES2Canvas.
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::canAccelerate):
+        Remove shadows (loopers) from the list of things we can't accelerate.
+
+2011-03-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Andreas Kling.
+
+        Tiled backing store should only request repaint for updated areas
+        https://bugs.webkit.org/show_bug.cgi?id=56464
+
+        Reuse updateBackBuffer's dirty rectangle calculations to only
+        invalidate the necessary parts of the window.
+
+        * platform/graphics/Tile.h:
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::updateTileBuffers):
+        * platform/graphics/qt/TileQt.cpp:
+        (WebCore::Tile::updateBackBuffer):
+
+2011-03-17  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Chromium] Reduce memory consumption by detailed heap snapshots indexes.
+        https://bugs.webkit.org/show_bug.cgi?id=56395
+
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotDiffNode.prototype._createNodesProvider.createProvider):
+        (WebInspector.HeapSnapshotDiffNode.prototype._createNodesProvider):
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshotRetainerEdge): Added
+        (WebInspector.HeapSnapshotRetainerEdgeIterator): Added
+        (WebInspector.HeapSnapshotNode.prototype.get retainers):
+        (WebInspector.HeapSnapshot.prototype.dispose):
+        (WebInspector.HeapSnapshot.prototype.hasId):
+        (WebInspector.HeapSnapshot.prototype.retainers):
+        (WebInspector.HeapSnapshot.prototype._buildRetainers):
+        (WebInspector.HeapSnapshot.prototype._buildIdsList):
+        (WebInspector.HeapSnapshot.prototype._buildNodeIndex):
+        (WebInspector.HeapSnapshot.prototype._findNodePositionInIndex):
+        (WebInspector.HeapSnapshot.prototype._findNearestNodeIndex):
+        (WebInspector.HeapSnapshot.prototype._getRetainerIndex):
+        (WebInspector.HeapSnapshot.prototype._markInvisibleEdges):
+        (WebInspector.HeapSnapshot.prototype._numbersComparator):
+        (WebInspector.HeapSnapshotPathFinder.prototype.get _lastEdge):
+        (WebInspector.HeapSnapshotPathFinder.prototype._nextEdgeIter):
+        (WebInspector.HeapSnapshotPathFinder.prototype._buildNextPath):
+        (WebInspector.HeapSnapshotPathFinder.prototype._pathToString):
+
+2011-03-17  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81243.
+        http://trac.webkit.org/changeset/81243
+        https://bugs.webkit.org/show_bug.cgi?id=56471
+
+        Breaks GTK 64-bit Debug tests (Requested by podivilov on
+        #webkit).
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::setFrontend):
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::setFrontend):
+        (WebCore::InspectorBrowserDebuggerAgent::setAllBrowserBreakpoints):
+        (WebCore::InspectorBrowserDebuggerAgent::inspectedURLChanged):
+        (WebCore::InspectorBrowserDebuggerAgent::restoreStickyBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::discardBindings):
+        (WebCore::InspectorBrowserDebuggerAgent::setEventListenerBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::removeEventListenerBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::pauseOnNativeEventIfNeeded):
+        (WebCore::InspectorBrowserDebuggerAgent::clear):
+        * inspector/InspectorBrowserDebuggerAgent.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.createEventListenerBreakpoint):
+        (WebInspector.BreakpointManager.prototype._createEventListenerBreakpoint):
+        (WebInspector.BreakpointManager.prototype.setXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype.removeXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype.breakpointViewForEventData):
+        (WebInspector.BreakpointManager.prototype._projectChanged):
+        (WebInspector.BreakpointManager.prototype._saveBreakpoints):
+        (WebInspector.BreakpointManager.prototype._validateBreakpoints):
+        (WebInspector.BreakpointManager.prototype._createDOMBreakpointId):
+        (WebInspector.BreakpointManager.prototype._createEventListenerBreakpointId):
+        (WebInspector.EventListenerBreakpoint):
+        (WebInspector.EventListenerBreakpoint.prototype._enable):
+        (WebInspector.EventListenerBreakpoint.prototype._disable):
+        (WebInspector.EventListenerBreakpoint.prototype._serializeToJSON):
+        (WebInspector.EventListenerBreakpointView):
+        (WebInspector.EventListenerBreakpointView.eventNameForUI):
+        (WebInspector.EventListenerBreakpointView.prototype.get eventName):
+        (WebInspector.EventListenerBreakpointView.prototype.compareTo):
+        (WebInspector.EventListenerBreakpointView.prototype.populateLabelElement):
+        (WebInspector.EventListenerBreakpointView.prototype.populateStatusMessageElement):
+        (WebInspector.EventListenerBreakpointView.prototype._uiEventName):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._setBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._removeBreakpoint):
+        (WebInspector.EventListenerBreakpointsSidebarPane):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._createCategory):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._categoryCheckboxClicked):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._breakpointCheckboxClicked):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._breakpointAdded):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._breakpointHitStateChanged):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._breakpointRemoved):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._updateCategoryCheckbox):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._projectChanged):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.prototype._scriptBreakpointHit):
+        (WebInspector.CallStackSidebarPane.prototype._xhrBreakpointHit):
+        (WebInspector.CallStackSidebarPane.prototype._nativeBreakpointHit):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype._clearInterface):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+
+2011-03-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add more ObjC++ files to the build
+        https://bugs.webkit.org/show_bug.cgi?id=56548
+
+        96 link errors.
+
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+
+2011-03-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add a few Objective-C++ files to the WebCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56547
+
+        464 link errors.
+
+        * gyp/WebCore.gyp:
+
+2011-03-17  Yuta Kitamura  <yutak@chromium.org>
+
+        Unreviewed build fix.
+
+        Non-ASCII characters in XMLTreeViewer.{cpp,h}
+        https://bugs.webkit.org/show_bug.cgi?id=56549
+
+        * xml/XMLTreeViewer.cpp: Replace non-ASCII characters with ASCII equivalents.
+        * xml/XMLTreeViewer.h: Ditto.
+
+2011-03-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add plugins and bridge to the WebCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56546
+
+        506 link errors.
+
+        * gyp/WebCore.gyp:
+
+2011-03-16  Jeff Johnson  <github@lapcatsoftware.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Logic error in -[WebHTMLView close]
+        https://bugs.webkit.org/show_bug.cgi?id=56445
+
+        The function setDraggingImageURL() is no longer called and can be deleted.
+
+        No new tests. Deleting dead code.
+
+        * page/DragController.h:
+
+2011-03-16  Naoki Takano  <takano.naoki@gmail.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        Textarea maxlength doesn't account for newlines
+        https://bugs.webkit.org/show_bug.cgi?id=54443
+
+        When a user presses a return key, TypingCommand::insertLineBreak() is called.
+        So before append a new line, check if we can add the new line.
+
+        * editing/TypingCommand.cpp:
+        (WebCore::canAppendNewLineFeed): Implement new helper function to check if we can add new line.
+        (WebCore::TypingCommand::insertLineBreak): Added check logic before adding the new line.
+        (WebCore::TypingCommand::insertParagraphSeparator): Added check logic before adding the new line.
+
+2011-03-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP build should build more derived sources
+        https://bugs.webkit.org/show_bug.cgi?id=56529
+
+        This patch brings us down to 597 link errors.
+
+        * gyp/WebCore.gyp:
+
+2011-03-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP should build (most) remaining source files
+        https://bugs.webkit.org/show_bug.cgi?id=56515
+
+        We're still not building all the files and we have 1305 link errors,
+        but this patch is progress.
+
+        * WebCore.gypi:
+        * gyp/WebCore.gyp:
+        * plugins/PluginStream.cpp:
+
+2011-03-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Update the default navigator.vendor value
+        https://bugs.webkit.org/show_bug.cgi?id=56449
+
+        * page/NavigatorBase.cpp: Updated the default value of
+        WEBCORE_NAVIGATOR_VENDOR.
+
+2011-03-16  John Bauman  <jbauman@chromium.org>
+
+        Reviewed by James Robinson.
+
+        texImage2D gets old contents of canvas
+        https://bugs.webkit.org/show_bug.cgi?id=56414
+
+        Always update the canvas contents in copiedImage, as there's no reason
+        to ask for an out-of-date image.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::copiedImage):
+
+2011-03-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by James Robinson.
+
+        Remove USE(BUILTIN_UTF8_CODEC)
+        https://bugs.webkit.org/show_bug.cgi?id=56508
+
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::registerEncodingNames):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+
+2011-03-16  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Viewport no longer allows an auto value for "user-scalable"
+        https://bugs.webkit.org/show_bug.cgi?id=55416
+
+        This restores our behavior before r67376 the default "user-scalable"
+        behavior can be defined by a WebKit client if a value was not
+        explicitly provided in web content (via the viewport <meta> tag).
+        Here, all WebKit ports default to "yes" after computing
+        viewport arguments. However, in the future they may consider
+        changing the default user-scalable value based on the type
+        of the document being viewed, a user preference, or other reasons.
+
+        Covered by existing tests. Should be no changes.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::computeViewportAttributes): be explicit about 0.
+        (WebCore::findUserScalableValue): convert to return a float, the instance variable type.
+        * dom/ViewportArguments.h:
+        (WebCore::ViewportArguments::ViewportArguments): convert the boolean back to a float to
+        allow for 3 states. Explicit no, explicit yes, and ValueAuto to be defined by the
+        WebKit client.
+
+2011-03-16  David Levin  <levin@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        REGRESSION(r81289): Fix valgrind error (and crashes) when running the chromium unit test "test_shell_test".
+
+        Conditional jump or move depends on uninitialised value(s)
+            WebCore::RenderLayerCompositor::RenderLayerCompositor(WebCore::RenderView*) (third_party/WebKit/Source/WebCore/rendering/RenderLayerCompositor.cpp:117)
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2011-03-16  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=56493 Drag-scrolling overlay 
+        scrollbars thumb in overflow regions does not work
+        -and corresponding-
+        <rdar://problem/9112688> Drag-scrolling overlay scrollbars thumb in overflow 
+        regions does not work
+
+        Up until now, overlay scrollbars have always been treated in the Render Tree as if 
+        they have a thickness of 0 because they should not affect layout. However, it is 
+        important to consider their size when hit-testing because otherwise, we have this 
+        bug! This patch adds a boolean parameter to overflowClipRect(), 
+        RenderLayer::verticalScrollbarWidth(), and 
+        RenderLayer::horizontalScrollbarHeight(). This bool indicates whether to include 
+        the actual overlay scrollbar thickness. It defaults to false and is only sent is 
+        as true from RenderBloc::nodeAtPoint().
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::nodeAtPoint):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::overflowClipRect):
+        * rendering/RenderBox.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::verticalScrollbarWidth):
+        (WebCore::RenderLayer::horizontalScrollbarHeight):
+        * rendering/RenderLayer.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::overflowClipRect):
+        * rendering/RenderTable.h:
+
+2011-03-16  Keith Kyzivat  <keith.kyzivat@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Fix std::swap not found issue on mobile Qt devices.
+        https://bugs.webkit.org/show_bug.cgi?id=56463
+
+        Include <algorithm> in TextBreakIteratorQt.cpp so std::swap is found
+        on some Qt mobile devices.
+
+        No new tests: No tests needed - compilation verified manually.
+
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        (WebCore::acquireLineBreakIterator):
+
+2011-03-16  Jarkko Sakkinen  <jarkko.j.sakkinen@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] WebGL content not shown when accelerated compositing is enabled
+        https://bugs.webkit.org/show_bug.cgi?id=56339
+
+        Removed all previously implemented WebGL code from GraphicsLayerQt
+        because API has changed. GraphicsContext3D provides PlatformLayer
+        that is added as a child of GraphicsLayer and is therefore painted
+        through QGraphicsView pipeline.
+
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3DInternal::GraphicsContext3DInternal):
+        (WebCore::GraphicsContext3DInternal::paint):
+        (WebCore::GraphicsContext3DInternal::boundingRect):
+        (WebCore::GraphicsContext3D::platformLayer):
+        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
+        (WebCore::GraphicsContext3D::reshape):
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::GraphicsLayerQtImpl):
+        (WebCore::GraphicsLayerQtImpl::paint):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+        (WebCore::GraphicsLayerQt::setContentsToCanvas):
+        * platform/graphics/qt/GraphicsLayerQt.h:
+
+2011-03-16  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        Get rid of nearestMailBlockquote
+        https://bugs.webkit.org/show_bug.cgi?id=56439
+
+        Removed nearestMailBlockquote and replaced the calls to the function by calls
+        to enclosingNodeOfType and highestEnclosingNodeOfType.
+        
+        Also fixed a bug in BreakBlockquoteCommand and DeleteSelectionCommand not to
+        respect editing boundaries.  Added a test for the former command.
+
+        Test: editing/execCommand/break-non-editable-blockquote.html
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply): No longer crosses editing boundary
+        when looking for a Mail blockquote.
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::saveTypingStyleState): Ditto.
+        (WebCore::DeleteSelectionCommand::calculateTypingStyleAfterDelete):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::hasMatchingQuoteLevel):
+        (WebCore::handleStyleSpansBeforeInsertion):
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans):
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/htmlediting.cpp:
+        (WebCore::enclosingNodeOfType): Check rule upfront to improve the performance.
+        (WebCore::highestEnclosingNodeOfType): Ditto; also add the missing check.
+        * editing/htmlediting.h:
+        (WebCore::firstPositionInOrBeforeNode): Added a null pointer check.
+        (WebCore::lastPositionInOrAfterNode): Ditto.
+        * editing/markup.cpp:
+        (WebCore::highestAncestorToWrapMarkup):
+        (WebCore::createMarkup):
+
+2011-03-16  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        RenderFullScreen::createFullScreenStyle() leaks
+        https://bugs.webkit.org/show_bug.cgi?id=53384
+
+        Two problems: a) not calling release() on the style returned in setFullScreenRenderer
+        causes an unnecessary ref/deref, and b) the fullscreen renderer needs to be destroyed,
+        not just detached, when it is no longer needed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFullScreenRenderer): Destroy the current renderer when a new one is set.
+        * rendering/RenderFullScreen.cpp:
+        (RenderFullScreen::createFullScreenStyle): release() the return value.
+
+2011-03-16  Mike Reed  <reed@google.com>
+
+        Reviewed by James Robinson.
+
+        Reestablish typeface/size/encoding when drawing stroked text
+        https://bugs.webkit.org/show_bug.cgi?id=56481
+
+        No new tests. LayoutTests/svg/css/composite-shadow-text.svg
+
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::paintSkiaText):
+
+2011-03-16  Daniel Sievers  <sievers@google.com>
+
+        Reviewed by James Robinson.
+
+        Add setting to always force compositing mode
+        https://bugs.webkit.org/show_bug.cgi?id=56156
+
+        No new tests needed as this defaults to disabled (and is unfeasible
+        to be tested through property overriding at runtime).
+
+        * page/Settings.h:
+        (WebCore::Settings::setForceCompositingMode):
+        (WebCore::Settings::forceCompositingMode):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        * rendering/RenderLayerCompositor.h:
+
+2011-03-16  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Fixing backface visibility for transformed layers.
+        https://bugs.webkit.org/show_bug.cgi?id=56237
+
+        Test: platform/chromium/compositing/backface-visibility-transformed.html
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawLayer):
+
+2011-03-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r76147): Dragging slider thumb is impossible or results in drawing artifacts.
+        https://bugs.webkit.org/show_bug.cgi?id=56469
+
+        Technically, this is not a regression, but rather uncovering of an old
+        problem. When the RenderSlider::layout was written, the layout state was
+        pushed with a wrong offset. However, since the whole slider track was
+        always repainted, the problem didn't manifest itself until we actually
+        started being more precise in our repaints.
+
+        Test: fast/repaint/slider-thumb-float.html
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::layout): Changed to pass actual thumb offset
+        to the LayoutStateMaintainer, rather than thumb size.
+
+2011-03-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Add play state callbacks to MediaControls, kill timeUpdate timer.
+        https://bugs.webkit.org/show_bug.cgi?id=56473
+
+        No change in behavior, covered by existing tests.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::playbackProgressTimerFired): Added a call to
+            media controls.
+        (WebCore::HTMLMediaElement::updatePlayState): Ditto.
+        * html/shadow/MediaControls.cpp:
+        (WebCore::MediaControls::MediaControls): Removed initialization of the timer.
+        (WebCore::MediaControls::playbackProgressed): Added.
+        (WebCore::MediaControls::playbackStarted): Added, for now routing to just
+            call playbackProgressed.
+        (WebCore::MediaControls::playbackStopped): Ditto.
+        (WebCore::MediaControls::update): Removed the code to start/stop the
+            timer that's now gone.
+        * html/shadow/MediaControls.h: Removed timer decls.
+
+2011-03-16  Bill Budge  <bbudge@chromium.org>
+
+        Reviewed by David Levin.
+
+        DocumentThreadableLoaderClient needs a protected default Constructor
+        https://bugs.webkit.org/show_bug.cgi?id=56479
+
+        No new tests. Exposes no new functionality.
+
+        * loader/DocumentThreadableLoaderClient.h:
+        (WebCore::DocumentThreadableLoaderClient::DocumentThreadableLoaderClient):
+
+2011-03-16  David Levin  <levin@chromium.org>
+
+        Chromium Leopard build fix attempt #2.
+
+        Same error as before.
+        * bindings/v8/V8GCController.cpp:
+
+2011-03-16  David Levin  <levin@chromium.org>
+
+        Chromium Leopard build fix attempt.
+
+        The error was 'WebCore::GrouperVisitor' has a field 'WebCore::GrouperVisitor::m_grouper' whose type uses the anonymous namespace.
+
+        * bindings/v8/V8GCController.cpp:
+
+2011-03-16  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Dimitri Glazkov and Darin Adler.
+
+        Node::isContentEditable should always call parentNode() instead of parentOrHostNode()
+        https://bugs.webkit.org/show_bug.cgi?id=56472
+
+        Replaced the call to parentOrHostNode() in Node::isContentEditable by a call to parentNode().
+        Node::isContentEditable now calls parentNode() on all nodes.
+
+        No tests are added since this behavior change is not visible to scripts at the moment.
+
+        * dom/Node.cpp:
+        (WebCore::Node::isContentEditable):
+
+2011-03-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WK2: Need to propagate enhanced accessibility flag from UI -> web process
+        https://bugs.webkit.org/show_bug.cgi?id=56379
+
+        Allow the enhanced accessibility flag to be toggleable. 
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::setEnhancedUserInterfaceAccessibility):
+
+2011-03-16  Csaba Osztrogonác  <ossy@webkit.org>
+
+        [Qt] Buildfix after r81230.
+
+        * WebCore.pri: Missing include path added.
+
+2011-03-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make Structure creation require a JSGlobalData
+        https://bugs.webkit.org/show_bug.cgi?id=56438
+
+        Mechanical change to make all structure creation use GlobalData
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSAudioConstructor.h:
+        (WebCore::JSAudioConstructor::createStructure):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure):
+        (WebCore::DOMConstructorObject::createStructure):
+        (WebCore::getDOMStructure):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::createStructure):
+        * bindings/js/JSDOMWindowBase.h:
+        (WebCore::JSDOMWindowBase::createStructure):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
+        (WebCore::JSDOMWindowShell::setWindow):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageConstructor.h:
+        (WebCore::JSImageConstructor::createStructure):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSOptionConstructor.h:
+        (WebCore::JSOptionConstructor::createStructure):
+        * bindings/js/JSWorkerContextBase.h:
+        (WebCore::JSWorkerContextBase::createStructure):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/c/CRuntimeObject.h:
+        (JSC::Bindings::CRuntimeObject::createStructure):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CRuntimeMethod::createStructure):
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaRuntimeMethod::createStructure):
+        * bridge/jni/jsc/JavaRuntimeObject.h:
+        (JSC::Bindings::JavaRuntimeObject::createStructure):
+        * bridge/objc/ObjCRuntimeObject.h:
+        (JSC::Bindings::ObjCRuntimeObject::createStructure):
+        * bridge/objc/objc_instance.mm:
+        (ObjCRuntimeMethod::createStructure):
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.h:
+        (JSC::Bindings::RuntimeObject::createStructure):
+
+2011-03-16  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION: Crash in adjustMIMETypeIfNecessary since r81001
+        https://bugs.webkit.org/show_bug.cgi?id=56345
+
+        Add NULL check for Content-Type header field.
+
+        Test: http/tests/xmlhttprequest/xmlhttprequest-no-content-type.html
+
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (WebCore::adjustMIMETypeIfNecessary):
+
+2011-03-15  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        REGRESSION (r81165): Assert running editing/style/iframe-onload-crash.html with non-Mac editing behavior
+        https://bugs.webkit.org/show_bug.cgi?id=56407
+
+        Fixing the creation of incorrect ranges from TextIterator due to passing node/offset pairs that
+        weren't parent-anchored. Also changing canHaveChildrenForEditing to properly handle nodes that
+        have had children appended to them that editing wouldn't normally allow.
+
+        Tests: editing/style/iframe-onload-crash-mac.html
+               editing/style/iframe-onload-crash-unix.html
+               editing/style/iframe-onload-crash-win.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::rangeFromLocationAndLength): Passing parent-anchored values to range.
+        * editing/htmlediting.cpp:
+        (WebCore::canHaveChildrenForEditing): Adding a condition that the nodes don't already have children
+        for hr and datagrid, as you can append any node to another using javascript.
+
+2011-03-16  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [Chromium] Report object groups and single DOM-related objects
+        to the new heap profiler.
+        https://bugs.webkit.org/show_bug.cgi?id=53659
+
+        * Android.v8bindings.mk:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/RetainedDOMInfo.cpp: Added.
+        (WebCore::RetainedDOMInfo::RetainedDOMInfo):
+        * bindings/v8/RetainedDOMInfo.h: Added.
+        * bindings/v8/RetainedObjectInfo.h: Added.
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::retainedDOMInfo):
+        (WebCore::ScriptProfiler::initialize):
+        * bindings/v8/ScriptProfiler.h:
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::GroupId::GrouperItem::GrouperItem):
+        (WebCore::GroupId::GrouperItem::groupId):
+        (WebCore::GroupId::GrouperItem::createRetainedObjectInfo):
+        (WebCore::calculateGroupId):
+        (WebCore::GrouperVisitor::visitDOMWrapper):
+        (WebCore::GrouperVisitor::applyGrouping):
+        * bindings/v8/WrapperTypeInfo.h:
+        * inspector/front-end/DetailedHeapshotGridNodes.js:
+        (WebInspector.HeapSnapshotConstructorNode):
+        (WebInspector.HeapSnapshotConstructorNode.prototype._createNodesProvider):
+        (WebInspector.HeapSnapshotDiffNode):
+        (WebInspector.HeapSnapshotDiffNode.prototype._createNodesProvider.createProvider):
+        (WebInspector.HeapSnapshotDiffNode.prototype._createNodesProvider):
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.HeapSnapshotRetainingPathsList.prototype.setDataSource):
+        (WebInspector.HeapSnapshotRetainingPathsList.prototype.refresh):
+        (WebInspector.HeapSnapshotRetainingPathsList.prototype.showNext.startSearching):
+        (WebInspector.HeapSnapshotRetainingPathsList.prototype.showNext):
+        (WebInspector.HeapSnapshotRetainingPathsList.prototype._setRootChildrenForFinder):
+        (WebInspector.DetailedHeapshotView.prototype._changeRetainingPathsRoot):
+        (WebInspector.DetailedHeapshotView.prototype.get isTracingToWindowObjects):
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshotNode.prototype.get className):
+        (WebInspector.HeapSnapshot.prototype._buildAggregates):
+        (WebInspector.HeapSnapshotPathFinder.prototype.updateRoots):
+        (WebInspector.HeapSnapshotPathFinder.prototype._fillRootChildren):
+        * inspector/front-end/heapProfiler.css:
+        (.detailed-heapshot-view .retaining-paths-view .title > span):
+        (.detailed-heapshot-view .retaining-paths-to-windows):
+
+2011-03-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add WebKit2 API to figure out if an input or textarea was edited
+        https://bugs.webkit.org/show_bug.cgi?id=56474
+
+        Add HTMLInputElement::lastChangeWasUserEdit and HTMLTextAreaElement::lastChangeWasUserEdit
+        and use them to implement -[DOMHTMLInputElement _isEdited] and -[DOMHTMLTextAreaElement _isEdited]
+        as well as API in WebKit2.
+
+        * WebCore.exp.in:
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isEdited]):
+        (-[DOMHTMLTextAreaElement _isEdited]):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::lastChangeWasUserEdit):
+        * html/HTMLInputElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::lastChangeWasUserEdit):
+        * html/HTMLTextAreaElement.h:
+
+2011-03-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: ASSERTION FAILED: !HashTranslator::equal(KeyTraits::emptyValue(), key)
+        https://bugs.webkit.org/show_bug.cgi?id=56376
+
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::willRemoveDOMNode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._setDocument):
+
+2011-03-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        text-combine text retains compressed font after adding characters to it
+        https://bugs.webkit.org/show_bug.cgi?id=56448
+
+        Test: fast/dynamic/text-combine.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Allow styles with text-combine to be shared, since
+        only the clones on the RenderCombineText will be mutated.
+        * rendering/RenderCombineText.cpp:
+        (WebCore::RenderCombineText::styleDidChange): Clone the style, to avoid mutating the parent’s
+        style.
+        (WebCore::RenderCombineText::combineText): Start off with the original font; restore it if
+        the text cannot be combined.
+        * rendering/RenderCombineText.h:
+        (WebCore::RenderCombineText::originalFont): Added. Returns the parent’s font.
+
+2011-03-14  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: refactor event listener breakpoints.
+        https://bugs.webkit.org/show_bug.cgi?id=56305
+
+        - restore event listener breakpoints one by one instead of using setAllBrowserBreakpoints
+        - store event listener breakpoints in a separate separate setting
+        - move presentation-related code from BreakpointManager to EventListenerBreakpointsSidebarPane
+
+        Test: inspector/debugger/event-listener-breakpoints.html
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::setFrontend):
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::setEventListenerBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::removeEventListenerBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::pauseOnNativeEventIfNeeded):
+        (WebCore::InspectorBrowserDebuggerAgent::clear):
+        * inspector/InspectorBrowserDebuggerAgent.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didCommitLoadImpl):
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.setEventListenerBreakpoint):
+        (WebInspector.BreakpointManager.prototype.removeEventListenerBreakpoint):
+        (WebInspector.BreakpointManager.prototype.breakpointViewForEventData):
+        (WebInspector.BreakpointManager.prototype._projectChanged):
+        (WebInspector.BreakpointManager.prototype._saveBreakpoints):
+        (WebInspector.BreakpointManager.prototype._validateBreakpoints):
+        (WebInspector.BreakpointManager.prototype._createDOMBreakpointId):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.EventListenerBreakpointsSidebarPane):
+        (WebInspector.EventListenerBreakpointsSidebarPane.eventNameForUI):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._createCategory):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._categoryCheckboxClicked):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._breakpointCheckboxClicked):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._setBreakpoint):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._removeBreakpoint):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._updateCategoryCheckbox):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype.highlightBreakpoint):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype.clearBreakpointHighlight):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._saveBreakpoints):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._restoreBreakpoints):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.prototype.setStatus):
+        (WebInspector.CallStackSidebarPane.prototype._domBreakpointHit):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype._clearInterface):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+
+2011-03-16  David Kilzer  <ddkilzer@apple.com>
+
+        Minor clean-up after r81156, r81172
+
+        Follow-up for:
+        <http://webkit.org/b/56381> Objective-C classes should be typedef-ed as structs (not void*) in C++
+
+        * platform/graphics/GraphicsLayer.h: Removed unused @class
+        WebLayer declaration.
+        * platform/graphics/ca/PlatformCAAnimation.h: Changed typedef
+        struct CAPropertyAnimation to class declaration.
+
+2011-03-16  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Remove live-edit code
+        https://bugs.webkit.org/show_bug.cgi?id=56177
+
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype._doubleClick):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorMainPanel):
+        (WebInspector.TextEditorMainPanel.prototype.set readOnly):
+
+2011-03-16  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Martin Robinson.
+
+        [GStreamer] There is no need to set the state of the pipeline to playing, HTMLMediaElement will do it.
+        https://bugs.webkit.org/show_bug.cgi?id=56403
+
+        In case of a seek on a live pipeline there is no need to call gst_element_set_state(m_playBin, GST_STATE_PLAYING);
+        As soon as HTMLMediaElement::updatePlayState() is called (like when the data comes in) the playback will be relaunched
+        i.e the pause() made when beginScrubbing is done is just internal.
+
+        No new tests: Verified manually.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::updateStates):
+
+2011-03-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP build should build platform/
+        https://bugs.webkit.org/show_bug.cgi?id=56430
+
+        Adding platform/ to the GYP build required disabling
+        ALWAYS_SEARCH_USER_PATHS, which in turn required fixing some latent
+        style issues.  I suspect we'll end up excluding some of these files
+        from the build in the final analysis, but we might as well fix the
+        style errors while we're here.
+
+        * bindings/js/JSMainThreadExecState.h:
+        * bindings/js/ScheduledAction.h:
+        * css/CSSPrimitiveValueCache.cpp:
+        * gyp/WebCore.gyp:
+        * platform/KillRingNone.cpp:
+        (WebCore::KillRing::append):
+        (WebCore::KillRing::prepend):
+        * platform/graphics/ContextShadow.h:
+        * platform/graphics/gpu/LoopBlinnPathProcessor.cpp:
+        (WebCore::LoopBlinnPathProcessor::buildContours):
+        (WebCore::TessellationState::combineCallback):
+        * platform/graphics/gpu/PODRedBlackTree.h:
+        (WebCore::PODRedBlackTree::updateNode):
+        (WebCore::PODRedBlackTree::logIfVerbose):
+        * platform/graphics/opengl/TextureMapperGL.cpp:
+        * platform/graphics/opengl/TextureMapperGL.h:
+        * platform/graphics/texmap/TextureMapper.h:
+        (WebCore::BitmapTexture::save):
+        (WebCore::TextureMapper::paintToTarget):
+        * platform/graphics/texmap/TextureMapperNode.h:
+
+2011-03-15  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Carlson.
+
+        [GStreamer] http/tests/media/video-play-stall-before-meta-data.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=56370
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateMessageCallback): Let the
+        mediaPlayerClient handle the stream error, in this case the
+        HTMLMediaElement will emit a stalled event.
+
+2011-03-10  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GStreamer] Frame accurate seeking isn't always accurate
+        https://bugs.webkit.org/show_bug.cgi?id=55217
+
+        Attempt to build the seek GstClockTime position by converting the
+        float time value to a GTimeVal value rounded at microsecond
+        precision. Additionally perform the seek with the ACCURATE seek
+        flag. These modifications at least fix this manual-test:
+        http://www.massive-interactive.nl/html5_video/smpte_test_universal.html
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::currentTime):
+        (WebCore::MediaPlayerPrivateGStreamer::seek):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+
+2011-03-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: split InspectorAgent.populateScriptObjects into more granular agent-specific requests
+        https://bugs.webkit.org/show_bug.cgi?id=56389
+
+        Instead of sending one big request populateScriptObjects each agent requests
+        for initial data in its constructor.
+        
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::restoreInspectorStateFromCookie):
+        (WebCore::InspectorAgent::setFrontend):
+        (WebCore::InspectorAgent::pushDataCollectedOffline):
+        (WebCore::InspectorAgent::getPreferredPanel):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::setFrontend):
+        (WebCore::InspectorDOMAgent::restore):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::create):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::setFrontend):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorProfilerAgent.h:
+        (WebCore::InspectorProfilerAgent::isEnabled):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        * inspector/front-end/inspector.js:
+
+2011-03-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Devirtualize isContentEditable and isRichlyContentEditable
+        https://bugs.webkit.org/show_bug.cgi?id=56421
+
+        Rewrote Node::isContentEditable as a non-recursive non-virtual function.
+
+        * dom/Document.cpp: Removed isContentEditable and isContentRichlyEditable.
+        * dom/Document.h: Ditto.
+        * dom/Node.cpp:
+        (WebCore::Node::isContentEditable): Rewritten.
+        * dom/Node.h:
+        (WebCore::Node::isContentEditable): Calls isContentEditable(Editable).
+        (WebCore::Node::isContentRichlyEditable): Calls isContentEditable(RichlyEditable).
+        * html/HTMLElement.cpp: Removed isContentEditable and isContentRichlyEditable.
+        * html/HTMLElement.h: Ditto.
+
+2011-03-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP build should build inspector/ loader/ mathml/ notifications/ and page/
+        https://bugs.webkit.org/show_bug.cgi?id=56412
+
+        Yay for smooth sailing.
+
+        * gyp/WebCore.gyp:
+
+2011-03-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        REGRESSION(r76147): A slider thumb that is styled cannot be programmatically moved
+        https://bugs.webkit.org/show_bug.cgi?id=56059
+
+        Test: fast/dom/HTMLInputElement/input-slider-update-styled.html
+
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::valueChanged): Changed to use setPositionFromValue.
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::SliderThumbElement::setPositionFromValue): Added.
+        (WebCore::SliderThumbElement::dragFrom): Changed to use setPositionFromPoint.
+        (WebCore::SliderThumbElement::setPositionFromPoint): Ditto.
+        (WebCore::SliderThumbElement::defaultEventHandler): Ditto.
+        * html/shadow/SliderThumbElement.h: Added decls.
+
+2011-03-15  David Levin  <levin@chromium.org>
+
+        Attempted build fix following r81213. Same song second verse.
+
+        * platform/image-encoders/skia/PNGImageEncoder.cpp:
+        (WebCore::encodePixels):
+
+2011-03-15  David Levin  <levin@chromium.org>
+
+        Attempted build fix for Chromium OSX release build following r81213.
+
+        * platform/image-encoders/skia/JPEGImageEncoder.cpp:
+        (WebCore::encodePixels): Change scoping of |pixels| to be after setjmp call.
+
+2011-03-15  John Bauman  <jbauman@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Non-premultiplied-alpha canvas attribute is ignore for toDataURL, drawImage, texImage2D
+        https://bugs.webkit.org/show_bug.cgi?id=56238
+
+       Attempt to get an ImageData (non-premultiplied) from a WebGL canvas
+       instead of getting an ImageBuffer, so there's a chance the data can be
+       passed straight through to the consumer with no premultiplication
+       necessary. Fixes Chromium and Safari.
+
+        Test: fast/canvas/webgl/premultiplyalpha-test.html
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::toDataURL):
+        (WebCore::HTMLCanvasElement::getImageData):
+        * html/HTMLCanvasElement.h:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::paintRenderingResultsToImageData):
+        (WebCore::WebGLRenderingContext::texImage2D):
+        (WebCore::WebGLRenderingContext::texSubImage2D):
+        * html/canvas/WebGLRenderingContext.h:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/ImageBuffer.h:
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::CGImageToDataURL):
+        (WebCore::ImageBuffer::toDataURL):
+        (WebCore::ImageDataToDataURL):
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::validateAttributes):
+        (WebCore::GraphicsContext3D::readRenderingResults):
+        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
+        (WebCore::GraphicsContext3D::paintRenderingResultsToImageData):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::paintRenderingResultsToImageData):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageToDataURL):
+        (WebCore::ImageBuffer::toDataURL):
+        (WebCore::ImageDataToDataURL):
+        * platform/image-encoders/skia/JPEGImageEncoder.cpp:
+        (WebCore::preMultipliedBGRAtoRGB):
+        (WebCore::RGBAtoRGB):
+        (WebCore::encodePixels):
+        (WebCore::JPEGImageEncoder::encode):
+        * platform/image-encoders/skia/JPEGImageEncoder.h:
+        * platform/image-encoders/skia/PNGImageEncoder.cpp:
+        (WebCore::preMultipliedBGRAtoRGBA):
+        (WebCore::encodePixels):
+        (WebCore::PNGImageEncoder::encode):
+        * platform/image-encoders/skia/PNGImageEncoder.h:
+
+2011-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix, only compile the methods when the INDEXED_DATABASE feature is enabled.
+        
+        * storage/IDBDatabaseCallbacksImpl.cpp:
+
+2011-03-15  Brady Eidson  <beidson@apple.com>
+
+        Build fix after r81208 for https://bugs.webkit.org/show_bug.cgi?id=56425
+
+        * loader/icon/IconDatabaseBase.h: #include instead of forward declare.
+
+2011-03-15  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/8944558> Overlay scrollers in overflow areas need to 
+        send notifications appropriate times (showing up, resizing)
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=56067
+
+        The general strategy here is to add a HashSet of ScrollableAreas to the page that 
+        can be accessed when necessary to send notifications to all ScrollableAreas. In 
+        turn, all of the ScrollableArea classes that add themselves to the HashSet must 
+        keep a weak pointer to Page so that they can remove themselves without relying on 
+        Frames or Renderers to still have references.
+
+        Find layers for relevant node and if the layers are in the Page's ScrollableArea 
+        set, then send the relevant notification.
+        * page/EventHandler.cpp:
+        (WebCore::layerForNode):
+        (WebCore::EventHandler::mouseMoved):
+        (WebCore::EventHandler::updateMouseEventTargetNode):
+
+        When the page is set active or not active, iterate through the Page's 
+        ScrollableAreas to send hide/show notifications. 
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setActive):
+
+        When a FrameView is created, add it to the ScrollableArea set. When it's 
+        destroyed, remove it.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::~FrameView):
+
+        Iterate through the Page's ScrollableAreas to send the paint notification.
+        (WebCore::FrameView::notifyPageThatContentAreaWillPaint):
+        * page/FrameView.h:
+        (WebCore::FrameView::disconnectFromPage):
+
+        Add the new ScrollableArea set.
+        * page/Page.cpp:
+        (WebCore::Page::~Page):
+        (WebCore::Page::addScrollableArea):
+(WebCore::Page::removeScrollableArea):
+        (WebCore::Page::containsScrollableArea):
+        * page/Page.h:
+        (WebCore::Page::scrollableAreaSet):
+
+        notifyPageThatContentAreaWillPaint() is a dummy function implemented in FrameView.
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::notifyPageThatContentAreaWillPaint):
+        
+        Call notifyPageThatContentAreaWillPaint() instead of calling 
+        contentAreaWillPaint() just for the ScrollView.
+        (WebCore::ScrollView::paint):
+        * platform/ScrollView.h:
+
+        Add/remove ScrollableAreas to the set. Add new disconnectFromPage().
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::disconnectFromPage):
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::RenderDataGrid):
+        (WebCore::RenderDataGrid::~RenderDataGrid):
+        * rendering/RenderDataGrid.h:
+        (WebCore::RenderDataGrid::disconnectFromPage):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::~RenderLayer):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::disconnectFromPage):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::RenderListBox):
+        (WebCore::RenderListBox::~RenderListBox):
+        * rendering/RenderListBox.h:
+        (WebCore::RenderListBox::disconnectFromPage):
+
+        Should have implemented this ScrollableArea-interface function a while ago.
+        (WebCore::RenderLayer::currentMousePosition):
+
+2011-03-15  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56425
+        WebKit2 icon database.
+
+        * WebCore.exp.in:
+
+2011-03-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebCore GYP build should build editing, fileapi, history, and html
+        https://bugs.webkit.org/show_bug.cgi?id=56411
+
+        These all went smoothly.
+
+        * gyp/WebCore.gyp:
+
+2011-03-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP build should build dom/
+        https://bugs.webkit.org/show_bug.cgi?id=56409
+
+        * gyp/WebCore.gyp:
+
+2011-03-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebCore GYP build should build css/
+        https://bugs.webkit.org/show_bug.cgi?id=56408
+
+        CSSParser.cpp #includes tokenizer.cpp, which we haven't included in the
+        build yet.  I've punted on that problem for now, but we'll come back to
+        it.
+
+        * gyp/WebCore.gyp:
+
+2011-03-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebCore GYP build should build bindings/
+        https://bugs.webkit.org/show_bug.cgi?id=56406
+
+        I wanted to include bindings/objc in this patch, but they were somewhat
+        complicated.  It looks like they include headers from the output
+        directory (via PrivateHeaders), but we haven't wired up the
+        PrivateHeaders yet.
+
+        * gyp/WebCore.gyp:
+
+2011-03-15  James Simonsen  <simonjam@chromium.org>
+
+        Reviewed by Tony Gentilcore.
+
+        Need different behavior for ensuring execution order of dynamically loaded scripts
+        https://bugs.webkit.org/show_bug.cgi?id=50115
+
+        Dynamically added scripts with async=false will load in parallel, but execute in order.
+        See: http://www.whatwg.org/specs/web-apps/current-work/multipage/scripting-1.html#force-async
+
+        Tests: fast/dom/HTMLScriptElement/script-async-attr.html
+               http/tests/misc/script-async-load-execute-in-order.html
+
+        * Android.mk: Rename AsyncScriptRunner -> ScriptRunner.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * dom/DOMAllInOne.cpp: Ditto.
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Ditto.
+        (WebCore::Document::~Document): Ditto.
+        * dom/Document.h:
+        (WebCore::Document::scriptRunner): Ditto.
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::ScriptElement): Added forceAsync and willExecuteInOrder.
+        (WebCore::ScriptElement::handleAsyncAttribute): Called by HTMLScriptElement when async attribute changes.
+        (WebCore::ScriptElement::prepareScript): Added support for forceAsync.
+        (WebCore::ScriptElement::notifyFinished): Tell ScriptRunner to execute in order if needed.
+        * dom/ScriptElement.h:
+        (WebCore::ScriptElement::forceAsync): Added.
+        * dom/ScriptRunner.cpp: Renamed from Source/WebCore/dom/AsyncScriptRunner.cpp.
+        (WebCore::ScriptRunner::ScriptRunner): Added in-order script queue.
+        (WebCore::ScriptRunner::~ScriptRunner): Ditto.
+        (WebCore::ScriptRunner::executeScriptSoon):
+        (WebCore::ScriptRunner::queueScriptForInOrderExecution): Added.
+        (WebCore::ScriptRunner::suspend):
+        (WebCore::ScriptRunner::resume):
+        (WebCore::ScriptRunner::timerFired): Execute in-order scripts if ready.
+        * dom/ScriptRunner.h: Renamed from Source/WebCore/dom/AsyncScriptRunner.h.
+        (WebCore::ScriptRunner::create):
+        (WebCore::ScriptRunner::hasPendingScripts): Check for in-order scripts too.
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::attributeChanged): Notify ScriptElement when async changes.
+        (WebCore::HTMLScriptElement::setAsync): Ditto.
+        (WebCore::HTMLScriptElement::async): Include forceAsync in calculation.
+        * html/HTMLScriptElement.h:
+        * html/HTMLScriptElement.idl: Removed Reflect from async for custom behavior.
+        * page/PageGroupLoadDeferrer.cpp:
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer): Rename AsyncScriptRunner -> ScriptRunner.
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer): Ditto.
+
+2011-03-15  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        pngcrush images used by inspector
+        https://bugs.webkit.org/show_bug.cgi?id=56426
+
+        This saves 120k in WebCore and 8k in WebKit/chromium.  I ran
+        pngcrush -brute, so none of the meta data (ancillary chunks)
+        are modified.
+
+        No new tests, just compressing png files.
+
+        * inspector/front-end/Images/applicationCache.png:
+        * inspector/front-end/Images/auditsIcon.png:
+        * inspector/front-end/Images/back.png:
+        * inspector/front-end/Images/breakpointBorder.png:
+        * inspector/front-end/Images/breakpointConditionalBorder.png:
+        * inspector/front-end/Images/breakpointConditionalCounterBorder.png:
+        * inspector/front-end/Images/breakpointCounterBorder.png:
+        * inspector/front-end/Images/breakpointsActivateButtonGlyph.png:
+        * inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png:
+        * inspector/front-end/Images/checker.png:
+        * inspector/front-end/Images/clearConsoleButtonGlyph.png:
+        * inspector/front-end/Images/closeButtons.png:
+        * inspector/front-end/Images/consoleButtonGlyph.png:
+        * inspector/front-end/Images/consoleIcon.png:
+        * inspector/front-end/Images/cookie.png:
+        * inspector/front-end/Images/database.png:
+        * inspector/front-end/Images/databaseTable.png:
+        * inspector/front-end/Images/debuggerContinue.png:
+        * inspector/front-end/Images/debuggerPause.png:
+        * inspector/front-end/Images/debuggerStepInto.png:
+        * inspector/front-end/Images/debuggerStepOut.png:
+        * inspector/front-end/Images/debuggerStepOver.png:
+        * inspector/front-end/Images/disclosureTriangleSmallDown.png:
+        * inspector/front-end/Images/disclosureTriangleSmallDownBlack.png:
+        * inspector/front-end/Images/disclosureTriangleSmallDownWhite.png:
+        * inspector/front-end/Images/disclosureTriangleSmallRight.png:
+        * inspector/front-end/Images/disclosureTriangleSmallRightBlack.png:
+        * inspector/front-end/Images/disclosureTriangleSmallRightDown.png:
+        * inspector/front-end/Images/disclosureTriangleSmallRightDownBlack.png:
+        * inspector/front-end/Images/disclosureTriangleSmallRightDownWhite.png:
+        * inspector/front-end/Images/disclosureTriangleSmallRightWhite.png:
+        * inspector/front-end/Images/dockButtonGlyph.png:
+        * inspector/front-end/Images/elementsIcon.png:
+        * inspector/front-end/Images/enableOutlineButtonGlyph.png:
+        * inspector/front-end/Images/enableSolidButtonGlyph.png:
+        * inspector/front-end/Images/errorIcon.png:
+        * inspector/front-end/Images/errorMediumIcon.png:
+        * inspector/front-end/Images/errorRedDot.png:
+        * inspector/front-end/Images/excludeButtonGlyph.png:
+        * inspector/front-end/Images/focusButtonGlyph.png:
+        * inspector/front-end/Images/forward.png:
+        * inspector/front-end/Images/frame.png:
+        * inspector/front-end/Images/garbageCollectButtonGlyph.png:
+        * inspector/front-end/Images/gearButtonGlyph.png:
+        * inspector/front-end/Images/glossyHeader.png:
+        * inspector/front-end/Images/glossyHeaderPressed.png:
+        * inspector/front-end/Images/glossyHeaderSelected.png:
+        * inspector/front-end/Images/glossyHeaderSelectedPressed.png:
+        * inspector/front-end/Images/goArrow.png:
+        * inspector/front-end/Images/graphLabelCalloutLeft.png:
+        * inspector/front-end/Images/graphLabelCalloutRight.png:
+        * inspector/front-end/Images/helpButtonGlyph.png:
+        * inspector/front-end/Images/largerResourcesButtonGlyph.png:
+        * inspector/front-end/Images/localStorage.png:
+        * inspector/front-end/Images/networkIcon.png:
+        * inspector/front-end/Images/nodeSearchButtonGlyph.png:
+        * inspector/front-end/Images/paneAddButtons.png:
+        * inspector/front-end/Images/paneBottomGrow.png:
+        * inspector/front-end/Images/paneBottomGrowActive.png:
+        * inspector/front-end/Images/paneGrowHandleLine.png:
+        * inspector/front-end/Images/paneSettingsButtons.png:
+        * inspector/front-end/Images/pauseOnExceptionButtonGlyph.png:
+        * inspector/front-end/Images/percentButtonGlyph.png:
+        * inspector/front-end/Images/popoverArrows.png:
+        * inspector/front-end/Images/popoverBackground.png:
+        * inspector/front-end/Images/profileGroupIcon.png:
+        * inspector/front-end/Images/profileIcon.png:
+        * inspector/front-end/Images/profileSmallIcon.png:
+        * inspector/front-end/Images/profilesIcon.png:
+        * inspector/front-end/Images/profilesSilhouette.png:
+        * inspector/front-end/Images/programCounterBorder.png:
+        * inspector/front-end/Images/radioDot.png:
+        * inspector/front-end/Images/recordButtonGlyph.png:
+        * inspector/front-end/Images/recordToggledButtonGlyph.png:
+        * inspector/front-end/Images/reloadButtonGlyph.png:
+        * inspector/front-end/Images/resourceCSSIcon.png:
+        * inspector/front-end/Images/resourceDocumentIcon.png:
+        * inspector/front-end/Images/resourceDocumentIconSmall.png:
+        * inspector/front-end/Images/resourceJSIcon.png:
+        * inspector/front-end/Images/resourcePlainIcon.png:
+        * inspector/front-end/Images/resourcePlainIconSmall.png:
+        * inspector/front-end/Images/resourcesIcon.png:
+        * inspector/front-end/Images/resourcesSizeGraphIcon.png:
+        * inspector/front-end/Images/resourcesTimeGraphIcon.png:
+        * inspector/front-end/Images/scriptsIcon.png:
+        * inspector/front-end/Images/scriptsSilhouette.png:
+        * inspector/front-end/Images/searchSmallBlue.png:
+        * inspector/front-end/Images/searchSmallBrightBlue.png:
+        * inspector/front-end/Images/searchSmallGray.png:
+        * inspector/front-end/Images/searchSmallWhite.png:
+        * inspector/front-end/Images/segment.png:
+        * inspector/front-end/Images/segmentEnd.png:
+        * inspector/front-end/Images/segmentHover.png:
+        * inspector/front-end/Images/segmentHoverEnd.png:
+        * inspector/front-end/Images/segmentSelected.png:
+        * inspector/front-end/Images/segmentSelectedEnd.png:
+        * inspector/front-end/Images/sessionStorage.png:
+        * inspector/front-end/Images/splitviewDimple.png:
+        * inspector/front-end/Images/splitviewDividerBackground.png:
+        * inspector/front-end/Images/statusbarButtons.png:
+        * inspector/front-end/Images/statusbarMenuButton.png:
+        * inspector/front-end/Images/statusbarMenuButtonSelected.png:
+        * inspector/front-end/Images/statusbarResizerHorizontal.png:
+        * inspector/front-end/Images/statusbarResizerVertical.png:
+        * inspector/front-end/Images/successGreenDot.png:
+        * inspector/front-end/Images/thumbActiveHoriz.png:
+        * inspector/front-end/Images/thumbActiveVert.png:
+        * inspector/front-end/Images/thumbHoriz.png:
+        * inspector/front-end/Images/thumbHoverHoriz.png:
+        * inspector/front-end/Images/thumbHoverVert.png:
+        * inspector/front-end/Images/thumbVert.png:
+        * inspector/front-end/Images/timelineBarBlue.png:
+        * inspector/front-end/Images/timelineBarGray.png:
+        * inspector/front-end/Images/timelineBarGreen.png:
+        * inspector/front-end/Images/timelineBarOrange.png:
+        * inspector/front-end/Images/timelineBarPurple.png:
+        * inspector/front-end/Images/timelineBarRed.png:
+        * inspector/front-end/Images/timelineBarYellow.png:
+        * inspector/front-end/Images/timelineCheckmarks.png:
+        * inspector/front-end/Images/timelineDots.png:
+        * inspector/front-end/Images/timelineHollowPillBlue.png:
+        * inspector/front-end/Images/timelineHollowPillGray.png:
+        * inspector/front-end/Images/timelineHollowPillGreen.png:
+        * inspector/front-end/Images/timelineHollowPillOrange.png:
+        * inspector/front-end/Images/timelineHollowPillPurple.png:
+        * inspector/front-end/Images/timelineHollowPillRed.png:
+        * inspector/front-end/Images/timelineHollowPillYellow.png:
+        * inspector/front-end/Images/timelineIcon.png:
+        * inspector/front-end/Images/timelinePillBlue.png:
+        * inspector/front-end/Images/timelinePillGray.png:
+        * inspector/front-end/Images/timelinePillGreen.png:
+        * inspector/front-end/Images/timelinePillOrange.png:
+        * inspector/front-end/Images/timelinePillPurple.png:
+        * inspector/front-end/Images/timelinePillRed.png:
+        * inspector/front-end/Images/timelinePillYellow.png:
+        * inspector/front-end/Images/toolbarItemSelected.png:
+        * inspector/front-end/Images/trackHoriz.png:
+        * inspector/front-end/Images/trackVert.png:
+        * inspector/front-end/Images/treeDownTriangleBlack.png:
+        * inspector/front-end/Images/treeDownTriangleWhite.png:
+        * inspector/front-end/Images/treeRightTriangleBlack.png:
+        * inspector/front-end/Images/treeRightTriangleWhite.png:
+        * inspector/front-end/Images/treeUpTriangleBlack.png:
+        * inspector/front-end/Images/treeUpTriangleWhite.png:
+        * inspector/front-end/Images/undockButtonGlyph.png:
+        * inspector/front-end/Images/userInputIcon.png:
+        * inspector/front-end/Images/userInputPreviousIcon.png:
+        * inspector/front-end/Images/userInputResultIcon.png:
+        * inspector/front-end/Images/warningIcon.png:
+        * inspector/front-end/Images/warningMediumIcon.png:
+        * inspector/front-end/Images/warningOrangeDot.png:
+        * inspector/front-end/Images/warningsErrors.png:
+
+2011-03-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        Crash in ReplaceSelectionCommand::doApply when inserting a node under a document node
+        https://bugs.webkit.org/show_bug.cgi?id=56372
+
+        The bug was caused by insertNodeAfter's calling parentElement on document's child.
+        Fixed this by changing the node that AppendNodeCommand takes.
+
+        There was also a bug that document node always returned false for isContentEditable
+        and isContentRichlyEditable because they never overrode Node's default implementation.
+        Fixed this by overriding them in Document.
+
+        Test: editing/execCommand/append-node-under-document.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::isContentEditable): Added.
+        (WebCore::Document::isContentRichlyEditable): Added.
+        * dom/Document.h:
+        * editing/AppendNodeCommand.cpp:
+        (WebCore::AppendNodeCommand::AppendNodeCommand): Takes ContainerNode instead of Element.
+        * editing/AppendNodeCommand.h:
+        (WebCore::AppendNodeCommand::create): Ditto.
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::appendNode): Ditto.
+        (WebCore::CompositeEditCommand::insertNodeAfter): Calls parentNode instead of parentElement.
+        * editing/CompositeEditCommand.h:
+
+2011-03-15  David Grogan  <dgrogan@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Fix crash caused by Invalid call to destroyActiveDOMObject during stopActiveDOMObjects
+        https://bugs.webkit.org/show_bug.cgi?id=56350
+
+        When a frame is unloaded, ScriptExecutionContext::stopActiveDOMObjects
+        calls stop() on each ActiveDOMObject.
+
+        Calling IDBDatabase::stop() can cause IDBDatabase to be destroyed:
+        * IDBDatabase::stop() causes the chrome message dispatcher to remove
+        its reference to IDBDatabase, which it has as type
+        IDBDatabaseCallbacks.
+        * If that reference is the last one, the IDBDatabase is destroyed.
+        * Destroying an ActiveDOMObject while they are being iterated over causes
+        a defensive crash.
+        
+        This change creates a separate IDBDatabaseCallbacks object that is not
+        an ActiveDOMObject, so it can be destroyed by
+        ScriptExecutionContext::stopActiveDOMObjects.
+        
+        Because the chrome message dispatcher is only used in multi-process
+        chromium, that's the only platform affected.  Chromium browser tests
+        forthcoming.
+
+        * WebCore.gypi:
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::IDBDatabase):
+        (WebCore::IDBDatabase::~IDBDatabase):
+        (WebCore::IDBDatabase::setVersion):
+        (WebCore::IDBDatabase::close):
+        (WebCore::IDBDatabase::open):
+        * storage/IDBDatabase.h:
+        * storage/IDBDatabaseCallbacks.h:
+        (WebCore::IDBDatabaseCallbacks::unRegisterDatabase):
+        * storage/IDBDatabaseCallbacksImpl.cpp: Copied from Source/WebCore/storage/IDBDatabaseCallbacks.h.
+        (WebCore::IDBDatabaseCallbacksImpl::create):
+        (WebCore::IDBDatabaseCallbacksImpl::IDBDatabaseCallbacksImpl):
+        (WebCore::IDBDatabaseCallbacksImpl::onVersionChange):
+        (WebCore::IDBDatabaseCallbacksImpl::unRegisterDatabase):
+        * storage/IDBDatabaseCallbacksImpl.h: Copied from Source/WebCore/storage/IDBDatabaseCallbacks.h.
+        (WebCore::IDBDatabaseCallbacksImpl::~IDBDatabaseCallbacksImpl):
+
+2011-03-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        accessibility should build in WebCore GYP build
+        https://bugs.webkit.org/show_bug.cgi?id=56405
+
+        This patch changes our include/exclude strategy to more closely match
+        the strategy used by the Chromium GYP build system.  Ideally, we'd find
+        a way to share more of these patterns.  In the meantime, I'm going to
+        slowly increase the number of translation units in the project and
+        adjust the include/exclude filters appropriately.
+
+        * gyp/WebCore.gyp:
+
+2011-03-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (WebKit2): keygen element doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=56402
+        <rdar://problem/9006545>
+
+        Covered by existing regresison tests.
+
+        * English.lproj/Localizable.strings:
+
+        * WebCore.exp.in: Removed WebCoreKeyGenerator, which no longer exists. Added
+        _wkSignedPublicKeyAndChallengeString, so that this WKSI function could be used in WebCore.
+
+        * platform/mac/SSLKeyGeneratorMac.mm: Removed.
+        * platform/mac/WebCoreKeyGenerator.h: Removed.
+        * platform/mac/WebCoreKeyGenerator.m: Removed.
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * WebCore.xcodeproj/project.pbxproj:
+        Renamed SSLKeyGeneratorMac.mm to .cpp, as it doesn't use any Objective C any more.
+        Removed WebCoreKeyGenerator, as we no longer need an interface to WebKit.
+
+        * platform/LocalizationStrategy.h:
+        * platform/LocalizedStrings.cpp:
+        (WebCore::keygenMenuItem512):
+        (WebCore::keygenMenuItem1024):
+        (WebCore::keygenMenuItem2048):
+        (WebCore::keygenKeychainItemName):
+        * platform/LocalizedStrings.h:
+        Added strings used by keygen element, now that the code using them is in WebCore.
+
+        * platform/mac/SSLKeyGeneratorMac.cpp: Copied from Source/WebCore/platform/mac/SSLKeyGeneratorMac.mm.
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        Moved the code from WebKit. There is never any need to provide implementation at runtime,
+        like old code was doing.
+
+        * platform/win/SSLKeyGeneratorWin.cpp: (WebCore::WebCore::getSupportedKeySizes):
+        Added a FIXME about localization. Note that Safari for Windows doesn't support keygen.
+
+2011-03-15  Anders Carlsson  <andersca@apple.com>
+
+        Fix clang build.
+
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/GraphicsLayer.h:
+
+2011-03-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Lion build after r81161.
+        
+        Pass the PlatformCALayer down into drawLayerContents()
+        so we can use its acceleratesDrawing() method.
+
+        * platform/graphics/mac/WebLayer.h:
+        * platform/graphics/mac/WebLayer.mm:
+        (drawLayerContents):
+        (-[WebLayer drawInContext:]):
+        * platform/graphics/mac/WebTiledLayer.mm:
+        (-[WebTiledLayer drawInContext:]):
+
+2011-03-15  Alok priyadarshi  <alokp@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Valgrind error due to uninitialized PluginLayerChromium::m_textureId
+        https://bugs.webkit.org/show_bug.cgi?id=56390
+
+        * platform/graphics/chromium/PluginLayerChromium.cpp:
+        (WebCore::PluginLayerChromium::PluginLayerChromium):
+        * platform/graphics/chromium/PluginLayerChromium.h:
+        (WebCore::PluginLayerChromium::textureId):
+
+2011-03-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        REGRESSION (r68976): Incorrect bidi rendering in SVG text
+        https://bugs.webkit.org/show_bug.cgi?id=53980
+
+        rework the test engine or SVG "text-intro" tests so we can turn them back on
+        https://bugs.webkit.org/show_bug.cgi?id=6524
+
+        svg/W3C-SVG-1.1/text-intro-0*.svg fail when MS Office fonts are present
+        https://bugs.webkit.org/show_bug.cgi?id=11662
+
+        svg/batik/text/textBiDi.svg failing
+        https://bugs.webkit.org/show_bug.cgi?id=17392
+
+        SVG bidi examples at w3C I18N WG tutorials are not rendered correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=24374
+
+        Implement proper bidirectionality support for SVG text.
+
+        BiDi didn't work properly until now, because the x/y/dx/dy/rotate value lists are stored in logical order (aka. in
+        the order the characters appear in the markup), and when laying out bidi text, we associated the current character
+        in visual order with the current x/y/dx/dy/rotate value in logical order, messing up RTL text layout.
+        The BiDi algorithm itself, inherited by RenderBlockLineLayout, works just fine, the inline box tree is correct.
+
+        Long story:
+        Before the inline box tree is created, SVGTextLayoutAttributesBuilder builds a list of x/y/dx/dy/rotate/<text metrics>
+        for each RenderSVGInlineText* object, called SVGTextLayoutAttributes. This happens in logical order, as specified in
+        the markup. <text x="10 20" y="10">abcdef</text> creates a SVGTextLayoutAttributes object in the renderer associated with
+        "abcdef" that contains (10, 20) for x, (10) for y, the dx/dy/rotate lists are empty, and the SVGTextMetrics list holds 6
+        width/height values for each of the glyphs (and some other infromation, see SVGTextMetrics class).
+        The SVGTextLayoutAttributes object is _used by_ RenderBlockLineLayout when applying the BiDi algorithm as SVG demands
+        that BiDi reordering does not happen across text chunks (a text chunk is defined by an absolute position, eg. x="10").
+
+        To summarize: SVGTextLayoutAttributes are stored in all RenderSVGInlineText renderers, caching the metrics of all
+        characters, their position based on the DOM attributes x/y/dx/dy/rotate. Using that information it's possible to
+        determine whether a position starts a new text chunk, and that's used by RenderBlockLineLayout to create the 
+        inline box tree, in _visual order_, as it will appear on screen.
+
+        After the inline box tree is created, the SVGRootInlineBox traverses its children in visual order and feeds the
+        found text boxes to SVGTextLayoutEngine, which lays out the text on a line or a path, according to SVG text layout
+        rules. For each character of the passed in InlineTextBox, it determines the x/y/dx/dy/rotate value, and the position
+        in the <text metrics> list of the renderer. The problem here is that the passed in text boxes are in visual order,
+        the x/y/.. lists are all in logical order.
+
+        Example: <text direction="rtl" unicde-bidi="bidi-override" x="10 20">abcdef</text>, reverse the text direction:
+                 the visual order now is: "fedcba", where 'f' should be associated with x="10" and 'e' with x="20".
+
+        Fix that problem, by computing a list of text boxes in _logical_ order in advance and pass it to SVGTextLayoutEngine,
+        before it starts processing the boxes in visual order, fed by SVGRootInlineBox. When laying oout text, we can now
+        process text in visual order, but grab the x/y/.. coordinates from the renderer in logical order.
+
+        Some more work was needed to truly fix Arabic. The SVGTextLayoutAttributesBuilder measured all characters isolated,
+        which is not a problem with latin text, but results in wrong advances for Arabic text, as isolated forms, instead of
+        shaped forms are measured. This broke text-anchor support, text queries on Arabic text etc. Fixed now, covered by
+        dozens of new tests.
+
+        Tests: svg/W3C-I18N/g-dirLTR-ubNone.svg
+               svg/W3C-I18N/g-dirLTR-ubOverride.svg
+               svg/W3C-I18N/g-dirRTL-ubNone.svg
+               svg/W3C-I18N/g-dirRTL-ubOverride.svg
+               svg/W3C-I18N/text-anchor-dirLTR-anchorEnd.svg
+               svg/W3C-I18N/text-anchor-dirLTR-anchorMiddle.svg
+               svg/W3C-I18N/text-anchor-dirLTR-anchorStart.svg
+               svg/W3C-I18N/text-anchor-dirNone-anchorEnd.svg
+               svg/W3C-I18N/text-anchor-dirNone-anchorMiddle.svg
+               svg/W3C-I18N/text-anchor-dirNone-anchorStart.svg
+               svg/W3C-I18N/text-anchor-dirRTL-anchorEnd.svg
+               svg/W3C-I18N/text-anchor-dirRTL-anchorMiddle.svg
+               svg/W3C-I18N/text-anchor-dirRTL-anchorStart.svg
+               svg/W3C-I18N/text-anchor-inherited-dirLTR-anchorEnd.svg
+               svg/W3C-I18N/text-anchor-inherited-dirLTR-anchorMiddle.svg
+               svg/W3C-I18N/text-anchor-inherited-dirLTR-anchorStart.svg
+               svg/W3C-I18N/text-anchor-inherited-dirRTL-anchorEnd.svg
+               svg/W3C-I18N/text-anchor-inherited-dirRTL-anchorMiddle.svg
+               svg/W3C-I18N/text-anchor-inherited-dirRTL-anchorStart.svg
+               svg/W3C-I18N/text-anchor-no-markup.svg
+               svg/W3C-I18N/text-dirLTR-ubNone.svg
+               svg/W3C-I18N/text-dirLTR-ubOverride.svg
+               svg/W3C-I18N/text-dirRTL-ubNone.svg
+               svg/W3C-I18N/text-dirRTL-ubOverride.svg
+               svg/W3C-I18N/tspan-dirLTR-ubEmbed-in-rtl-context.svg
+               svg/W3C-I18N/tspan-dirLTR-ubNone-in-rtl-context.svg
+               svg/W3C-I18N/tspan-dirLTR-ubOverride-in-default-context.svg
+               svg/W3C-I18N/tspan-dirLTR-ubOverride-in-ltr-context.svg
+               svg/W3C-I18N/tspan-dirLTR-ubOverride-in-rtl-context.svg
+               svg/W3C-I18N/tspan-dirNone-ubOverride-in-default-context.svg
+               svg/W3C-I18N/tspan-dirNone-ubOverride-in-ltr-context.svg
+               svg/W3C-I18N/tspan-dirNone-ubOverride-in-rtl-context.svg
+               svg/W3C-I18N/tspan-dirRTL-ubEmbed-in-default-context.svg
+               svg/W3C-I18N/tspan-dirRTL-ubEmbed-in-ltr-context.svg
+               svg/W3C-I18N/tspan-dirRTL-ubNone-in-default-context.svg
+               svg/W3C-I18N/tspan-dirRTL-ubNone-in-ltr-context.svg
+               svg/W3C-I18N/tspan-dirRTL-ubOverride-in-default-context.svg
+               svg/W3C-I18N/tspan-dirRTL-ubOverride-in-ltr-context.svg
+               svg/W3C-I18N/tspan-dirRTL-ubOverride-in-rtl-context.svg
+               svg/W3C-I18N/tspan-direction-ltr.svg
+               svg/W3C-I18N/tspan-direction-rtl.svg
+               svg/W3C-SVG-1.1-SE/text-intro-02-b.svg
+               svg/W3C-SVG-1.1-SE/text-intro-05-t.svg
+               svg/W3C-SVG-1.1-SE/text-intro-09-b.svg
+               svg/W3C-SVG-1.1/text-align-08-b.svg
+               svg/W3C-SVG-1.1/text-fonts-03-t.svg
+               svg/W3C-SVG-1.1/text-intro-01-t.svg
+               svg/W3C-SVG-1.1/text-intro-02-b.svg
+               svg/W3C-SVG-1.1/text-intro-03-b.svg
+               svg/W3C-SVG-1.1/text-intro-04-t.svg
+               svg/text/bidi-reorder-value-lists.svg
+               svg/text/bidi-text-anchor-direction.svg
+               svg/text/bidi-text-query.svg
+               svg/text/bidi-tspans.svg
+
+        * rendering/RenderBlockLineLayout.cpp: Remove hack that forced LTR support when unicode-bidi="normal" and handling SVG text.
+        (WebCore::RenderBlock::determineStartPosition):
+        * rendering/svg/SVGInlineTextBox.cpp: s/fragment.positionListOffset/fragment.characterOffset/
+        (WebCore::SVGInlineTextBox::offsetForPositionInFragment):
+        (WebCore::SVGInlineTextBox::constructTextRun):
+        (WebCore::SVGInlineTextBox::mapStartEndPositionsIntoFragmentCoordinates):
+        * rendering/svg/SVGRenderTreeAsText.cpp: Ditto.
+        (WebCore::writeSVGInlineTextBox):
+        * rendering/svg/SVGRootInlineBox.cpp: Add new buildTextBoxListInLogicalOrder(), collecting all text boxes recursively in logical order (aka. as specified in markup).
+                                              This is needed as we have to process x/y/dx/dy/rotate value lists of text/tspan/.. elements in logical order, not in visual
+                                              order as the characters are presented on screen.
+        (WebCore::SVGRootInlineBox::computePerCharacterLayoutInformation):
+        (WebCore::SVGRootInlineBox::buildTextBoxListInLogicalOrder):
+        (WebCore::SVGRootInlineBox::layoutCharactersInTextBoxes):
+        * rendering/svg/SVGRootInlineBox.h:
+        * rendering/svg/SVGTextChunk.cpp: Cleanup code, minimize SVGTextChunks memory consumption.
+        (WebCore::SVGTextChunk::SVGTextChunk): A text chunk now know whether its base progress direction is left-to-right or right-to-left.
+        (WebCore::SVGTextChunk::calculateLength):
+        (WebCore::SVGTextChunk::calculateTextAnchorShift): Make text-anchor direction aware. text-anchor="start/end" meaning depends on the context (ltr vs. rtl).
+        * rendering/svg/SVGTextChunk.h: Adapt code, merging three members into a bitfield.
+        (WebCore::SVGTextChunk::isVerticalText):
+        (WebCore::SVGTextChunk::hasDesiredTextLength):
+        (WebCore::SVGTextChunk::hasTextAnchor):
+        (WebCore::SVGTextChunk::hasLengthAdjustSpacing):
+        (WebCore::SVGTextChunk::hasLengthAdjustSpacingAndGlyphs):
+        * rendering/svg/SVGTextChunkBuilder.cpp: Adapt to SVGTextChunk code changes.
+        (WebCore::SVGTextChunkBuilder::addTextChunk):
+        (WebCore::SVGTextChunkBuilder::processTextChunk):
+        * rendering/svg/SVGTextFragment.h: Add metricsListOffset, needed only while laying out text.
+        (WebCore::SVGTextFragment::SVGTextFragment): Rename positionListOffset to characterOffset, as it describes an offset in the textRenderer->characters() array.
+        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp
+        (WebCore::SVGTextLayoutAttributesBuilder::propagateLayoutAttributes): Fix measuring Arabic text in LTR/RTL modes. Assure that each SVGTextMetrics object
+                                                                              that we cache, refers to the _rendered_ character. For Arabic text that means, that we're
+                                                                              measuring the shaped width of the glyph, not the glyph in its isolated form. Without that
+                                                                              fix reordering boxes containing Arabic is wrong.
+        * rendering/svg/SVGTextLayoutEngine.cpp: SVGTextLayoutEngine is fed with text boxes to be laid out in _visual_ order, left-to-right, after the BiDi algorithm
+                                                 has been applied by RenderBlockLineLayout to create the inline box tree. The coordinates lists x/y/dx/dy/rotate have
+                                                 to be processed in _logical_ order. SVGRootInlineBox now passes a list of text boxes in logical order to SVGTextLayoutEngine,
+                                                 to assure it grabs the coordinates from the correct InlineTextBox. See examples at the top of the ChangeLog.
+        (WebCore::SVGTextLayoutEngine::SVGTextLayoutEngine):
+        (WebCore::SVGTextLayoutEngine::recordTextFragment): No need to measure text here anymore, SVGTextLayoutAttributesBuilder now provides exact advances for each glyph.
+                                                            The width of a SVGTextFragment is always equal to the sum of each glyph advance. (This was not the case for
+                                                            Arabic until now.)
+        (WebCore::SVGTextLayoutEngine::finalizeTransformMatrices):
+        (WebCore::SVGTextLayoutEngine::nextLogicalBoxAndOffset): Computes the next logical box and the offset to the next coordinate value in its position list.
+        (WebCore::SVGTextLayoutEngine::layoutTextOnLineOrPath):
+        * rendering/svg/SVGTextLayoutEngine.h: Add CharacterRange helper struct.
+        (WebCore::SVGTextLayoutEngine::CharacterRange::CharacterRange):
+        * rendering/svg/SVGTextMetrics.cpp: Remove unused measureAllCharactersIndividually() method.
+        (WebCore::constructTextRun): Pass direction and unicode-bidi="override" values to the TextRun, otherwhise LTR is always asumed.
+        * rendering/svg/SVGTextMetrics.h:
+        (WebCore::SVGTextMetrics::setWidth): Add private setter, only SVGTextLayoutAttributesBuilder is allowed to modify the metrics (to fix up glyph widths for Arabic).
+        * rendering/svg/SVGTextQuery.cpp: s/fragment.positionListOffset/fragment.characterOffset/
+        (WebCore::SVGTextQuery::subStringLengthCallback):
+        (WebCore::SVGTextQuery::startPositionOfCharacterCallback):
+        (WebCore::SVGTextQuery::endPositionOfCharacterCallback):
+        (WebCore::calculateGlyphBoundaries):
+
+2011-03-15  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fix make distcheck for 1.3.13 release
+        https://bugs.webkit.org/show_bug.cgi?id=56371
+
+        No new tests as this is a build fix.
+
+        * GNUmakefile.am: added a couple of missing files.
+
+2011-03-08  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Get rid of firstDeepEditingPositionForNode and lastDeepEditingPositionForNode
+        https://bugs.webkit.org/show_bug.cgi?id=52642
+
+        Replacing calls to first/lastDeepEditingPositionForNode with calls to their analogous
+        functions that create new positions. Also fixing various parts of editing code that
+        incorrectly handled the new positions now being created.
+
+        No new tests as this is refactoring/cleanup.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::visiblePositionRange):
+        * dom/Position.cpp:
+        (WebCore::Position::parentAnchoredEquivalent):
+        (WebCore::Position::previous):
+        (WebCore::Position::next):
+        (WebCore::Position::atFirstEditingPositionForNode):
+        (WebCore::Position::atLastEditingPositionForNode):
+        (WebCore::Position::upstream):
+        (WebCore::Position::isCandidate):
+        (WebCore::Position::getInlineBoxAndOffset):
+        * dom/Position.h:
+        (WebCore::operator==):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::operator Position):
+        * editing/ApplyBlockElementCommand.cpp:
+        (WebCore::ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::isTableCellEmpty):
+        (WebCore::DeleteSelectionCommand::removeNode):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::unlistifyParagraph):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::positionAtEndOfInsertedContent):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::selectionFromContentsOfNode):
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries):
+        * editing/htmlediting.cpp:
+        (WebCore::firstEditablePositionAfterPositionInRoot):
+        (WebCore::lastEditablePositionBeforePositionInRoot):
+        (WebCore::enclosingEmptyListItem):
+        * editing/htmlediting.h:
+        * editing/visible_units.cpp:
+        (WebCore::startOfParagraph):
+        (WebCore::endOfParagraph):
+        (WebCore::startOfEditableContent):
+        (WebCore::endOfEditableContent):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForPoint):
+
+2011-03-15  Beth Dakin  <bdakin@apple.com>
+
+        Attempted build fix.
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::cancelAnimations):
+
+2011-03-15  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dave Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56329
+
+        Fix FontCache problems on Linux.  Make sure not to mutate the platform data passed in to SimpleFontData's
+        constructor.  Change this code to match Mac and to set the new m_hasVerticalGlyphs boolean instead of
+        mutating orientation.
+
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2011-03-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Disable ShadowBlur shadow drawing in accelerated contexts
+        https://bugs.webkit.org/show_bug.cgi?id=56392
+
+        When drawing into a graphics context that is accelerated, don't use
+        ShadowBlur, because it may be slower.
+        
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::fillRectWithRoundedHole):
+        (WebCore::GraphicsContext::setIsCALayerContext):
+        (WebCore::GraphicsContext::isCALayerContext):
+        (WebCore::GraphicsContext::setIsAcceleratedContext):
+        (WebCore::GraphicsContext::isAcceleratedContext):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        * platform/graphics/mac/WebLayer.mm:
+        (drawLayerContents):
+
+2011-03-15  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for <rdar://problem/9075624> Overlay scrollbars slow down PLT by 6%
+
+        Tell the ScrollAnimator to cancelAnimations() since we are navigating to a new 
+        page.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::transitionToCommitted):
+        
+        Scroll animations should be suspended if the FrameLoadState is anything but 
+        complete.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::shouldSuspendScrollAnimations):
+        * page/FrameView.h:
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::shouldSuspendScrollAnimations):
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::shouldSuspendScrollAnimations):
+        * rendering/RenderDataGrid.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::shouldSuspendScrollAnimations):
+        * rendering/RenderLayer.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::shouldSuspendScrollAnimations):
+        * rendering/RenderListBox.h:
+
+        New virtual function cancelAnimations() is only needed on the Mac, so the base 
+        class is empty.
+        * platform/ScrollAnimator.h:
+        (WebCore::ScrollAnimator::cancelAnimations):
+
+        ScrollAnimatorMac needs to keep track of whether the page has been scrolled since 
+        it started loading. If so, we will override optimizations that wait for the 
+        FrameLoadState to be complete before animating scrollbars.
+        * platform/mac/ScrollAnimatorMac.h:
+        (WebCore::ScrollAnimatorMac::haveScrolledSincePageLoad):
+
+        If the scrollbar animations should be suspended, we start a timer to make sure 
+        that we do flash the scrollbars. Animating the scrollbars is expensive, so this is 
+        both a performance optimization and a UI enhancement since the scrollbar won't 
+        jump around nearly as much on a page load.
+        * platform/mac/ScrollAnimatorMac.mm:
+        (-[ScrollbarPainterDelegate cancelAnimations]):
+        (-[ScrollbarPainterDelegate scrollerImp:animateKnobAlphaTo:duration:]):
+        (-[ScrollbarPainterDelegate scrollerImp:animateTrackAlphaTo:duration:]):
+        (-[ScrollbarPainterDelegate scrollerImp:overlayScrollerStateChangedTo:]):
+        (WebCore::ScrollAnimatorMac::ScrollAnimatorMac):
+        (WebCore::ScrollAnimatorMac::scroll):
+        (WebCore::ScrollAnimatorMac::handleWheelEvent):
+        (WebCore::ScrollAnimatorMac::cancelAnimations):
+        (WebCore::ScrollAnimatorMac::smoothScrollWithEvent):
+        (WebCore::ScrollAnimatorMac::beginScrollGesture):
+        (WebCore::ScrollAnimatorMac::startScrollbarPaintTimer):
+        (WebCore::ScrollAnimatorMac::scrollbarPaintTimerIsActive):
+        (WebCore::ScrollAnimatorMac::stopScrollbarPaintTimer):
+        (WebCore::ScrollAnimatorMac::initialScrollbarPaintTimerFired):
+
+        New WebCoreSystemInterface function to force the scrollbars to flash
+        * WebCore.exp.in:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2011-03-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove stale comment at RenderStyle::diff.
+        https://bugs.webkit.org/show_bug.cgi?id=56387
+
+        * rendering/style/RenderStyle.cpp: Removed comment.
+
+2011-03-15  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/56381> Objective-C classes should be typedef-ed as structs (not void*) in C++
+
+        Reviewed by Simon Fraser.
+
+        Typedef-ing Objective-C classes as void* for pure C++ makes it
+        easier for bugs to creep in because compilers can't do any type
+        checking for void pointers.
+
+        * platform/graphics/GraphicsContext3D.h: Changed typedef
+        declarations for CALayer and WebGLLayer from void* to structs.
+        (WebCore::GraphicsContext3D::platformLayer): Changed
+        static_cast<CALayer*> to reinterpret_cast<CALayer*> now that
+        CALayer and WebGLLayer are not void pointers.
+        * platform/graphics/GraphicsLayer.h: Changed typedef declaration
+        for PlatformLayer from void* to struct CALayer.
+        * platform/graphics/ca/PlatformCAAnimation.h: Changed typedef
+        declaration for CAPropertyAnimation from void* to a struct.
+        Extracted typdef for PlatformAnimationRef.
+
+2011-03-15  Ilya Sherman  <isherman@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Autofilled form elements are assigned fixed background color but not text color
+        https://bugs.webkit.org/show_bug.cgi?id=48382
+
+        Test: fast/forms/input-autofilled.html
+
+        * css/html.css:
+        (input:-webkit-autofill): Added foreground color: #000000
+        * css/wml.css:
+        (input:-webkit-autofill): Added foreground color: #000000
+
+2011-03-15  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Eric Carlson.
+
+        HTMLMediaElement::mediaPlayerPlaybackStateChanged should not change the "public" state of the element
+        if it's an internal pause for example.
+        https://bugs.webkit.org/show_bug.cgi?id=56374
+
+        In case of an internal pause, the callback from the mediaplayer should be ignored to avoid reflecting the
+        change into the DOM.
+
+        No new tests: Verified manually.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerPlaybackStateChanged):
+
+2011-03-12  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: re-implement xhr breakpoints.
+        https://bugs.webkit.org/show_bug.cgi?id=56252
+
+        - restore xhr breakpoints one by one instead of using setAllBrowserBreakpoints
+        - store xhr breakpoints in a separate setting
+        - move presentation-related code from BreakpointManager to XHRBreakpointsSidebarPane
+
+        Test: inspector/debugger/xhr-breakpoints.html
+
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::InspectorBrowserDebuggerAgent):
+        (WebCore::InspectorBrowserDebuggerAgent::inspectedURLChanged):
+        (WebCore::InspectorBrowserDebuggerAgent::restoreStickyBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::setXHRBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::removeXHRBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::willSendXMLHttpRequest):
+        (WebCore::InspectorBrowserDebuggerAgent::clear):
+        * inspector/InspectorBrowserDebuggerAgent.h:
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.setXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype.removeXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype.breakpointViewForEventData):
+        (WebInspector.BreakpointManager.prototype._projectChanged):
+        (WebInspector.BreakpointManager.prototype._validateBreakpoints):
+        (WebInspector.BreakpointManager.prototype._createEventListenerBreakpointId):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.XHRBreakpointsSidebarPane):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._addButtonClicked.finishEditing):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._addButtonClicked):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._setBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._removeBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._contextMenu.removeBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._contextMenu):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._checkboxClicked):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._labelClicked.finishEditing):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._labelClicked):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype.highlightBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype.clearBreakpointHighlight):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._saveBreakpoints):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._restoreBreakpoints):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._projectChanged):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.prototype._xhrBreakpointHit):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype._clearInterface):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        * inspector/front-end/inspector.js:
+        (WebInspector.resetFocusElement):
+        (WebInspector.set attached):
+
+2011-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin Adler.
+
+        Introduce WTF_USE_EXPORT_MACROS, which will allow us to put shared library import/export
+        info into the headers rather than in export symbol definition files, but disable it on 
+        all platforms initially so we can deal with port build issues one port at a time.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=27551
+
+        * config.h:
+        * platform/mac/LoggingMac.mm:
+
+2011-03-15  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed build fix.
+
+        Chromium: shared lib linux build are failing.
+
+        Two exclude rules for LocalizedNumberNone and TextEncodingDetectorNone were added to the wrong library.
+        It was webcore_remaining instead of webcore_platform.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2011-03-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: expanding/collapsing object shouldn&apos;t affect outer console.group expansion state
+        https://bugs.webkit.org/show_bug.cgi?id=56373
+
+        * inspector/front-end/Section.js:
+        (WebInspector.Section):
+        (WebInspector.Section.prototype.toggleExpanded):
+        (WebInspector.Section.prototype.handleClick): stop click even propagation if it was handled by this section.
+
+2011-03-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: crash upon "//html//@id" search in elements panel.
+        https://bugs.webkit.org/show_bug.cgi?id=56334
+
+        * inspector/InspectorDOMAgent.cpp:
+        * inspector/front-end/ElementsTreeOutline.js:
+
+2011-03-15  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: further extension API cleanup (removed inspectedPage, add experimental prefix)
+        https://bugs.webkit.org/show_bug.cgi?id=56327
+
+        * inspector/front-end/ExtensionAPI.js:
+        (WebInspector.injectedExtensionAPI):
+        * inspector/front-end/ExtensionAPISchema.json:
+
+2011-03-15  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: when console.groupEnd calls twice
+        https://bugs.webkit.org/show_bug.cgi?id=56114
+
+        Test: inspector/console/console-nested-group.html
+
+        * inspector/ConsoleMessage.h:
+        (WebCore::ConsoleMessage::type):
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::addConsoleMessage): do not coalesce adjacent EndGroup messages.
+
+2011-03-15  Chris Mumford  <chris.mumford@palm.com>
+
+        Reviewed by Adam Barth.
+
+        Initializing several member variables that were not initialized in
+        their constructors. These values were all read prior to initialization
+        as reported by Valgrind.
+
+        No new tests: No feature additions/removals.
+
+        * accessibility/AccessibilityImageMapLink.cpp:
+        (WebCore::AccessibilityImageMapLink::AccessibilityImageMapLink):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::DeleteSelectionCommand):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::HTMLCanvasElement):
+        * xml/XPathResult.cpp:
+        (WebCore::XPathResult::XPathResult):
+
+2011-03-15  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56255
+        Fix build on Solaris 10/Sun Studio 12 C++
+
+        No new tests. This is to fix compilation on Solaris 10 with Sun Studio 12 C++
+
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::getConcreteArray):
+
+2011-03-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben
+
+        about:blank fake responses don't get serialized when sent the UIProcess
+        <rdar://problem/9108119>
+        https://bugs.webkit.org/show_bug.cgi?id=56357
+
+        Test: AboutBlankLoad
+
+        * platform/network/cf/ResourceResponse.h:
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::cfURLResponse):
+        Create a CFURLResponseRef if one does not exist yet as we do for
+        NSURLResponses on the mac.
+
+2011-03-14  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Seeking videos using the timeline bar does not work properly and stop the video playback.
+        https://bugs.webkit.org/show_bug.cgi?id=56145
+
+        We do not need seekTimeout and queuedSeekTimeout anymore. setPosition on QMediaPlayer is good enough.
+        positionChanged() will be emitted when the data is buffered. On Linux the signal was not emitted because
+        of a bug in QtMultimedia.
+
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivateQt::MediaPlayerPrivateQt):
+        (WebCore::MediaPlayerPrivateQt::seek):
+        (WebCore::MediaPlayerPrivateQt::stateChanged):
+        (WebCore::MediaPlayerPrivateQt::positionChanged):
+        * platform/graphics/qt/MediaPlayerPrivateQt.h:
+
+2011-03-14  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=44138
+        Crash beneath SocketStreamHandle::readStreamCallback when running websocket/tests/workers/worker-handshake-challenge-randomness.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=55375
+        http/tests/websocket/tests/reload-crash.html sometimes crashes beneath SocketStreamHandle::readStreamCallback on Windows
+
+        https://bugs.webkit.org/show_bug.cgi?id=56185
+        http/tests/websocket/tests/url-with-credential.html sometimes crashes beneath SocketStreamHandle::readStreamCallback on Windows
+
+        * platform/network/cf/SocketStreamHandle.h: Made SocketStreamHandle ThreadSafeShared, so that
+        a pointer can be passed across threads when wrapped in a RefPtr.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Make sure that an object still exists
+        when executing a method on main thread by using RefPtr.
+
+2011-03-14  Sam Weinig  <sam@webkit.org>
+
+        Mac build fix. Part 1 of N.
+
+        * WebCore.exp.in:
+
+2011-03-14  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Eric Carlson.
+
+        Stalled media elements don't stop delaying the load event
+        https://bugs.webkit.org/show_bug.cgi?id=56316
+
+        We should stop delaying the load event when the load has
+        stalled naturally, or if we require a user gesture to
+        continue the load.
+
+        Test: http/tests/media/video-play-stall-before-meta-data.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setNetworkState): when suspending, stop delaying.
+        (WebCore::HTMLMediaElement::progressEventTimerFired): when stalling, stop delaying.
+
+2011-03-13  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Tony Chang.
+
+        Crash when dragging and dropping in a document with an invalid XHTML header
+        https://bugs.webkit.org/show_bug.cgi?id=48799
+
+        DragController tried to dispatch textInput event even when the
+        drag destination is not the editable area.
+        This change skips the event dispatching on that case.
+        
+        Test: editing/pasteboard/drop-file-svg.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::dispatchTextInputEventFor):
+        (WebCore::DragController::concludeEditDrag):
+
+2011-03-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81094.
+        http://trac.webkit.org/changeset/81094
+        https://bugs.webkit.org/show_bug.cgi?id=56355
+
+        Broke the chromium DRT related build. (Requested by dave_levin
+        on #webkit).
+
+        * WebCore.exp.in:
+        * WebCore.order:
+        * page/Frame.cpp:
+        (WebCore::Frame::layerTreeAsText):
+        * page/Frame.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::layerTreeAsText):
+        * rendering/RenderLayerCompositor.h:
+
+2011-03-14  Adam Barth  <abarth@webkit.org>
+
+        Apparently we need to exclude DefaultSharedWorkerRepository.cpp from
+        the Chromium build, otherwise the objects visible in the global scope
+        change.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2011-03-14  Adam Barth  <abarth@webkit.org>
+
+        Attempted Chromium build fix.  Exclude AllInOne harder.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2011-03-14  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        EventHandler calls shouldChangeSelection needlessly
+        https://bugs.webkit.org/show_bug.cgi?id=56324
+
+        Extracted setSelectionIfNeeded and setNonDirectionalSelectionIfNeeded and
+        avoided calling shouldChangeSelection and setSelection when the existing
+        selection is identical to that of new selection.
+
+        * page/EventHandler.cpp:
+        (WebCore::setSelectionIfNeeded): Extracted.
+        (WebCore::setNonDirectionalSelectionIfNeeded): Extracted.
+        (WebCore::EventHandler::selectClosestWordFromMouseEvent): Calls a helper function above.
+        (WebCore::EventHandler::selectClosestWordOrLinkFromMouseEvent): Ditto.
+        (WebCore::EventHandler::handleMousePressEventTripleClick): Ditto.
+        (WebCore::EventHandler::handleMousePressEventSingleClick): Ditto.
+        (WebCore::EventHandler::updateSelectionForMouseDrag): Ditto.
+        (WebCore::EventHandler::handleMouseReleaseEvent): Ditto.
+
+2011-03-14  Daniel Sievers  <sievers@google.com>
+
+        Reviewed by Simon Fraser.
+
+        [Chromium] Make RenderAsTextBehavior and LayerTreeAsTextBehavior tweakable from the DumpRenderTree commandline
+        https://bugs.webkit.org/show_bug.cgi?id=56139
+
+        * WebCore.exp.in:
+        * WebCore.order:
+        * page/Frame.cpp:
+        (WebCore::Frame::layerTreeAsText):
+        * page/Frame.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::layerTreeAsText):
+        * rendering/RenderLayerCompositor.h:
+
+2011-03-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add remaining files to WebCore.gypi
+        https://bugs.webkit.org/show_bug.cgi?id=56351
+
+        Adding the remaining files to WebCore.gypi required updating the
+        include/exclude lists in WebCore.gyp.  These lists aren't overly
+        elegant, but we can try to improve them in the future.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * bindings/v8/ScriptCachedFrameData.cpp:
+            - Added ifdefs to this file to match the header.
+        * platform/graphics/WOFFFileFormat.cpp:
+            - Fixed build error when compiling without ENABLE(OPENTYPE_SANITIZER).
+
+2011-03-14  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] Rework object group building.
+        https://bugs.webkit.org/show_bug.cgi?id=55399
+
+        Instead of going top-down (from owner to owned elements), go up---from objects
+        to their group ids.  That fits better to v8's object grouping model and guarantees
+        that each wrapper belongs to the single group.
+
+        Alas, this cannot be implemented for one kind of objects---CSSProperties.
+
+        Part of core GC algorithm and tested extensively by exisiting layout tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::calculateGroupId):
+        (WebCore::calculateRootStyleSheet):
+        (WebCore::GrouperVisitor::visitDOMWrapper):
+        (WebCore::GrouperVisitor::applyGrouping):
+        (WebCore::V8GCController::gcPrologue):
+        * bindings/v8/WrapperTypeInfo.h:
+        (WebCore::WrapperTypeInfo::isSubclass):
+        * css/CSSRuleList.h:
+        (WebCore::CSSRuleList::styleList):
+        * css/StyleSheetList.h:
+        (WebCore::StyleSheetList::document):
+
+2011-03-14  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Assertion failure by form validation message for <select required> with float:left
+        https://bugs.webkit.org/show_bug.cgi?id=55995
+
+        Test: fast/forms/interactive-validation-select-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::canMergeContiguousAnonymousBlocks):
+          isAnonymousBlock() doesn't mean it is a RenderBlock. We need to check isRenderBlock().
+
+2011-03-14  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [Qt][WK2]Unbreak InjectedBundle on Qt
+        https://bugs.webkit.org/show_bug.cgi?id=54109
+
+        No code changes so no new tests.
+
+        Revert the changes that were needed to use KURL
+        in WebKitTestRunner.
+
+        * Configurations/WebCore.xcconfig:
+        * WebCore.exp.in:
+
+2011-03-14  Jarkko Sakkinen  <jarkko.j.sakkinen@gmail.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Compilation fails with --3d-canvas 
+        https://bugs.webkit.org/show_bug.cgi?id=55964
+
+        * WebCore.pro:
+        * platform/graphics/qt/Extensions3DQt.cpp:
+
+2011-03-14  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben and Gavin Barraclough.
+
+        FileSystemWin.cpp needs listDirectory() implementation
+        https://bugs.webkit.org/show_bug.cgi?id=56331
+        <rdar://problem/9126635>
+        
+        Move PathWalker from an inline class in WebKit2 to its own class in WebCore,
+        so it can be used from both WebCore and WebKit2.
+        
+        Implement FileSystemWin::listDirectory using PathWalker to populate the Vector
+        of paths matching the passed in pattern.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::listDirectory): Call through to PathWalker.
+        * platform/win/PathWalker.cpp: Added.
+        (WebCore::PathWalker::PathWalker): Moved from WebKit2. Added a second argument
+            for the pattern to pass to the Windows File APIs.
+        (WebCore::PathWalker::~PathWalker): Moved from WebKit2.
+        (WebCore::PathWalker::isValid): Ditto.
+        (WebCore::PathWalker::data): Ditto.
+        (WebCore::PathWalker::step): Ditto.
+        * platform/win/PathWalker.h: Added.
+
+2011-03-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56320
+        Remove HistoryItem::icon() and the WebCore dependency on "IconDatabaseBase::defaultIcon()"
+
+        Remove HistoryItem::icon():
+        * history/HistoryItem.cpp:
+        * history/HistoryItem.h:
+        * WebCore.exp.in:
+
+        * loader/icon/IconDatabaseBase.h:
+        (WebCore::IconDatabaseBase::defaultIcon):
+
+2011-03-14  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Timer-based events should inherit the user gesture state of their
+        originating event in certain cases.
+        https://bugs.webkit.org/show_bug.cgi?id=55104
+
+        If a timer is installed by a gesture-originated event and will fire
+        within one second, the timer-initiated event should behave as if it
+        were also initiated by a user gesture. Multi-shot timers should only
+        get this behavior on their first execution. Nested timers should not
+        get this behavior. This makes us compatible with Gecko when handling
+        popups and file chooser dialogs created from timer events.
+
+        Test: fast/events/popup-blocking-timers.html
+
+        * page/DOMTimer.cpp:
+        (WebCore::timeoutId): Create a helper function so that m_timeoutId can
+        be initialized in the data member initialization list.
+        (WebCore::shouldForwardUserGesture): Ditto, but for
+        m_shouldForwardUserGesture.
+        (WebCore::DOMTimer::DOMTimer): Move initialization of data members from
+        the ctor body to the data member initialization list. Also rename the
+        argument 'timeout' to 'interval'.
+        (WebCore::DOMTimer::fired): Create a UserGestureIndicator and set its
+        state based on the value of m_shouldForwardUserGesture.
+        (WebCore::DOMTimer::adjustMinimumTimerInterval): m_originalTimeout was
+        renamed to m_originalInterval.
+        * page/DOMTimer.h: Add m_shouldForwardUserGesture and rename
+        m_originalTimeout to m_originalInterval.
+
+2011-03-09  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Deleting content directly following a button inserts an unnecessary placeholder
+        https://bugs.webkit.org/show_bug.cgi?id=56053
+
+        Fixing a use of Node's enclosingBlockFlowElement with enclosingBlock htmlediting's
+        enclosingBlock, as enclosingBlockFlowElement would return inline-block elements despite
+        DeleteSelectionCommand treating them as blockflow.
+
+        Test: editing/deleting/delete-inserts-br-after-button.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs):
+
+2011-03-14  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=45164
+
+        REGRESSION: <a><img align=top></a> Clickable area too large
+        
+        Make sure to clamp hit testing of quirky inline flow boxes the same way we already clamped
+        painting.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::nodeAtPoint):
+
+2011-03-14  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        REGRESSION (r75138-r75503): Animations on Apple HTML5 Gallery demo are wrong
+        https://bugs.webkit.org/show_bug.cgi?id=52845
+
+        The lastCommitTime() value in CACFLayerTreeHost was returning as the time
+        the render previous to this one happened. That often made it seem like
+        animations started more in the past than they did, breaking many animations.
+        The startAnimations() call actually fires from a CACF callback after all the
+        WebKit content has been rendered. So sending currentTime as the start time
+        to the animations is close enough for proper synchronization.
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
+        (WebCore::CACFLayerTreeHost::notifyAnimationsStarted):
+
+2011-03-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        Selection uses first mousemove's localRect instead of that of mousedown
+        https://bugs.webkit.org/show_bug.cgi?id=56213
+
+        Fixed the bug by adding an extra call to updateSelectionForMouseDrag in handleMouseDraggedEvent
+        using the mouse coordinates of the mousedown event that started the drag.
+
+        Test: editing/selection/drag-select-rapidly.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseDraggedEvent):
+
+2011-03-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Apply a large, blunt object directly to the skull of the Leopard build.
+
+        * Configurations/Base.xcconfig: Disable the generation of debugging symbols when
+        building the Debug configuration on Leopard. This should cut the size of the object
+        files that the linker needs to process by over 85%. This will hopefully allow them
+        to fit in to the 32-bit address space of the Leopard linker.
+
+2011-03-14  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56246
+        
+        Add support for relative positioning to table cells.   Back out the code that hacked around the lack of support
+        for offsetLeft, and add new tests to demonstrate that relative positioning works.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::offsetParent):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isRelPositioned):
+        * rendering/RenderTableCell.h:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h:
+
+2011-03-14  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Partial backout of https://bugs.webkit.org/show_bug.cgi?id=56230.  Go back to repainting the root
+        layer, since first layouts and printing mess up otherwise.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+
+2011-03-11  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Clean up full repainting of layers during layout and at other times.  Platforms that did not do an invalidation on
+        size changes were incorrectly relying on the DoFullRepaint case of RenderLayer::updateLayerPositions to invalidate
+        for them. However this code is now wrong, since it assumed that the outermost layer was a RenderView that encompassed
+        all of the child layers.  This is no longer the case since the overflow changes that tightened up visual overflow
+        and limited that overflow only to content that the layer painted.
+        
+        Eliminate the DoFullRepaint flag and actually make no repainting of any kind happen from the layer code if FrameView's
+        m_doFullRepaint boolean is set.  This will flush out any ports that aren't just invalidating the world on their
+        own in response to view resizes or fixed layout size changes and force them to fix things to be consistent with
+        the other ports.
+        
+        Make the two dynamic calls to updateLayerPositions still do a full repaint by setting the repaint flag on the layer.
+        I'm suspicious as to the correctness of the repainting in both of these cases (both before and after this patch),
+        but the behavior should be the same.
+        
+        No new tests, since this is untestable on ports that invalidate on a resize.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::removeOnlyThisLayer):
+        * rendering/RenderLayer.h:
+
+2011-03-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Ensure all values are correctly tagged in the registerfile
+        https://bugs.webkit.org/show_bug.cgi?id=56214
+
+        Make sure everything builds still.
+
+        * bridge/c/c_class.cpp:
+        * bridge/c/c_runtime.cpp:
+        * bridge/jni/JavaMethod.cpp:
+        * plugins/PluginViewNone.cpp:
+
+2011-03-14  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Unreviewed build fix for r81035.
+
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::defaultEventHandler):
+        * rendering/RenderDetailsMarker.cpp:
+        (WebCore::createDownArrowPath):
+        (WebCore::createUpArrowPath):
+        (WebCore::createLeftArrowPath):
+        (WebCore::createRightArrowPath):
+
+2011-03-13  Jer Noble  <jer.noble@apple.com>
+
+        FullScreen: Handle entering full screen security restrictions
+        https://bugs.webkit.org/show_bug.cgi?id=56264
+
+        Tests: fullscreen/full-screen-iframe-allowed.html
+               fullscreen/full-screen-iframe-not-allowed.html
+
+        Disable full screen documents in the following conditions:
+        1) requesting element is in an iframe which does not have a
+        webkitallowfullscreen attribute.
+        2) page is not processing a user gesture.
+
+        * dom/Document.cpp:
+        (WebCore::Document::fullScreenIsAllowedForElement): Added.  Checks
+            to see if elements contained in IFRAMES are allowed to
+            enter full screen.
+        (WebCore::Document::webkitRequestFullScreenForElement): Checks
+            if page is currently processing a user gesture.
+        * dom/Document.h:
+        * html/HTMLAttributeNames.in: Added webkitallowfullscreenAttr.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::allowFullScreen): Added.
+        * html/HTMLFrameElementBase.h:
+
+2011-03-14  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed by David Levin.
+
+        REGRESSION(r80892): Use of uninitialized variable "m_syncCloseDatabase" in StorageAreaSync::sync
+        https://bugs.webkit.org/show_bug.cgi?id=56303
+
+        Initialized m_syncCloseDatabase to false in the StorageAreaSync constructor.
+
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+
+2011-03-14  Steve Block  <steveblock@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        JavaMethod.cpp does not compile with V8
+        https://bugs.webkit.org/show_bug.cgi?id=56306
+
+        Moved the ScopeChain.h include to JavaStringJSC.
+
+        No new tests, build fix only.
+
+        * bridge/jni/JavaMethod.cpp:
+        * bridge/jni/jsc/JavaStringJSC.h
+
+2011-02-28  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Dave Hyatt.
+
+        HTML5 <details> and <summary>: rendering
+        https://bugs.webkit.org/show_bug.cgi?id=51071
+
+        Tests: fast/html/details-add-summary-1-and-click.html
+               fast/html/details-add-summary-1.html
+               fast/html/details-add-summary-10-and-click.html
+               fast/html/details-add-summary-10.html
+               fast/html/details-add-summary-2-and-click.html
+               fast/html/details-add-summary-2.html
+               fast/html/details-add-summary-3-and-click.html
+               fast/html/details-add-summary-3.html
+               fast/html/details-add-summary-4-and-click.html
+               fast/html/details-add-summary-4.html
+               fast/html/details-add-summary-5-and-click.html
+               fast/html/details-add-summary-5.html
+               fast/html/details-add-summary-6-and-click.html
+               fast/html/details-add-summary-6.html
+               fast/html/details-add-summary-7-and-click.html
+               fast/html/details-add-summary-7.html
+               fast/html/details-add-summary-8-and-click.html
+               fast/html/details-add-summary-8.html
+               fast/html/details-add-summary-9-and-click.html
+               fast/html/details-add-summary-9.html
+               fast/html/details-mouse-click.html
+               fast/html/details-no-summary1.html
+               fast/html/details-no-summary2.html
+               fast/html/details-no-summary3.html
+               fast/html/details-no-summary4.html
+               fast/html/details-open-javascript.html
+               fast/html/details-open1.html
+               fast/html/details-open2.html
+               fast/html/details-open3.html
+               fast/html/details-open4.html
+               fast/html/details-open5.html
+               fast/html/details-open6.html
+               fast/html/details-position.html
+               fast/html/details-remove-summary-1-and-click.html
+               fast/html/details-remove-summary-1.html
+               fast/html/details-remove-summary-2-and-click.html
+               fast/html/details-remove-summary-2.html
+               fast/html/details-remove-summary-3-and-click.html
+               fast/html/details-remove-summary-3.html
+               fast/html/details-remove-summary-4-and-click.html
+               fast/html/details-remove-summary-4.html
+               fast/html/details-remove-summary-5-and-click.html
+               fast/html/details-remove-summary-5.html
+               fast/html/details-remove-summary-6-and-click.html
+               fast/html/details-remove-summary-6.html
+               fast/html/details-writing-mode.html
+
+        http://www.w3.org/TR/html5/interactive-elements.html#the-details-element
+
+        The main <summary> element is the first <summary> element of a <details> element.
+        All other childs of the <details> element are rendered only if the attribute 'open' is set.
+        Click event toggles the 'open' attribute.
+
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::HTMLDetailsElement):
+        (WebCore::HTMLDetailsElement::findMainSummary):
+        (WebCore::HTMLDetailsElement::childrenChanged):
+        (WebCore::HTMLDetailsElement::finishParsingChildren):
+        (WebCore::HTMLDetailsElement::parseMappedAttribute):
+        (WebCore::HTMLDetailsElement::childShouldCreateRenderer):
+        (WebCore::HTMLDetailsElement::defaultEventHandler):
+        * html/HTMLDetailsElement.h:
+        (WebCore::HTMLDetailsElement::mainSummary):
+
+        Method createRenderer added to class HTMLSummaryElement.
+
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::HTMLSummaryElement::createRenderer):
+        * html/HTMLSummaryElement.h:
+
+        The first <summary> element is positioned at the top of its <details> parent.
+        The area occupied by this main <summary> element is the interactive area of the
+        <details> element. If the <details> tag has no <summary> child an OwnedSummaryRenderer
+        is created and added to the corresponding RenderDetails object.
+
+        * rendering/RenderDetails.cpp:
+        (WebCore::RenderDetails::RenderDetails):
+        (WebCore::RenderDetails::destroy):
+        (WebCore::RenderDetails::summaryBlock):
+        (WebCore::RenderDetails::contentBlock):
+        (WebCore::RenderDetails::addChild):
+        (WebCore::RenderDetails::removeChild):
+        (WebCore::RenderDetails::setMarkerStyle):
+        (WebCore::RenderDetails::styleDidChange):
+        (WebCore::RenderDetails::getRenderPosition):
+        (WebCore::RenderDetails::markerDestroyed):
+        (WebCore::RenderDetails::summaryDestroyed):
+        (WebCore::RenderDetails::moveSummaryToContents):
+        (WebCore::RenderDetails::createSummaryStyle):
+        (WebCore::RenderDetails::replaceMainSummary):
+        (WebCore::RenderDetails::createDefaultSummary):
+        (WebCore::RenderDetails::checkMainSummary):
+        (WebCore::RenderDetails::layout):
+        (WebCore::RenderDetails::isOpen):
+        (WebCore::RenderDetails::getParentOfFirstLineBox):
+        (WebCore::RenderDetails::firstNonMarkerChild):
+        (WebCore::RenderDetails::updateMarkerLocation):
+        * rendering/RenderDetails.h:
+        (WebCore::RenderDetails::interactiveArea):
+        (WebCore::RenderDetails::removeLeftoverAnonymousBlock):
+        (WebCore::RenderDetails::createsAnonymousWrapper):
+        (WebCore::RenderDetails::requiresForcedStyleRecalcPropagation):
+
+        A marker is added to the main <summary> element to indicate the current value of the 'open'
+        attribute of the <details> element.
+
+        * rendering/RenderDetailsMarker.cpp:
+        (WebCore::RenderDetailsMarker::RenderDetailsMarker):
+        (WebCore::RenderDetailsMarker::destroy):
+        (WebCore::RenderDetailsMarker::lineHeight):
+        (WebCore::RenderDetailsMarker::baselinePosition):
+        (WebCore::RenderDetailsMarker::computePreferredLogicalWidths):
+        (WebCore::RenderDetailsMarker::layout):
+        (WebCore::RenderDetailsMarker::getRelativeMarkerRect):
+        (WebCore::RenderDetailsMarker::isOpen):
+        (WebCore::createPath):
+        (WebCore::createDownArrowPath):
+        (WebCore::createUpArrowPath):
+        (WebCore::createLeftArrowPath):
+        (WebCore::createRightArrowPath):
+        (WebCore::RenderDetailsMarker::orientation):
+        (WebCore::RenderDetailsMarker::getCanonicalPath):
+        (WebCore::RenderDetailsMarker::getPath):
+        (WebCore::RenderDetailsMarker::paint):
+        * rendering/RenderDetailsMarker.h:
+        (WebCore::toRenderDetailsMarker):
+
+        * rendering/RenderSummary.cpp:
+        (WebCore::RenderSummary::RenderSummary):
+        (WebCore::RenderSummary::destroy):
+        (WebCore::RenderSummary::parentDetails):
+        (WebCore::RenderSummary::styleDidChange):
+        * rendering/RenderSummary.h:
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::RenderTreeAsText::writeRenderObject):
+
+2011-03-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56296
+        Clean up IconDatabaseBase header.
+
+        -Get rid of the "PlatformString.h" include and replace it with a forward declaration.
+        -Group methods by which are used in WebCore directly and which are used in WebKit ports.
+
+        This'll make it easier to use in external frameworks (like WebKit2).
+
+        * loader/icon/IconDatabase.h:
+        * loader/icon/IconDatabaseBase.h:
+        (WebCore::IconDatabaseBase::retainIconForPageURL):
+        (WebCore::IconDatabaseBase::releaseIconForPageURL):
+        (WebCore::IconDatabaseBase::iconForPageURL):
+        (WebCore::IconDatabaseBase::setIconURLForPageURL):
+        (WebCore::IconDatabaseBase::setIconDataForIconURL):
+        (WebCore::IconDatabaseBase::iconDataKnownForIconURL):
+        (WebCore::IconDatabaseBase::loadDecisionForIconURL):
+        (WebCore::IconDatabaseBase::importIconURLForPageURL):
+        (WebCore::IconDatabaseBase::importIconDataForIconURL):
+        (WebCore::IconDatabaseBase::open):
+
+2011-03-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81026.
+        http://trac.webkit.org/changeset/81026
+        https://bugs.webkit.org/show_bug.cgi?id=56313
+
+        Breaks gtk 64-bit tests (Requested by podivilov on #webkit).
+
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::InspectorBrowserDebuggerAgent):
+        (WebCore::InspectorBrowserDebuggerAgent::inspectedURLChanged):
+        (WebCore::InspectorBrowserDebuggerAgent::restoreStickyBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::setXHRBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::removeXHRBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::willSendXMLHttpRequest):
+        (WebCore::InspectorBrowserDebuggerAgent::clear):
+        * inspector/InspectorBrowserDebuggerAgent.h:
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.createXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype._createXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype.breakpointViewForEventData):
+        (WebInspector.BreakpointManager.prototype._projectChanged):
+        (WebInspector.BreakpointManager.prototype._validateBreakpoints):
+        (WebInspector.BreakpointManager.prototype._createEventListenerBreakpointId):
+        (WebInspector.BreakpointManager.prototype._createXHRBreakpointId):
+        (WebInspector.XHRBreakpoint):
+        (WebInspector.XHRBreakpoint.prototype._enable):
+        (WebInspector.XHRBreakpoint.prototype._disable):
+        (WebInspector.XHRBreakpoint.prototype._serializeToJSON):
+        (WebInspector.XHRBreakpointView):
+        (WebInspector.XHRBreakpointView.prototype.compareTo):
+        (WebInspector.XHRBreakpointView.prototype.populateEditElement):
+        (WebInspector.XHRBreakpointView.prototype.populateLabelElement):
+        (WebInspector.XHRBreakpointView.prototype.populateStatusMessageElement):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.XHRBreakpointsSidebarPane.addButtonClicked):
+        (WebInspector.XHRBreakpointsSidebarPane):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype.addBreakpointItem):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._startEditingBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._hideEditBreakpointDialog):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype._clearInterface):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        * inspector/front-end/inspector.js:
+        (WebInspector.resetFocusElement):
+        (WebInspector.createXHRBreakpointsSidebarPane.breakpointAdded):
+        (WebInspector.createXHRBreakpointsSidebarPane):
+        (WebInspector.set attached):
+
+2011-03-14  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Factor out binary search algo from the insertionIndexForObjectInListSortedByFunction function.
+        https://bugs.webkit.org/show_bug.cgi?id=56312
+
+        Test: inspector/utilities.html
+
+        * inspector/front-end/utilities.js:
+
+2011-03-12  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: re-implement xhr breakpoints.
+        https://bugs.webkit.org/show_bug.cgi?id=56252
+
+        - restore xhr breakpoints one by one instead of using setAllBrowserBreakpoints
+        - store xhr breakpoints in a separate setting
+        - move presentation-related code from BreakpointManager to XHRBreakpointsSidebarPane
+
+        Test: inspector/debugger/xhr-breakpoints.html
+
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        (WebCore::InspectorBrowserDebuggerAgent::InspectorBrowserDebuggerAgent):
+        (WebCore::InspectorBrowserDebuggerAgent::inspectedURLChanged):
+        (WebCore::InspectorBrowserDebuggerAgent::restoreStickyBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::setXHRBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::removeXHRBreakpoint):
+        (WebCore::InspectorBrowserDebuggerAgent::willSendXMLHttpRequest):
+        (WebCore::InspectorBrowserDebuggerAgent::clear):
+        * inspector/InspectorBrowserDebuggerAgent.h:
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.setXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype.removeXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype.breakpointViewForEventData):
+        (WebInspector.BreakpointManager.prototype._projectChanged):
+        (WebInspector.BreakpointManager.prototype._validateBreakpoints):
+        (WebInspector.BreakpointManager.prototype._createEventListenerBreakpointId):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.XHRBreakpointsSidebarPane):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._addButtonClicked.finishEditing):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._addButtonClicked):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._setBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._removeBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._contextMenu.removeBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._contextMenu):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._checkboxClicked):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._labelClicked.finishEditing):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._labelClicked):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype.highlightBreakpoint):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype.clearBreakpointHighlight):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._saveBreakpoints):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._restoreBreakpoints):
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._projectChanged):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.prototype._xhrBreakpointHit):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype._clearInterface):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        * inspector/front-end/inspector.js:
+        (WebInspector.resetFocusElement):
+        (WebInspector.set attached):
+
+2011-03-14  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: move breakpoints restoring to debugger presentation model.
+        https://bugs.webkit.org/show_bug.cgi?id=56123
+
+        DebuggerModel's "breakpoint-added" and "breakpoint-removed" events are gone since
+        setBreakpoint/removeBreakpoint are now called from DPM only.
+
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::disable):
+        (WebCore::InspectorDebuggerAgent::enableDebuggerAfterShown):
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.enableDebugger):
+        (WebInspector.DebuggerModel.prototype._debuggerWasEnabled):
+        (WebInspector.DebuggerModel.prototype._debuggerWasDisabled):
+        (WebInspector.DebuggerModel.prototype.setBreakpoint.didSetBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpointBySourceId):
+        (WebInspector.DebuggerModel.prototype.removeBreakpoint):
+        (WebInspector.DebuggerModel.prototype._breakpointResolved):
+        (WebInspector.DebuggerModel.prototype.reset):
+        (WebInspector.DebuggerDispatcher.prototype.debuggerWasEnabled):
+        (WebInspector.DebuggerDispatcher.prototype.debuggerWasDisabled):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerWasEnabled):
+        (WebInspector.DebuggerPresentationModel.prototype._parsedScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._failedToParseScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptSourceChanged):
+        (WebInspector.DebuggerPresentationModel.prototype.breakpointsForSourceFileId):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpointEnabled):
+        (WebInspector.DebuggerPresentationModel.prototype.updateBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype.removeBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype.findBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointRemoved):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointResolved):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype._saveBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype.reset):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._debuggerWasEnabled):
+        (WebInspector.ScriptsPanel.prototype._debuggerWasDisabled):
+
+2011-03-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r81015.
+        http://trac.webkit.org/changeset/81015
+        https://bugs.webkit.org/show_bug.cgi?id=56308
+
+        A Similar patch landed in r76960 (Requested by philn-tp on
+        #webkit).
+
+        * GNUmakefile.am:
+
+2011-03-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: don't use innerText, use textContent instead.
+        https://bugs.webkit.org/show_bug.cgi?id=56307
+
+        * inspector/front-end/AuditFormatters.js:
+        (WebInspector.AuditFormatters.snippet):
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/GoToLineDialog.js:
+        * inspector/front-end/HelpScreen.js:
+        (WebInspector.HelpScreen):
+        * inspector/front-end/ShortcutsHelp.js:
+        (WebInspector.ShortcutsSection.prototype.renderSection):
+        (WebInspector.ShortcutsSection.prototype._renderHeader):
+
+2011-03-14  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Text editor] Disable live-edit in favor of the text editor
+        https://bugs.webkit.org/show_bug.cgi?id=56176
+
+        * inspector/front-end/Settings.js:
+
+2011-03-14  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [REGRESSION] scroll does not work in source frame when mouse is inside the gutter
+        https://bugs.webkit.org/show_bug.cgi?id=56095
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer):
+
+2011-03-11  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: move breakpoints restoring after live edit to debugger presentation model.
+        https://bugs.webkit.org/show_bug.cgi?id=56179
+
+        Presentation model should move breakpoints based on text diff as required by "revert to revision" action in resources panel.
+
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel):
+        (WebInspector.DebuggerModel.prototype.setBreakpoint.didSetBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerModel.prototype.reset):
+        (WebInspector.DebuggerModel.prototype.editScriptSource.didEditScriptSource):
+        (WebInspector.DebuggerModel.prototype.editScriptSource):
+        (WebInspector.DebuggerModel.prototype.get callFrames):
+        (WebInspector.DebuggerModel.prototype._pausedScript):
+        (WebInspector.DebuggerModel.prototype._resumedScript):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptSourceChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._scriptSourceChanged):
+
+2011-03-10  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Optimize backend-frontend data transfer volume for CSS styles
+        https://bugs.webkit.org/show_bug.cgi?id=56111
+
+        This change reduces the getStylesForNode() payload more than twice for BODY elements.
+
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyle::populateObjectWithStyleProperties):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSProperty.parsePayload):
+
+2011-03-14  John Knottenbelt  <jknotten@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Detach Geolocation from Frame when Page destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=52877
+
+        On Page destruction, any outstanding Geolocation permission
+        requests should be cancelled, because the Geolocation can only
+        access the client indirectly via m_frame->page().
+
+        Page destruction is signalled by a call to the
+        Frame::pageDestroyed() method. This explictly calls
+        DOMWindow::resetGeolocation which ultimately calls Geolocation::reset.
+
+        Geolocation::reset() detaches from the GeolocationController,
+        cancels requests, watches and single shots, and sets the
+        permission state back to Unknown.
+
+        Frame::pageDestroyed() is also called by FrameLoader even though
+        the page is not destroyed. We should still cancel permission
+        requests, because the GeolocationClient will become inaccessible
+        to the Geolocation object after this call.
+
+        Frame::transferChildFrameToNewDocument also indirectly calls
+        Geolocation::reset when the frame is reparented between
+        pages. Ideally we would like the Geolocation's activities to
+        continue after reparenting, see bug
+        https://bugs.webkit.org/show_bug.cgi?id=55577
+
+        Since GeolocationController is owned by Page, and all Geolocation
+        objects will now unsubscribe from the GeolocationController on
+        pageDetached(), we no longer need to call stopUpdating() from the
+        GeolocationController's destructor. Instead we can simply assert
+        that there should be no no observers. See related bug
+        https://bugs.webkit.org/show_bug.cgi?id=52216 .
+
+        Introduced new method 'numberOfPendingPermissionRequests' on
+        GeolocationClientMock to count the number of outstanding pending
+        permission requests. This provides a reusable implementation for
+        client-based implementations of the LayoutTestController's
+        numberOfPendingGeolocationPermissionRequests method.
+
+        Test: fast/dom/Geolocation/page-reload-cancel-permission-requests.html
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::resetGeolocation):
+        * page/DOMWindow.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::pageDestroyed):
+        (WebCore::Frame::transferChildFrameToNewDocument):
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::~Geolocation):
+        (WebCore::Geolocation::page):
+        (WebCore::Geolocation::reset):
+        (WebCore::Geolocation::disconnectFrame):
+        (WebCore::Geolocation::lastPosition):
+        (WebCore::Geolocation::requestPermission):
+        (WebCore::Geolocation::startUpdating):
+        (WebCore::Geolocation::stopUpdating):
+        * page/Geolocation.h:
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::~GeolocationController):
+        * page/Navigator.cpp:
+        (WebCore::Navigator::resetGeolocation):
+        * page/Navigator.h:
+        * platform/mock/GeolocationClientMock.cpp:
+        (WebCore::GeolocationClientMock::numberOfPendingPermissionRequests):
+        * platform/mock/GeolocationClientMock.h:
+
+2011-03-14  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: REGRESSION: Messed up with the tabIndex for text editor
+        https://bugs.webkit.org/show_bug.cgi?id=56183
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._handleKeyDown):
+        (WebInspector.SourceFrame.prototype._handleSave):
+        (WebInspector.SourceFrame.prototype._handleRevertEditing):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorMainPanel):
+        (WebInspector.TextEditorMainPanel.prototype.set readOnly):
+
+2011-03-14  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Xan Lopez.
+
+        Add all web audio auto-generated files to GTK make system
+        https://bugs.webkit.org/show_bug.cgi?id=50497
+
+        No new tests since these are build-system tweaks.
+
+        * GNUmakefile.am:
+
+2011-03-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: make DOMAgent event target, remove dependency from ElementsPanel.
+        https://bugs.webkit.org/show_bug.cgi?id=56268
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::reset):
+        (WebCore::InspectorDOMAgent::performSearch):
+        (WebCore::InspectorDOMAgent::cancelSearch):
+        (WebCore::InspectorDOMAgent::onMatchJobsTimer):
+        (WebCore::InspectorDOMAgent::reportNodesAsSearchResults):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.requestDocument.mycallback):
+        (WebInspector.DOMAgent.prototype.requestDocument):
+        (WebInspector.DOMAgent.prototype._attributesUpdated):
+        (WebInspector.DOMAgent.prototype._characterDataModified):
+        (WebInspector.DOMAgent.prototype._documentUpdated):
+        (WebInspector.DOMAgent.prototype._setDocument):
+        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
+        (WebInspector.DOMAgent.prototype._childNodeInserted):
+        (WebInspector.DOMAgent.prototype._childNodeRemoved):
+        (WebInspector.DOMAgent.prototype._removeBreakpoints):
+        (WebInspector.DOMAgent.prototype.performSearch):
+        (WebInspector.DOMAgent.prototype.cancelSearch):
+        (WebInspector.DOMDispatcher.prototype.searchResults):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype._reset):
+        (WebInspector.ElementsPanel.prototype._documentUpdated):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        (WebInspector.ElementsPanel.prototype._addNodesToSearchResult):
+        (WebInspector.ElementsPanel.prototype._attributesUpdated):
+        (WebInspector.ElementsPanel.prototype._characterDataModified):
+        (WebInspector.ElementsPanel.prototype._nodeInserted):
+        (WebInspector.ElementsPanel.prototype._nodeRemoved):
+        (WebInspector.ElementsPanel.prototype._childNodeCountUpdated):
+        (WebInspector.ElementsPanel.prototype.updateModifiedNodes):
+
+2011-03-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: add tests for edit dom operations.
+        https://bugs.webkit.org/show_bug.cgi?id=56248
+
+        Test: inspector/elements/edit-dom-actions.html
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::assertNode):
+        (WebCore::InspectorDOMAgent::assertElement):
+        (WebCore::InspectorDOMAgent::assertHTMLElement):
+        (WebCore::InspectorDOMAgent::nodeToSelectOn):
+        (WebCore::InspectorDOMAgent::querySelector):
+        (WebCore::InspectorDOMAgent::querySelectorAll):
+        (WebCore::InspectorDOMAgent::setAttribute):
+        (WebCore::InspectorDOMAgent::removeAttribute):
+        (WebCore::InspectorDOMAgent::getOuterHTML):
+        (WebCore::InspectorDOMAgent::setOuterHTML):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype.setAttribute):
+        (WebInspector.DOMNode.prototype.removeAttribute):
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.defaultFinishHandler):
+
+2011-03-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/8762095> and https://bugs.webkit.org/show_bug.cgi?id=55172
+        Need WK2 API to view/manage origins with LocalStorage
+
+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::initializeTracker): Make sure the TextEncoding map is initialized on the main thread
+          before the StorageTracker thread can do it on the background thread.
+
+2011-03-13  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed by Brady Eidson and David Levin, landed by Brady Eidson.
+
+        Fixed lock-taking order to prevent deadlock, added lock for m_client,
+        removed premature return in syncImportOriginIdentifiers when tracker
+        db does not exist because that prevented syncFileSystemAndTrackerDatabase()
+        from running until next LocalStorage db creation, cleaned up
+        StorageTracker::scheduleTask() code for readability.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=56285
+        
+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::trackerDatabasePath):
+        (WebCore::StorageTracker::syncImportOriginIdentifiers): If tracker db isn't
+        optionally opened (as in the case when it doesn't exist on disk), don't
+        exit early and call syncFileSystemAndTrackerDatabase(), which will create
+        a tracker db if localstorage db files are found on disk by calling setOriginDetails.
+        (WebCore::StorageTracker::syncFileSystemAndTrackerDatabase):
+        (WebCore::StorageTracker::setOriginDetails):
+        (WebCore::StorageTracker::scheduleTask): readability changes.
+        (WebCore::StorageTracker::syncSetOriginDetails):
+        (WebCore::StorageTracker::syncDeleteAllOrigins):
+        (WebCore::StorageTracker::syncDeleteOrigin):
+        (WebCore::StorageTracker::cancelDeletingOrigin): order lock-taking consistently to avoid deadlock.
+        (WebCore::StorageTracker::setClient):
+        * storage/StorageTracker.h:
+
+2011-03-13  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed and landed by Brady Eidson.
+
+        Invalid assertion in StorageTracker - PageGroup::numberOfPageGroups() == 1
+        https://bugs.webkit.org/show_bug.cgi?id=56240
+
+        This assertion is invalid until LocalStorage is either global or is isolated by PageGroup.
+
+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::origins):
+        (WebCore::StorageTracker::deleteAllOrigins):
+        (WebCore::StorageTracker::deleteOrigin):
+
+2011-03-13  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Make adjustMIMETypeIfNecessary use CFNetwork directly
+        https://bugs.webkit.org/show_bug.cgi?id=55912
+
+        Follow up fix for Layout Test failure. Fix typo - it should be text/plain, not test/plain.
+
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (WebCore::adjustMIMETypeIfNecessary):
+
+2011-03-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Include hyphenation information in text representation of render tree
+        https://bugs.webkit.org/show_bug.cgi?id=56287
+
+        (WebCore::writeTextRun): If the text box is hyphenated, output the hyphenation
+        string.
+
+2011-03-13  David Levin  <levin@chromium.org>
+
+        Improve my hasitly added build fix and added a bug https://bugs.webkit.org/show_bug.cgi?id=56288
+        above addressing this FIXME.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2011-03-13  David Levin  <levin@chromium.org>
+
+        Build fix adding remaining enum values to switch statement.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2011-03-13  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::ResourceError):
+        Add missing constructor.
+
+2011-03-13  David Sosby  <dsosby@rim.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION: Soft hyphen is not always rendered
+        https://bugs.webkit.org/show_bug.cgi?id=56017
+        
+        The check to flag a text block as hyphenated was only
+        occurring at break points in the line. If no break points
+        were found after the soft hyphen then the line would not
+        be flagged hyphenated. Adding a check for soft hyphen at
+        the end of the text run resolves the issue.
+
+        Test: fast/text/soft-hyphen-4.html
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2011-03-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        REGRESSION (r80438): fast/text/hyphenate-character failing in pixel mode
+        https://bugs.webkit.org/show_bug.cgi?id=56280
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::tryHyphenating): Avoid subtracting 1 from an unsigned 0.
+
+2011-03-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add ability to create a WKErrorRef
+        <rdar://problem/9115768>
+        https://bugs.webkit.org/show_bug.cgi?id=56279
+
+        * WebCore.exp.in:
+        Add new exports.
+
+        * platform/network/cf/ResourceError.h:
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::platformCompare):
+        (WebCore::ResourceError::cfError):
+        (WebCore::ResourceError::operator CFErrorRef):
+        (WebCore::ResourceError::ResourceError):
+        (WebCore::ResourceError::cfStreamError):
+        (WebCore::ResourceError::operator CFStreamError):
+        * platform/network/mac/ResourceErrorMac.mm:
+        (WebCore::ResourceError::ResourceError):
+        (WebCore::ResourceError::platformCompare):
+        (WebCore::ResourceError::nsError):
+        (WebCore::ResourceError::operator NSError *):
+        (WebCore::ResourceError::cfError):
+        (WebCore::ResourceError::operator CFErrorRef):
+        Clean up ResourceError a bit and add ability to create a ResourceError from a CFErrorRef
+        regardless of whether CFNetwork is being used.
+
+2011-03-13  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Make adjustMIMETypeIfNecessary use CFNetwork directly
+        https://bugs.webkit.org/show_bug.cgi?id=55912
+
+        Convert category method [NSURLResponse adjustMIMETypeIfNecessary] to C function
+        WebCore::adjustMIMETypeIfNecessary() that takes a CFURLResponseRef and is functionally
+        identical.
+
+        Testing is covered by existing LayoutTests.
+
+        * WebCore.exp.in:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+        * platform/network/mac/WebCoreURLResponse.h:
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (WebCore::createBinaryExtensionsSet):
+        (WebCore::createExtensionToMIMETypeMap):
+        (WebCore::mimeTypeFromUTITree):
+        (WebCore::adjustMIMETypeIfNecessary):
+
+2011-03-13  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Update comment in CSSValueKeywords.in
+        https://bugs.webkit.org/show_bug.cgi?id=56266
+
+        The enums the comment refers to were moved from RenderStyle.h to RenderStyleConstants.h
+        in r36579 but it appears that the comment in CSSValueKeywords.in wasn't updated.
+
+        No tests - just updating a comment.
+
+        * css/CSSValueKeywords.in:
+
+2011-03-13  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed by Alice Liu.
+
+        StorageTracker constructor shouldn't have initialization code and isMainThread() assertion
+        https://bugs.webkit.org/show_bug.cgi?id=56259
+
+        Move all StorageTracker initialization to
+        StorageTracker::initializeTracker. This also removes the
+        requirement that the StorageTracker constructor isn't run
+        on the main thread.
+
+        * storage/StorageTracker.cpp:
+        (WebCore::StorageTracker::initializeTracker):
+        (WebCore::StorageTracker::tracker):
+        (WebCore::StorageTracker::StorageTracker):
+
+2011-03-13  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Dave Hyatt.
+
+        REGRESSION (r61383): Navigation menu laid out incorrectly on aboardtheworld.com
+        https://bugs.webkit.org/show_bug.cgi?id=53470
+
+        Prefer !important over normal properties when dealing with duplicate properties in style rules.
+
+        Test: fast/css/duplicate-property-in-rule-important.html
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::CSSMutableStyleDeclaration):
+
+2011-03-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80895.
+        http://trac.webkit.org/changeset/80895
+        https://bugs.webkit.org/show_bug.cgi?id=56261
+
+        Causing crashes in several tests including
+        t1202-counters-16-c.html (see
+        http://build.webkit.org/results/SnowLeopard%20Intel%20Leaks/r80956%20(15528)/results.html)
+        (Requested by dave_levin on #webkit).
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::CounterNode):
+        (WebCore::CounterNode::create):
+        (WebCore::CounterNode::resetRenderer):
+        (WebCore::CounterNode::resetRenderers):
+        (WebCore::CounterNode::recount):
+        (WebCore::CounterNode::insertAfter):
+        (WebCore::CounterNode::removeChild):
+        (WebCore::showTreeAndMark):
+        * rendering/CounterNode.h:
+        (WebCore::CounterNode::renderer):
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        (WebCore::RenderCounter::~RenderCounter):
+        (WebCore::RenderCounter::originalText):
+        (WebCore::RenderCounter::invalidate):
+        (WebCore::destroyCounterNodeWithoutMapRemoval):
+        (WebCore::RenderCounter::destroyCounterNodes):
+        (WebCore::RenderCounter::destroyCounterNode):
+        (WebCore::updateCounters):
+        (showCounterRendererTree):
+        * rendering/RenderCounter.h:
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::invalidateCountersInContainer):
+        (WebCore::RenderObjectChildList::invalidateCounters):
+        * rendering/RenderObjectChildList.h:
+
+2011-03-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION (r76474): IntegerArray hash hashes only 1/4 of the array
+        https://bugs.webkit.org/show_bug.cgi?id=56258
+
+        No tests because the wrong hashing is mostly harmless. The only symptom
+        we have seen is an occasional assertion in debug builds about the size
+        not being a multiple of two. But a worse hash is worse for performance too.
+
+        * platform/cf/BinaryPropertyList.cpp:
+        (WebCore::IntegerArrayHash::hash): Pass in the size in bytes rather
+        than the number of array entries.
+
+2011-03-12  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the build with newer GCCs and remove some extra whitespae.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::uint8_t):
+
+2011-03-12  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Removed unused ARMv5 code. The ARMv5 case now falls under the general
+        unaligned accessed case.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::readLittleEndian):
+        (WebCore::CloneDeserializer::readString):
+
+2011-03-12  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        WebCore fails to build with Clang on ARM
+        https://bugs.webkit.org/show_bug.cgi?id=56257
+
+        Add an explicit instantiation of writeLittleEndian for uint8_t and move it to
+        namespace scope, since explicit specializations are not allowed at class scope.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::writeLittleEndian):
+
+2011-03-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Dragging image to desktop gives webloc instead of image file in WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=56193
+
+        * WebCore.exp.in: Added some additional exports. Re-sorted.
+
+2011-03-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80919.
+        http://trac.webkit.org/changeset/80919
+        https://bugs.webkit.org/show_bug.cgi?id=56251
+
+        all windows bots failed to compile this change (Requested by
+        loislo on #webkit).
+
+        * bridge/c/c_class.cpp:
+        * bridge/c/c_runtime.cpp:
+        * bridge/jni/JavaMethod.cpp:
+        * plugins/PluginViewNone.cpp:
+
+2011-03-12  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed WinCE build fix for r80900.
+
+        * CMakeListsWinCE.txt: Removed IconDatabaseNone.cpp.
+
+2011-03-12  Andras Becsi  <abecsi@webkit.org>
+
+        Unreviewed typo fix.
+
+        No new tests needed.
+
+        * WebCore.pro: Fix typo in header name.
+
+2011-03-12  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: Inspect Element action regression fix.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.inspect):
+
+2011-03-12  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed. One line fix for inspector/dom-breakpoints.html
+
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.DOMBreakpointView.prototype.populateStatusMessageElement.decorateNode):
+
+2011-03-12  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed build fix.
+
+        Almost all inspector tests are crashing after r80928.
+
+        * inspector/front-end/inspector.js:
+
+2011-03-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: follow up to error reporting, fixing multiple regressions.
+        https://bugs.webkit.org/show_bug.cgi?id=56243
+
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::setPropertyValue):
+        * inspector/InjectedScript.h:
+        * inspector/Inspector.idl:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getChildNodes):
+        (WebCore::InspectorDOMAgent::getOuterHTML):
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::setPropertyValue):
+        * inspector/InspectorRuntimeAgent.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype.setNodeName):
+        (WebInspector.DOMNode.prototype.setNodeValue):
+        (WebInspector.DOMNode.prototype.getChildNodes):
+        (WebInspector.DOMNode.prototype.getOuterHTML):
+        (WebInspector.DOMNode.prototype.setOuterHTML):
+        (WebInspector.DOMNode.prototype.removeNode):
+        (WebInspector.DOMNode.prototype.copyNode):
+        (WebInspector.DOMAgent.prototype.pushNodeToFrontend):
+        (WebInspector.DOMAgent.prototype.pushNodeByPathToFrontend):
+        (WebInspector.EventListeners.getEventListenersForNode):
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorage.prototype.getEntries):
+        (WebInspector.DOMStorage.prototype.setItem):
+        (WebInspector.DOMStorage.prototype.removeItem):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._createTooltipForNode.setTooltip):
+        (WebInspector.ElementsTreeElement.prototype.updateChildren):
+        ():
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
+        (WebInspector.EventListenersSidebarPane.prototype.update):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.nodeResolved):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject.prototype.setPropertyValue):
+        (WebInspector.RemoteObject.prototype.evaluate):
+        * inspector/front-end/inspector.js:
+
+2011-03-12  Jer Noble  <jer.noble@apple.com>
+
+        Unreviewed build fix.
+
+        Fix GTK+ builds by wrapping sections of full screen code in USE(ACCELERATED_COMPOSITING)
+        checks.
+
+        * dom/Document.cpp:
+        (WebCore::Document::webkitWillEnterFullScreenForElement):
+        (WebCore::Document::webkitDidEnterFullScreenForElement):
+        (WebCore::Document::webkitWillExitFullScreenForElement):
+        (WebCore::Document::webkitDidExitFullScreenForElement):
+
+2011-03-12  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Unreviewed build fix.
+
+        [EFL] Fix build break because of several reason.
+        https://bugs.webkit.org/show_bug.cgi?id=56244
+
+        * CMakeLists.txt: Add missing files.
+        * platform/posix/FileSystemPOSIX.cpp: Add PLATFORM(EFL).
+
+2011-03-11  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: move profiler related methods from inspector agent to profiler agent
+        https://bugs.webkit.org/show_bug.cgi?id=56204
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::restoreInspectorStateFromCookie):
+        (WebCore::InspectorAgent::setFrontend):
+        (WebCore::InspectorAgent::disconnectFrontend):
+        (WebCore::InspectorAgent::populateScriptObjects):
+        (WebCore::InspectorAgent::showProfilesPanel):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::profilerEnabled):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        (WebCore::InspectorController::isRecordingUserInitiatedProfile):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::profilerEnabledImpl):
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::create):
+        (WebCore::InspectorProfilerAgent::InspectorProfilerAgent):
+        (WebCore::InspectorProfilerAgent::enable):
+        (WebCore::InspectorProfilerAgent::disable):
+        (WebCore::InspectorProfilerAgent::setFrontend):
+        (WebCore::InspectorProfilerAgent::clearFrontend):
+        (WebCore::InspectorProfilerAgent::restore):
+        (WebCore::InspectorProfilerAgent::restoreEnablement):
+        (WebCore::InspectorProfilerAgent::startUserInitiatedProfiling):
+        (WebCore::InspectorProfilerAgent::stopUserInitiatedProfiling):
+        * inspector/InspectorProfilerAgent.h:
+        (WebCore::InspectorProfilerAgent::start):
+        (WebCore::InspectorProfilerAgent::stop):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileType.prototype.buttonClicked):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype._registerProfileType):
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2011-03-11  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        WebCore::Document should notify ChromeClient when the full screen renderer's backing changes.
+        https://bugs.webkit.org/show_bug.cgi?id=56226
+
+        * dom/Document.cpp:
+        (WebCore::Document::webkitWillEnterFullScreenForElement): Call setRootFullScreenLayer().
+        (WebCore::Document::webkitDidEnterFullScreenForElement): Ditto.
+        (WebCore::Document::webkitWillExitFullScreenForElement): Ditto.
+        (WebCore::Document::webkitDidExitFullScreenForElement): Ditto.
+        (WebCore::Document::setFullScreenRendererSize): Layout after setting the renderer's size.
+
+2011-03-11  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Create new interface stubs to support full screen mode in WebKit2.
+
+        WebKit2: Plumb new full screen animation APIs through WebKit2.
+        https://bugs.webkit.org/show_bug.cgi?id=55993
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::setRootFullScreenLayer): Added.
+
+2011-03-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Ensure all values are correctly tagged in the registerfile
+        https://bugs.webkit.org/show_bug.cgi?id=56214
+
+        Make sure everything builds still.
+
+        * bridge/c/c_class.cpp:
+        * bridge/c/c_runtime.cpp:
+        * bridge/jni/JavaMethod.cpp:
+        * plugins/PluginViewNone.cpp:
+
+2011-03-11  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 32-bit build.
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
+        (WebCore::MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation):
+
+2011-03-11  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Eric Carlsson.
+
+        <rdar://problem/9124537> Crashes during layout tests due to overrelease of AVFoundation objects.
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createContextVideoRenderer):
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::setAsset):
+
+2011-03-11  Chris Marrin  <cmarrin@apple.com>
+
+        Unreviewed.
+
+        Fixes an error with the checkin for https://bugs.webkit.org/show_bug.cgi?id=52468
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::createTransformAnimationsFromKeyframes):
+
+2011-03-11  Brady Eidson  <beidson@apple.com>
+
+        Attempted Qt build fix for https://bugs.webkit.org/show_bug.cgi?id=56216
+
+        * loader/icon/IconDatabase.h: Make this guy public.
+
+2011-03-11  Brady Eidson  <beidson@apple.com>
+
+        Attempted Qt build fix for https://bugs.webkit.org/show_bug.cgi?id=56216
+
+        * loader/icon/IconDatabase.h:
+        (WebCore::IconDatabase::delayDatabaseCleanup): Maybe Qt has Icon Database disabled, so we need to define this here?
+
+2011-03-11  Brady Eidson  <beidson@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=56216
+        Fix the Qt build following the same pattern of the patch.
+
+        * loader/icon/IconDatabase.h:
+        * loader/icon/IconDatabaseBase.cpp:
+        (WebCore::IconDatabaseBase::databasePath): Added to the virtual base.
+        * loader/icon/IconDatabaseBase.h:
+        (WebCore::IconDatabaseBase::isOpen): Ditto.
+
+2011-03-11  Ben Taylor  <bentaylor.solx86@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56198
+        Fix conditional which had an int for one case and a pointer for another.
+
+        No new tests. Fix compilation on Solaris 10 with SunStudio 12 C++
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+
+2011-03-11  Brady Eidson  <beidson@apple.com>
+
+        Windows build fix.
+
+        * history/HistoryItem.cpp:
+        * loader/icon/IconDatabaseBase.cpp:
+
+2011-03-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8648311> and https://bugs.webkit.org/show_bug.cgi?id=56216
+        Rework disabled IconDatabase builds while allowing for a pluggable icon database implementation.
+
+        Project file stuff:
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCore.vcproj/WebCore.vcproj:
+
+        * loader/icon/IconDatabase.cpp:
+        * loader/icon/IconDatabase.h: Inherit from IconDatabaseBase.
+
+        * loader/icon/IconDatabaseBase.cpp: Added.
+        (WebCore::IconDatabaseBase::iconURLForPageURL):
+        (WebCore::iconDatabase):
+        (WebCore::setGlobalIconDatabase):
+        * loader/icon/IconDatabaseBase.h: Added.
+        (WebCore::IconDatabaseBase::IconDatabaseBase):
+        (WebCore::IconDatabaseBase::~IconDatabaseBase):
+        (WebCore::IconDatabaseBase::setEnabled):
+        (WebCore::IconDatabaseBase::isEnabled):
+        (WebCore::IconDatabaseBase::defaultIcon):
+        (WebCore::IconDatabaseBase::retainIconForPageURL):
+        (WebCore::IconDatabaseBase::releaseIconForPageURL):
+        (WebCore::IconDatabaseBase::iconForPageURL):
+        (WebCore::IconDatabaseBase::setIconURLForPageURL):
+        (WebCore::IconDatabaseBase::setIconDataForIconURL):
+        (WebCore::IconDatabaseBase::iconDataKnownForIconURL):
+        (WebCore::IconDatabaseBase::loadDecisionForIconURL):
+        (WebCore::IconDatabaseBase::pageURLMappingCount):
+        (WebCore::IconDatabaseBase::retainedPageURLCount):
+        (WebCore::IconDatabaseBase::iconRecordCount):
+        (WebCore::IconDatabaseBase::iconRecordCountWithData):
+        (WebCore::IconDatabaseBase::importIconURLForPageURL):
+        (WebCore::IconDatabaseBase::importIconDataForIconURL):
+        (WebCore::IconDatabaseBase::shouldStopThreadActivity):
+        (WebCore::IconDatabaseBase::open):
+        (WebCore::IconDatabaseBase::close):
+        (WebCore::IconDatabaseBase::removeAllIcons):
+        (WebCore::IconDatabaseBase::setPrivateBrowsingEnabled):
+        (WebCore::IconDatabaseBase::setClient):
+
+        * loader/icon/IconDatabaseNone.cpp: Removed.
+
+2011-03-11  Brady Eidson  <beidson@apple.com>
+
+        Attempt at a build-fix for https://bugs.webkit.org/show_bug.cgi?id=51878
+
+        * page/PageGroup.h: Declare this method, even if the definition will end up being empty.
+
+2011-03-11  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Dmitry Titov.
+
+        Adding the '~' to the dtor (duh).
+
+        No new tests.
+
+        * storage/SQLCallbackWrapper.h:
+        (WebCore::SQLCallbackWrapper::~SQLCallbackWrapper):
+
+2011-03-11  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by David Hyatt.
+
+        Introduced double linkage between a CounterNode and its display renderer.
+
+        use of freed pointer in WebCore::RenderCounter::originalText()
+        https://bugs.webkit.org/show_bug.cgi?id=56065
+
+        No new tests. This bug could only be reproduced manually by
+        refreshing the page during load at a critical point.
+        See bug attachment for testing.
+
+        * rendering/CounterNode.cpp:
+        Introduced new member "m_owner" to store the renderer that has the
+        style directives that produce the CounterNode.
+        Repurposed m_renderer to reffer to the RenderCounter that shows the
+        CounterNode.
+        (WebCore::CounterNode::CounterNode):
+        Updated member initialization.
+        (WebCore::CounterNode::create):
+        (WebCore::CounterNode::resetRenderer):
+        (WebCore::CounterNode::resetRenderers):
+        (WebCore::CounterNode::recount):
+        (WebCore::CounterNode::removeChild):
+        (WebCore::CounterNode::insertAfter):
+        No functional changes.
+        (WebCore::showTreeAndMark):
+        Added flushing to ensure that the output is complete.
+        * rendering/CounterNode.h:
+        (WebCore::CounterNode::owner):
+        Renamed from renderer()
+        (WebCore::CounterNode::renderer):
+        (WebCore::CounterNode::setRenderer):
+        Added new accessors for the display renderer.
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+        Fixed comments. No functional changes.
+        (WebCore::RenderCounter::~RenderCounter):
+        Made sure that the CounterNode that this renderers displays is
+        detached from this.
+        (WebCore::RenderCounter::originalText):
+        (WebCore::RenderCounter::invalidate):
+        Added code to update m_renderer on the displayed CounterNode.
+        (WebCore::destroyCounterNodeWithoutMapRemoval):
+        (WebCore::RenderCounter::destroyCounterNodes):
+        (WebCore::RenderCounter::destroyCounterNode):
+        (WebCore::updateCounters):
+        No change, just kept code in line with the changes above.
+        (showCounterRendererTree):
+        Added fflush to ensure complete display.
+        * rendering/RenderCounter.h:
+        * rendering/RenderObjectChildList.cpp:
+        * rendering/RenderObjectChildList.h:
+        Removed unneeded invalidateCounters related functions.
+
+2011-03-11  Luke Macpherson   <macpherson@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduce lookup-table based approach for applying CSS properties.
+        The aim is to be a starting point for refactoring
+        CSSStyleSelector::applyProperty() into more readable, maintainable code.
+        https://bugs.webkit.org/show_bug.cgi?id=54707
+
+        No new behavior / covered by existing tests.
+
+        * css/CSSStyleApplyProperty.cpp: Added.
+        (WebCore::ApplyPropertyNull):
+        Class that provides empty implementations of inherit, initial, value.
+        (WebCore::ApplyPropertyDefault::ApplyPropertyDefault):
+        Class that calls the appropriate RenderStyle setters directly.
+        (WebCore::ApplyPropertyColorBase::ApplyPropertyColorBase):
+        Class for handling CSSProperty*Color.
+        (WebCore::ApplyPropertyColor::ApplyPropertyColor):
+        Class for handling CSSPropertyColor.
+        (WebCore::CSSStyleApplyProperty::sharedCSSStyleApplyProperty):
+        Singleton initializer.
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        Constructor that bulds up the map from property id to apply-er objects.
+        * css/CSSStyleApplyProperty.h: Added.
+        (WebCore::CSSStyleApplyProperty::inherit):
+        Handle the inherit case for a given property.
+        (WebCore::CSSStyleApplyProperty::initial):
+        Handle the initial case for a given property.
+        (WebCore::CSSStyleApplyProperty::value):
+        Apply a value to a given property.
+        (WebCore::CSSStyleApplyProperty::implements):
+        Returns true if the provided property id is implemented.
+        (WebCore::CSSStyleApplyProperty::index):
+        Private function to determine the index of a property the property map.
+        (WebCore::CSSStyleApplyProperty::valid):
+        Function to determine that a given property id is valid.
+        (WebCore::CSSStyleApplyProperty::setPropertyValue):
+        (WebCore::CSSStyleApplyProperty::propertyValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        Get reference to the CSSStyleApplyProperty singleton.
+        (WebCore::CSSStyleSelector::applyProperty):
+        Now calls into CSSStyleApplyProperty for implemented property ids.
+        Deleted color-related methods from the property id switch.
+        * css/CSSStyleSelector.h:
+        (WebCore::CSSStyleSelector::style):
+        Made public to allow access from CSSStyleApplyProperty.
+        (WebCore::CSSStyleSelector::parentStyle):
+        Made public to allow access from CSSStyleApplyProperty.
+        * rendering/style/RenderStyle.h:
+        Made CSSStyleApplyProperty a friend class. Necessary because it needs
+        to access the private getters and setters on this clsass.
+
+2011-03-11  Anton D'Auria  <adauria@apple.com>
+
+        Reviewed and landed by Brady Eidson.
+
+        Add WebKit1 API to view and delete local storage
+        https://bugs.webkit.org/show_bug.cgi?id=51878
+
+        Created StorageTracker as a central point for tracking and deleting LocalStorage per origin.
+        StorageTracker maintains its own database of origin identifiers and backing db paths,
+        and this allows it to contain more relational data in the future, like variable quotas per origin.
+
+        On initialization, StorageTracker syncs its database with LocalStorage files on disk. It adds
+        an origin entry when StorageAreaSync performs a first sync for an origin.
+
+        All StorageTracker file operations are performed on one background thread with a task queue.
+
+        Tests: storage/domstorage/localstorage/storagetracker/storage-tracker-1-prepare.html
+               storage/domstorage/localstorage/storagetracker/storage-tracker-2-create.html
+               storage/domstorage/localstorage/storagetracker/storage-tracker-3-delete-all.html
+               storage/domstorage/localstorage/storagetracker/storage-tracker-4-create.html
+               storage/domstorage/localstorage/storagetracker/storage-tracker-5-delete-one.html
+
+        * GNUmakefile.am:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::clearLocalStorageForAllOrigins):
+        (WebCore::PageGroup::clearLocalStorageForOrigin):
+        (WebCore::PageGroup::syncLocalStorage):
+        (WebCore::PageGroup::numberOfPageGroups):
+        * page/PageGroup.h:
+        * platform/chromium/FileSystemChromium.cpp:
+        (WebCore::listDirectory):
+        * platform/posix/FileSystemPOSIX.cpp:
+        (WebCore::listDirectory):
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::LocalStorageTask):
+        (WebCore::LocalStorageTask::performTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createOriginIdentifiersImport):
+        (WebCore::LocalStorageTask::createSetOriginDetails):
+        (WebCore::LocalStorageTask::createDeleteOrigin):
+        (WebCore::LocalStorageTask::createDeleteAllOrigins):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::clearForOriginDeletion):
+        (WebCore::StorageAreaImpl::sync):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::scheduleCloseDatabase):
+        (WebCore::StorageAreaSync::openDatabase):
+        (WebCore::StorageAreaSync::sync):
+        (WebCore::StorageAreaSync::deleteEmptyDatabase):
+        (WebCore::StorageAreaSync::scheduleSync):
+        * storage/StorageAreaSync.h:
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::clearOriginForDeletion):
+        (WebCore::StorageNamespaceImpl::clearAllOriginsForDeletion):
+        (WebCore::StorageNamespaceImpl::sync):
+        * storage/StorageNamespaceImpl.h:
+        * storage/StorageTracker.cpp: Added.
+        (WebCore::StorageTracker::initializeTracker):
+        (WebCore::StorageTracker::tracker):
+        (WebCore::StorageTracker::StorageTracker):
+        (WebCore::StorageTracker::setStorageDirectoryPath):
+        (WebCore::StorageTracker::trackerDatabasePath):
+        (WebCore::StorageTracker::openTrackerDatabase):
+        (WebCore::StorageTracker::importOriginIdentifiers):
+        (WebCore::StorageTracker::syncImportOriginIdentifiers):
+        (WebCore::StorageTracker::syncFileSystemAndTrackerDatabase):
+        (WebCore::StorageTracker::setOriginDetails):
+        (WebCore::StorageTracker::scheduleTask):
+        (WebCore::StorageTracker::syncSetOriginDetails):
+        (WebCore::StorageTracker::origins):
+        (WebCore::StorageTracker::deleteAllOrigins):
+        (WebCore::StorageTracker::syncDeleteAllOrigins):
+        (WebCore::StorageTracker::deleteOrigin):
+        (WebCore::StorageTracker::syncDeleteOrigin):
+        (WebCore::StorageTracker::willDeleteAllOrigins):
+        (WebCore::StorageTracker::willDeleteOrigin):
+        (WebCore::StorageTracker::canDeleteOrigin):
+        (WebCore::StorageTracker::cancelDeletingOrigin):
+        (WebCore::StorageTracker::setClient):
+        (WebCore::StorageTracker::syncLocalStorage):
+        * storage/StorageTracker.h: Added.
+        * storage/StorageTrackerClient.h: Added.
+        (WebCore::StorageTrackerClient::~StorageTrackerClient):
+
+2011-03-11  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        JavaMethod does not correctly check for a null jstring for the method name
+        https://bugs.webkit.org/show_bug.cgi?id=56187
+
+        No new tests, simple typo fix.
+
+        * bridge/jni/JavaMethod.cpp:
+        (JavaMethod::JavaMethod):
+
+2011-03-11  Adrienne Walker  <enne@google.com>
+
+        Reviewed by James Robinson.
+
+        [chromium] Compositor uses too much texture memory for scrollbars
+        https://bugs.webkit.org/show_bug.cgi?id=56212
+
+        Compositor invalidations can be off the page (and very large), but
+        scrollbars only need to care about the invalidation that's visible.
+        The large invalidation was causing the tiler layer size to grow
+        needlessly larger than the scrollbar.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::invalidateRootLayerRect):
+
+2011-03-11  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=52987
+        
+        REGRESSION: Overflowing columns not repainted correctly
+        
+        Make sure to add in column overflow as visual overflow as well.  It was only propagating layout overflow, which is obviously not
+        sufficient, since blocks paint their own columns.
+
+        Added fast/multicol/scrolling-overflow.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addOverflowFromChildren):
+
+2011-03-11  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Set canvasUsesAcceleratedDrawing setting to be off(false) by default
+        https://bugs.webkit.org/show_bug.cgi?id=56215
+
+        No new tests. Does not affect behavior. Just keeping the setting off by default.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2011-03-11  Andy Estes  <aestes@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Table cells with dynamically added percentage height descendants do not
+        grow in size if the table has already been laid out.
+        https://bugs.webkit.org/show_bug.cgi?id=56174
+        
+        Table cells ignore their specified size and collapse to fit their
+        children. When a descendent with percentage height is present before
+        the table is first laid out, the descendent is sized based on the
+        specified size of the table cell. However, when the child isn't present
+        when the table is first laid out, the table cell ignores its specified
+        size and collapses down to 0. Then, when the child div is added in a
+        separate run loop iteration, it is sized to be 100% of the collapsed
+        cell height instead of 100% of the cell's specified height. We should
+        not get different layouts depending on the timing of tree construction.
+        
+        Fix this by clearing intrinsic padding before calculating the table
+        cell's override height when we detect a child that should flex the
+        table cell.
+
+        Test: fast/table/dynamic-descendant-percentage-height.html
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::setOverrideSizeFromRowHeight): clear
+        intrinsic padding before setting the override size.
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows): Call
+        setOverrideSizeFromRowHeight() instead of setOverrideSize().
+
+2011-03-11  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by David Levin.
+
+        Add SQLCallbackWrapper
+        Instead of directly holding RefPtrs to the Callback objects in SQLStatement and SQLTransaction, hold a wrapper objects
+        which holds those references whose dtors will schedule the release of those references on the ScriptExecution thread.
+        https://bugs.webkit.org/show_bug.cgi?id=55919
+
+        No new tests, existing tests apply.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/SQLCallbackWrapper.h: Added.
+        (WebCore::SQLCallbackWrapper::SQLCallbackWrapper):
+        (WebCore::SQLCallbackWrapper::clear):
+        (WebCore::SQLCallbackWrapper::unwrap):
+        (WebCore::SQLCallbackWrapper::hasCallback):
+        (WebCore::SQLCallbackWrapper::safeRelease):
+        * storage/SQLStatement.cpp:
+        (WebCore::SQLStatement::create):
+        (WebCore::SQLStatement::SQLStatement):
+        (WebCore::SQLStatement::performCallback):
+        * storage/SQLStatement.h:
+        (WebCore::SQLStatement::hasStatementCallback):
+        (WebCore::SQLStatement::hasStatementErrorCallback):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::executeSQL):
+        (WebCore::SQLTransaction::checkAndHandleClosedOrInterruptedDatabase):
+        (WebCore::SQLTransaction::deliverTransactionCallback):
+        (WebCore::SQLTransaction::deliverStatementCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        (WebCore::SQLTransaction::deliverSuccessCallback):
+        (WebCore::SQLTransaction::handleTransactionError):
+        (WebCore::SQLTransaction::deliverTransactionErrorCallback):
+        * storage/SQLTransaction.h:
+
+2011-03-11  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8955589> Adopt AVFoundation media back end on Lion.
+
+        No new tests, existing media tests cover this.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::installedMediaEngines): Register MediaPlayerPrivateAVFoundationObjC.
+        (WebCore::bestMediaEngineForTypeAndCodecs): Kill some whitespace.
+        (WebCore::MediaPlayer::loadWithNextMediaEngine): Ditto.
+        (WebCore::MediaPlayer::inMediaDocument): Ditto.
+        * platform/graphics/MediaPlayer.h:
+
+        * platform/graphics/avfoundation: Added.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp: Added.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h: Added.
+
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h: Added.
+        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm: Added.
+
+2011-03-11  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56205
+        m_restrictions needs to allow multiple values (a bitfield)
+
+        HTMLMediaElement::m_restrictions needs to hold multiple values, so
+        change BehaviorRestrictions to an unsigned typedef and rename the
+        existing enum BehaviorRestrictionFlags.
+
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::setBehaviorRestrictions):
+
+2011-03-11  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47206
+        
+        Table rows don't support ::before/::after.  Add support to RenderTableRow::styleDidChange so that ::before/::after content gets
+        properly constructed.
+
+        Added fast/css-generated-content/table-row-before-after.html
+
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::styleDidChange):
+        * rendering/RenderTableRow.h:
+
+2011-03-11  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Avoid updating a composited layer&apos;s contents if the layer has nonpositive dimensions
+        https://bugs.webkit.org/show_bug.cgi?id=56209
+
+        This matches the behavior prior to r80482.  No test since the only changes in
+        behavior are avoiding work on invisible layers, which is unobservable,
+        and fixing a crash due to bug 56153.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::updateContentsRecursive):
+
+2011-03-11  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47159
+        
+        CSS2.1 failures in background position parsing.
+        
+        Rewrite background position component parsing to match the spec.  Our old parsing would allow "100% left" to be valid
+        when it should not have.  Rename parseFillPositionXY to parseFillPositionComponent and pass in enough information for
+        it to understand what the first component was.
+        
+        For individual property parsing using background-position-x/y, I added new functions that just handle that without
+        worrying about the other component.
+        
+        In order to pass the CSS2.1 test, I also had to fix multiple background parsing.  The number of layers in multiple
+        backgrounds is determined solely by the background-image property and not by any of the other properties.  cullEmptyLayers
+        has been changed to always consider a layer empty if it has no image set, even if other properties are set.
+        
+        A number of layout tests had to be patched as they were invalid.  A couple of them relied on incorrect background-position
+        parsing (e.g., "50 left") and another relied on incorrect multiple background parsing.  It's not clear if the computed style
+        should actually include the additional values when no image is set though, so that should perhaps be the subject of a 
+        follow-up bug.
+
+        Added fast/backgrounds/background-position-parsing.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillPositionX):
+        (WebCore::CSSParser::parseFillPositionY):
+        (WebCore::CSSParser::parseFillPositionComponent):
+        (WebCore::CSSParser::parseFillPosition):
+        (WebCore::CSSParser::parseFillProperty):
+        (WebCore::CSSParser::parseTransformOrigin):
+        (WebCore::CSSParser::parsePerspectiveOrigin):
+        * css/CSSParser.h:
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::fillUnsetProperties):
+        (WebCore::FillLayer::cullEmptyLayers):
+
+2011-03-11  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] Allow large layers with non-identity transforms to be drawn
+        as long as their visible portion is smaller than the largest supported
+        texture size. This code will soon be replaced by tiled layers.
+        https://bugs.webkit.org/show_bug.cgi?id=55984
+
+        Test: platform/chromium/compositing/huge-layer-rotated.html
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::updateContentsIfDirty):
+        (WebCore::ContentLayerChromium::draw):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+
+2011-03-09  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        REGRESSION (5.0.3-ToT): Scrolling text doesn&apos;t scroll in Star Wars intro animation
+        https://bugs.webkit.org/show_bug.cgi?id=52468
+
+        Added WIN32 to the ifdef controlling whether animations are applied in normal or
+        reverse order. On Mac, animations used to be applied in reverse, but 
+        <rdar://problem/7095638> fixed this in the release after Snow Leopard.
+        But that patch has not be applied to the Safari Windows SDK yet. For now
+        I've made Windows use the reverse order logig. <rdar://problem/9112233> is
+        tracking the inclusion of the patch on Windows.
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::createTransformAnimationsFromKeyframes):
+
+2011-03-11  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Let the parser yield for layout before running scripts
+        https://bugs.webkit.org/show_bug.cgi?id=54355
+
+        Prior to this patch, the parser would yield to perform a layout/paint before running a
+        script only if the script or a stylesheet blocking the script is not loaded yet. Since we
+        don't preload scan into the body while parsing the head, typically we'll block on a script
+        early in the body that causes us to yield to do the first paint within a reasonable time.
+
+        However, I'm planning to change the PreloadScanner to scan into the body from the head.
+        That significantly improves overall load time, but would hurt first paint time because
+        fewer scripts would be blocked during parsing and thus wouldn't yield.
+
+        This change causes us to yield before running scripts if we haven't painted yet (regardless
+        of whether or not the script is loaded). In addition to allowing the above mentioned
+        PreloadScanner change to be implemented without regressing first paint time, this also
+        improves first paint time by itself.
+
+        I tested Alexa's top 45 websites using Web Page Replay to control the content and simulate
+        bandwidth. This patch improved average first paint time by 1% over an unlimited connection,
+        6% over a 1Mbps connection and 11% over a 5Mbps connection. There was no statistically
+        signifcant change in page load time.
+
+        Within the pages tested, 33 had no statistically significant change in time to first paint,
+        12 improved, and none regressed. Of the improved, some of the standouts from the 1Mbps set
+        are: 20% on youtube, 37% on wiki, 27% on ebay, 13% on cnn, 16% on espn, 74% on sohu.
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::canTakeNextToken): This is the new yield point.
+        (WebCore::HTMLDocumentParser::pumpTokenizer): Remove ASSERT that we are not paused. isPaused
+        means that we are waiting for a script. Bug 54574 changed pumpTokenizer() so that it does
+        the right thing whether we are just before a token or waiting for a script. Now that we may
+        yield before a token or before a script, this may be called while paused.
+        * html/parser/HTMLParserScheduler.cpp:
+        (WebCore::HTMLParserScheduler::checkForYieldBeforeScript): Added.
+        * page/FrameView.h:
+        (WebCore::FrameView::hasEverPainted): Added.
+
+2011-03-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Fix crashes in dom/html/level2/html/HTMLInputElement*.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle): Added a null-check for e,
+            because e can certainly be a null.
+
+2011-03-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Choke text-decoration when entering shadow DOM subtree.
+        https://bugs.webkit.org/show_bug.cgi?id=56044
+
+        No new tests, because the functionality can't be tested yet.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle): Added a check for shadow DOM root.
+
+2011-03-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Convert MediaControlTimeDisplayElement to use standard layout with a custom renderer.
+        https://bugs.webkit.org/show_bug.cgi?id=55972
+
+        Instead of poking at the time display elements all the way from RenderMedia,
+        let the standard layout cycle take care of things. Move the logic of calculating
+        when to collapse the time display elements into a custom renderer, since
+        this is not something that can be accomplished with CSS.
+
+        Also, the logic of keeping the timeline slider at least 100px needed refreshing,
+        since it didn't actually keep it at 100px.
+
+        * html/shadow/MediaControls.cpp: Moved the logic of determining visibility
+            of time display elements to RenderMediaControlTimeDisplay, eliminating
+            updateTimeDisplayVisibility method.
+        * html/shadow/MediaControls.h: Removed decl.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::RenderMediaControlTimeDisplay::RenderMediaControlTimeDisplay):
+            Added new renderer class.
+        (WebCore::RenderMediaControlTimeDisplay::layout): Simplified (and corrected)
+            size-sensing logic, still using hard-coded values.
+        (WebCore::MediaControlTimeDisplayElement::MediaControlTimeDisplayElement):
+            Removed m_isVisible member, which is no longer necessary.
+        (WebCore::MediaControlTimeDisplayElement::createRenderer): Added to
+            return the new renderer.
+        * rendering/MediaControlElements.h: Adjusted decls.
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::layout): Remove the now-unnecessary poking at
+            media controls in layout.
+
+2011-03-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Start focusing updates to media controls, away from always updating everything.
+        https://bugs.webkit.org/show_bug.cgi?id=56038
+
+        For now, the new methods just call generic MediaControls::update.
+
+        Covered by existing tests.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::attributeChanged): Changed to use MediaControls::reset.
+        (WebCore::HTMLMediaElement::setMuted): Changed to use MediaControls::changedMute.
+        (WebCore::HTMLMediaElement::updateVolume): Changed to use MediaControls::changedVolume.
+        (WebCore::HTMLMediaElement::defaultEventHandler): Changed to use the new mediaControls
+            accessor.
+        (WebCore::HTMLMediaElement::setClosedCaptionsVisible): Changed to use
+            MediaControls::changedClosedCaptionsVisibility.
+        (WebCore::HTMLMediaElement::mediaControls): Added.
+        (WebCore::HTMLMediaElement::hasMediaControls): Added.
+        * html/HTMLMediaElement.h: Added decls.
+        * html/shadow/MediaControls.cpp:
+        (WebCore::MediaControls::reset): Added.
+        (WebCore::MediaControls::changedMute): Added.
+        (WebCore::MediaControls::changedVolume): Added.
+        (WebCore::MediaControls::changedClosedCaptionsVisibility): Added.
+        * html/shadow/MediaControls.h: Added decls.
+
+2011-03-11  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Reviewed by Martin Robinson.
+
+        [GStreamer] When seeking webKitWebSrcStop release the frame but should not.
+        https://bugs.webkit.org/show_bug.cgi?id=55703
+
+        When calling webKitWebSrcStop in case of a seeking, the frame should not
+        be reset (the source hasn't change). The frame may be used to get the network
+        context. Some network stack (like Qt) are relaying on the network context
+        to work.
+
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        (webKitWebSrcStop):
+
+2011-03-11  Dean Jackson  <dino@apple.com>
+
+        Unreviewed.
+
+        Build fixes for GTK and Leopard.
+
+        * bindings/gobject/GNUmakefile.am:
+        - add missing WebKitAnimation* generated bindings
+        * page/WebKitAnimation.idl:
+        - use double in place of float (the core values are double anyway)
+
+2011-03-11  Dean Jackson  <dino@apple.com>
+
+        Unreviewed build fix for QT.
+
+        * WebCore.pro:
+
+2011-03-11  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser and Chris Marrin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=54151
+        Implement an API to play/pause/scrub animations
+
+        This is Part 1. Adds the new WebKitAnimation and WebKitAnimationList
+        APIs, exposed via Element.getWebKitAnimations(). This first pass
+        is a read-only API - a subsequent commit will add the ability
+        to scrub animations.
+
+        Test: animations/animation-api-1.html
+
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * Android.mk:
+        * Android.v8bindings.mk:
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        - All build settings updated for new files
+        * bindings/js/JSBindingsAllInOne.cpp:
+        - Include new custom files
+        * bindings/js/JSWebKitAnimationCustom.cpp: Added.
+        (WebCore::JSWebKitAnimation::iterationCount):
+        - Custom property getter so that we can return INFINITY
+        * bindings/js/JSWebKitAnimationListCustom.cpp: Added.
+        (WebCore::JSWebKitAnimationList::markChildren):
+        - Make sure WebKitAnimations are marked
+        * bindings/v8/custom/V8WebKitAnimationCustom.cpp: Added.
+        (WebCore::V8WebkitAnimation::iterationCountAccessorGetter):
+        - Custom property getter so that we can return INFINITY
+        * dom/Element.cpp:
+        (WebCore::Element::webkitGetAnimations):
+        * dom/Element.h:
+        * dom/Element.idl:
+        - New API entry point
+        * page/DOMWindow.idl:
+        - Constructor definitions for WebKitAnimation and WebKitAnimationList
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::~AnimationBase):
+        - Since AnimationBase can now live longer (if a WebKitAnimation is
+        held in Javascript) we need to guard for the renderer having disappeared.
+        (WebCore::AnimationBase::setElapsedTime):
+        (WebCore::AnimationBase::play):
+        (WebCore::AnimationBase::pause):
+        - Stub implementations at present
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::animation):
+        - Expose the Animation properties
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::animationsForRenderer):
+        (WebCore::AnimationController::animationsForRenderer):
+        - Builds the list of WebKitAnimations
+        * page/animation/AnimationController.h:
+        * page/animation/AnimationControllerPrivate.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        - Make sure we clear the renderer if we are removing the animation
+        (WebCore::CompositeAnimation::animations):
+        * page/animation/CompositeAnimation.h:
+        * page/WebKitAnimation.cpp: Added.
+        (WebCore::WebKitAnimation::WebKitAnimation):
+        (WebCore::WebKitAnimation::name):
+        (WebCore::WebKitAnimation::duration):
+        (WebCore::WebKitAnimation::elapsedTime):
+        (WebCore::WebKitAnimation::setElapsedTime):
+        (WebCore::WebKitAnimation::delay):
+        (WebCore::WebKitAnimation::iterationCount):
+        (WebCore::WebKitAnimation::paused):
+        (WebCore::WebKitAnimation::ended):
+        (WebCore::WebKitAnimation::direction):
+        (WebCore::WebKitAnimation::fillMode):
+        (WebCore::WebKitAnimation::pause):
+        (WebCore::WebKitAnimation::play):
+        - The implementation of the new API. All the read-only parts are
+        done, but elapsedTime, play() and pause() are stubs.
+        * page/WebKitAnimation.h: Added.
+        (WebCore::WebKitAnimation::create):
+        (WebCore::WebKitAnimation::~WebKitAnimation):
+        * page/WebKitAnimation.idl: Added.
+        * page/WebKitAnimationList.cpp: Added.
+        * page/WebKitAnimationList.h: Added.
+        * page/WebKitAnimationList.idl: Added.
+        - Copies NodeList implementation
+
+2011-03-11  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: introduce error argument for all the callbacks on frontend.
+        https://bugs.webkit.org/show_bug.cgi?id=56100
+
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.evaluateInTargetWindow):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.allStylesCallback):
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun.getStyles):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.getStylesAsync):
+        (WebInspector.CSSStyleModel.prototype.getComputedStyleAsync):
+        (WebInspector.CSSStyleModel.prototype.getInlineStyleAsync):
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector):
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector.callback):
+        (WebInspector.CSSStyleModel.prototype.addRule):
+        (WebInspector.CSSStyleModel.prototype.addRule.callback):
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged.callback):
+        (WebInspector.CSSStyleModel.prototype._styleSheetChanged):
+        (WebInspector.CSSStyleModel.prototype._onRevert):
+        (WebInspector.CSSStyleDeclaration.prototype.insertPropertyAt):
+        (WebInspector.CSSProperty.prototype.setText.callback):
+        (WebInspector.CSSProperty.prototype.setText):
+        (WebInspector.CSSProperty.prototype.setDisabled.callback):
+        (WebInspector.CSSProperty.prototype.setDisabled):
+        (WebInspector.CSSStyleSheet.createForId):
+        (WebInspector.CSSStyleSheet.prototype.setText):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype.setNodeName):
+        (WebInspector.DOMNode.prototype.setNodeValue):
+        (WebInspector.DOMNode.prototype.setAttribute):
+        (WebInspector.DOMNode.prototype.removeAttribute):
+        (WebInspector.DOMNode.prototype.childNodes.mycallback):
+        (WebInspector.DOMNode.prototype.childNodes):
+        (WebInspector.DOMNode.prototype.outerHTML):
+        (WebInspector.DOMNode.prototype.setOuterHTML):
+        (WebInspector.DOMNode.prototype.removeNode):
+        (WebInspector.DOMNode.prototype.copyNode):
+        (WebInspector.DOMAgent.prototype.pushNodeToFrontend):
+        (WebInspector.DOMAgent.prototype.pushNodeByPathToFrontend):
+        (WebInspector.DOMAgent.prototype._documentUpdated):
+        (WebInspector.ApplicationCacheDispatcher.getApplicationCachesAsync):
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.EventListeners.getEventListenersForNodeAsync):
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorage.prototype.getEntries):
+        (WebInspector.DOMStorage.prototype.setItem):
+        (WebInspector.DOMStorage.prototype.removeItem):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.getTableNames):
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.setBreakpoint.didSetBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpointBySourceId):
+        (WebInspector.DebuggerModel.prototype.editScriptSource):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._setSearchingForNode):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._createTooltipForNode.resolvedNode):
+        (WebInspector.ElementsTreeElement.prototype._createTooltipForNode):
+        (WebInspector.ElementsTreeElement.prototype._tagNameEditingCommitted.changeTagNameCallback):
+        (WebInspector.ElementsTreeElement.prototype._tagNameEditingCommitted):
+        ():
+        * inspector/front-end/ExtensionPanel.js:
+        (WebInspector.ExtensionWatchSidebarPane.prototype._onEvaluate):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onEvaluateOnInspectedPage):
+        * inspector/front-end/NetworkManager.js:
+        (WebInspector.NetworkManager.prototype.requestContent):
+        (WebInspector.NetworkManager.prototype._processCachedResources):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.CPUProfileView.profileCallback):
+        (WebInspector.CPUProfileView):
+        * inspector/front-end/ProfilesPanel.js:
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject.resolveNode):
+        (WebInspector.RemoteObject.prototype.getProperties.remoteObjectBinder):
+        (WebInspector.RemoteObject.prototype.getProperties):
+        (WebInspector.RemoteObject.prototype.setPropertyValue):
+        (WebInspector.RemoteObject.prototype.evaluate):
+        * inspector/front-end/Script.js:
+        (WebInspector.Script.prototype.requestSource.didGetScriptSource):
+        (WebInspector.Script.prototype.requestSource):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame.updatingCallbackWrapper):
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype._setPauseOnExceptions):
+        * inspector/front-end/inspector.js:
+        ():
+        (WebInspector.doLoadedDone.onPopulateScriptObjects):
+        (WebInspector.doLoadedDone.propertyNamesCallback):
+        (WebInspector.doLoadedDone):
+
+2011-03-11  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: split InjectedScriptHost into InjectedScriptManager and InjectedScriptHost
+        https://bugs.webkit.org/show_bug.cgi?id=56173
+
+        Moved all injected script managing logic into InjectedScriptManager which is owned by InspectorController.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        * bindings/js/JSInjectedScriptManager.cpp: Added.
+        (WebCore::InjectedScriptManager::createInjectedScript):
+        (WebCore::InjectedScriptManager::discardInjectedScript):
+        (WebCore::InjectedScriptManager::injectedScriptFor):
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8InjectedScriptManager.cpp: Copied from Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp.
+        (WebCore::WeakReferenceCallback):
+        (WebCore::createInjectedScriptHostV8Wrapper):
+        (WebCore::InjectedScriptManager::createInjectedScript):
+        (WebCore::InjectedScriptManager::discardInjectedScript):
+        (WebCore::InjectedScriptManager::injectedScriptFor):
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::canAccessInspectedWindow):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::create):
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::~InjectedScriptHost):
+        (WebCore::InjectedScriptHost::disconnect):
+        (WebCore::InjectedScriptHost::inspectImpl):
+        (WebCore::InjectedScriptHost::clearConsoleMessages):
+        (WebCore::InjectedScriptHost::databaseIdImpl):
+        (WebCore::InjectedScriptHost::storageIdImpl):
+        * inspector/InjectedScriptHost.h:
+        (WebCore::InjectedScriptHost::init):
+        (WebCore::InjectedScriptHost::setFrontend):
+        (WebCore::InjectedScriptHost::clearFrontend):
+        * inspector/InjectedScriptManager.cpp: Added.
+        (WebCore::InjectedScriptManager::create):
+        (WebCore::InjectedScriptManager::InjectedScriptManager):
+        (WebCore::InjectedScriptManager::~InjectedScriptManager):
+        (WebCore::InjectedScriptManager::disconnect):
+        (WebCore::InjectedScriptManager::injectedScriptHost):
+        (WebCore::InjectedScriptManager::injectedScriptForId):
+        (WebCore::InjectedScriptManager::injectedScriptForObjectId):
+        (WebCore::InjectedScriptManager::discardInjectedScripts):
+        (WebCore::InjectedScriptManager::releaseObjectGroup):
+        (WebCore::InjectedScriptManager::injectedScriptSource):
+        (WebCore::InjectedScriptManager::injectScript):
+        * inspector/InjectedScriptManager.h: Copied from Source/WebCore/inspector/InjectedScriptHost.h.
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::inspectedPageDestroyed):
+        (WebCore::InspectorAgent::focusNode):
+        (WebCore::InspectorAgent::didClearWindowObjectInWorld):
+        (WebCore::InspectorAgent::createFrontendLifetimeAgents):
+        (WebCore::InspectorAgent::didCommitLoad):
+        (WebCore::InspectorAgent::domContentLoadedEventFired):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::InspectorConsoleAgent):
+        (WebCore::InspectorConsoleAgent::~InspectorConsoleAgent):
+        (WebCore::InspectorConsoleAgent::clearConsoleMessages):
+        (WebCore::InspectorConsoleAgent::addInspectedNode):
+        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
+        (WebCore::InspectorConsoleAgent::addConsoleMessage):
+        * inspector/InspectorConsoleAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::disconnectFrontend):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::discardBindings):
+        (WebCore::InspectorDOMAgent::pushNodeToFrontend):
+        (WebCore::InspectorDOMAgent::resolveNode):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::create):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::create):
+        (WebCore::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::currentCallFrames):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::create):
+        (WebCore::InspectorRuntimeAgent::InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::~InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::evaluate):
+        (WebCore::InspectorRuntimeAgent::evaluateOn):
+        (WebCore::InspectorRuntimeAgent::getProperties):
+        (WebCore::InspectorRuntimeAgent::setPropertyValue):
+        (WebCore::InspectorRuntimeAgent::releaseObject):
+        (WebCore::InspectorRuntimeAgent::releaseObjectGroup):
+        * inspector/InspectorRuntimeAgent.h:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel):
+
+2011-03-11  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] Change the way group id for CSS objects is calculated
+        https://bugs.webkit.org/show_bug.cgi?id=56117
+
+        Do not treat CSSStyleDeclarations under not CSSRule as belonging to the same object group
+        as they should not be reachable in JavaScript.
+
+        Covered by existing layout tests.  Fact of absence of retention is not trivial to prove.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::calculateGroupId):
+        (WebCore::DOMObjectGrouperVisitor::visitDOMWrapper):
+
+2011-03-11  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: hover over elements in Elements panel does not highlight nodes
+        https://bugs.webkit.org/show_bug.cgi?id=56121
+
+        In DOM trees with a comment and/or doctype preceding the HTML tag, the tree container right boundary
+        is 16px apart from the OL right boundary, and we miss the relevant LI by 4px. The fix is to compensate
+        for these 16px when computing the test point coordinates.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._treeElementFromEvent):
+
+2011-03-11  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Roll out r80837.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::InjectedScriptHost::createInjectedScript):
+        (WebCore::InjectedScriptHost::discardInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        (WebCore::InjectedScriptHost::canAccessInspectedWindow):
+        * bindings/js/JSInjectedScriptManager.cpp: Removed.
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        (WebCore::WeakReferenceCallback):
+        (WebCore::createInjectedScriptHostV8Wrapper):
+        (WebCore::InjectedScriptHost::createInjectedScript):
+        (WebCore::InjectedScriptHost::discardInjectedScript):
+        (WebCore::InjectedScriptHost::injectedScriptFor):
+        (WebCore::InjectedScriptHost::canAccessInspectedWindow):
+        * bindings/v8/custom/V8InjectedScriptManager.cpp: Removed.
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::canAccessInspectedWindow):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::~InjectedScriptHost):
+        (WebCore::InjectedScriptHost::inspectImpl):
+        (WebCore::InjectedScriptHost::clearConsoleMessages):
+        (WebCore::InjectedScriptHost::databaseIdImpl):
+        (WebCore::InjectedScriptHost::storageIdImpl):
+        (WebCore::InjectedScriptHost::injectedScriptForId):
+        (WebCore::InjectedScriptHost::injectedScriptForObjectId):
+        (WebCore::InjectedScriptHost::injectedScriptForMainFrame):
+        (WebCore::InjectedScriptHost::discardInjectedScripts):
+        (WebCore::InjectedScriptHost::releaseObjectGroup):
+        (WebCore::InjectedScriptHost::frontend):
+        (WebCore::InjectedScriptHost::injectedScriptSource):
+        (WebCore::InjectedScriptHost::injectScript):
+        * inspector/InjectedScriptHost.h:
+        (WebCore::InjectedScriptHost::create):
+        (WebCore::InjectedScriptHost::inspectorAgent):
+        (WebCore::InjectedScriptHost::disconnectController):
+        * inspector/InjectedScriptManager.cpp: Removed.
+        * inspector/InjectedScriptManager.h: Removed.
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::inspectedPageDestroyed):
+        (WebCore::InspectorAgent::focusNode):
+        (WebCore::InspectorAgent::didClearWindowObjectInWorld):
+        (WebCore::InspectorAgent::createFrontendLifetimeAgents):
+        (WebCore::InspectorAgent::didCommitLoad):
+        (WebCore::InspectorAgent::domContentLoadedEventFired):
+        * inspector/InspectorAgent.h:
+        (WebCore::InspectorAgent::injectedScriptHost):
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::InspectorConsoleAgent):
+        (WebCore::InspectorConsoleAgent::~InspectorConsoleAgent):
+        (WebCore::InspectorConsoleAgent::clearConsoleMessages):
+        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
+        (WebCore::InspectorConsoleAgent::addConsoleMessage):
+        * inspector/InspectorConsoleAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::disconnectFrontend):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::discardBindings):
+        (WebCore::InspectorDOMAgent::addInspectedNode):
+        (WebCore::InspectorDOMAgent::pushNodeToFrontend):
+        (WebCore::InspectorDOMAgent::resolveNode):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::create):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::create):
+        (WebCore::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::currentCallFrames):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::~InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::evaluate):
+        (WebCore::InspectorRuntimeAgent::evaluateOn):
+        (WebCore::InspectorRuntimeAgent::getProperties):
+        (WebCore::InspectorRuntimeAgent::setPropertyValue):
+        (WebCore::InspectorRuntimeAgent::releaseObject):
+        (WebCore::InspectorRuntimeAgent::releaseObjectGroup):
+        * inspector/InspectorRuntimeAgent.h:
+        (WebCore::InspectorRuntimeAgent::create):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel):
+
+2011-03-11  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: split InjectedScriptHost into InjectedScriptManager and InjectedScriptHost
+        https://bugs.webkit.org/show_bug.cgi?id=56173
+
+        Moved all injected script managing logic into InjectedScriptManager which is owned by InspectorController.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        * bindings/js/JSInjectedScriptManager.cpp: Added.
+        (WebCore::InjectedScriptManager::createInjectedScript):
+        (WebCore::InjectedScriptManager::discardInjectedScript):
+        (WebCore::InjectedScriptManager::injectedScriptFor):
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
+        * bindings/v8/custom/V8InjectedScriptManager.cpp: Copied from Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp.
+        (WebCore::WeakReferenceCallback):
+        (WebCore::createInjectedScriptHostV8Wrapper):
+        (WebCore::InjectedScriptManager::createInjectedScript):
+        (WebCore::InjectedScriptManager::discardInjectedScript):
+        (WebCore::InjectedScriptManager::injectedScriptFor):
+        (WebCore::InjectedScriptManager::canAccessInspectedWindow):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToFrontend):
+        * inspector/ConsoleMessage.h:
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::canAccessInspectedWindow):
+        * inspector/InjectedScript.h:
+        * inspector/InjectedScriptHost.cpp:
+        (WebCore::InjectedScriptHost::create):
+        (WebCore::InjectedScriptHost::InjectedScriptHost):
+        (WebCore::InjectedScriptHost::~InjectedScriptHost):
+        (WebCore::InjectedScriptHost::disconnect):
+        (WebCore::InjectedScriptHost::inspectImpl):
+        (WebCore::InjectedScriptHost::clearConsoleMessages):
+        (WebCore::InjectedScriptHost::databaseIdImpl):
+        (WebCore::InjectedScriptHost::storageIdImpl):
+        * inspector/InjectedScriptHost.h:
+        (WebCore::InjectedScriptHost::init):
+        (WebCore::InjectedScriptHost::setFrontend):
+        (WebCore::InjectedScriptHost::clearFrontend):
+        * inspector/InjectedScriptManager.cpp: Added.
+        (WebCore::InjectedScriptManager::create):
+        (WebCore::InjectedScriptManager::InjectedScriptManager):
+        (WebCore::InjectedScriptManager::~InjectedScriptManager):
+        (WebCore::InjectedScriptManager::disconnect):
+        (WebCore::InjectedScriptManager::injectedScriptHost):
+        (WebCore::InjectedScriptManager::injectedScriptForId):
+        (WebCore::InjectedScriptManager::injectedScriptForObjectId):
+        (WebCore::InjectedScriptManager::discardInjectedScripts):
+        (WebCore::InjectedScriptManager::releaseObjectGroup):
+        (WebCore::InjectedScriptManager::injectedScriptSource):
+        (WebCore::InjectedScriptManager::injectScript):
+        * inspector/InjectedScriptManager.h: Copied from Source/WebCore/inspector/InjectedScriptHost.h.
+        * inspector/Inspector.idl:
+        * inspector/InspectorAgent.cpp:
+        (WebCore::InspectorAgent::InspectorAgent):
+        (WebCore::InspectorAgent::inspectedPageDestroyed):
+        (WebCore::InspectorAgent::focusNode):
+        (WebCore::InspectorAgent::didClearWindowObjectInWorld):
+        (WebCore::InspectorAgent::createFrontendLifetimeAgents):
+        (WebCore::InspectorAgent::didCommitLoad):
+        (WebCore::InspectorAgent::domContentLoadedEventFired):
+        * inspector/InspectorAgent.h:
+        * inspector/InspectorBrowserDebuggerAgent.cpp:
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::InspectorConsoleAgent):
+        (WebCore::InspectorConsoleAgent::~InspectorConsoleAgent):
+        (WebCore::InspectorConsoleAgent::clearConsoleMessages):
+        (WebCore::InspectorConsoleAgent::addInspectedNode):
+        (WebCore::InspectorConsoleAgent::setConsoleMessagesEnabled):
+        (WebCore::InspectorConsoleAgent::addConsoleMessage):
+        * inspector/InspectorConsoleAgent.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::disconnectFrontend):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::discardBindings):
+        (WebCore::InspectorDOMAgent::pushNodeToFrontend):
+        (WebCore::InspectorDOMAgent::resolveNode):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::create):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::create):
+        (WebCore::InspectorDebuggerAgent::InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::evaluateOnCallFrame):
+        (WebCore::InspectorDebuggerAgent::currentCallFrames):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorRuntimeAgent.cpp:
+        (WebCore::InspectorRuntimeAgent::create):
+        (WebCore::InspectorRuntimeAgent::InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::~InspectorRuntimeAgent):
+        (WebCore::InspectorRuntimeAgent::evaluate):
+        (WebCore::InspectorRuntimeAgent::evaluateOn):
+        (WebCore::InspectorRuntimeAgent::getProperties):
+        (WebCore::InspectorRuntimeAgent::setPropertyValue):
+        (WebCore::InspectorRuntimeAgent::releaseObject):
+        (WebCore::InspectorRuntimeAgent::releaseObjectGroup):
+        * inspector/InspectorRuntimeAgent.h:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel):
+
+2011-03-09  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        IndexedDB: Make IDBBackingStore abstract
+        https://bugs.webkit.org/show_bug.cgi?id=56013
+
+        Make IDBBackingStore abstract to allow for multiple implementations.
+        Move the SQLite implementation to IDBSQLiteBackingStore.
+
+        No new tests: refactoring only.
+
+        * WebCore.gypi:
+        * storage/IDBBackingStore.h:
+        (WebCore::IDBBackingStore::~IDBBackingStore):
+        * storage/IDBFactoryBackendImpl.cpp:
+        (WebCore::IDBFactoryBackendImpl::open):
+        * storage/IDBSQLiteBackingStore.cpp:
+        (WebCore::IDBSQLiteBackingStore::IDBSQLiteBackingStore):
+        (WebCore::IDBSQLiteBackingStore::~IDBSQLiteBackingStore):
+        (WebCore::runCommands):
+        (WebCore::createTables):
+        (WebCore::createMetaDataTable):
+        (WebCore::getDatabaseSchemaVersion):
+        (WebCore::migrateDatabase):
+        (WebCore::IDBSQLiteBackingStore::open):
+        (WebCore::IDBSQLiteBackingStore::extractIDBDatabaseMetaData):
+        (WebCore::IDBSQLiteBackingStore::setIDBDatabaseMetaData):
+        (WebCore::IDBSQLiteBackingStore::getObjectStores):
+        (WebCore::IDBSQLiteBackingStore::createObjectStore):
+        (WebCore::doDelete):
+        (WebCore::IDBSQLiteBackingStore::deleteObjectStore):
+        (WebCore::whereSyntaxForKey):
+        (WebCore::bindKeyToQuery):
+        (WebCore::lowerCursorWhereFragment):
+        (WebCore::upperCursorWhereFragment):
+        (WebCore::IDBSQLiteBackingStore::getObjectStoreRecord):
+        (WebCore::bindKeyToQueryWithNulls):
+        (WebCore::IDBSQLiteBackingStore::putObjectStoreRecord):
+        (WebCore::IDBSQLiteBackingStore::clearObjectStore):
+        (WebCore::IDBSQLiteBackingStore::deleteObjectStoreRecord):
+        (WebCore::IDBSQLiteBackingStore::nextAutoIncrementNumber):
+        (WebCore::IDBSQLiteBackingStore::keyExistsInObjectStore):
+        (WebCore::IDBSQLiteBackingStore::forEachObjectStoreRecord):
+        (WebCore::IDBSQLiteBackingStore::getIndexes):
+        (WebCore::IDBSQLiteBackingStore::createIndex):
+        (WebCore::IDBSQLiteBackingStore::deleteIndex):
+        (WebCore::IDBSQLiteBackingStore::putIndexDataForRecord):
+        (WebCore::IDBSQLiteBackingStore::deleteIndexDataForRecord):
+        (WebCore::IDBSQLiteBackingStore::getObjectViaIndex):
+        (WebCore::keyFromQuery):
+        (WebCore::IDBSQLiteBackingStore::getPrimaryKeyViaIndex):
+        (WebCore::IDBSQLiteBackingStore::keyExistsInIndex):
+        (WebCore::IDBSQLiteBackingStore::openObjectStoreCursor):
+        (WebCore::IDBSQLiteBackingStore::openIndexKeyCursor):
+        (WebCore::IDBSQLiteBackingStore::openIndexCursor):
+        (WebCore::IDBSQLiteBackingStore::createTransaction):
+        * storage/IDBSQLiteBackingStore.h: Added.
+
+2011-03-11  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Unreviewed build error fix.
+
+        [EFL] Fix build break when SHARED_CORE is ON
+        https://bugs.webkit.org/show_bug.cgi?id=56155
+
+        * platform/efl/ContextMenuEfl.cpp:
+        (WebCore::ContextMenu::ContextMenu):
+        * platform/efl/ContextMenuItemEfl.cpp:
+        (WebCore::ContextMenuItem::nativeMenuItem):
+        (WebCore::ContextMenuItem::ContextMenuItem):
+        (WebCore::ContextMenuItem::~ContextMenuItem):
+
+2011-03-11  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: resource load cancellation is reported to console as an error
+        https://bugs.webkit.org/show_bug.cgi?id=55764
+
+        - mark interruptionForPolicyChangeError as cancellation
+        - do not log resource cancelation as an error
+        - always push resource to front-end before console message, so front-end can use resource info while formatting message.
+
+        * inspector/InspectorConsoleAgent.cpp:
+        (WebCore::InspectorConsoleAgent::didFailLoading):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didReceiveResourceResponseImpl):
+        (WebCore::InspectorInstrumentation::didFailLoadingImpl):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::stopLoadingForPolicyChange):
+
+2011-03-10  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Get rid of has/add/removeStyleClass() methods on Element.prototype - Step 1
+        https://bugs.webkit.org/show_bug.cgi?id=56096
+
+        No new tests, as this is a refactoring.
+
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.EventListenerBreakpointsSidebarPane):
+        * inspector/front-end/DetailedHeapshotView.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.BaseStorageTreeElement):
+        (WebInspector.BaseStorageTreeElement.prototype.onattach):
+        (WebInspector.StorageCategoryTreeElement):
+        (WebInspector.FrameTreeElement):
+        (WebInspector.FrameResourceTreeElement):
+        (WebInspector.DatabaseTreeElement):
+        (WebInspector.DatabaseTableTreeElement):
+        (WebInspector.DOMStorageTreeElement):
+        (WebInspector.CookieTreeElement):
+        (WebInspector.ApplicationCacheTreeElement):
+        (WebInspector.ResourceRevisionTreeElement):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.removeStyleClass):
+        (Element.prototype.addStyleClass):
+        (Element.prototype.hasStyleClass):
+
+2011-03-11  Brian Salomon  <bsalomon@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Adds GrContext flush call to PlatformContextSkia destructor. 
+Calls GrContext flush with int parameter instead of bool due to skia 
+revision.       
+
+        No new tests needed.
+
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        (WebCore::DrawingBuffer::publishToPlatformLayer):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::~PlatformContextSkia):
+        (WebCore::PlatformContextSkia::setSharedGraphicsContext3D):
+
+2011-03-10  Chris Guillory  <chris.guillory@google.com>
+
+        Reviewed by James Robinson.
+
+        Fix for Coverity discovered NO_EFFECT (self-assign) defect.
+        https://bugs.webkit.org/show_bug.cgi?id=54143
+
+        * platform/graphics/gpu/TilingData.cpp:
+        (WebCore::TilingData::setMaxTextureSize):
+
+2011-03-10  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        The web colours palevioletred and mediumpurple are incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=46658
+
+        Changed value for the palevioletred and mediumpurple colors to match
+        the css3 specification.
+
+        Test: fast/css/named-colors.html
+
+        * inspector/front-end/Color.js:
+        * platform/ColorData.gperf:
+
+2011-03-10  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Unreviewed build fix.
+
+        [WML] Fix build error
+        https://bugs.webkit.org/show_bug.cgi?id=56078
+
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2011-03-10  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix navigation menus on a bunch of sites in WebKit.
+        https://bugs.webkit.org/show_bug.cgi?id=52535
+
+        WebKit doesn't support position:relative for several table elements and
+        overwrites the style internally when position:relative is encountered.
+        Unfortunately position:relative affects the choice of nodes returned by
+        offsetParent.
+
+        This CL adds a bit to RenderStyle to track whether position:relative was
+        overwritten.  The value is then consulted in offsetParent which makes us
+        match FF/IE.
+
+        Tests: fast/block/positioning/offsetLeft-relative-iframe.html
+               fast/block/positioning/offsetLeft-relative-td.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::isOriginallyRelPositioned):
+        (WebCore::RenderObject::offsetParent):
+        * rendering/RenderObject.h:
+        * rendering/style/RenderStyle.h: Add a bit to track the original value of position:relative.
+        (WebCore::InheritedFlags::positionWasRelative):
+        (WebCore::InheritedFlags::setPositionWasRelative):
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h:
+
+2011-03-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r66428/r71892): Crash after assertion failure (!m_reachedTerminalState) in ResourceLoader::didCancel()
+        https://bugs.webkit.org/show_bug.cgi?id=51357
+
+        Previously, we would try to print from a callstack that didn't want a
+        nested event loop, leading to re-entrancy problems.  In this patch, we
+        complete the print call asynchronously, giving us a clean stack on
+        which to run the nested event loop.
+
+        Test: printing/print-close-crash.html
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::DOMWindow):
+        (WebCore::DOMWindow::print):
+        (WebCore::DOMWindow::printTimerFired):
+        * page/DOMWindow.h:
+
+2011-03-11  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        Bug 55570 - Remove dependency of dom/InputElement.cpp on html/ and wml/
+        https://bugs.webkit.org/show_bug.cgi?id=55570
+
+        Add a virtual function toInputElement() to Node that has a default
+        implementation of returning 0.
+        For HTMLInputElement and WMLInputElement (which derive from InputElement)
+        override this to return the object.
+        Change all calling sites of the old toInputElement to use the new member
+        function. This also allows us to save some casts.
+
+        No new tests. (refactoring)
+
+        * WebCore.exp.in:
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isPasswordField):
+        (WebCore::AccessibilityRenderObject::isIndeterminate):
+        (WebCore::AccessibilityRenderObject::isNativeCheckboxOrRadio):
+        (WebCore::AccessibilityRenderObject::isChecked):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * dom/CheckedRadioButtons.cpp:
+        (WebCore::CheckedRadioButtons::removeButton):
+        * dom/InputElement.cpp:
+        * dom/InputElement.h:
+        * dom/Node.cpp:
+        (WebCore::Node::toInputElement):
+        * dom/Node.h:
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::toInputElement):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::inputElement):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::isChecked):
+        (WebCore::RenderTheme::isIndeterminate):
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::toInputElement):
+
+2011-03-10  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] New mediaControl css file for EFL
+        https://bugs.webkit.org/show_bug.cgi?id=55460
+
+        Add new mediaControl css file for html5 video UI.
+
+        * CMakeLists.txt:
+        * CMakeListsEfl.txt:
+        * css/mediaControlsEfl.css: Added.
+        (audio):
+        (audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel):
+        (video:-webkit-full-page-media::-webkit-media-controls-panel):
+        (audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button):
+        (audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button):
+        (audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container):
+        (audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display):
+        (audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display):
+        (audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline):
+        (audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container):
+        (audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider):
+        (audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button):
+        (audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button):
+        (audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button):
+        (audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button):
+        (audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button):
+        (audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button):
+        (audio::-webkit-media-controls-volume-slider-mute-button, video::-webkit-media-controls-volume-slider-mute-button):
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::extraMediaControlsStyleSheet):
+
+2011-03-10  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        style.display affecting the initial selectedIndex value of a <select> when its multiple attribute is set programatically
+        https://bugs.webkit.org/show_bug.cgi?id=53860
+
+        Preserve selection when changing between multi-select and single-select
+        for <select> boxes even if it has not yet been rendered.
+
+        Test: fast/dom/HTMLSelectElement/change-multiple-preserve-selection.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setMultiple):
+
+2011-03-10  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        update comment to reference new DOM Core spec
+        https://bugs.webkit.org/show_bug.cgi?id=56079
+
+        I'm excising all instances of WRONG_DOCUMENT_ERR from WebKit.
+        This is the only one that's actually specified to fire
+        in the latest DOM Core spec.
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+
+2011-03-10  Rik Cabanier  <cabanier@gmail.com>
+
+        Reviewed by Tony Gentilcore.
+
+        Fix that allows fixed length values to be floating point
+        https://bugs.webkit.org/show_bug.cgi?id=52699
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::convertToLength):
+        (WebCore::convertToIntLength):
+        (WebCore::convertToFloatLength):
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::createTransformOperations):
+        * platform/Length.h:
+        (WebCore::Length::Length):
+        (WebCore::Length::operator==):
+        (WebCore::Length::operator!=):
+        (WebCore::Length::rawValue):
+        (WebCore::Length::type):
+        (WebCore::Length::quirk):
+        (WebCore::Length::setValue):
+        (WebCore::Length::calcFloatValue):
+        (WebCore::Length::isZero):
+        (WebCore::Length::blend):
+        (WebCore::Length::getIntValue):
+        (WebCore::Length::getFloatValue):
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        (WebCore::AutoTableLayout::calcEffectiveLogicalWidth):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
+
+2011-03-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80800.
+        http://trac.webkit.org/changeset/80800
+        https://bugs.webkit.org/show_bug.cgi?id=56163
+
+        Caused hundreds of tests to crash on Windows 7 (Requested by
+        rniwa on #webkit).
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::mouseMoved):
+        (WebCore::EventHandler::updateMouseEventTargetNode):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setActive):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::~FrameView):
+        * page/FrameView.h:
+        * page/Page.cpp:
+        * page/Page.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::RenderDataGrid):
+        (WebCore::RenderDataGrid::~RenderDataGrid):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::~RenderLayer):
+        * rendering/RenderLayer.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::RenderListBox):
+        (WebCore::RenderListBox::~RenderListBox):
+
+2011-03-10  Alice Boxhall  <aboxhall@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        NULL pointer crash when using :empty and :first-line pseudoclass selectors together
+        https://bugs.webkit.org/show_bug.cgi?id=53316
+
+        :empty is calculated for each element during parsing, but then not 
+        recalculated after any child elements are attached. Force style 
+        re-calculation on elements which have :empty in their style when
+        their children are changed.
+
+        Test: fast/css/empty-first-line-crash.html
+
+        * dom/Element.cpp:
+        (WebCore::checkForEmptyStyleChange): Pull out empty style checking
+        logic from checkForSiblingStyleChanges().
+        (WebCore::checkForSiblingStyleChanges): Use new checkForEmptyStyleChanges()
+        method.
+        (WebCore::Element::childrenChanged):  Call checkForEmptyStyleChanges() when
+        called with changedByParser = true.
+
+2011-03-10  Emil A Eklund  <eae@chromium.org>
+
+        Unreviewed build fix.
+
+        Fix Leopard Release build broken by r80797.
+
+        * html/CollectionCache.h:
+
+2011-03-10  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/8944558> Overlay scrollers in overflow areas need to 
+        send notifications appropriate times (showing up, resizing)
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=56067
+
+        The general strategy here is to add a HashSet of ScrollableAreas to the page that 
+        can be accessed when necessary to send notifications to all ScrollableAreas.
+
+        Find layers for relevant node and if the layers are in the Page's ScrollableArea 
+        set, then send the relevant notification.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::mouseMoved):
+        (WebCore::EventHandler::updateMouseEventTargetNode):
+
+        When the page is set active or not active, iterate through the Page's 
+        ScrollableAreas to send hide/show notifications. 
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setActive):
+
+        When a FrameView is created, add it to the ScrollableArea set. When it's 
+        destroyed, remove it.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::~FrameView):
+
+        Iterate through the Page's ScrollableAreas to send the paint notification.
+        (WebCore::FrameView::notifyPageThatContentAreaWillPaint):
+        * page/FrameView.h:
+
+        Add the new ScrollableArea set.
+        * page/Page.cpp:
+        (WebCore::Page::addScrollableArea):
+        (WebCore::Page::removeScrollableArea):
+        (WebCore::Page::pageContainsScrollableArea):
+        * page/Page.h:
+        (WebCore::Page::scrollableAreaSet):
+
+        notifyPageThatContentAreaWillPaint() is a dummy function implemented in FrameView.
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::notifyPageThatContentAreaWillPaint):
+
+        Call notifyPageThatContentAreaWillPaint() instead of calling 
+        contentAreaWillPaint() just for the ScrollView.
+        (WebCore::ScrollView::paint):
+        * platform/ScrollView.h:
+
+        Add/remove ScrollableAreas to the set.
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::RenderDataGrid):
+        (WebCore::RenderDataGrid::~RenderDataGrid):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::RenderListBox):
+        (WebCore::RenderListBox::~RenderListBox):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::~RenderLayer):
+
+        Should have implemented this ScrollableArea-interface function a while ago.
+        (WebCore::RenderLayer::currentMousePosition):
+        * rendering/RenderLayer.h:
+
+2011-03-10  takano takumi  <takano@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Crash in RenderCombineText::combineText when running fast/text/international/text-combine-parser-test.html on Windows with full page heap enabled
+        https://bugs.webkit.org/show_bug.cgi?id=55069
+
+        No new tests. If the test above runs without crash, the fix should be okay.
+
+        * dom/Node.cpp:
+        (WebCore::Node::diff):
+        - Changed to return Detach when textCombine style was changed.
+        * rendering/RenderCombineText.cpp:
+        (WebCore::RenderCombineText::styleDidChange):
+        (WebCore::RenderCombineText::setTextInternal):
+        (WebCore::RenderCombineText::width):
+        (WebCore::RenderCombineText::adjustTextOrigin):
+        (WebCore::RenderCombineText::charactersToRender):
+        (WebCore::RenderCombineText::combineText):
+        - Added assertions to ensure the passed object is RenderCombineText.
+        * rendering/RenderCombineText.h:
+        (WebCore::RenderCombineText::isCombineText):
+        - Added to distinguish plain RenderText and RenderCombineText.
+        (WebCore::toRenderCombineText):
+        - Added assertions to ensure the passed object is RenderCombineText.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isCombineText):
+        - Added to distinguish plain RenderText and RenderCombineText.
+
+2011-03-10  Emil A Eklund  <eae@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Collection cache not reset when moving base node between documents
+        https://bugs.webkit.org/show_bug.cgi?id=55446
+
+        Fix bug where HTMLCollection::resetCollectionInfo does not reset the
+        cache when the base node is moved to a different document by making sure
+        that the DOMVersion is updated and that it's unique across documents.
+
+        Tests: fast/dom/HTMLFormElement/invalid-form-field.html
+               fast/dom/HTMLFormElement/move-option-between-documents.html
+               fast/dom/collection-nameditem-move-between-documents.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore::Document::incDOMTreeVersion):
+        (WebCore::Document::domTreeVersion):
+        * dom/Node.cpp:
+        (WebCore::Node::setDocumentRecursively):
+        * html/FormAssociatedElement.cpp:
+        (WebCore::FormAssociatedElement::resetFormOwner):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::resetCollectionInfo):
+        * xml/XPathResult.h:
+
+2011-03-10  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Unreviewed build fix.
+
+        [EFL] Fix build break when CROSS_PLATFORM_CONTEXT_MENUS is disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=56005
+
+        There are build breaks when CROSS_PLATFORM_CONTEXT_MENUS is disabled.
+
+        * platform/efl/ContextMenuEfl.cpp:
+        (WebCore::ContextMenu::ContextMenu):
+        * platform/efl/ContextMenuItemEfl.cpp:
+
+2011-03-10  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        startOfBlock and endOfBlock may return a position inside hr
+        https://bugs.webkit.org/show_bug.cgi?id=56025
+
+        Replaced calls to enclosingBlockFlowElement in startOfBlock and endOfBlock by
+        calls to enclosingBlock. Added EditingBoundaryCrossingRule to the argument lists
+        of startOfBlock, endOfBlock, and enclosingBlock. Also replaced the last boolean
+        argument variable of enclosingNodeOfType by EditingBoundaryCrossingRule.
+
+        Also replaced calls to enclosingBlockFlowElement in inSameBlock by calls to
+        enclosingBlock to be consitent with startOfBlock and endOfBlock.
+
+        This patch also replaced calls to deprecatedNode in startOfBlock, endOfBlock,
+        and inSameBlock by calls to containerNode because the enclosing block of a position
+        should never be before or after the position.
+
+        No tests are added because this change only affects WebCore internally.
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializePositionData): Calls enclosingNodeOfType.
+        Pass CanCrossEditingBoundary instead of false.
+        * editing/htmlediting.cpp:
+        (WebCore::unsplittableElementForPosition): Ditto.
+        (WebCore::enclosingBlock): Takes EditingBoundaryCrossingRule and passes it to
+        enclosingNodeOfType.
+        (WebCore::enclosingNodeOfType): Takes EditingBoundaryCrossingRule instead of boolean.
+        Fixed a bug that it stops walking the tree when it reached the root editable node
+        even when the editing boundary crossing rule is CanCrossEditingBoundary.
+        * editing/htmlediting.h: Prototype changes.
+        * editing/visible_units.cpp:
+        (WebCore::startOfBlock): Calls enclosingBlock instead of enclosingBlockFlowElement.
+        Also added an early exit when there's no enclosing block.
+        (WebCore::endOfBlock): Ditto. The early exist in this case prevents crash in
+        lastPositionInNode.
+        (WebCore::inSameBlock): Calls enclosingBlock instead of enclosingBlockFlowElement.
+        (WebCore::isStartOfBlock): Calls startOfBlock with CanCrossEditingBoundary because
+        we don't care where the start of block is when we're comparing against the given position.
+        (WebCore::isEndOfBlock): Ditto.
+        * editing/visible_units.h:
+
+2011-03-10  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Backspace deletes all non-BMP symbols at once, and then some
+        https://bugs.webkit.org/show_bug.cgi?id=55971
+        <rdar://problem/8725312>
+
+        Test: platform/mac/editing/input/insert-delete-smp-symbol.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::isMark): This matches what Core Foundation does for all characters that I tested.
+        (WebCore::RenderText::previousOffsetForBackwardDeletion): Changed to use isMark().
+
+2011-03-10  Chris Evans  <cevans@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Error in StyleElement::process with large nodesets
+        https://bugs.webkit.org/show_bug.cgi?id=56150
+
+        Test: none due to excessive runtime and CRASH() vs. real crash.
+
+        * dom/StyleElement.cpp:
+        (WebCore::StyleElement::process): Handle large node sets better.
+
+2011-03-10  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47151
+        
+        Percentage heights should skip anonymous containing blocks when computing the used value.
+
+        Added fast/block/basic/percentage-height-inside-anonymous-block.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computePercentageLogicalHeight):
+
+2011-03-10  Nat Duca  <nduca@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] Make updateAndDrawLayers argumentless.
+        https://bugs.webkit.org/show_bug.cgi?id=55985
+
+        Made the TilePainters and viewport parameters for
+        LayerRendererChromium member variables instead of arguments on
+        updateAndDrawLayers. In a future change, this will allows us to
+        draw the layer tree without the WebView's assistance.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::create):
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        (WebCore::LayerRendererChromium::verticalScrollbarRect):
+        (WebCore::LayerRendererChromium::horizontalScrollbarRect):
+        (WebCore::LayerRendererChromium::invalidateRootLayerRect):
+        (WebCore::LayerRendererChromium::updateRootLayerContents):
+        (WebCore::LayerRendererChromium::updateRootLayerScrollbars):
+        (WebCore::LayerRendererChromium::drawRootLayer):
+        (WebCore::LayerRendererChromium::setViewport):
+        (WebCore::LayerRendererChromium::updateAndDrawLayers):
+        (WebCore::LayerRendererChromium::updateLayers):
+        (WebCore::LayerRendererChromium::drawLayers):
+        (WebCore::LayerRendererChromium::setRootLayer):
+        (WebCore::LayerRendererChromium::getFramebufferPixels):
+        (WebCore::LayerRendererChromium::cleanupSharedObjects):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore::LayerRendererChromium::viewportSize):
+        * platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp:
+        (WebCore::CCHeadsUpDisplay::draw):
+
+2011-01-25  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Implement spin buttons for GTK+ 2.x
+        https://bugs.webkit.org/show_bug.cgi?id=53098
+
+        Implement spin buttons for GTK+ 2.x. This allows proper render and functioning
+        for input type=number. The implementation is based on the one in gtkspinbutton.c
+        from the GTK+ sources.
+
+        * platform/gtk/RenderThemeGtk.h: Added new members and getters.
+        * platform/gtk/RenderThemeGtk2.cpp:
+        (WebCore::RenderThemeGtk::platformInit): Initialize spin button widget.
+        (WebCore::RenderThemeGtk::adjustRepaintRect): We need to draw outside the
+        spin button area to have proper rendering. There doesn't seem to be any other
+        clean way of having spin buttons that are the size of the text input frame.
+        (WebCore::RenderThemeGtk::adjustInnerSpinButtonStyle): Added implementation.
+        (WebCore::RenderThemeGtk::paintInnerSpinButton): Ditto.
+        (WebCore::RenderThemeGtk::gtkSpinButton): Added.
+
+2011-03-10  Levi Weintraub  <leviw@chromium.org>
+
+        Reviewed by Ryosuke Niwa.
+
+        InsertUnorderedList over a non-editable region and multiple lines enters an infinite loop
+        https://bugs.webkit.org/show_bug.cgi?id=53409
+
+        Fixing broken handling of mixed-editability content for InsertListCommand. Previously, if the selection
+        spanned non-contenteditable regions, it would get stuck endlessly iterating the same region as the algorithm
+        didn't skip the editable boundary.
+
+        Test: editing/execCommand/insert-list-with-noneditable-content.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::cleanupAfterDeletion): Changed signature to take the destination
+        position for the active editing command. Without this, there are cases when the destination happens
+        to be a placeholder, and we remove it.
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        * editing/CompositeEditCommand.h:
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply): Added logic to the paragraph iteration loop to handle pockets of
+        non-editable content in an editable context. Previously, this could cause an infinite loop.
+        * editing/visible_units.cpp:
+        (WebCore::startOfParagraph): Added a mode of operation where we'll jump across non-editable
+        content in the same paragraph to reach the actual editable paragraph start.
+        (WebCore::endOfParagraph): Ditto.
+        (WebCore::startOfNextParagraph): Now uses the aforementioned non-editable content skipping mode of
+        endOfParagraph.
+
+2011-03-10  Berend-Jan Wever  <skylined@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Calling focus() on an area element not in a document should not cause a NULL ptr crash
+        https://bugs.webkit.org/show_bug.cgi?id=54877
+
+        Test: fast/dom/HTMLAreaElement/area-islink-focus-null-ptr-crash.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::focus): Check element is in the document before allowing focus
+        * html/HTMLAreaElement.cpp: 
+        (WebCore::HTMLAreaElement::imageElement): Check element has a parent before checking if its parent is a map
+
+2011-03-10  Xiyuan Xia  <xiyuan@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [Chromium] Fix default single selection select's popup background on chromium/linux
+        https://bugs.webkit.org/show_bug.cgi?id=56023
+
+        Test: fast/html/select-dropdown-consistent-background-color.html
+
+        * css/themeChromiumLinux.css:
+
+2011-03-10  Kris Jordan  <krisjordan@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Improve default Accept header to give preference to HTML over XML.
+        https://bugs.webkit.org/show_bug.cgi?id=27267
+
+        * loader/FrameLoader.cpp:Changed default accept header to match
+        FireFox' as per bug 27267.
+
+2011-03-10  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] [Webkit2] There are no scrollbars visible in the MiniBrowser
+        https://bugs.webkit.org/show_bug.cgi?id=56125
+
+        No new tests. This functionality will be tested once we have TestRunner
+        implementation for WebKit2 with pixel dumping support.
+
+        * GNUmakefile.am: Add a new define with tracks whether or not we are using
+        our specialized GTK+ ScrollView.
+        * platform/ScrollView.cpp: Only use the GTK+-specific ScrollView if we are compiling
+        WebKit1.
+        (WebCore::ScrollView::wheelEvent):
+        * platform/gtk/ScrollViewGtk.cpp: Ditto.
+
+2011-03-10  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Assertion fails by validating a form twice very quickly
+        https://bugs.webkit.org/show_bug.cgi?id=56069
+
+        If the interactive validation is invoked when a form control is in
+        needsLayout() state, an assertion in isFocusable() fails. To avoid it,
+        Add a call to updateLayoutIgnorePendingStylesheets() before isFocusable().
+
+        Test: fast/forms/interactive-validation-assertion-by-validate-twice.html
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::validateInteractively):
+          Calls updateLayoutIgnorePendingStylesheets().
+
+2011-03-10  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47143
+        
+        Static distance computation is wrong when an ancestor is also positioned.  We need to go up the container()
+        chain (after initially starting with the parent()) when doing this computation, so that we properly skip
+        intermediate boxes between two positioned blocks.
+
+        Added fast/block/positioning/static-distance-with-positioned-ancestor.html.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::computeInlineStaticDistance):
+        (WebCore::computeBlockStaticDistance):
+
+2011-03-10  Adrienne Walker  <enne@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Make tiled compositor data structure more efficient.
+        https://bugs.webkit.org/show_bug.cgi?id=54133
+
+        Previously, the compositor had a sparse 2D array of tiles for the
+        whole page, most of which were null.  The tiles were implicitly
+        located based on their position in the array. This was inefficient
+        when the page grew (e.g. infinite scrolling) and caused some bugs
+        (e.g. width * height > MAX_INT).  This change modifies tiles to have
+        explicit positions so they can be stored in a hash map.
+
+        Tests: LayoutTests/compositing/
+
+        * platform/graphics/chromium/LayerTilerChromium.cpp:
+        (WebCore::LayerTilerChromium::reset):
+        (WebCore::LayerTilerChromium::createTile):
+        (WebCore::LayerTilerChromium::invalidateTiles):
+        (WebCore::LayerTilerChromium::contentRectToTileIndices):
+        (WebCore::LayerTilerChromium::tileAt):
+        (WebCore::LayerTilerChromium::tileContentRect):
+        (WebCore::LayerTilerChromium::tileLayerRect):
+        (WebCore::LayerTilerChromium::invalidateRect):
+        (WebCore::LayerTilerChromium::invalidateEntireLayer):
+        (WebCore::LayerTilerChromium::update):
+        (WebCore::LayerTilerChromium::updateFromPixels):
+        (WebCore::LayerTilerChromium::draw):
+        (WebCore::LayerTilerChromium::growLayerToContain):
+        * platform/graphics/chromium/LayerTilerChromium.h:
+        (WebCore::LayerTilerChromium::Tile::Tile):
+        (WebCore::LayerTilerChromium::Tile::i):
+        (WebCore::LayerTilerChromium::Tile::j):
+        (WebCore::LayerTilerChromium::Tile::moveTo):
+        (WebCore::LayerTilerChromium::TileMapKeyTraits::emptyValue):
+        (WebCore::LayerTilerChromium::TileMapKeyTraits::constructDeletedValue):
+        (WebCore::LayerTilerChromium::TileMapKeyTraits::isDeletedValue):
+
+2011-03-10  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Unreviewed build fix for r80752; Negated the boolean logic.
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::next):
+        (WebCore::VisiblePosition::previous):
+
+2011-03-10  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make the same change to xheight on Windows for CG.
+
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2011-03-10  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47147
+        
+        Fix for repaint issues when the root element is a table and needs to paint a background that
+        covers the entire canvas.  Remove paintRootBoxDecorations and replace with paintRootBoxFillLayers,
+        so that it can be called only for fill layer painting.  Make tables and normal boxes both
+        call this new method.  Fix the dirty check at the start of RenderTable paint to not happen if
+        the table is the root of the document (this same check exists in RenderBlock painting already).
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintRootBoxFillLayers):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::paintBoxDecorationsWithSize):
+        * rendering/RenderBox.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paint):
+        (WebCore::RenderTable::paintBoxDecorations):
+
+2011-03-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80749.
+        http://trac.webkit.org/changeset/80749
+        https://bugs.webkit.org/show_bug.cgi?id=56143
+
+        "Caused at least 3 media tests to be flaky" (Requested by
+        tonyg-cr on #webkit).
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::canTakeNextToken):
+        (WebCore::HTMLDocumentParser::pumpTokenizer):
+        * html/parser/HTMLParserScheduler.cpp:
+        * html/parser/HTMLParserScheduler.h:
+        (WebCore::HTMLParserScheduler::checkForYieldBeforeToken):
+        * page/FrameView.h:
+
+2011-03-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Regression: Content not drawn when scrolling horizontally in an RTL page
+        https://bugs.webkit.org/show_bug.cgi?id=55077
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::overhangAmount):
+        (WebCore::ScrollView::calculateOverhangAreasForPainting):
+        Take the scroll origin into account when calculating overhang.
+
+        * platform/ScrollView.h:
+        * rendering/RenderLayer.h:
+        * platform/ScrollableArea.h:
+        (WebCore::ScrollableArea::scrollOrigin):
+        Move identical scroll origin member from ScrollView and RenderLayer
+        to shared base ScrollableArea. This is also needed so that the animator
+        can access it.
+
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::pinnedInDirection):
+        (WebCore::ScrollAnimatorMac::smoothScrollWithEvent):
+        (WebCore::ScrollAnimatorMac::snapRubberBandTimerFired):
+        Account for a scroll origin when doing calculating scroll offsets.
+
+2011-03-09  Matthew Delaney  <mdelaney@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Plumb through settings for accelerated drawing for canvas
+        https://bugs.webkit.org/show_bug.cgi?id=56039
+
+        No new tests. Doesn't affect behavior, just adding a switch to toggle canvas backends.
+
+        * WebCore.exp.in:
+        * html/HTMLCanvasElement.cpp:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * page/Settings.cpp:
+        * page/Settings.h:
+
+2011-03-10  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47157
+        
+        CSS2.1 test suite failures because the ex unit is broken with the Ahem font.
+        
+        Remove the code that tries to also include the maxX of the glyph bounds for the
+        'x' glyph, since it just causes the x-height to be way too large in cases where the 'x' glyph extends
+        below the baseline.
+
+        Remove the Apple Symbol hack for ex units, since the person who added that was confused by another
+        issue, namely that CGFontGetXHeight wasn't being properly multiplied by the pointSize.  That's why
+        the value was too small.  Patched the code to just multiply by pointSize and took out the hack.
+        
+        Fix causes many tests in the css2.1 directory to progress, so no new tests required.  Many other
+        layout tests change because the xHeight for Lucida Grande gets smaller by a little bit, and radio
+        buttons use ex horizontal margins by default.
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit):
+
+2011-03-10  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        VisiblePosition's next and previous should take an enum instead of a boolean
+        https://bugs.webkit.org/show_bug.cgi?id=56135
+
+        Changed the argument type of VisiblePosition::next and VisiblePosition::previous
+        from bool to EditingBoundaryCrossingRule. Also got rid of StayInEditableContent enum
+        in VisibleSelection and replaced it by EditingBoundaryCrossingRule because the enum
+        was only used in VisiblePosition::isAll and subsequently in SelectionController::isAll
+        to call VisiblePosition::next and VisiblePosition::previous.
+
+        * WebCore.exp.in:
+        * dom/Position.cpp:
+        (WebCore::Position::trailingWhitespacePosition):
+        * editing/ApplyBlockElementCommand.cpp:
+        (WebCore::ApplyBlockElementCommand::doApply):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+        (WebCore::InsertListCommand::listifyParagraph):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::shouldMergeStart):
+        (WebCore::ReplaceSelectionCommand::shouldMergeEnd):
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyExtendingRight):
+        (WebCore::SelectionController::modifyExtendingForward):
+        (WebCore::SelectionController::modifyMovingForward):
+        (WebCore::SelectionController::modifyExtendingLeft):
+        (WebCore::SelectionController::modifyExtendingBackward):
+        (WebCore::SelectionController::modifyMovingBackward):
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::isAll):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::next):
+        (WebCore::VisiblePosition::previous):
+        * editing/VisiblePosition.h:
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::isAll):
+        (WebCore::VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity):
+        * editing/VisibleSelection.h:
+        * editing/htmlediting.cpp:
+        (WebCore::selectionForParagraphIteration):
+        * editing/visible_units.cpp:
+        (WebCore::startOfNextParagraph):
+
+2011-03-10  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Tony Gentilcore.
+
+        Remove CRASH() calls added to track down bug 53045
+        https://bugs.webkit.org/show_bug.cgi?id=56137
+
+        Remove CRASH() calls added by r76575 and re-label ones added by r80155
+        and r80269 as being associated with bug 56124 (which may still be
+        happening).
+
+        * css/CSSImageValue.cpp:
+        (WebCore::CSSImageValue::cachedImage):
+        * css/CSSSelector.h:
+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::deleteSelectors):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::CachedResource):
+        (WebCore::CachedResource::~CachedResource):
+        * loader/cache/CachedResource.h:
+
+2011-03-10  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Let the parser yield for layout before running scripts
+        https://bugs.webkit.org/show_bug.cgi?id=54355
+
+        Prior to this patch, the parser would yield to perform a layout/paint before running a
+        script only if the script or a stylesheet blocking the script is not loaded yet. Since we
+        don't preload scan into the body while parsing the head, typically we'll block on a script
+        early in the body that causes us to yield to do the first paint within a reasonable time.
+
+        However, I'm planning to change the PreloadScanner to scan into the body from the head.
+        That significantly improves overall load time, but would hurt first paint time because
+        fewer scripts would be blocked during parsing and thus wouldn't yield.
+
+        This change causes us to yield before running scripts if we haven't painted yet (regardless
+        of whether or not the script is loaded). In addition to allowing the above mentioned
+        PreloadScanner change to be implemented without regressing first paint time, this also
+        improves first paint time by itself.
+
+        I tested Alexa's top 45 websites using Web Page Replay to control the content and simulate
+        bandwidth. This patch improved average first paint time by 1% over an unlimited connection,
+        6% over a 1Mbps connection and 11% over a 5Mbps connection. There was no statistically
+        signifcant change in page load time.
+
+        Within the pages tested, 33 had no statistically significant change in time to first paint,
+        12 improved, and none regressed. Of the improved, some of the standouts from the 1Mbps set
+        are: 20% on youtube, 37% on wiki, 27% on ebay, 13% on cnn, 16% on espn, 74% on sohu.
+
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::canTakeNextToken): This is the new yield point.
+        (WebCore::HTMLDocumentParser::pumpTokenizer): Remove ASSERT that we are not paused. isPaused
+        means that we are waiting for a script. Bug 54574 changed pumpTokenizer() so that it does
+        the right thing whether we are just before a token or waiting for a script. Now that we may
+        yield before a token or before a script, this may be called while paused.
+        * html/parser/HTMLParserScheduler.cpp:
+        (WebCore::HTMLParserScheduler::checkForYieldBeforeScript): Added.
+        * page/FrameView.h:
+        (WebCore::FrameView::hasEverPainted): Added.
+
+2011-03-10  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Some Gtk code uses defined(USE_FREETYPE) instead of just USE(FREETYPE)
+        https://bugs.webkit.org/show_bug.cgi?id=55996
+
+        Use the macre USE instead of defined fro WTF_USE_FREETYPE and
+        WTF_USE_PANGO.
+
+        * GNUmakefile.am:
+        * platform/graphics/cairo/OwnPtrCairo.cpp:
+        * platform/graphics/cairo/OwnPtrCairo.h:
+        * platform/graphics/cairo/RefPtrCairo.cpp:
+        * platform/graphics/cairo/RefPtrCairo.h:
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::setPangoAttributes):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+
+2011-03-10  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Rolled back in 80277 and 80280 with event handler layout test failures fixed.
+        https://bugs.webkit.org/show_bug.cgi?id=55653
+
+        The failures were caused by a last minute typo: assigning to currentEvent
+        instead of m_currentEvent.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.h:
+        * bindings/js/JSWorkerContextBase.cpp:
+
+2011-03-10  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=56129, vertical text broken on Lion and Leopard.
+
+        Add Snow Leopard ifdefs for the scaling by point size and then the division by unitsPerEm to the
+        translationsTransform applied to the results from CTFontGetVerticalTranslationsForGlyphs, since
+        this is done already on Lion and Leopard.
+
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::showGlyphsWithAdvances):
+
+2011-03-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80701.
+        http://trac.webkit.org/changeset/80701
+        https://bugs.webkit.org/show_bug.cgi?id=56126
+
+        fast/dom/Geolocation/window-close-crash.html fails on Snow
+        Leopard release builds (Requested by mihaip on #webkit).
+
+        * page/DOMWindow.cpp:
+        * page/DOMWindow.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::pageDestroyed):
+        (WebCore::Frame::transferChildFrameToNewDocument):
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::~Geolocation):
+        (WebCore::Geolocation::disconnectFrame):
+        (WebCore::Geolocation::lastPosition):
+        (WebCore::Geolocation::requestPermission):
+        (WebCore::Geolocation::startUpdating):
+        (WebCore::Geolocation::stopUpdating):
+        * page/Geolocation.h:
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::~GeolocationController):
+        * page/Navigator.cpp:
+        * page/Navigator.h:
+        * platform/mock/GeolocationClientMock.cpp:
+        * platform/mock/GeolocationClientMock.h:
+
+2011-03-10  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        ASSERT_NOT_REACHED triggered in WebCore::mapHTTPPipeliningPriorityToResourceLoadPriority
+        https://bugs.webkit.org/show_bug.cgi?id=56075
+
+        Map priority value 3, which means no priority, to ResourceLoadPriorityUnresolved.
+
+        * platform/network/cf/ResourceRequestCFNet.h:
+        (WebCore::mapHTTPPipeliningPriorityToResourceLoadPriority):
+        (WebCore::mapResourceLoadPriorityToHTTPPipeliningPriority):
+
+2011-03-10  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Text editor] Substitute live-edit mode activation by double-click
+        https://bugs.webkit.org/show_bug.cgi?id=56084
+
+        Also fixed a regression: console was not opening/closing on ESC key press because tabIndex="0" attribute was preserved for a readOnly viewer.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame):
+        (WebInspector.SourceFrame.prototype._startEditing):
+        (WebInspector.SourceFrame.prototype._registerShortcuts):
+        (WebInspector.SourceFrame.prototype._handleKeyDown):
+        (WebInspector.SourceFrame.prototype._handleSave):
+        (WebInspector.SourceFrame.prototype._handleRevertEditing):
+        (WebInspector.SourceFrame.prototype._doubleClick):
+        * inspector/front-end/TextEditorModel.js:
+        (WebInspector.TextEditorModel.prototype.get text):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype.get readOnly):
+        (WebInspector.TextEditorMainPanel):
+        (WebInspector.TextEditorMainPanel.prototype.set readOnly):
+        (WebInspector.TextEditorMainPanel.prototype.get readOnly):
+
+2011-03-10  Greg Simon  <gregsimon@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Need new graphic icon for garbage collect button.
+        https://bugs.webkit.org/show_bug.cgi?id=55794
+
+        No new tests: gc tests are flaky due to non-determinisic
+        behavior of collection APIs (more notes in bug)
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * bindings/js/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::collectGarbage):
+        * bindings/js/ScriptProfiler.h:
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::collectGarbage):
+        * bindings/v8/ScriptProfiler.h:
+        * inspector/Inspector.idl:
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::collectGarbage):
+        * inspector/InspectorProfilerAgent.h:
+        * inspector/front-end/Images/garbageCollectButtonGlyph.png: Added.
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._garbageCollectButtonClicked):
+        * inspector/front-end/inspector.css:
+        (.garbage-collect-status-bar-item .glyph):
+
+2011-03-10  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: better names for HAR export commands
+        https://bugs.webkit.org/show_bug.cgi?id=56097
+
+        Rename Export to HAR to Copy entry/network log as HAR
+        Expose Copy as HAR unconditionally, remove related settings entry.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel.prototype._contextMenu):
+        * inspector/front-end/Settings.js:
+
+2011-03-10  Qi Zhang  <qi.2.zhang@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Mobile Devices should include Model and Firmware Version in Webkit Generated User Agent String
+        https://bugs.webkit.org/show_bug.cgi?id=48636
+
+        Fix a typo in features.pri that turns on this feature on mobile
+        devices by default.
+
+        * features.pri:
+
+2011-03-10  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Invalid expected parameter list in CSSAgent.setSelectorText() callback (CSSStyleModel.js)
+        https://bugs.webkit.org/show_bug.cgi?id=56092
+
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleModel.prototype.setRuleSelector):
+
+2011-03-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed: rolling out r80478 and its follow ups for breaking
+        inspector and engadget.com.
+        https://bugs.webkit.org/show_bug.cgi?id=49401
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::performTask):
+        (WebCore::Document::postTask):
+        * dom/Document.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::setDefersLoading):
+        * manual-tests/database-callback-deferred.html: Removed.
+        * page/PageGroupLoadDeferrer.cpp:
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+
+2011-03-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Tiled backing store's delegated scroll request uses incorrect convention
+        https://bugs.webkit.org/show_bug.cgi?id=56011
+
+        Use a point instead of delta, when relaying the scroll request from
+        ScrollView::setScrollPosition.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::delegatedScrollRequested):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::delegatedScrollRequested):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * platform/HostWindow.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setScrollPosition):
+
+2011-03-10  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: brush up DOM agent API.
+        https://bugs.webkit.org/show_bug.cgi?id=56093
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::childNodes):
+        (WebCore::InspectorDOMAgent::setNodeName):
+        (WebCore::InspectorDOMAgent::outerHTML):
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.DOMNode.prototype.hasAttributes):
+        (WebInspector.DOMNode.prototype.nodeType):
+        (WebInspector.DOMNode.prototype.nodeName):
+        (WebInspector.DOMNode.prototype.setNodeName):
+        (WebInspector.DOMNode.prototype.localName):
+        (WebInspector.DOMNode.prototype.nodeValue):
+        (WebInspector.DOMNode.prototype.setNodeValue):
+        (WebInspector.DOMNode.prototype.setAttribute):
+        (WebInspector.DOMNode.prototype.attributes):
+        (WebInspector.DOMNode.prototype.removeAttribute):
+        (WebInspector.DOMNode.prototype.childNodes.mycallback):
+        (WebInspector.DOMNode.prototype.childNodes):
+        (WebInspector.DOMNode.prototype.outerHTML):
+        (WebInspector.DOMNode.prototype.setOuterHTML):
+        (WebInspector.DOMNode.prototype.removeNode):
+        (WebInspector.DOMNode.prototype.copyNode):
+        (WebInspector.DOMNode.prototype.path):
+        (WebInspector.DOMNode.prototype._setAttributesPayload):
+        (WebInspector.DOMNode.prototype._addAttribute):
+        (WebInspector.DOMAgent.prototype._characterDataModified):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        (WebInspector.ElementsPanel.prototype.decorateNodeLabel):
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.updateChildren):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        (WebInspector.ElementsTreeElement.prototype._startEditingTarget):
+        (WebInspector.ElementsTreeElement.prototype._startEditing):
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        (WebInspector.ElementsTreeElement.prototype._tagNameEditingCommitted.moveToNextAttributeIfNeeded):
+        (WebInspector.ElementsTreeElement.prototype._tagNameEditingCommitted):
+        (WebInspector.ElementsTreeElement.prototype._textNodeEditingCommitted):
+        (WebInspector.ElementsTreeElement.prototype._attributeHTML):
+        ():
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/MetricsSidebarPane.js:
+        * inspector/front-end/StylesSidebarPane.js:
+        * inspector/front-end/utilities.js:
+
+2011-03-09  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [STYLES] Editing a property value adds a word for any property value that uses a paren
+        https://bugs.webkit.org/show_bug.cgi?id=56002
+
+        * inspector/front-end/StylesSidebarPane.js: Introduce an additional check.
+
+2011-03-09  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: use DebuggerPresentation instead of DebuggerModel in source frame delegate.
+        https://bugs.webkit.org/show_bug.cgi?id=56034
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.continueToLine):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype.updateBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype.findBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._sourceLocationToActualLocation):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._createSourceFrame):
+        (WebInspector.SourceFrameDelegateForScriptsPanel):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.setBreakpoint):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.updateBreakpoint):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.removeBreakpoint):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.findBreakpoint):
+        (WebInspector.SourceFrameDelegateForScriptsPanel.prototype.continueToLine):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._contextMenu.else.editBreakpointCondition.didEditBreakpointCondition):
+        (WebInspector.SourceFrame.prototype._contextMenu.else.editBreakpointCondition):
+        (WebInspector.SourceFrame.prototype._contextMenu.else.setBreakpointEnabled):
+        (WebInspector.SourceFrame.prototype._contextMenu):
+        (WebInspector.SourceFrame.prototype._mouseDown):
+        (WebInspector.SourceFrameDelegate.prototype.removeBreakpoint):
+        (WebInspector.SourceFrameDelegate.prototype.updateBreakpoint):
+
+2011-03-09  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: elements dom tree - word wrap toggle
+        https://bugs.webkit.org/show_bug.cgi?id=44311
+
+        A "Word Wrap" option is now shown in a context menu for the entire DOM tree content area
+        and persisted into application settings.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._contextMenuEventFired):
+        (WebInspector.ElementsPanel.prototype._contextMenuEventFired.toggleWordWrap):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline):
+        (WebInspector.ElementsTreeOutline.prototype._treeElementFromEvent):
+        (WebInspector.ElementsTreeOutline.prototype.populateContextMenu):
+        (WebInspector.ElementsTreeElement.prototype.onreveal):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        * inspector/front-end/inspector.css:
+        (#elements-content.nowrap):
+        (#elements-content > ol):
+
+2011-03-09  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: re-implement breakpoints sidebar pane based on debugger presentation model.
+        https://bugs.webkit.org/show_bug.cgi?id=55823
+
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.JavaScriptBreakpointsSidebarPane):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype.addBreakpoint.didLoadSnippet):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype.removeBreakpoint):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype.highlightBreakpoint):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype.clearBreakpointHighlight):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._createBreakpointItemId):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._breakpointClicked):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._breakpointCheckboxClicked):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype._contextMenu):
+        (WebInspector.JavaScriptBreakpointsSidebarPane.prototype.reset):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._parsedScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._failedToParseScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._revealHiddenBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype.breakpointsForSourceFileId):
+        (WebInspector.DebuggerPresentationModel.prototype.setBreakpointEnabled):
+        (WebInspector.DebuggerPresentationModel.prototype.removeBreakpoint):
+        (WebInspector.DebuggerPresentationModel.prototype._breakpointAdded):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype._actualLocationToSourceLocation):
+        (WebInspector.DebuggerPresentationModel.prototype.reset):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype._breakpointAdded):
+        (WebInspector.ScriptsPanel.prototype._breakpointRemoved):
+        (WebInspector.ScriptsPanel.prototype._debuggerPaused):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype._clearInterface):
+
+2011-03-10  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Highlighter refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=56015
+
+        * inspector/front-end/TextEditorHighlighter.js:
+        (WebInspector.TextEditorHighlighter):
+        (WebInspector.TextEditorHighlighter.prototype.set mimeType):
+        (WebInspector.TextEditorHighlighter.prototype.highlight):
+        (WebInspector.TextEditorHighlighter.prototype.updateHighlight):
+        (WebInspector.TextEditorHighlighter.prototype._highlightInChunks):
+        (WebInspector.TextEditorHighlighter.prototype._highlightLines):
+        (WebInspector.TextEditorHighlighter.prototype._selectHighlightState):
+        (WebInspector.TextEditorHighlighter.prototype._clearHighlightState):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorMainPanel.prototype._buildChunks):
+        (WebInspector.TextEditorMainPanel.prototype._updateHighlightsForRange):
+
+2011-03-05  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: move breakpoint column adjustment to debugger model.
+        https://bugs.webkit.org/show_bug.cgi?id=55821
+
+        Test: inspector/debugger/debug-inlined-scripts.html
+
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.setBreakpoint.didSetBreakpoint):
+        (WebInspector.DebuggerModel.prototype.setBreakpoint):
+        * inspector/front-end/SourceFrameContent.js:
+        (WebInspector.SourceFrameContent.prototype.sourceFrameLineNumberToActualLocation):
+
+2011-01-21  John Knottenbelt  <jknotten@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Detach Geolocation from Frame when Page destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=52877
+
+        On Page destruction, any outstanding Geolocation permission
+        requests should be cancelled, because the Geolocation can only
+        access the client indirectly via m_frame->page().
+
+        Page destruction is signalled by a call to the
+        Frame::pageDestroyed() method. This explictly calls
+        DOMWindow::resetGeolocation which ultimately calls Geolocation::reset.
+
+        Geolocation::reset() detaches from the GeolocationController,
+        cancels requests, watches and single shots, and sets the
+        permission state back to Unknown.
+
+        Frame::pageDestroyed() is also called by FrameLoader even though
+        the page is not destroyed. We should still cancel permission
+        requests, because the GeolocationClient will become inaccessible
+        to the Geolocation object after this call.
+
+        Frame::transferChildFrameToNewDocument also indirectly calls
+        Geolocation::reset when the frame is reparented between
+        pages. Ideally we would like the Geolocation's activities to
+        continue after reparenting, see bug
+        https://bugs.webkit.org/show_bug.cgi?id=55577
+
+        Since GeolocationController is owned by Page, and all Geolocation
+        objects will now unsubscribe from the GeolocationController on
+        pageDetached(), we no longer need to call stopUpdating() from the
+        GeolocationController's destructor. Instead we can simply assert
+        that there should be no no observers. See related bug
+        https://bugs.webkit.org/show_bug.cgi?id=52216 .
+
+        Introduced new method 'numberOfPendingPermissionRequests' on
+        GeolocationClientMock to count the number of outstanding pending
+        permission requests. This provides a reusable implementation for
+        client-based implementations of the LayoutTestController's
+        numberOfPendingGeolocationPermissionRequests method.
+
+        Test: fast/dom/Geolocation/page-reload-cancel-permission-requests.html
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::resetGeolocation):
+        * page/DOMWindow.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::pageDestroyed):
+        (WebCore::Frame::transferChildFrameToNewDocument):
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::~Geolocation):
+        (WebCore::Geolocation::page):
+        (WebCore::Geolocation::reset):
+        (WebCore::Geolocation::disconnectFrame):
+        (WebCore::Geolocation::lastPosition):
+        (WebCore::Geolocation::requestPermission):
+        (WebCore::Geolocation::startUpdating):
+        (WebCore::Geolocation::stopUpdating):
+        * page/Geolocation.h:
+        * page/GeolocationController.cpp:
+        (WebCore::GeolocationController::~GeolocationController):
+        * page/Navigator.cpp:
+        (WebCore::Navigator::resetGeolocation):
+        * page/Navigator.h:
+        * platform/mock/GeolocationClientMock.cpp:
+        (WebCore::GeolocationClientMock::numberOfPendingPermissionRequests):
+        * platform/mock/GeolocationClientMock.h:
+
+2011-03-10  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Able to move nodes across documents
+        https://bugs.webkit.org/show_bug.cgi?id=19524
+
+        Makes cross-document appendChild, insertBefore, Range.insertNode and Range.surroundContents work.
+        This matches Gecko and the new Dom Core spec. There are a number of Range methods where we don't 
+        match Gecko or the spec that will need to be updated in a following patch.
+
+        Test: fast/dom/move-nodes-across-documents.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::removeAttributeNode):
+        * dom/NamedNodeMap.cpp:
+        (WebCore::NamedNodeMap::setNamedItem):
+        * dom/Node.cpp:
+        (WebCore::Node::setDocumentRecursively):
+        (WebCore::checkAcceptChild):
+        (WebCore::Node::checkReplaceChild):
+        * dom/Range.cpp:
+        (WebCore::Range::insertNode):
+        (WebCore::Range::surroundContents):
+
+2011-03-09  Antti Koivisto  <antti@apple.com>
+
+        Not reviewed.
+
+        Reverting crash catching code, the bug being hunted was fixed by
+        http://trac.webkit.org/changeset/80686
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::CachedResourceLoader):
+        (WebCore::CachedResourceLoader::~CachedResourceLoader):
+        (WebCore::CachedResourceLoader::requestImage):
+        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet):
+        (WebCore::CachedResourceLoader::requestResource):
+        (WebCore::CachedResourceLoader::setAutoLoadImages):
+        (WebCore::CachedResourceLoader::load):
+        (WebCore::CachedResourceLoader::loadDone):
+        (WebCore::CachedResourceLoader::preload):
+        (WebCore::CachedResourceLoader::requestPreload):
+        * loader/cache/CachedResourceLoader.h:
+
+2011-03-09  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed, build fix.
+
+        * StringsNotToBeLocalized.txt: Add function names I forgot.
+        * platform/win/SystemInfo.cpp: #if out some uncalled functions on WinCE,
+          since they don't compile anyway.  Use ZeroMemory() instead of "= {0}"
+          since Qt is stupid and (sometimes?!) warns about it.
+        (WebCore::windowsVersion):
+        (WebCore::processorArchitecture):
+
+2011-03-09  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Ryosuke Niwa.
+
+        Add UA string tags for Windows 64.
+        https://bugs.webkit.org/show_bug.cgi?id=55226
+
+        * StringsNotToBeLocalized.txt:
+        * platform/win/SystemInfo.cpp:
+        (WebCore::osVersionForUAString):
+        (WebCore::isWOW64):
+        (WebCore::processorArchitecture):
+        (WebCore::architectureTokenForUAString):
+        (WebCore::windowsVersionForUAString):
+
+2011-03-09  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed, attempted build fix.
+
+        * WebCore.pri: Try to update include path for Qt Windows build.
+
+2011-03-09  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed, build fix.
+
+        * platform/win/SystemInfo.cpp:
+        (WebCore::windowsVersionForUAString): Fix const conversion warning on Qt.
+
+2011-03-09  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Mihai Parparita.
+
+        Unify Windows version checks.
+        https://bugs.webkit.org/show_bug.cgi?id=55979
+
+        * GNUmakefile.am: Fix spaces -> tabs.
+        * StringsNotToBeLocalized.txt:
+        * WebCore.pro: Add SystemInfo.* to Qt build.
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarThemeChromiumWin::invalidateOnMouseEnterExit):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeState):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeArrowState):
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        (WebCore::fillBMPGlyphs):
+        * platform/win/CursorWin.cpp:
+        (WebCore::createSharedCursor):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::ScrollbarThemeWin):
+        * platform/win/SystemInfo.cpp: Add full-fledged version check and UA string helper function.
+        (WebCore::windowsVersion):
+        (WebCore::windowsVersionForUAString):
+        * platform/win/SystemInfo.h: Add full-fledged version check and UA string helper function.
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::getNonClientMetrics):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::getThemeData):
+        (WebCore::RenderThemeWin::paintMenuList):
+        (WebCore::RenderThemeWin::paintMenuListButton):
+
+2011-03-09  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Tony Gentilcore.
+
+        REGRESSION (r74807): memory corruption after CachedResourceLoader refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=53045
+        
+        Copy the URL out of the CachedResource that is being revalidated, so
+        that we can still use it (in m_validatedURLs) after removing the
+        resource from the memory cache, which may delete it.
+
+        No new tests, since I was not able to trigger this locally (in a layout
+        test or otherwise).
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::revalidateResource):
+
+2011-03-09  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        VO reporting incorrect list count for http://www.macworld.com/news.html
+        https://bugs.webkit.org/show_bug.cgi?id=56064
+
+        <li> tags should not be ignored, because they provide valuable information
+        to screen readers.
+
+        Test: platform/mac/accessibility/list-items-ignored.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+
+2011-03-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/8733254> Float disappears after incremental layout
+        Fixed the original bug and a copule more issues noticed while doing so.
+
+        Tests: fast/dynamic/dirty-float-in-clean-line.html
+               fast/dynamic/float-at-line-break.html
+               fast/dynamic/float-from-empty-line.html
+
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): If findNextLineBreak() returned an empty line,
+        update the line break info of the last line with the new line break position. This is tested
+        by float-from-empty-line.html.
+        (WebCore::RenderBlock::checkFloatsInCleanLine): Factored out code from determineStartPosition()
+        into this new function.
+        (WebCore::RenderBlock::determineStartPosition): Call checkFloatsInCleanLine().
+        (WebCore::RenderBlock::determineEndPosition): When iterating over lines, check clean lines with
+        floats, as they may yet become dirty because of the floats. This is tested by
+        dirty-float-in-clean-line.html.
+        (WebCore::RenderBlock::findNextLineBreak): If a float fits on the line, and the current line
+        break is at the float, advance it to after the float. Otherwise, if the line gets dirty and the
+        next one does not, the float will not make it into any line. This is tested by
+        float-at-line-break.html.
+
+2011-03-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Kent Tamura.
+
+        selectionStart reports wrong caret position when the last characters are newlines
+        https://bugs.webkit.org/show_bug.cgi?id=56061
+
+        The bug was caused by SelectionController::setSelection's not calling
+        notifyRendererOfSelectionChange when old selection was equal to new selection.
+
+        Because InsertLineBreakCommand inserts a text node with a single LF before the caret,
+        this condition holds after the command is executed. However, the values of
+        selectionStart and selectionEnd still need to be updated in this case because
+        the offsets counted from the beginning of textarea have been increased by 1.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection): Call notifyRendererOfSelectionChange
+        when m_selection = s.
+        * manual-tests/selection-start-after-inserting-line-break-in-textarea.html: Added.
+
+2011-03-09  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Bad cast in HTMLTreeBuilder::processStartTag
+        https://bugs.webkit.org/show_bug.cgi?id=55955
+
+        Test: fast/parser/self-closing-foreign-content.html
+
+        When the parser encounters an svg or mathml root element, it places the
+        insertion mode into InForeignContentMode. However, if the root element
+        is self-closing (e.g. <svg />) then the element is never placed on the
+        open elements stack. This leaves the parser in an inconsistent state
+        where it is in InForeignContentMode but no foreign content is in the
+        open element stack.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTagForInBody): If a self-closing
+        foreign element is inserted into the tree, do not set the insertion
+        mode to InForeignContentMode.
+
+2011-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Qt build fix.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue):
+
+2011-03-09  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Adam Barth.
+
+        REGRESSION (r80320): Assertion failure when processing mis-nested foreign content.
+        https://bugs.webkit.org/show_bug.cgi?id=55982
+
+        Test: fast/parser/fragment-foreign-content-misnested.html
+        
+        It is a parse error to encounter certain start tags while the parser's
+        insertion mode is InForeignContentMode (e.g. <br>). In these cases, we
+        are to pop open elements off the HTMLElementStack until a foreign
+        content scope marker is encountered. Before the change in r80320 to not
+        insert a fake HTML element during fragment parsing, said fake HTML
+        element counted as a foreign content scope marker.
+        
+        With r80320, no fake HTML element is inserted and the stack is popped
+        until empty in cases where no other element claims to be a foreign
+        content scope marker. Fix this by treating the DocumentFragment as a
+        foreign content scope marker.
+
+        * html/parser/HTMLElementStack.cpp:
+        (WebCore::HTMLNames::isForeignContentScopeMarker): Take a
+        ContainerNode* instead of a Element*.
+        (WebCore::HTMLElementStack::popUntilForeignContentScopeMarker): Pass
+        topNode() to isForeignContentScopeMarker() instead of top().
+
+2011-03-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 56041 - RexExp constructor should only accept flags "gim"
+        We also should be passing the flags around as a bitfield rather than a string,
+        and should not have redundant, incompatible code for converting the string to a bitfield!
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::readTerminal):
+            - Need to parse flags string back to enum.
+
+2011-03-09  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium]: Regression - Explicitly copy compositing properties from LayerChromium to CCLayerImpl
+        https://bugs.webkit.org/show_bug.cgi?id=56021
+
+        Initializes the m_doubleSided flag of LayerChromiums to the default
+        value of true so the back sides of layers without
+        backface-visibility:hidden are rendered.
+
+        Test: compositing/backface-visibility.html
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+
+2011-03-09  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/9110316> REGRESSION: 'ex' unit broken for vertical text
+
+        Fall back to the verticalRightOrientation data when obtaining the x-height for vertically oriented
+        text. That way we use the same metrics as for horizontal.
+
+        This fixes regressions in fast/lists and fast/overflow vertical text tests.
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformBoundsForGlyph):
+
+2011-03-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        REGRESSION: crash in nextLinePosition when extending selection forward by line in an empty document
+        https://bugs.webkit.org/show_bug.cgi?id=56004
+
+        The crash was caused by the false assumption that rootEditableElement() or documentElement()
+        always return non-null pointer. Fixed the bug by adding an early exit.
+
+        Test: editing/selection/extend-by-line-in-empty-document.html
+
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+
+2011-03-09  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: it should be possible to copy stack trace from call stack sidebar pane.
+        https://bugs.webkit.org/show_bug.cgi?id=56024
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane):
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        (WebInspector.CallStackSidebarPane.prototype._contextMenu):
+
+2011-03-09  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Patch FontPlatformDataLinux to properly initialize and copy orientation/text-orientation in all
+        places.  Make sure text-orientation is specified in the lookups/creation in FontCustomPlatformData
+        and FontCache.
+
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2011-03-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        JavaNPObject should not use JNI directly
+        https://bugs.webkit.org/show_bug.cgi?id=56009
+
+        We move the JNI code to access a Java object's fields into
+        a new JavaInstance::getField() method.
+
+        No new tests, refactoring only.
+
+        * bridge/jni/v8/JavaInstanceV8.cpp:
+        (JavaInstance::getField):
+        * bridge/jni/v8/JavaInstanceV8.h:
+        * bridge/jni/v8/JavaNPObjectV8.cpp:
+        (JSC::Bindings::JavaNPObjectGetProperty):
+
+2011-03-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        NPAPI - jvalue conversion should not be in JavaInstance
+        https://bugs.webkit.org/show_bug.cgi?id=55967
+
+        No new tests, refactoring only.
+
+        * bridge/jni/v8/JavaInstanceV8.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/v8/JavaInstanceV8.h:
+        * bridge/jni/v8/JavaNPObjectV8.cpp:
+        (JSC::Bindings::JavaNPObjectInvoke):
+
+2011-03-09  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Use the Cookie Storage from the Private Browsing Storage Session directly
+        https://bugs.webkit.org/show_bug.cgi?id=55986
+
+        * WebCore.exp.in:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+        * platform/network/mac/CookieStorageMac.mm:
+        (WebCore::setCookieStoragePrivateBrowsingEnabled):
+        Just copy the cookie storage from the private browsing storage session.
+        * platform/network/cf/CookieStorageCFNet.cpp:
+        (WebCore::setCookieStoragePrivateBrowsingEnabled):
+        Ditto.
+
+2011-03-09  Andrey Kosyakov  <caseq@chromium.org>
+
+        Unreviewed. Fixed a crash in InspectorInstrumentation::didReceiveResponse() when loader is null (broken in r80639)
+
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didReceiveResourceResponseImpl):
+
+2011-03-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: pass explicit agent references to InspectorBackendDispatcher
+        https://bugs.webkit.org/show_bug.cgi?id=55820
+
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::disconnectFrontend):
+        (WebCore::InspectorController::dispatchMessageFromFrontend):
+
+2011-03-09  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: resource errors are not reported before front-end is opened
+        https://bugs.webkit.org/show_bug.cgi?id=55939
+
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didReceiveResourceResponseImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::didReceiveResourceResponse):
+        (WebCore::InspectorInstrumentation::didFailLoading):
+
+2011-03-08  Hans Wennborg  <hans@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        IndexedDB: Add BackingStoreType parameter to IDBFactoryBackendInterface::open
+        https://bugs.webkit.org/show_bug.cgi?id=55948
+
+        Add a parameter that allows for selection of alternative backing store
+        implementations.
+
+        No new tests: no new functionality.
+
+        * storage/IDBFactory.cpp:
+        (WebCore::IDBFactory::open):
+        * storage/IDBFactoryBackendImpl.cpp:
+        (WebCore::IDBFactoryBackendImpl::open):
+        * storage/IDBFactoryBackendImpl.h:
+        * storage/IDBFactoryBackendInterface.h:
+
+2011-03-08  Steve Block  <steveblock@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        Factor out JNI method call to be used by both JSC and V8
+        https://bugs.webkit.org/show_bug.cgi?id=55966
+
+        No new tests, refactoring only.
+
+        * bridge/jni/JNIUtility.cpp:
+        (JSC::Bindings::callJNIMethod):
+        * bridge/jni/JNIUtility.h:
+        * bridge/jni/jsc/JavaInstanceJSC.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/v8/JavaInstanceV8.cpp:
+        (JavaInstance::invokeMethod):
+
+2011-03-09  Andrey Adaikin  <aandrey@google.com>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Text editor] Regression in handling DOMNodeInserted/DOMNodeRemoved events
+        https://bugs.webkit.org/show_bug.cgi?id=55818
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextEditorMainPanel.prototype._handleDOMUpdates):
+
+2011-03-09  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Web Inspector: we don't need to transfer objectId and hasChildren for primitive values.
+        https://bugs.webkit.org/show_bug.cgi?id=55998
+
+        * inspector/InjectedScriptSource.js:
+
+2011-03-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: watch expressions should show string values in quotes.
+        https://bugs.webkit.org/show_bug.cgi?id=55846
+
+        * inspector/InjectedScriptSource.js:
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.LocalJSONObject.prototype.get description):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        * inspector/front-end/inspector.css:
+        (.console-formatted-string, .console-formatted-regexp):
+
+2011-03-09  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: "length" getter is invoked upon console object formatting.
+        https://bugs.webkit.org/show_bug.cgi?id=55220
+
+        * inspector/InjectedScriptSource.js:
+
+2011-03-08  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: remove groupName from objectId.
+        https://bugs.webkit.org/show_bug.cgi?id=55825
+
+        * inspector/InjectedScriptSource.js:
+
+2011-03-08  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Fix Regression: Content not drawn when scrolling horizontally in an RTL page.
+        https://bugs.webkit.org/show_bug.cgi?id=55077.
+
+        Inside ScrollView::calculateOverhangAreasForPainting(), when scroll position
+        is negative, should include the position value into overhang rectangle's 
+        starting position. 
+
+        Tests: fast/dom/scroll-reveal-left-overflow.html
+               fast/dom/scroll-reveal-top-overflow.html
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::calculateOverhangAreasForPainting):
+
+2011-03-08  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Add templatized CSSMutableStyleDeclaration::get{ShorthandValue, CommonValue, LayeredShorthandValue}()
+        https://bugs.webkit.org/show_bug.cgi?id=55351
+
+        By using some template magic CSSMutableStyleDeclaration::get{ShorthandValue, CommonValue, LayeredShorthandValue}()
+        can be called on an array A without the caller explicitly specifying the size of A.
+
+        No functionality was changed. So no new tests.
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue): Modified to call templatized variants of
+        CSSMutableStyleDeclaration::get{ShorthandValue, CommonValue, LayeredShorthandValue}().
+        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue): Renamed second argument from "number" to "size"
+        to better reflect its purpose - to be the size of the passed array.
+        (WebCore::CSSMutableStyleDeclaration::getShorthandValue): Ditto.
+        (WebCore::CSSMutableStyleDeclaration::getCommonValue): Ditto.
+        (WebCore::CSSMutableStyleDeclaration::cssText): Modified to call templatized variant of CSSMutableStyleDeclaration::getShorthandValue().
+        * css/CSSMutableStyleDeclaration.h:
+        (WebCore::CSSMutableStyleDeclaration::getShorthandValue): Added templatized function that can determine
+        the size of a passed array. Changed type of second argument to size_t since it represents the size of
+        an array.
+        (WebCore::CSSMutableStyleDeclaration::getCommonValue): Ditto.
+        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue): Ditto.
+
+2011-03-08  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        REGRESSION: Copied content loses formatting on paste to external apps.
+        https://bugs.webkit.org/show_bug.cgi?id=47615
+        <rdar://problem/9001214>
+        
+        This is a resubmission of a patch that was landed a while ago then rolled
+        back because of a build failure on SnowLeopard and Leopard on the 32-bit builds.
+
+        This patch adds a way for WebKit2 to create NSAttributedStrings from
+        a DOM range without using the AppKit api initWithDOMRange that internally
+        needs to access the WebView. The NSAttributedString is needed to create
+        RTF formats in the pasteboard.
+        This is to be considered a first step, since in the future we want to have
+        an implementation based on the TextIterator.
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/mac/HTMLConverter.h: Added.
+        * platform/mac/HTMLConverter.mm: Added.
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection):
+
+2011-03-08  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Explicitly copy compositing properties from LayerChromium to CCLayerImpl
+        https://bugs.webkit.org/show_bug.cgi?id=55900
+
+        This adds an explicit step to synchronize properties from
+        LayerChromiums to their corresponding CCLayerImpls.
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::setBounds):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::bounds):
+        (WebCore::LayerChromium::doubleSided):
+        (WebCore::LayerChromium::setDoubleSided):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::updatePropertiesAndRenderSurfaces):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        (WebCore::CCLayerImpl::updateFromLayer):
+        (WebCore::CCLayerImpl::descendantsDrawsContent):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::anchorPoint):
+        (WebCore::CCLayerImpl::anchorPointZ):
+        (WebCore::CCLayerImpl::masksToBounds):
+        (WebCore::CCLayerImpl::opacity):
+        (WebCore::CCLayerImpl::position):
+        (WebCore::CCLayerImpl::preserves3D):
+        (WebCore::CCLayerImpl::sublayerTransform):
+        (WebCore::CCLayerImpl::transform):
+
+2011-03-08  James Robinson  <jamesr@chromium.org>
+
+        Chromium compile fix.
+
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2011-03-08  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by James Robinson.
+
+        Unify Windows version checks, part 1.
+        https://bugs.webkit.org/show_bug.cgi?id=55979
+
+        Make everyone (I hope) pull in SystemInfo.cpp.  Eliminate the
+        now-unnecessary WindowsVersion.cpp from Chromium.
+
+        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarThemeChromiumWin::invalidateOnMouseEnterExit):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeState):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeArrowState):
+        * platform/chromium/WindowsVersion.cpp: Removed.
+        * platform/chromium/WindowsVersion.h: Removed.
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        (WebCore::fillBMPGlyphs):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::getNonClientMetrics):
+
+2011-03-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Chromium Linux build fix attempt after r80582.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/skia/GlyphPageTreeNodeSkia.cpp:
+        (WebCore::GlyphPage::fill):
+
+2011-03-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Mac build fix attempt for r80582.
+
+        * platform/graphics/mac/ComplexTextControllerATSUI.cpp:
+        (WebCore::disableLigatures):
+
+2011-03-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Kent Tamura.
+
+        Remove calls to deprecatedEditingOffset in SelectionController and VisibleSelection
+        https://bugs.webkit.org/show_bug.cgi?id=54937
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection): Calls anchorNode() instead of deprecatedNode() to obtain
+        the document. Also restrained the lifetime of document variable.
+        (WebCore::removingNodeRemovesPosition): Compare the node with anchorNode() instead of deprecatedNode()
+        to determine whether or not position becomes null after removing a node.
+        (WebCore::SelectionController::directionOfEnclosingBlock): The enclosing block is always a container
+        so call containerNode() instead of deprecatedNode().
+        (WebCore::SelectionController::debugRenderer): Call containerNode() and computeOffsetInContainer()
+        instead of deprecatedNode() and deprecatedEditingOffset() respectively.
+        (WebCore::SelectionController::isInPasswordField): Look for the shadow root from containerNode()
+        instead of deprecatedNode to determine whether or not selection inside a password field. Also assert
+        that the specified position is not before or after the shadow root as it violates our assumption.
+        * editing/VisibleSelection.cpp:
+        (WebCore::makeSearchRange): Call containerNode() and offsetInContainerNode() instead of deprecatedNode()
+        and deprecatedEditingOffset() respectively because start is always parent anchored and therefore
+        guaranteed to be an offset inside an anchor node.
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries): Call containerNode()
+        instead of deprecatedNode() to look for the lowest editable ancestor because position before or after
+        an editable element isn't editable.
+        * page/DOMSelection.cpp: Call containerNode() and offsetInContainerNode() instead of deprecatedNode()
+        and deprecatedEditingOffset() respectively in the following functions because they are exposed to
+        DOM, which doesn't have before/after concept.
+        (WebCore::DOMSelection::anchorNode):
+        (WebCore::DOMSelection::anchorOffset):
+        (WebCore::DOMSelection::focusNode):
+        (WebCore::DOMSelection::focusOffset):
+        (WebCore::DOMSelection::baseNode):
+        (WebCore::DOMSelection::baseOffset):
+        (WebCore::DOMSelection::extentNode):
+        (WebCore::DOMSelection::extentOffset):
+
+2011-03-08  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Correct uninitialized variable in PolicyCallback found while
+        running WebKit in BoundsChecker.
+        https://bugs.webkit.org/show_bug.cgi?id=45199.
+
+        * loader/PolicyCallback.cpp:
+        (WebCore::PolicyCallback::PolicyCallback): Initialize
+        m_argument.
+
+2011-03-08  Brent Fulgham  <bfulgham@webkit.org>
+
+        More build bustage fix.
+
+        * platform/graphics/win/cairo/FontPlatformData.h:
+        (WebCore::FontPlatformData::setOrientation): Duplicate accessor
+        in WinCairo-local header.  This is such a mess!
+
+2011-03-08  David Hyatt  <hyatt@apple.com>
+
+        Fix build bustage.  Hide orientation setting behind a setter and stub it out in all
+        FontPlatformData classes.  (This class really needs to move to a common header with ifdefs.)
+
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::verticalRightOrientationFontData):
+        * platform/graphics/cg/FontPlatformData.h:
+        (WebCore::FontPlatformData::setOrientation):
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.h:
+        (WebCore::FontPlatformData::setOrientation):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+        (WebCore::FontPlatformData::setOrientation):
+        * platform/graphics/cocoa/FontPlatformData.h:
+        (WebCore::FontPlatformData::setOrientation):
+        * platform/graphics/freetype/FontPlatformData.h:
+        (WebCore::FontPlatformData::setOrientation):
+        * platform/graphics/qt/FontPlatformData.h:
+        (WebCore::FontPlatformData::setOrientation):
+        * platform/graphics/wince/FontPlatformData.h:
+        (WebCore::FontPlatformData::setOrientation):
+        * platform/graphics/wx/FontPlatformData.h:
+        (WebCore::FontPlatformData::setOrientation):
+
+2011-03-08  Joe Wild  <joseph.wild@nokia.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Missing SVG variables
+        https://bugs.webkit.org/show_bug.cgi?id=32941
+
+        Basically, this patch just modifies features.pri to the Qt build to
+        pass on the ENABLE_SVG_* flags to the IDL binding generator.
+
+        Also I had remove global-construtors.html from the skip list and
+        updated the associated expected results files.
+
+        * features.pri:
+        * page/DOMWindow.idl:
+
+2011-03-08  Alok priyadarshi  <alokp@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Plugins needs a way to trigger style recalc
+        https://bugs.webkit.org/show_bug.cgi?id=55242
+
+        No test needed. A simple get function is added.
+
+        * platform/graphics/chromium/PluginLayerChromium.h:
+        (WebCore::PluginLayerChromium::getTextureId):
+
+2011-03-08  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48540, support the text-orientation CSS property.
+        
+        This patch adds support for two values of the text-orientation property (the ones that actually matter): vertical-right and upright.
+        The TextOrientation is part of the FontDescription and used to look up fonts (similar to FontOrientation).
+        
+        Orientation of non-CJK characters is done using fallback font data of the appropriate orientation type, e.g., verticalRightOrientation and
+        uprightOrientation fallback font data.  Vertical right is just implemented as a normal horizontal font.  Upright is implemented as a
+        vertically oriented font that rotates all glyphs.
+        
+        The main complication implementing text-orientation is that fonts have "baked-in" vertical glyphs for letters that are hardcoded to
+        a vertical right facing.  This means that you can use those special vertical glyphs for vertical-right orientation without having to 
+        fall back, but then for upright orientation you have to ignore them and still fall back.  As you can see from the test case, this doesn't
+        work very well, but hopefully it won't be all that common.  Limitations of CoreText prevent this case from rendering properly in either the
+        simple or complex code paths, although the simple code path at least gets close.
+
+        Added fast/blockflow/text-orientation-basic.html
+
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSFontFaceSource.cpp:
+        (WebCore::CSSFontFaceSource::getFontData):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextOrientation):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyDeclarations):
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * loader/cache/CachedFont.cpp:
+        (WebCore::CachedFont::platformDataFromCustomData):
+        * loader/cache/CachedFont.h:
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        (WebCore::FontPlatformDataCacheKey::operator==):
+        (WebCore::computeHash):
+        (WebCore::FontCache::getCachedFontPlatformData):
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::textOrientation):
+        (WebCore::FontDescription::setTextOrientation):
+        (WebCore::FontDescription::operator==):
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+        (WebCore::offsetToMiddleOfGlyph):
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData):
+        (WebCore::SimpleFontData::verticalRightOrientationFontData):
+        (WebCore::SimpleFontData::uprightOrientationFontData):
+        (WebCore::SimpleFontData::brokenIdeographFontData):
+        (WebCore::SimpleFontData::DerivedFontData::~DerivedFontData):
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::hasVerticalGlyphs):
+        (WebCore::SimpleFontData::isTextOrientationFallback):
+        * platform/graphics/cairo/FontCustomPlatformData.h:
+        * platform/graphics/cocoa/FontPlatformData.h:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::textOrientation):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::operator==):
+        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        * platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/haiku/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/haiku/FontCustomPlatformData.h:
+        * platform/graphics/mac/ComplexTextControllerCoreText.cpp:
+        (WebCore::ComplexTextController::collectComplexTextRunsForCharactersCoreText):
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/mac/FontCustomPlatformData.h:
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::showGlyphsWithAdvances):
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/mac/GlyphPageTreeNodeMac.cpp:
+        (WebCore::shouldUseCoreText):
+        (WebCore::GlyphPage::fill):
+        * platform/graphics/mac/SimpleFontDataCoreText.cpp:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformBoundsForGlyph):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/graphics/pango/FontCustomPlatformDataPango.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/qt/FontCustomPlatformData.h:
+        * platform/graphics/qt/FontCustomPlatformDataQt.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/skia/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/skia/FontCustomPlatformData.h:
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/win/FontCustomPlatformData.h:
+        * platform/graphics/win/FontCustomPlatformDataCairo.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/win/FontCustomPlatformDataCairo.h:
+        * platform/graphics/wince/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/wince/FontCustomPlatformData.h:
+        * platform/text/TextOrientation.h: Added.
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::requiresIdeographicBaseline):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::initialTextOrientation):
+
+2011-03-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        addInlineStyleIfNeeded should take EditingStyle
+        https://bugs.webkit.org/show_bug.cgi?id=55950
+
+        Deployed EditingStyle in addInlineStyleIfNeeded, StyleChange::StyleChange, and StyleChange::init.
+        Also extracted EditingStyle::styleIsPresentInComputedStyleOfNode from removeStyleFromRunBeforeApplyingStyle.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::StyleChange): Takes EditingStyle instead of CSSStyleDeclaration.
+        (WebCore::StyleChange::init): Ditto.
+        (WebCore::ApplyStyleCommand::applyBlockStyle): Instantiates StyleChange.
+        (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange): Calls addInlineStyleIfNeeded.
+        (WebCore::ApplyStyleCommand::removeStyleFromRunBeforeApplyingStyle): Calls styleIsPresentInComputedStyleOfNode.
+        (WebCore::ApplyStyleCommand::removeInlineStyleFromElement): Calls EditingStyle::mergeInlineStyleOfElement
+        instead of manually merging styles.
+        (WebCore::ApplyStyleCommand::applyInlineStyleToPushDown): Calls addInlineStyleIfNeeded.
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Takes EditingStyle instead of CSSMutableStyleDeclaration.
+        * editing/ApplyStyleCommand.h:
+        * editing/CompositeEditCommand.h:
+        * editing/EditingStyle.cpp:
+        (WebCore::EditingStyle::styleIsPresentInComputedStyleOfNode): Extracted from removeStyleFromRunBeforeApplyingStyle.
+        * editing/EditingStyle.h:
+
+2011-03-08  Nico Weber  <thakis@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Crash on big blur radius with canvas
+        https://bugs.webkit.org/show_bug.cgi?id=55951
+
+        Move the clamping code out of an if branch, so that it happens in the
+        canvas case as well.
+
+        Test: fast/canvas/shadow-huge-blur.html
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2011-03-08  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WK2: Cannot set focus on an element when focus is outside of WKView
+        https://bugs.webkit.org/show_bug.cgi?id=55281
+    
+        In WK2, focus cannot be set from the WebProcess side because there's no platformWidget().
+        Instead, the focus/unfocus messages need to be sent to the UIProcess side.
+
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::setFocus):
+
+2011-03-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Overflow: scroll areas should not paint white in scroll corner if the 
+        scrollbars are overlay.
+        <rdar://problem/9082871>
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintScrollCorner):
+        Don't paint the scroll corner white if we have overlay scrollbars.
+
+2011-03-08  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        The first time animations are committed they have a bad start time
+        https://bugs.webkit.org/show_bug.cgi?id=55947
+
+        Do a check for a returned lastCommitTime of <=0 and replace it
+        with the mediaTime.
+
+
+        * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
+        (WebCore::CACFLayerTreeHost::notifyAnimationsStarted):
+
+2011-03-08  James Kozianski  <koz@chromium.org>
+
+        Reviewed by David Levin.
+
+        Expose isValidProtocol() in KURL.h.
+        https://bugs.webkit.org/show_bug.cgi?id=54594
+
+        This is needed to validate protocols used in calls to
+        navigator.registerProtocolHandler().
+
+        * platform/KURL.cpp:
+        * platform/KURL.h:
+        * platform/KURLGoogle.cpp:
+        (WebCore::isValidProtocol):
+
+2011-03-08  Adam Roben  <aroben@apple.com>
+
+        Set svn:mime-type to text/css for all Inspector CSS files
+
+        This will cause them to be served with the correct MIME type from svn.webkit.org's web
+        interface.
+
+        Rubber-stamped by Tim Hatcher.
+
+        * inspector/front-end/audits.css: Added property svn:mime-type.
+        * inspector/front-end/goToLineDialog.css: Added property svn:mime-type.
+        * inspector/front-end/heapProfiler.css: Added property svn:mime-type.
+        * inspector/front-end/helpScreen.css: Added property svn:mime-type.
+        * inspector/front-end/inspector.css: Added property svn:mime-type.
+        * inspector/front-end/inspectorSyntaxHighlight.css: Added property svn:mime-type.
+        * inspector/front-end/networkPanel.css: Added property svn:mime-type.
+        * inspector/front-end/popover.css: Added property svn:mime-type.
+        * inspector/front-end/textViewer.css: Added property svn:mime-type.
+
+2011-03-08  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Steve Block.
+
+        IDBCallbacks::onsuccess(IDBIndex*) is unused and should be removed.
+        https://bugs.webkit.org/show_bug.cgi?id=55938
+
+        The IndexedDatabase specification changed and IDBIndex objects are no
+        longer created asynchronously. We therefore no longer need this method.
+
+        No new tests, just cleanup.
+
+        * storage/IDBCallbacks.h:
+        * storage/IDBRequest.cpp:
+        * storage/IDBRequest.h:
+
+2011-03-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r80551.
+        http://trac.webkit.org/changeset/80551
+        https://bugs.webkit.org/show_bug.cgi?id=55933
+
+        It broke 285 tests on Qt bot (Requested by Ossy on #webkit).
+
+        * WebCore.pro:
+        * platform/SharedBuffer.cpp:
+        * platform/SharedBuffer.h:
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::supportsBufferedData):
+        (WebCore::ResourceHandle::bufferedData):
+        * platform/qt/QtByteBlock.cpp: Removed.
+        * platform/qt/QtByteBlock.h: Removed.
+        * platform/qt/SharedBufferQt.cpp:
+
+2011-03-08  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Benjamin Poulain.
+
+        RenderObject: Pass complex type arguments as const-references.
+
+        * WebCore.exp.in:
+        * rendering/RenderObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawBoxSideFromPath):
+        (WebCore::RenderObject::drawArcForBoxSide):
+        (WebCore::RenderObject::localToAbsolute):
+        (WebCore::RenderObject::absoluteToLocal):
+
+2011-03-08  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        Path: Make measurement functions const
+        https://bugs.webkit.org/show_bug.cgi?id=55914
+
+        * platform/graphics/Path.cpp:
+        (WebCore::Path::length):
+        (WebCore::Path::pointAtLength):
+        (WebCore::Path::normalAngleAtLength):
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::strokeBoundingRect):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::strokeBoundingRect):
+        * platform/graphics/openvg/PathOpenVG.cpp:
+        (WebCore::Path::strokeBoundingRect):
+        (WebCore::Path::length):
+        (WebCore::Path::pointAtLength):
+        (WebCore::Path::normalAngleAtLength):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::strokeBoundingRect):
+        (WebCore::Path::length):
+        (WebCore::Path::pointAtLength):
+        (WebCore::Path::normalAngleAtLength):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::strokeBoundingRect):
+        * platform/graphics/wince/PathWinCE.cpp:
+        (WebCore::Path::strokeBoundingRect):
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::strokeBoundingRect):
+
+2011-03-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Do not set juntion sides on scrollbar stepper buttons
+        https://bugs.webkit.org/show_bug.cgi?id=55868
+
+        Fixes rendering of steppers for themes using rounded stepper
+        buttons on scrollbars like Adwaita.
+
+        * platform/gtk/ScrollbarThemeGtk3.cpp:
+        (WebCore::ScrollbarThemeGtk::paintButton):
+
+2011-03-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Use doubles instead of integers for coordinates when rendering arrows
+        https://bugs.webkit.org/show_bug.cgi?id=55866
+
+        To prevent off-by-one rounding errors.
+
+        * platform/gtk/RenderThemeGtk3.cpp:
+        (WebCore::RenderThemeGtk::paintMenuList):
+        * platform/gtk/ScrollbarThemeGtk3.cpp:
+        (WebCore::ScrollbarThemeGtk::paintButton):
+
+2011-03-08  Markus Goetz  <guruz@guruz.de>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Use the QNetworkAccessManager zerocopy feature
+        https://bugs.webkit.org/show_bug.cgi?id=50082
+
+        The feature will be introduced in Qt 4.8.
+        This patch is backwards compatible with Qt 4.7.
+
+        * WebCore.pro:
+        * platform/SharedBuffer.cpp:
+        * platform/SharedBuffer.h:
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::bufferedData):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::downloadProgress):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::start):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::supportsBufferedData):
+        (WebCore::ResourceHandle::bufferedData):
+        * platform/qt/SharedBufferQt.cpp:
+        (WebCore::SharedBuffer::wrapQtByteBlock):
+        (WebCore::SharedBuffer::hasPlatformData):
+        (WebCore::SharedBuffer::platformData):
+        (WebCore::SharedBuffer::platformDataSize):
+        (WebCore::SharedBuffer::maybeTransferPlatformData):
+        (WebCore::SharedBuffer::clearPlatformData):
+
+2011-03-08  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Fix compilation warnings after r80429
+        https://bugs.webkit.org/show_bug.cgi?id=55864
+
+        * platform/gtk/WidgetGtk.cpp:
+
+2011-03-08  Philippe Normand  <pnormand@igalia.com>
+
+        Unreviewed, GTK build fix after r80536
+
+        * GNUmakefile.am:
+
+2011-03-08  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Martin Robinson.
+
+        [Gtk] toDataURL uses incorrect quality value when saving GdkPixbuf to buffer
+        https://bugs.webkit.org/show_bug.cgi?id=55878
+
+        Multiply the quality parameter by 100 to put it in the range [0, 100] as needed
+        when saving GdkPixbuf to a buffer.
+
+        * platform/graphics/gtk/ImageBufferGtk.cpp:
+        (WebCore::ImageBuffer::toDataURL):
+
+2011-03-07  Daniel Cheng  <dcheng@chromium.org>
+
+        Unreviewed.
+
+        Final build fix for r80536.
+
+        * DerivedSources.make:
+
+2011-03-07  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Kent Tamura.
+
+        [EFL] Adjust functions of WebCore's efl port to WebKit coding style
+        https://bugs.webkit.org/show_bug.cgi?id=55924
+
+        Adjust webkit style to PlatformKeyboardEventEfl, PlatformMouseEventEfl and WidgetEfl files.
+
+        * platform/efl/PlatformKeyboardEventEfl.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/efl/PlatformMouseEventEfl.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/efl/WidgetEfl.cpp:
+        (WebCore::Widget::frameRectsChanged):
+        (WebCore::Widget::setEvasObject):
+
+2011-03-07  Daniel Cheng  <dcheng@chromium.org>
+
+        Unreviewed.
+
+        More build fixes for r80536.
+
+        * CMakeLists.txt:
+        * platform/chromium/ClipboardChromium.cpp:
+        * platform/chromium/ClipboardChromium.h:
+
+2011-03-07  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Adjust functions of ScrollbarEfl.cpp to WebKit coding style
+        https://bugs.webkit.org/show_bug.cgi?id=55917
+
+        Adjust webkit style to ScrollbarEfl files.
+
+        * platform/efl/ScrollbarEfl.cpp:
+        (scrollbarEflEdjeMessage):
+        (ScrollbarEfl::setParent):
+        (ScrollbarEfl::updateThumbPositionAndProportion):
+        (ScrollbarEfl::frameRectsChanged):
+        (ScrollbarEfl::paint):
+        * platform/efl/ScrollbarEfl.h:
+
+2011-03-07  Daniel Cheng  <dcheng@chromium.org>
+
+        Unreviewed.
+
+        Build fix for Chromium after r80536.
+
+        * platform/chromium/DataTransferItemChromium.cpp:
+        * platform/chromium/DataTransferItemsChromium.cpp:
+
+2011-03-07  Daniel Cheng  <dcheng@chromium.org>
+
+        Unreviewed.
+
+        More build fixes for r80536.
+
+        * CMakeLists.txt:
+        * platform/chromium/ClipboardChromium.cpp:
+        * platform/chromium/ClipboardChromium.h:
+
+2011-03-07  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add support for DataTransferItems
+        https://bugs.webkit.org/show_bug.cgi?id=55115
+
+        This patch adds stubs for DataTransferItems/DataTransferItem as well as implementing the
+        basic functionality on the Chromium port. With the exception of DataTransferItem::getAsFile,
+        all functionality on the DataTransferItems collection has been implemented.
+        This change does not actually hook up DataTransferItems to reflect the actual contents of a
+        drop/paste operation or to allow mutation of data in a copy/drag start yet. That will be
+        enabled via several followup patches.
+
+        Test: editing/pasteboard/data-transfer-items.html
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * CodeGenerators.pri:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setDataTransferItemsEnabled):
+        (WebCore::RuntimeEnabledFeatures::dataTransferItemsEnabled):
+        * bindings/scripts/CodeGeneratorV8.pm: Do not emit an #include line for DOMString, since it's built-in.
+        * dom/Clipboard.h:
+        (WebCore::Clipboard::policy):
+        * dom/Clipboard.idl:
+        * dom/DataTransferItem.cpp: Added.
+        * dom/DataTransferItem.h: Added.
+        (WebCore::DataTransferItem::~DataTransferItem):
+        * dom/DataTransferItem.idl: Added.
+        * dom/DataTransferItems.h: Added.
+        (WebCore::DataTransferItems::~DataTransferItems):
+        * dom/DataTransferItems.idl: Added.
+        * dom/StringCallback.cpp: Added.
+        (WebCore::StringCallback::scheduleCallback):
+        * dom/StringCallback.h: Added.
+        (WebCore::StringCallback::~StringCallback):
+        * dom/StringCallback.idl: Added.
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::items):
+        * platform/chromium/ClipboardChromium.h:
+        * platform/chromium/DataTransferItemChromium.cpp: Added.
+        (WebCore::DataTransferItemChromium::create):
+        (WebCore::DataTransferItemChromium::DataTransferItemChromium):
+        (WebCore::DataTransferItemChromium::kind):
+        (WebCore::DataTransferItemChromium::type):
+        (WebCore::DataTransferItemChromium::getAsString):
+        * platform/chromium/DataTransferItemChromium.h: Added.
+        * platform/chromium/DataTransferItemsChromium.cpp: Added.
+        (WebCore::DataTransferItemsChromium::create):
+        (WebCore::DataTransferItemsChromium::DataTransferItemsChromium):
+        (WebCore::DataTransferItemsChromium::length):
+        (WebCore::DataTransferItemsChromium::item):
+        (WebCore::DataTransferItemsChromium::deleteItem):
+        (WebCore::DataTransferItemsChromium::clear):
+        (WebCore::DataTransferItemsChromium::add):
+        * platform/chromium/DataTransferItemsChromium.h: Added.
+
 2011-03-07  Ryosuke Niwa  <rniwa@webkit.org>
 
         Reviewed by Darin Adler.
diff --git a/Source/WebCore/CodeGenerators.pri b/Source/WebCore/CodeGenerators.pri
index d20f661..2f89a5d 100644
--- a/Source/WebCore/CodeGenerators.pri
+++ b/Source/WebCore/CodeGenerators.pri
@@ -109,6 +109,8 @@ IDL_BINDINGS += \
     dom/Comment.idl \
     dom/CompositionEvent.idl \
     dom/CustomEvent.idl \
+    dom/DataTransferItem.idl \
+    dom/DataTransferItems.idl \
     dom/DeviceMotionEvent.idl \
     dom/DeviceOrientationEvent.idl \
     dom/DocumentFragment.idl \
@@ -146,6 +148,7 @@ IDL_BINDINGS += \
     dom/ProgressEvent.idl \
     dom/RangeException.idl \
     dom/Range.idl \
+    dom/StringCallback.idl \
     dom/Text.idl \
     dom/TextEvent.idl \
     dom/Touch.idl \
@@ -331,6 +334,8 @@ IDL_BINDINGS += \
     page/SpeechInputEvent.idl \
     page/SpeechInputResult.idl \
     page/SpeechInputResultList.idl \
+    page/WebKitAnimation.idl \
+    page/WebKitAnimationList.idl \
     page/WebKitPoint.idl \
     page/WorkerNavigator.idl \
     plugins/DOMPlugin.idl \
@@ -542,7 +547,8 @@ IDL_BINDINGS += \
     xml/XSLTProcessor.idl
 
 
-INSPECTOR_INTERFACES = inspector/Inspector.idl
+INSPECTOR_JSON = inspector/Inspector.json
+INSPECTOR_IDL = $${WC_GENERATED_SOURCES_DIR}/Inspector.idl
 INSPECTOR_BACKEND_STUB_QRC = inspector/front-end/InspectorBackendStub.qrc
 INJECTED_SCRIPT_SOURCE = $$PWD/inspector/InjectedScriptSource.js
 
@@ -640,18 +646,27 @@ v8 {
 addExtraCompiler(idl)
 
 # GENERATOR 2: inspector idl compiler
+inspectorJSON.output = $${WC_GENERATED_SOURCES_DIR}/Inspector.idl
+inspectorJSON.input = INSPECTOR_JSON
+inspectorJSON.wkScript = $$PWD/inspector/generate-inspector-idl
+inspectorJSON.commands = python $$inspectorJSON.wkScript -o $${WC_GENERATED_SOURCES_DIR}/Inspector.idl $$PWD/inspector/Inspector.json
+inspectorJSON.depends = $$PWD/inspector/generate-inspector-idl
+inspectorJSON.wkAddOutputToSources = false
+addExtraCompiler(inspectorJSON)
+
 inspectorIDL.output = $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}Frontend.cpp $${WC_GENERATED_SOURCES_DIR}/${QMAKE_FILE_BASE}BackendDispatcher.cpp
-inspectorIDL.input = INSPECTOR_INTERFACES
+inspectorIDL.input = INSPECTOR_IDL
 inspectorIDL.wkScript = $$PWD/bindings/scripts/generate-bindings.pl
 inspectorIDL.commands = perl -I$$PWD/bindings/scripts -I$$PWD/inspector $$inspectorIDL.wkScript --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" --generator Inspector --outputDir $$WC_GENERATED_SOURCES_DIR --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_FILE_NAME}
 inspectorIDL.depends = $$PWD/bindings/scripts/CodeGenerator.pm \
               $$PWD/inspector/CodeGeneratorInspector.pm \
               $$PWD/bindings/scripts/IDLParser.pm \
               $$PWD/bindings/scripts/IDLStructure.pm \
-              $$PWD/bindings/scripts/InFilesParser.pm
+              $$PWD/bindings/scripts/InFilesParser.pm \
+              $$PWD/inspector/Inspector.json \
+              $$PWD/inspector/generate-inspector-idl
 addExtraCompiler(inspectorIDL)
 
-inspectorBackendStub.wkAddOutputToSources = false
 inspectorBackendStub.output = generated/InspectorBackendStub.qrc
 inspectorBackendStub.input = INSPECTOR_BACKEND_STUB_QRC
 inspectorBackendStub.tempNames = $$PWD/$$INSPECTOR_BACKEND_STUB_QRC $${WC_GENERATED_SOURCES_DIR}/InspectorBackendStub.qrc
diff --git a/Source/WebCore/Configurations/Base.xcconfig b/Source/WebCore/Configurations/Base.xcconfig
index 94beb03..71344d4 100644
--- a/Source/WebCore/Configurations/Base.xcconfig
+++ b/Source/WebCore/Configurations/Base.xcconfig
@@ -25,7 +25,6 @@ DEBUG_INFORMATION_FORMAT = dwarf;
 GCC_C_LANGUAGE_STANDARD = gnu99;
 GCC_DEBUGGING_SYMBOLS = default;
 GCC_DYNAMIC_NO_PIC = NO;
-GCC_ENABLE_CPP_EXCEPTIONS = NO;
 GCC_ENABLE_CPP_RTTI = NO;
 GCC_ENABLE_OBJC_EXCEPTIONS = YES;
 GCC_ENABLE_OBJC_GC = $(GCC_ENABLE_OBJC_GC_$(REAL_PLATFORM_NAME));
@@ -118,12 +117,36 @@ TARGET_GCC_VERSION_macosx_1050_ = $(TARGET_GCC_VERSION_macosx_1050_$(XCODE_VERSI
 TARGET_GCC_VERSION_macosx_1050_0310 = GCC_42;
 TARGET_GCC_VERSION_macosx_1050_0320 = GCC_42;
 TARGET_GCC_VERSION_macosx_1060 = GCC_42;
-TARGET_GCC_VERSION_macosx_1070 = LLVM_GCC_42;
+TARGET_GCC_VERSION_macosx_1070 = $(TARGET_GCC_VERSION_macosx_1070_$(CONFIGURATION));
+TARGET_GCC_VERSION_macosx_1070_Debug = LLVM_COMPILER;
+TARGET_GCC_VERSION_macosx_1070_Release = LLVM_GCC_42;
+TARGET_GCC_VERSION_macosx_1070_Production = LLVM_GCC_42;
 
 GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
 GCC_VERSION_GCC_40 = 4.0;
 GCC_VERSION_GCC_42 = 4.2;
 GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
+GCC_VERSION_LLVM_COMPILER = com.apple.compilers.llvm.clang.1_0;
+
+// FIXME: Disable C++ exceptions in the LLVM Compiler once it supports enabling Obj-C exceptions without C++ exceptions.
+GCC_ENABLE_CPP_EXCEPTIONS = $(GCC_ENABLE_CPP_EXCEPTIONS_$(TARGET_GCC_VERSION));
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_40 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_GCC_42 = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_GCC = NO;
+GCC_ENABLE_CPP_EXCEPTIONS_LLVM_COMPILER = YES;
+
+// FIXME: The size of the debug symbols generated for WebCore exceeds that which a 32-bit linker can deal with.
+// To allow the Leopard build bots to successfully compile WebCore we're disabling debug symbols in debug builds.
+GCC_GENERATE_DEBUGGING_SYMBOLS = $(GCC_GENERATE_DEBUGGING_SYMBOLS_$(REAL_PLATFORM_NAME));
+GCC_GENERATE_DEBUGGING_SYMBOLS_iphoneos = YES;
+GCC_GENERATE_DEBUGGING_SYMBOLS_iphonesimulator = YES;
+GCC_GENERATE_DEBUGGING_SYMBOLS_macosx = $(GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1050 = $(GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1050_$(CONFIGURATION));
+GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1050_Debug = NO;
+GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1050_Release = YES;
+GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1050_Production = YES;
+GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1060 = YES;
+GCC_GENERATE_DEBUGGING_SYMBOLS_macosx_1070 = YES;
 
 // If the target Mac OS X version does not match the current Mac OS X version then we'll want to build using the target version's SDK.
 SDKROOT = $(SDKROOT_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
diff --git a/Source/WebCore/Configurations/Version.xcconfig b/Source/WebCore/Configurations/Version.xcconfig
index 312b348..cc13feb 100644
--- a/Source/WebCore/Configurations/Version.xcconfig
+++ b/Source/WebCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 24;
+MINOR_VERSION = 27;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebCore/Configurations/WebCore.xcconfig b/Source/WebCore/Configurations/WebCore.xcconfig
index f164902..33dc0e7 100644
--- a/Source/WebCore/Configurations/WebCore.xcconfig
+++ b/Source/WebCore/Configurations/WebCore.xcconfig
@@ -63,7 +63,7 @@ PRODUCTION_FRAMEWORKS_DIR_iphonesimulator = $(PRODUCTION_FRAMEWORKS_DIR_iphoneos
 PRODUCTION_FRAMEWORKS_DIR_macosx = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks;
 
 WEBKIT2_LDFLAGS = $(WEBKIT2_LDFLAGS_$(TARGET_MAC_OS_X_VERSION_MAJOR));
-WEBKIT2_LDFLAGS_1060 = -allowable_client WebKit2 -allowable_client WebKitTestRunner -allowable_client WebKitTestRunnerInjectedBundle;
+WEBKIT2_LDFLAGS_1060 = -allowable_client WebKit2
 WEBKIT2_LDFLAGS_1070 = $(WEBKIT2_LDFLAGS_1060);
 
 JAVASCRIPTCORE_PRIVATE_HEADERS_DIR = $(JAVASCRIPTCORE_PRIVATE_HEADERS_DIR_$(CONFIGURATION));
diff --git a/Source/WebCore/DerivedSources.cpp b/Source/WebCore/DerivedSources.cpp
index 72f1b2d..24022f7 100644
--- a/Source/WebCore/DerivedSources.cpp
+++ b/Source/WebCore/DerivedSources.cpp
@@ -72,6 +72,8 @@
 #include "JSDatabaseSync.cpp"
 #include "JSDataGridColumn.cpp"
 #include "JSDataGridColumnList.cpp"
+#include "JSDataTransferItem.cpp"
+#include "JSDataTransferItems.cpp"
 #include "JSDataView.cpp"
 #include "JSDedicatedWorkerContext.cpp"
 #include "JSDeviceOrientationEvent.cpp"
@@ -281,6 +283,7 @@
 #include "JSSQLTransactionSyncCallback.cpp"
 #include "JSStorage.cpp"
 #include "JSStorageEvent.cpp"
+#include "JSStringCallback.cpp"
 #include "JSStyleMedia.cpp"
 #include "JSStyleSheet.cpp"
 #include "JSStyleSheetList.cpp"
@@ -432,7 +435,9 @@
 #include "JSUint8Array.cpp"
 #include "JSUIEvent.cpp"
 #include "JSValidityState.cpp"
+#include "JSWebKitAnimation.cpp"
 #include "JSWebKitAnimationEvent.cpp"
+#include "JSWebKitAnimationList.cpp"
 #include "JSWebKitCSSKeyframeRule.cpp"
 #include "JSWebKitCSSKeyframesRule.cpp"
 #include "JSWebKitCSSTransformValue.cpp"
diff --git a/Source/WebCore/DerivedSources.make b/Source/WebCore/DerivedSources.make
index 29298ff..c8fa310 100644
--- a/Source/WebCore/DerivedSources.make
+++ b/Source/WebCore/DerivedSources.make
@@ -131,6 +131,8 @@ DOM_CLASSES = \
     CustomEvent \
     DataGridColumn \
     DataGridColumnList \
+    DataTransferItem \
+    DataTransferItems \
     DedicatedWorkerContext \
     DOMApplicationCache \
     DOMCoreException \
@@ -150,6 +152,8 @@ DOM_CLASSES = \
     DOMTokenList \
     DOMURL \
     DOMWindow \
+    DataTransferItem \
+    DataTransferItems \
     Database \
     DatabaseCallback \
     DatabaseSync \
@@ -347,6 +351,7 @@ DOM_CLASSES = \
     SQLTransactionSyncCallback \
     Storage \
     StorageEvent \
+    StringCallback \
     SVGAElement \
     SVGAltGlyphElement \
     SVGAngle \
@@ -493,6 +498,7 @@ DOM_CLASSES = \
     SVGZoomAndPan \
     SVGZoomEvent \
     Screen \
+    StringCallback \
     StyleMedia \
     StyleSheet \
     StyleSheetList \
@@ -506,7 +512,9 @@ DOM_CLASSES = \
     TreeWalker \
     UIEvent \
     ValidityState \
+    WebKitAnimation \
     WebKitAnimationEvent \
+    WebKitAnimationList \
     WebKitCSSKeyframeRule \
     WebKitCSSKeyframesRule \
     WebKitCSSMatrix \
@@ -569,7 +577,6 @@ all : \
     MathMLNames.cpp \
     XPathGrammar.cpp \
     tokenizer.cpp \
-    HeaderDetection.h \
 #
 
 # --------
@@ -730,7 +737,7 @@ ifeq ($(findstring ENABLE_VIDEO,$(FEATURE_DEFINES)), ENABLE_VIDEO)
 endif
 
 ifeq ($(findstring ENABLE_FULLSCREEN_API,$(FEATURE_DEFINES)), ENABLE_FULLSCREEN_API)
-    USER_AGENT_STYLE_SHEETS := $(USER_AGENT_STYLE_SHEETS) $(WebCore)/css/fullscreen.css
+    USER_AGENT_STYLE_SHEETS := $(USER_AGENT_STYLE_SHEETS) $(WebCore)/css/fullscreen.css $(WebCore)/css/fullscreenQuickTime.css
 endif
 
 UserAgentStyleSheets.h : css/make-css-file-arrays.pl $(USER_AGENT_STYLE_SHEETS)
@@ -881,6 +888,9 @@ JS%.h : %.idl $(JS_BINDINGS_SCRIPTS)
 
 # Inspector interfaces generator
 
+Inspector.idl : Inspector.json inspector/generate-inspector-idl
+	python $(WebCore)/inspector/generate-inspector-idl -o Inspector.idl $(WebCore)/inspector/Inspector.json
+
 all : InspectorFrontend.h
 
 INSPECTOR_GENERATOR_SCRIPTS = $(GENERATE_SCRIPTS) inspector/CodeGeneratorInspector.pm
@@ -949,21 +959,3 @@ DOM%.h : %.idl $(DOM_BINDINGS_SCRIPTS) bindings/objc/PublicDOMInterfaces.h
 # --------
 
 endif # MACOS
-
-# ------------------------
-
-# header detection
-
-ifeq ($(OS),MACOS)
-
-HeaderDetection.h : DerivedSources.make /System/Library/CoreServices/SystemVersion.plist
-	rm -f $@
-	echo "/* This is a generated file. Do not edit. */" > $@
-	if [ -f $(SDKROOT)/System/Library/Frameworks/AppKit.framework/PrivateHeaders/NSScrollerImpPair_Private.h ]; then echo "#define USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER 1" >> $@; else echo >> $@; fi
-
-else
-
-HeaderDetection.h :
-	echo > $@
-
-endif
diff --git a/Source/WebCore/English.lproj/Localizable.strings b/Source/WebCore/English.lproj/Localizable.strings
index 2019d1d..d47f260 100644
--- a/Source/WebCore/English.lproj/Localizable.strings
+++ b/Source/WebCore/English.lproj/Localizable.strings
diff --git a/Source/WebCore/English.lproj/localizedStrings.js b/Source/WebCore/English.lproj/localizedStrings.js
index cd4e6aa..0acde95 100644
--- a/Source/WebCore/English.lproj/localizedStrings.js
+++ b/Source/WebCore/English.lproj/localizedStrings.js
diff --git a/Source/WebCore/ForwardingHeaders/wtf/HexNumber.h b/Source/WebCore/ForwardingHeaders/wtf/HexNumber.h
new file mode 100644
index 0000000..d17b95e
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/wtf/HexNumber.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_HexNumber_h
+#define WebCore_FWD_HexNumber_h
+#include <JavaScriptCore/HexNumber.h>
+#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeRefCounted.h b/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeRefCounted.h
new file mode 100644
index 0000000..d7a35f8
--- /dev/null
+++ b/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeRefCounted.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_ThreadSafeRefCounted_h
+#define WebCore_FWD_ThreadSafeRefCounted_h
+#include <JavaScriptCore/ThreadSafeRefCounted.h>
+#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeShared.h b/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeShared.h
deleted file mode 100644
index 50c2bf4..0000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeShared.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ThreadSafeShared_h
-#define WebCore_FWD_ThreadSafeShared_h
-#include <JavaScriptCore/ThreadSafeShared.h>
-#endif
diff --git a/Source/WebCore/GNUmakefile.am b/Source/WebCore/GNUmakefile.am
index 4993bbb..eedbc9a 100644
--- a/Source/WebCore/GNUmakefile.am
+++ b/Source/WebCore/GNUmakefile.am
@@ -196,6 +196,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSDataGridColumn.h \
 	DerivedSources/WebCore/JSDataGridColumnList.cpp \
 	DerivedSources/WebCore/JSDataGridColumnList.h \
+	DerivedSources/WebCore/JSDataTransferItems.h \
+	DerivedSources/WebCore/JSDataTransferItems.cpp \
 	DerivedSources/WebCore/JSDataView.cpp \
 	DerivedSources/WebCore/JSDataView.h \
 	DerivedSources/WebCore/JSDedicatedWorkerContext.cpp \
@@ -596,7 +598,11 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSWebGLUniformLocation.h \
 	DerivedSources/WebCore/JSWebGLVertexArrayObjectOES.cpp \
 	DerivedSources/WebCore/JSWebGLVertexArrayObjectOES.h \
+	DerivedSources/WebCore/JSWebKitAnimation.cpp \
+	DerivedSources/WebCore/JSWebKitAnimation.h \
 	DerivedSources/WebCore/JSWebKitAnimationEvent.cpp \
+	DerivedSources/WebCore/JSWebKitAnimationList.h \
+	DerivedSources/WebCore/JSWebKitAnimationList.cpp \
 	DerivedSources/WebCore/JSWebKitAnimationEvent.h \
 	DerivedSources/WebCore/JSWebKitCSSKeyframeRule.cpp \
 	DerivedSources/WebCore/JSWebKitCSSKeyframeRule.h \
@@ -819,6 +825,7 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JSImageConstructor.h \
 	Source/WebCore/bindings/js/JSImageDataCustom.cpp \
 	Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp \
+	Source/WebCore/bindings/js/JSInjectedScriptManager.cpp \
 	Source/WebCore/bindings/js/JSInspectorFrontendHostCustom.cpp \
 	Source/WebCore/bindings/js/JSInt16ArrayCustom.cpp \
 	Source/WebCore/bindings/js/JSInt32ArrayCustom.cpp \
@@ -868,6 +875,8 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JSUint16ArrayCustom.cpp \
 	Source/WebCore/bindings/js/JSUint32ArrayCustom.cpp \
 	Source/WebCore/bindings/js/JSUint8ArrayCustom.cpp \
+	Source/WebCore/bindings/js/JSWebKitAnimationCustom.cpp \
+	Source/WebCore/bindings/js/JSWebKitAnimationListCustom.cpp \
 	Source/WebCore/bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp \
 	Source/WebCore/bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp \
 	Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp \
@@ -884,6 +893,8 @@ webcore_sources += \
 	Source/WebCore/bindings/js/JavaScriptCallFrame.cpp \
 	Source/WebCore/bindings/js/JavaScriptCallFrame.h \
 	Source/WebCore/bindings/js/OptionsObject.h \
+	Source/WebCore/bindings/js/PageScriptDebugServer.cpp \
+	Source/WebCore/bindings/js/PageScriptDebugServer.h \
 	Source/WebCore/bindings/js/ScheduledAction.cpp \
 	Source/WebCore/bindings/js/ScheduledAction.h \
 	Source/WebCore/bindings/js/ScriptCachedFrameData.cpp \
@@ -922,6 +933,8 @@ webcore_sources += \
 	Source/WebCore/bindings/js/WebCoreJSClientData.h \
 	Source/WebCore/bindings/js/WorkerScriptController.cpp \
 	Source/WebCore/bindings/js/WorkerScriptController.h \
+	Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp \
+	Source/WebCore/bindings/js/WorkerScriptDebugServer.h \
 	Source/WebCore/bindings/ScriptControllerBase.cpp \
 	Source/WebCore/bindings/ScriptControllerBase.h \
 	Source/WebCore/bridge/Bridge.h \
@@ -939,7 +952,10 @@ webcore_sources += \
 	Source/WebCore/bridge/IdentifierRep.h \
 	Source/WebCore/bridge/jni/JNIUtility.h \
 	Source/WebCore/bridge/jni/JavaMethod.h \
+	Source/WebCore/bridge/jni/JavaMethodJobject.cpp \
+	Source/WebCore/bridge/jni/JavaMethodJobject.h \
 	Source/WebCore/bridge/jni/JavaString.h \
+	Source/WebCore/bridge/jni/JavaType.h \
 	Source/WebCore/bridge/jni/jni_jsobject.h \
 	Source/WebCore/bridge/jni/jsc/JavaArrayJSC.h \
 	Source/WebCore/bridge/jni/jsc/JavaClassJSC.h \
@@ -1001,6 +1017,8 @@ webcore_sources += \
 	Source/WebCore/css/CSSInheritedValue.h \
 	Source/WebCore/css/CSSInitialValue.cpp \
 	Source/WebCore/css/CSSInitialValue.h \
+        Source/WebCore/css/CSSLineBoxContainValue.cpp \
+	Source/WebCore/css/CSSLineBoxContainValue.h \
 	Source/WebCore/css/CSSMediaRule.cpp \
 	Source/WebCore/css/CSSMediaRule.h \
 	Source/WebCore/css/CSSMutableStyleDeclaration.cpp \
@@ -1040,6 +1058,8 @@ webcore_sources += \
 	Source/WebCore/css/CSSSelector.h \
 	Source/WebCore/css/CSSSelectorList.cpp \
 	Source/WebCore/css/CSSSelectorList.h \
+	Source/WebCore/css/CSSStyleApplyProperty.cpp \
+	Source/WebCore/css/CSSStyleApplyProperty.h \
 	Source/WebCore/css/CSSStyleDeclaration.cpp \
 	Source/WebCore/css/CSSStyleDeclaration.h \
 	Source/WebCore/css/CSSStyleRule.cpp \
@@ -1106,8 +1126,6 @@ webcore_sources += \
 	Source/WebCore/css/WebKitCSSTransformValue.h \
 	Source/WebCore/dom/ActiveDOMObject.cpp \
 	Source/WebCore/dom/ActiveDOMObject.h \
-	Source/WebCore/dom/AsyncScriptRunner.cpp \
-	Source/WebCore/dom/AsyncScriptRunner.h \
 	Source/WebCore/dom/Attr.cpp \
 	Source/WebCore/dom/Attr.h \
 	Source/WebCore/dom/Attribute.cpp \
@@ -1208,6 +1226,8 @@ webcore_sources += \
 	Source/WebCore/dom/Event.h \
 	Source/WebCore/dom/EventContext.cpp \
 	Source/WebCore/dom/EventContext.h \
+	Source/WebCore/dom/EventDispatcher.cpp \
+	Source/WebCore/dom/EventDispatcher.h \
 	Source/WebCore/dom/EventException.h \
 	Source/WebCore/dom/EventListener.h \
 	Source/WebCore/dom/EventNames.cpp \
@@ -1297,6 +1317,8 @@ webcore_sources += \
 	Source/WebCore/dom/ScriptElement.h \
 	Source/WebCore/dom/ScriptExecutionContext.cpp \
 	Source/WebCore/dom/ScriptExecutionContext.h \
+	Source/WebCore/dom/ScriptRunner.cpp \
+	Source/WebCore/dom/ScriptRunner.h \
 	Source/WebCore/dom/SelectElement.cpp \
 	Source/WebCore/dom/SelectElement.h \
 	Source/WebCore/dom/SelectorNodeList.cpp \
@@ -1965,10 +1987,14 @@ webcore_sources += \
 	Source/WebCore/icu/unicode/uversion.h \
 	Source/WebCore/inspector/ConsoleMessage.cpp \
 	Source/WebCore/inspector/ConsoleMessage.h \
+	Source/WebCore/inspector/DOMNodeHighlighter.cpp \
+	Source/WebCore/inspector/DOMNodeHighlighter.h \
 	Source/WebCore/inspector/InjectedScript.cpp \
 	Source/WebCore/inspector/InjectedScript.h \
 	Source/WebCore/inspector/InjectedScriptHost.cpp \
 	Source/WebCore/inspector/InjectedScriptHost.h \
+	Source/WebCore/inspector/InjectedScriptManager.cpp \
+	Source/WebCore/inspector/InjectedScriptManager.h \
 	Source/WebCore/inspector/InspectorAgent.cpp \
 	Source/WebCore/inspector/InspectorAgent.h \
 	Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp \
@@ -2004,6 +2030,8 @@ webcore_sources += \
 	Source/WebCore/inspector/InspectorFrontendHost.h \
 	Source/WebCore/inspector/InspectorInstrumentation.cpp \
 	Source/WebCore/inspector/InspectorInstrumentation.h \
+	Source/WebCore/inspector/InspectorPageAgent.cpp \
+	Source/WebCore/inspector/InspectorPageAgent.h \
 	Source/WebCore/inspector/InspectorProfilerAgent.cpp \
 	Source/WebCore/inspector/InspectorProfilerAgent.h \
 	Source/WebCore/inspector/InspectorResourceAgent.cpp \
@@ -2020,6 +2048,8 @@ webcore_sources += \
 	Source/WebCore/inspector/InspectorValues.h \
 	Source/WebCore/inspector/InspectorWorkerResource.h \
 	Source/WebCore/inspector/InstrumentingAgents.h \
+	Source/WebCore/inspector/PageDebuggerAgent.cpp \
+	Source/WebCore/inspector/PageDebuggerAgent.h \
 	Source/WebCore/inspector/ScriptArguments.cpp \
 	Source/WebCore/inspector/ScriptArguments.h \
 	Source/WebCore/inspector/ScriptBreakpoint.h \
@@ -2031,6 +2061,8 @@ webcore_sources += \
 	Source/WebCore/inspector/ScriptGCEventListener.h \
 	Source/WebCore/inspector/TimelineRecordFactory.cpp \
 	Source/WebCore/inspector/TimelineRecordFactory.h \
+	Source/WebCore/inspector/WorkerDebuggerAgent.cpp \
+	Source/WebCore/inspector/WorkerDebuggerAgent.h \
 	Source/WebCore/loader/appcache/ApplicationCache.cpp \
 	Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp \
 	Source/WebCore/loader/appcache/ApplicationCacheGroup.h \
@@ -2108,7 +2140,8 @@ webcore_sources += \
 	Source/WebCore/loader/icon/IconDatabaseClient.h \
 	Source/WebCore/loader/icon/IconDatabase.cpp \
 	Source/WebCore/loader/icon/IconDatabase.h \
-	Source/WebCore/loader/icon/IconDatabaseNone.cpp \
+	Source/WebCore/loader/icon/IconDatabaseBase.cpp \
+	Source/WebCore/loader/icon/IconDatabaseBase.h \
 	Source/WebCore/loader/icon/IconLoader.cpp \
 	Source/WebCore/loader/icon/IconLoader.h \
 	Source/WebCore/loader/icon/IconRecord.cpp \
@@ -2303,6 +2336,11 @@ webcore_sources += \
 	Source/WebCore/page/UserScriptTypes.h \
 	Source/WebCore/page/UserStyleSheet.h \
 	Source/WebCore/page/UserStyleSheetTypes.h \
+	Source/WebCore/page/WebCoreKeyboardUIMode.h \
+	Source/WebCore/page/WebKitAnimation.h \
+	Source/WebCore/page/WebKitAnimation.cpp \
+	Source/WebCore/page/WebKitAnimationList.h \
+	Source/WebCore/page/WebKitAnimationList.cpp \
 	Source/WebCore/page/WebKitPoint.h \
 	Source/WebCore/page/WindowFeatures.cpp \
 	Source/WebCore/page/WindowFeatures.h \
@@ -2329,6 +2367,8 @@ webcore_sources += \
 	Source/WebCore/platform/CrossThreadCopier.h \
 	Source/WebCore/platform/Cursor.cpp \
 	Source/WebCore/platform/Cursor.h \
+	Source/WebCore/platform/DefaultLocalizationStrategy.cpp \
+	Source/WebCore/platform/DefaultLocalizationStrategy.h \
 	Source/WebCore/platform/DragData.cpp \
 	Source/WebCore/platform/DragData.h \
 	Source/WebCore/platform/DragImage.cpp \
@@ -2671,6 +2711,7 @@ webcore_sources += \
 	Source/WebCore/platform/text/TextEncoding.h \
 	Source/WebCore/platform/text/TextEncodingRegistry.cpp \
 	Source/WebCore/platform/text/TextEncodingRegistry.h \
+	Source/WebCore/platform/text/TextOrientation.h \
 	Source/WebCore/platform/text/TextStream.cpp \
 	Source/WebCore/platform/text/TextStream.h \
 	Source/WebCore/platform/text/transcoder/FontTranscoder.cpp \
@@ -3104,7 +3145,6 @@ webcore_sources += \
 	Source/WebCore/storage/DatabaseTracker.h \
 	Source/WebCore/storage/IDBAny.cpp \
 	Source/WebCore/storage/IDBAny.h \
-	Source/WebCore/storage/IDBBackingStore.cpp \
 	Source/WebCore/storage/IDBBackingStore.h \
 	Source/WebCore/storage/IDBCallbacks.h \
 	Source/WebCore/storage/IDBCursorBackendImpl.cpp \
@@ -3115,6 +3155,8 @@ webcore_sources += \
 	Source/WebCore/storage/IDBDatabaseBackendImpl.cpp \
 	Source/WebCore/storage/IDBDatabaseBackendImpl.h \
 	Source/WebCore/storage/IDBDatabaseBackendInterface.h \
+	Source/WebCore/storage/IDBDatabaseCallbacks.h \
+	Source/WebCore/storage/IDBDatabaseCallbacksImpl.h \
 	Source/WebCore/storage/IDBDatabase.cpp \
 	Source/WebCore/storage/IDBDatabaseError.h \
 	Source/WebCore/storage/IDBDatabaseException.h \
@@ -3146,10 +3188,13 @@ webcore_sources += \
 	Source/WebCore/storage/IDBObjectStore.h \
 	Source/WebCore/storage/IDBRequest.cpp \
 	Source/WebCore/storage/IDBRequest.h \
+	Source/WebCore/storage/IDBSQLiteBackingStore.cpp \
+	Source/WebCore/storage/IDBSQLiteBackingStore.h \
 	Source/WebCore/storage/IDBTransactionBackendInterface.h \
 	Source/WebCore/storage/IDBTransactionCoordinator.h \
 	Source/WebCore/storage/IDBTransaction.cpp \
 	Source/WebCore/storage/IDBTransaction.h \
+	Source/WebCore/storage/IDBVersionChangeEvent.h \
 	Source/WebCore/storage/IDBVersionChangeRequest.h \
 	Source/WebCore/storage/LocalStorageTask.cpp \
 	Source/WebCore/storage/LocalStorageTask.h \
@@ -3159,6 +3204,7 @@ webcore_sources += \
 	Source/WebCore/storage/OriginQuotaManager.h \
 	Source/WebCore/storage/OriginUsageRecord.cpp \
 	Source/WebCore/storage/OriginUsageRecord.h \
+	Source/WebCore/storage/SQLCallbackWrapper.h \
 	Source/WebCore/storage/SQLError.h \
 	Source/WebCore/storage/SQLException.h \
 	Source/WebCore/storage/SQLResultSet.cpp \
@@ -3201,6 +3247,9 @@ webcore_sources += \
 	Source/WebCore/storage/StorageNamespaceImpl.h \
 	Source/WebCore/storage/StorageSyncManager.cpp \
 	Source/WebCore/storage/StorageSyncManager.h \
+	Source/WebCore/storage/StorageTracker.cpp \
+	Source/WebCore/storage/StorageTracker.h \
+	Source/WebCore/storage/StorageTrackerClient.h \
 	Source/WebCore/svg/animation/SMILTimeContainer.cpp \
 	Source/WebCore/svg/animation/SMILTimeContainer.h \
 	Source/WebCore/svg/animation/SMILTime.cpp \
@@ -3711,6 +3760,8 @@ webcoregtk_sources += \
 	Source/WebCore/platform/graphics/cairo/OwnPtrCairo.h \
 	Source/WebCore/platform/graphics/cairo/PathCairo.cpp \
 	Source/WebCore/platform/graphics/cairo/PatternCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/PlatformContextCairo.cpp \
+	Source/WebCore/platform/graphics/cairo/PlatformContextCairo.h \
 	Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp \
 	Source/WebCore/platform/graphics/cairo/RefPtrCairo.h \
 	Source/WebCore/platform/graphics/cairo/TransformationMatrixCairo.cpp \
@@ -3849,6 +3900,8 @@ if TARGET_WIN32
 webcore_sources += \
 	Source/WebCore/platform/ScrollAnimatorWin.cpp \
 	Source/WebCore/platform/ScrollAnimatorWin.h \
+	Source/WebCore/platform/win/SystemInfo.cpp \
+	Source/WebCore/platform/win/SystemInfo.h \
 	Source/WebCore/plugins/win/PluginDatabaseWin.cpp \
 	Source/WebCore/plugins/win/PluginMessageThrottlerWin.cpp \
 	Source/WebCore/plugins/win/PluginMessageThrottlerWin.h
@@ -3876,6 +3929,10 @@ webcoregtk_sources += \
 	Source/WebCore/platform/text/gtk/TextBreakIteratorGtk.cpp
 endif
 
+if !ENABLE_WEBKIT2
+FEATURE_DEFINES += WTF_USE_NATIVE_GTK_MAIN_FRAME_SCROLLBAR=1
+webcore_cppflags += -DWTF_USE_NATIVE_GTK_MAIN_FRAME_SCROLLBAR=1
+endif # END WEBKIT2
 
 # ---
 # Channel mesaging support
@@ -3898,7 +3955,7 @@ endif # END ENABLE_FAST_MOBILE_SCROLLING
 # ---
 if USE_FREETYPE
 webcoregtk_cppflags += \
-	-DUSE_FREETYPE=1 \
+	-DWTF_USE_FREETYPE=1 \
 	-I$(srcdir)/Source/WebCore/platform/graphics/freetype
 
 webcoregtk_sources += \
@@ -3915,7 +3972,7 @@ endif # END USE_FREETYPE
 # ---
 if USE_PANGO
 webcoregtk_cppflags += \
-	-DUSE_PANGO=1 \
+	-DWTF_USE_PANGO=1 \
 	-I$(srcdir)/Source/WebCore/platform/graphics/pango
 
 webcoregtk_sources += \
@@ -4016,10 +4073,23 @@ endif # END ENABLE_DATALIST
 
 # ----
 # HTML5 data transfer items support
-#-----
+# ----
 if ENABLE_DATA_TRANSFER_ITEMS
 FEATURE_DEFINES += ENABLE_DATA_TRANSFER_ITEMS=1
 webcore_cppflags += -DENABLE_DATA_TRANSFER_ITEMS=1
+webcore_built_sources += \
+        DerivedSources/WebCore/JSDataTransferItem.cpp \
+        DerivedSources/WebCore/JSDataTransferItem.h \
+        DerivedSources/WebCore/JSDataTransferItems.cpp \
+        DerivedSources/WebCore/JSDataTransferItems.h \
+        DerivedSources/WebCore/JSStringCallback.cpp \
+        DerivedSources/WebCore/JSStringCallback.h
+webcore_sources += \
+	Source/WebCore/dom/DataTransferItem.cpp \
+	Source/WebCore/dom/DataTransferItem.h \
+	Source/WebCore/dom/DataTransferItems.h \
+	Source/WebCore/dom/StringCallback.cpp \
+	Source/WebCore/dom/StringCallback.h
 endif # END ENABLE_DATA_TRANSFER_ITEMS
 
 # ----
@@ -4954,7 +5024,10 @@ DerivedSources/WebCore/XMLNames.cpp DerivedSources/WebCore/XMLNames.h: $(WebCore
 	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/xml/xmlattrs.in --outputDir "$(GENSOURCES_WEBCORE)"
 
 # All Web Inspector generated files are created with this one call to CodeGeneratorInspector.pm
-DerivedSources/WebCore/InspectorBackendDispatcher.cpp: $(WebCore)/inspector/Inspector.idl $(SCRIPTS_BINDINGS) $(WebCore)/inspector/CodeGeneratorInspector.pm
+DerivedSources/WebCore/Inspector.idl : $(WebCore)/inspector/Inspector.json $(WebCore)/inspector/generate-inspector-idl
+	$(PYTHON) $(WebCore)/inspector/generate-inspector-idl -o $(GENSOURCES_WEBCORE)/Inspector.idl $(WebCore)/inspector/Inspector.json
+
+DerivedSources/WebCore/InspectorBackendDispatcher.cpp: DerivedSources/WebCore/Inspector.idl $(SCRIPTS_BINDINGS) $(WebCore)/inspector/CodeGeneratorInspector.pm
 	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts -I$(WebCore)/inspector $(WebCore)/bindings/scripts/generate-bindings.pl $(IDL_PATH:%=--include "%") --outputDir "$(GENSOURCES_WEBCORE)" --defines "LANGUAGE_JAVASCRIPT=1 $(FEATURE_DEFINES)" --generator Inspector $<
 DerivedSources/WebCore/InspectorFrontend.h: DerivedSources/WebCore/InspectorFrontend.cpp
 DerivedSources/WebCore/InspectorFrontend.cpp: DerivedSources/WebCore/InspectorBackendStub.js
@@ -5090,6 +5163,8 @@ EXTRA_DIST += \
 	Source/WebCore/icu/LICENSE \
 	Source/WebCore/inspector/CodeGeneratorInspector.pm \
 	Source/WebCore/inspector/InjectedScriptSource.js \
+	Source/WebCore/inspector/Inspector.json \
+	Source/WebCore/inspector/generate-inspector-idl \
 	Source/WebCore/inspector/xxd.pl \
 	Source/WebCore/LICENSE-APPLE \
 	Source/WebCore/LICENSE-LGPL-2 \
@@ -5104,6 +5179,7 @@ EXTRA_DIST += \
 	Source/WebCore/svg/xlinkattrs.in \
 	Source/WebCore/xml/xmlattrs.in \
 	Source/WebCore/xml/xmlnsattrs.in \
+	Source/WebCore/xml/XMLViewer.xsl \
 	Source/WebCore/xml/XPathGrammar.y
 
 # Installing web inspector files
diff --git a/Source/WebCore/StringsNotToBeLocalized.txt b/Source/WebCore/StringsNotToBeLocalized.txt
deleted file mode 100644
index 6fb11f2..0000000
--- a/Source/WebCore/StringsNotToBeLocalized.txt
+++ /dev/null
@@ -1,893 +0,0 @@
-"    "
-" "
-" #%*[^\n\r]%*[\n\r]"
-" %32[^# \t\n\r]%*[^# \t\n\r] "
-" %@"
-" (KHTML, like Gecko) "
-" (KHTML, like Gecko)"
-" (clipped)"
-" (clipping)"
-" (reflection)"
-" *POST*"
-" *target*"
-" >>>"
-" Mac OS X %@) AppleWebKit/%@ (KHTML, like Gecko) %@"
-" Mac OS X %@) AppleWebKit/%@ (KHTML, like Gecko)"
-" Version/3.2.1"
-" class=\"%@\""
-" id=\"%@\""
-"#"
-"%"
-"%.0f"
-"%.1lf"
-"%.2lu/%.2lu/%.10lu-%.10lu.cache"
-"%.2u/%.2u/%.10u-%.10u.cache"
-"%0.fpx"
-"%02d:%02d"
-"%20"
-"%2d) "
-"%4u"
-"%@ %.0fpx %.0fpx %.0fpx"
-"%@ %.0fpx %.0fpx"
-"%@ %@"
-"%@%@"
-"%@, %@"
-"%@-%d"
-"%@/%s"
-"%@/Library/Preferences/%@"
-"%@:%u"
-"%@://%@"
-"%@://%@/%@"
-"%@://%@:%d"
-"%d"
-"%d:%02d:%02d"
-"%d_%d"
-"%d_%d_%d"
-"%dpx"
-"%ld"
-"%s%01d:%02d:%02d"
-"%s%02d:%02d"
-"%s%02d:%02d:%02d"
-"%u"
-"&ie=UTF-8&oe=UTF-8"
-"(%.0f, %.0f)"
-") AppleWebKit/"
-"+"
-"+ve z-order list"
-", "
-","
-"-"
-"-1px"
-"-createPluginMIMETypesPreferences"
-"-khtml-text-decorations-in-effect"
-"-ve z-order list"
-"."
-".download"
-".html"
-".jpg"
-".svg"
-".xhtml"
-"/"
-"/Frameworks/PDFKit.framework"
-"/Library/Internet Plug-Ins"
-"/System/Library/Frameworks/ApplicationServices.framework/Frameworks/LangAnalysis.framework/LangAnalysis"
-"/System/Library/Frameworks/Carbon.framework/Frameworks/HIToolbox.framework/HIToolbox"
-"/System/Library/Frameworks/CoreVideo.framework"
-"/Volumes"
-"/tmp/XXXXXX.tiff"
-"0"
-"062AEEE3-9E42-44DC-A8A9-236B216FE011"
-"1"
-"10.1"
-"10.1.53.60"
-"1000"
-"12px"
-"13"
-"16"
-"1800"
-"1px"
-"2"
-"3.1"
-"3dbd565b-db22-4d88-8e0e-778bde54524a"
-"420+"
-"5CACD637-F82F-491F-947A-5DCA38AA0FEA"
-"6EB8D98F-2723-4472-88D3-5936F9D6E631"
-"7"
-"7.1"
-"9"
-":"
-"://"
-":/?#"
-"; "
-"<!"
-"<%@ %@>"
-"<?"
-"<a "
-"<channel"
-"<feed"
-"<html"
-"<html>"
-"<rdf"
-"<rss"
-"<script"
-"<title>"
-">,?"
-"?"
-"@"
-"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-."
-"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+.-"
-"ARIAApplicationAlert"
-"ARIAApplicationAlertDialog"
-"ARIAApplicationDialog"
-"ARIAApplicationLog"
-"ARIAApplicationMarquee"
-"ARIAApplicationStatus"
-"ARIAApplicationTimer"
-"ARIADocument"
-"ARIADocumentArticle"
-"ARIADocumentMath"
-"ARIADocumentNote"
-"ARIADocumentRegion"
-"ARIALandmarkApplication"
-"ARIALandmarkBanner"
-"ARIALandmarkComplementary"
-"ARIALandmarkContentInfo"
-"ARIALandmarkMain"
-"ARIALandmarkNavigation"
-"ARIALandmarkSearch"
-"ARIATabPanel"
-"ARIAUserInterfaceTooltip"
-"AXEnhancedUserInterface"
-"AccessibleBase"
-"AccessibleObjectFromWindow"
-"AllowsUndo"
-"Apple Web Archive pasteboard type"
-"AppleKeyboardUIMode"
-"AppleTextDirection"
-"AudioElement"
-"BEGIN:VCALENDAR"
-"BEGIN:VCARD"
-"BP_CreatePluginMIMETypesPreferences"
-"CFBundleShortVersionString"
-"CFDictionaryPropertyBag"
-"CSS"
-"Change Back to \\U201C%@\\U201D"
-"Content-Encoding"
-"Content-Length"
-"Content-Type"
-"ControlsPanel"
-"CurrentTimeDisplay"
-"D"
-"DCMDictionaryServiceWindowShow"
-"DELEGATE METHODS"
-"DOCBASE"
-"DOMHTMLObjectElement"
-"DOMNode"
-"DYLD_FRAMEWORK_PATH"
-"DefaultDownloadDelegate"
-"DefaultPolicyDelegate"
-"DeleteBackward"
-"DeleteForward"
-"DeleteWordBackward"
-"DeleteWordForward"
-"DisableWebKitDeveloperExtras"
-"FAKETRACKPOINTHSCROLLBAR"
-"FAKETRACKPOINTVSCROLLBAR"
-"FD3B2381-0BB6-4B59-AF09-0E599C8901CF"
-"FastMallocCommittedVMBytes"
-"FastMallocFreeListBytes"
-"FastMallocReservedVMBytes"
-"FrameName"
-"FullscreenButton"
-"GCS_COMPATTR"
-"GEN_DOMObject"
-"GET"
-"GroupName"
-"HIDictionaryWindowShow"
-"HTTP "
-"Helvetica"
-"HideClosedCaptionsButton"
-"HostedNetscapePluginStream"
-"IDNScriptWhiteList"
-"IDNScriptWhiteList.txt"
-"IMM32.DLL"
-"IMN_CHANGECANDIDATE"
-"IMN_CLOSECANDIDATE"
-"IMN_CLOSESTATUSWINDOW"
-"IMN_GUIDELINE"
-"IMN_OPENCANDIDATE"
-"IMN_OPENSTATUSWINDOW"
-"IMN_SETCANDIDATEPOS"
-"IMN_SETCOMPOSITIONFONT"
-"IMN_SETCOMPOSITIONWINDOW"
-"IMN_SETCONVERSIONMODE"
-"IMN_SETOPENSTATUS"
-"IMN_SETSENTENCEMODE"
-"IMN_SETSTATUSWINDOWPOS"
-"IMR_CANDIDATEWINDOW"
-"IMR_COMPOSITIONFONT"
-"IMR_COMPOSITIONWINDOW"
-"IMR_CONFIRMRECONVERTSTRING"
-"IMR_DOCUMENTFEED"
-"IMR_QUERYCHARPOSITION"
-"IMR_RECONVERTSTRING"
-"If-Match"
-"If-Modified-Since"
-"If-None-Match"
-"If-Range"
-"If-Unmodified-Since"
-"ImmAssociateContextEx"
-"ImmGetCompositionStringW"
-"ImmGetContext"
-"ImmNotifyIME"
-"ImmReleaseContext"
-"ImmSetCandidateWindow"
-"ImmSetOpenStatus"
-"IncludeDebugMenu"
-"InsertBacktab"
-"InsertNewline"
-"InsertTab"
-"Intel"
-"JSDOMWindowShell"
-"JavaScript"
-"JavaScriptFreeSize"
-"JavaScriptHeapSize"
-"JavaScriptJITSize"
-"JavaScriptStackSize"
-"Joy!peff"
-"LTR"
-"Library/Caches"
-"Library/Internet Plug-Ins"
-"LresultFromObject"
-"MIME\\Database\\Content Type"
-"MailQuirksUserScript"
-"MainPageJavaScript.js"
-"MemoryStream"
-"MenuCommands"
-"Microsoft/com.microsoft.Messenger"
-"MoveDown"
-"MoveDownAndModifySelection"
-"MoveLeft"
-"MoveLeftAndModifySelection"
-"MovePageDown"
-"MovePageDownAndModifySelection"
-"MovePageUp"
-"MovePageUpAndModifySelection"
-"MoveRight"
-"MoveRightAndModifySelection"
-"MoveToBeginningOfDocument"
-"MoveToBeginningOfDocumentAndModifySelection"
-"MoveToBeginningOfLine"
-"MoveToBeginningOfLineAndModifySelection"
-"MoveToEndOfDocument"
-"MoveToEndOfDocumentAndModifySelection"
-"MoveToEndOfLine"
-"MoveToEndOfLineAndModifySelection"
-"MoveUp"
-"MoveUpAndModifySelection"
-"MoveWordLeft"
-"MoveWordLeftAndModifySelection"
-"MoveWordRight"
-"MoveWordRightAndModifySelection"
-"Mozilla/5.0 (Macintosh; "
-"Mozilla/5.0 ("
-"MuteButton"
-"NP_GetEntryPoints"
-"NP_Initialize"
-"NP_Shutdown"
-"NSAlert"
-"NSAllowContinuousSpellChecking"
-"NSAllowsBaseWritingDirectionKeyBindings"
-"NSApplicationIcon"
-"NSCarbonWindow"
-"NSErrorFailingURLKey"
-"NSErrorFailingURLStringKey"
-"NSEvent"
-"NSView"
-"NeXT smart paste pasteboard type"
-"NetscapePluginInstanceProxy"
-"PDFDocument"
-"PDFPreviewView"
-"PDFView"
-"PDFViewChangedPage"
-"PDFViewDisplayModeChanged"
-"PDFViewScaleChanged"
-"POST"
-"PPC"
-"PauseButton"
-"PlayButton"
-"ProxyRuntimeObject"
-"Quartz.framework"
-"RTL"
-"Referer"
-"ReturnToRealtimeButton"
-"RewindButton"
-"SAMILang"
-"SAMIStyle"
-"SCROLLBAR"
-"Safari.exe"
-"ScrollerRectangle"
-"SeekBackButton"
-"SeekForwardButton"
-"SelectAll"
-"ShowClosedCaptionsButton"
-"Slider"
-"SliderThumb"
-"Software\\Alps\\Apoint\\TrackPoint"
-"Software\\Lenovo\\TrackPoint"
-"Software\\Lenovo\\UltraNav"
-"Software\\Synaptics\\SynTPEnh\\UltraNavPS2"
-"Software\\Synaptics\\SynTPEnh\\UltraNavUSB"
-"StatusDisplay"
-"TSUpdateCheck"
-"TimeRemainingDisplay"
-"Times"
-"ToggleBold"
-"ToggleItalic"
-"U+0009"
-"U+001B"
-"UTF-8"
-"UnMuteButton"
-"UseBackForwardList"
-"User-Agent"
-"VideoElement"
-"Volumes"
-"W"
-"WEBKIT_UNSET_DYLD_FRAMEWORK_PATH"
-"WebActionButtonKey"
-"WebActionElementKey"
-"WebActionFormKey"
-"WebActionModifierFlagsKey"
-"WebActionNavigationTypeKey"
-"WebActionOriginalURLKey"
-"WebActionPropertyBag"
-"WebArchive"
-"WebAuthenticationPanel"
-"WebBackForwardList"
-"WebBackForwardList:\n"
-"WebCache"
-"WebCookieManager"
-"WebCoreStatistics"
-"WebDataRequest"
-"WebDataSource"
-"WebDatabaseDidModifyDatabaseNotification"
-"WebDatabaseDidModifyOriginNotification"
-"WebDatabaseDirectory"
-"WebDatabaseDisplayNameKey"
-"WebDatabaseExpectedSizeKey"
-"WebDatabaseIdentifierKey"
-"WebDatabaseManager"
-"WebDatabaseUsageKey"
-"WebDocumentLoader"
-"WebDownload"
-"WebDropSource"
-"WebElementDOMNode"
-"WebElementFrame"
-"WebElementImage"
-"WebElementImageAltString"
-"WebElementImageRect"
-"WebElementImageURL"
-"WebElementIsContentEditableKey"
-"WebElementIsInScrollBar"
-"WebElementIsSelected"
-"WebElementLinkIsLive"
-"WebElementLinkLabel"
-"WebElementLinkTitle"
-"WebElementLinkURL"
-"WebElementMediaURL"
-"WebElementPropertyBag"
-"WebElementSpellingToolTip"
-"WebElementTargetFrame"
-"WebElementTitle"
-"WebError"
-"WebFrame"
-"WebFrameCanSuspendActiveDOMObjectsKey"
-"WebFrameHasPluginsKey"
-"WebFrameHasUnloadListenerKey"
-"WebFrameMainDocumentErrorKey"
-"WebFramePolicyListener"
-"WebFrameUsesApplicationCacheKey"
-"WebFrameUsesDatabasesKey"
-"WebFrameUsesGeolocationKey"
-"WebGeolocationPolicyListener"
-"WebGeolocationPosition"
-"WebHTMLRepresentation"
-"WebHistory"
-"WebHistoryAllItemsRemovedNotification"
-"WebHistoryDates"
-"WebHistoryFileVersion"
-"WebHistoryItem"
-"WebHistoryItemChangedNotification"
-"WebHistoryItems"
-"WebHistoryItemsAddedNotification"
-"WebHistoryItemsDiscardedWhileLoadingNotification"
-"WebHistoryItemsRemovedNotification"
-"WebHistoryLoadedNotification"
-"WebHistorySavedNotification"
-"WebIconDatabase"
-"WebIconDatabaseDidAddIconNotification"
-"WebIconDatabaseDidRemoveAllIconsNotification"
-"WebIconDatabaseDirectoryDefaultsKey"
-"WebIconDatabaseEnabled"
-"WebIconDatabaseImportDirectoryDefaultsKey"
-"WebIconDatabaseVersion"
-"WebIconNotificationUserInfoURLKey"
-"WebInspector"
-"WebInspectorPointer"
-"WebInspectorPreferences"
-"WebInspectorWindowClass"
-"WebJavaScriptCollector"
-"WebJavaScriptTextInputPanel"
-"WebKitClassFactory"
-"WebKitDeveloperExtras"
-"WebKitErrorDomain"
-"WebKitErrorMIMETypeKey"
-"WebKitErrorPlugInNameKey"
-"WebKitErrorPlugInPageURLStringKey"
-"WebKitHistoryAgeInDaysLimit"
-"WebKitHistoryItemLimit"
-"WebKitInspectorHiddenPanels"
-"WebKitLocalCache"
-"WebKitLogLevel"
-"WebKitOmitPDFSupport"
-"WebKitOriginalBottomMargin"
-"WebKitOriginalTopMargin"
-"WebKitPDFs-XXXXXX"
-"WebKitPlugInStreamXXXXXX"
-"WebKitPluginHost.app"
-"WebKitPreferences.plist"
-"WebKitStatistics"
-"WebLoginWindowDidSwitchFromUserNotification"
-"WebLoginWindowDidSwitchToUserNotification"
-"WebMainResource"
-"WebModalDialogPretendWindow"
-"WebMutableURLRequest"
-"WebNavigationData"
-"WebNodeHighlightPointer"
-"WebNodeHighlightWindowClass"
-"WebNotification"
-"WebNotificationCenter"
-"WebPageCacheDataSourceKey"
-"WebPageCacheDocumentViewKey"
-"WebPageCacheEntryDateKey"
-"WebPlugInAttributesKey"
-"WebPlugInBaseURLKey"
-"WebPlugInContainerKey"
-"WebPlugInContainingElementKey"
-"WebPlugInModeKey"
-"WebPlugInShouldLoadMainResourceKey"
-"WebPluginAttributes"
-"WebPluginBaseURL"
-"WebPluginContainer"
-"WebPluginDescription"
-"WebPluginExtensions"
-"WebPluginLocalizationName"
-"WebPluginMIMETypes"
-"WebPluginMIMETypesFilename"
-"WebPluginName"
-"WebPluginTypeDescription"
-"WebPluginTypeEnabled"
-"WebPluginWillPresentNativeUserInterface"
-"WebPreferences"
-"WebPreferences%d"
-"WebPreferencesChangedNotification"
-"WebPreferencesRemovedNotification"
-"WebProgressEstimateChangedNotification"
-"WebProgressFinishedNotification"
-"WebProgressStartedNotification"
-"WebResource"
-"WebResourceData"
-"WebResourceFrameName"
-"WebResourceHandler"
-"WebResourceMIMEType"
-"WebResourceResponse"
-"WebResourceTextEncodingName"
-"WebResourceURL"
-"WebScriptErrorDescription"
-"WebScriptErrorDomain"
-"WebScriptErrorLineNumber"
-"WebScriptObject"
-"WebScriptWorld"
-"WebScrollBar"
-"WebSecurityOrigin"
-"WebSerializedJSValue"
-"WebSiteURLToIconURLKey"
-"WebSubframeArchives"
-"WebSubresources"
-"WebTextRenderer"
-"WebURLAuthenticationChallenge"
-"WebURLAuthenticationChallengeSender"
-"WebURLCredential"
-"WebURLProtectionSpace"
-"WebURLResponse"
-"WebURLsWithTitlesPboardType"
-"WebUserContentURLPattern"
-"WebView"
-"WebViewDidBeginEditingNotification"
-"WebViewDidChangeNotification"
-"WebViewDidChangeSelectionNotification"
-"WebViewDidChangeTypingStyleNotification"
-"WebViewDidEndEditingNotification"
-"WebViewWindowClass"
-"WebWorkersPrivate"
-"Windows "
-"Windows 95"
-"Windows 98"
-"Windows 98; Win 9x 4.90"
-"Windows NT "
-"WmvPlugin"
-"XSL"
-"XXXXXX-"
-"\"@?"
-"\"\\"
-"\0"
-"\0*.*\0\0"
-"\\"
-"\\StringFileInfo\\%04x%04x\\ProductVersion"
-"\\StringFileInfo\\040904b0\\ProductVersion"
-"\\VarFileInfo\\Translation"
-"\\WebKit.resources"
-"\n        "
-"\n    "
-"\n"
-"\n--------------------------------------------\n"
-"\r"
-"\xFF\xD8\xFF\xE0"
-"_WebViewDidStartAcceleratedCompositing"
-"_top"
-"a"
-"ab"
-"about:"
-"acceleratedCompositingEnabled"
-"actions"
-"anchorPoint"
-"apple-dashboard://stylesheet"
-"applewebdata"
-"applewebdata://%@"
-"application.pdf"
-"application/atom+xml"
-"application/octet-stream"
-"application/pdf"
-"application/postscript"
-"application/rss+xml"
-"application/x-apple-msg-attachment"
-"application/x-java-applet"
-"application/x-snkp"
-"application/x-webarchive"
-"application/xhtml+xml"
-"attributeKeys"
-"attributeValues"
-"b"
-"basefont"
-"bounds"
-"bundlePath"
-"c"
-"canGoBack"
-"canGoForward"
-"com.RealNetworks.RealOne Player"
-"com.adiumX.adiumX"
-"com.adobe.Acrobat"
-"com.adobe.Acrobat.Pro"
-"com.adobe.Contribute"
-"com.adobe.InCopy"
-"com.adobe.InDesign"
-"com.adobe.Installers.Setup"
-"com.adobe.Reader"
-"com.adobe.Soundbooth"
-"com.adobe.distiller"
-"com.adobe.dreamweaver-9.0"
-"com.alientechnology.Proteus"
-"com.app4mac.KidsBrowsercom.app4mac.wKiosk"
-"com.apple.Aperture"
-"com.apple.AppKit"
-"com.apple.Automator"
-"com.apple.Automator."
-"com.apple.AutomatorRunner"
-"com.apple.Dashcode"
-"com.apple.Dictionary"
-"com.apple.HIWebView"
-"com.apple.JavaAppletPlugin"
-"com.apple.JavaPluginCocoa"
-"com.apple.KeyboardUIModeDidChange"
-"com.apple.Mail"
-"com.apple.QuickTime Plugin.plugin"
-"com.apple.Safari"
-"com.apple.WebCore"
-"com.apple.WebKit"
-"com.apple.WebKit.PluginAgent"
-"com.apple.Xcode"
-"com.apple.dashboard.client"
-"com.apple.helpviewer"
-"com.apple.hiview"
-"com.apple.iChat"
-"com.apple.iWeb"
-"com.apple.installer"
-"com.apple.mail"
-"com.apple.quicktime.webplugin"
-"com.apple.universalaccess"
-"com.barebones.bbedit"
-"com.barebones.textwrangler"
-"com.barebones.yojimbo"
-"com.culturedcode.xyle"
-"com.e-frontier.shade10"
-"com.equinux.iSale4"
-"com.equinux.iSale5"
-"com.freeverse.bumpercar"
-"com.growl.growlframework"
-"com.intrarts.PandoraMan"
-"com.karelia.Sandvox"
-"com.lizardtech.NPDjVu"
-"com.macrabbit.CSSEdit"
-"com.macromates.textmate"
-"com.macromedia.Flash Player.plugin"
-"com.macromedia.fireworks"
-"com.microsoft.SilverlightPlugin"
-"com.microsoft.WMP.defaultplugin"
-"com.omnigroup.OmniWeb5"
-"com.panic.Coda"
-"com.ranchero.NetNewsWire"
-"com.realmacsoftware.rapidweaverpro"
-"com.red-sweater.marsedit"
-"com.sunrisebrowser.Sunrise"
-"com.thinkmac.NewsLife"
-"com.yahoo.messenger3"
-"composited for plug-in, video or WebGL"
-"composited: container layer"
-"composited: tiled layer"
-"contents"
-"contentsRect"
-"cp949"
-"cpuType"
-"de.codingmonkeys.SubEthaEdit"
-"dir"
-"displayTitle"
-"doctype"
-"estimatedProgress"
-"fi.karppinen.Pyro"
-"file:"
-"file:///System/Library/PrivateFrameworks/DashboardClient.framework/Resources/widget.css"
-"frameName"
-"fsVideoAudioVolumeHigh"
-"fsVideoAudioVolumeLow"
-"fsVideoExitFullscreen"
-"fsVideoPause"
-"fsVideoPlay"
-"ftp:"
-"fullFrame"
-"fullscreenVideeoHUDWindowClass"
-"groupName"
-"htm"
-"html"
-"http"
-"http:"
-"http://"
-"http://www.google.com/search?q="
-"https"
-"https:"
-"i"
-"icon.db"
-"image.pict"
-"image.png"
-"image.tiff"
-"image/jpeg"
-"image/pict"
-"image/png"
-"image/svg+xml"
-"image/tiff"
-"img"
-"info.colloquy"
-"insertText:"
-"isLoading"
-"isindex"
-"javascript:"
-"jpeg"
-"js"
-"kioskmode"
-"ks_c_5601-1987"
-"kungfoo.tv.ecto"
-"lastVisitWasFailure"
-"lastVisitWasHTTPNonGet"
-"lastVisitedDate"
-"line-through"
-"lineNumber"
-"localhost"
-"localized string not found"
-"localizedStrings"
-"mailto:"
-"mainFrameDocument"
-"mainFrameIcon"
-"mainFrameTitle"
-"mainFrameURL"
-"mimeType"
-"net.hmdt-web.Shiira"
-"normal flow list"
-"oleacc.dll"
-"opacity"
-"org.xlife.NewsFire"
-"pluginHostPath"
-"pluginspage"
-"position"
-"privateBrowsingEnabled"
-"public.url"
-"public.url-name"
-"r"
-"r+b"
-"rect:%@ clip:%@ type:%s"
-"redirectURLs"
-"rgb(%.0f,%.0f,%.0f)"
-"rgba(%.0f,%.0f,%.0f,%f)"
-"s"
-"sourceURL"
-"src"
-"sub"
-"sublayerTransform"
-"sublayers"
-"text/calendar"
-"text/directory"
-"text/html"
-"text/ldif"
-"text/pdf"
-"text/plain"
-"text/qif"
-"text/rtf"
-"text/vcalendar"
-"text/vcard"
-"text/x-calendar"
-"text/x-csv"
-"text/x-qif"
-"text/x-vcalendar"
-"text/x-vcard"
-"text/x-vcf"
-"transform"
-"txt"
-"u"
-"uk.co.opencommunity.vienna2"
-"userAgent"
-"userInfo"
-"utf-16"
-"visibleName"
-"visitCount"
-"webkit-fake-url"
-"webplugin"
-"x"
-"x-apple-web-kit/"
-"xml"
-"xsl"
-"{A3676398-4485-4a9d-87DC-CB5A40E6351D}"
-"~/Library/Icons"
-"~/Library/WebKit/Databases"
-WebKit/mac/History/WebHistoryItem.mm:" in \"%@\""
-WebKit/mac/History/WebHistoryItem.mm:"children"
-WebKit/mac/History/WebHistoryItem.mm:"title"
-WebKit/mac/Misc/WebCache.mm:"Images"
-WebKit/mac/Misc/WebKitLogging.h:"<not running on main thread>"
-WebKit/mac/Misc/WebKitVersionChecks.m:"WebKit"
-WebKit/mac/Misc/WebNSNotificationCenterExtras.m:"name"
-WebKit/mac/Misc/WebNSNotificationCenterExtras.m:"object"
-WebKit/mac/Misc/WebNSURLExtras.mm:"file"
-WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm:" OK\n"
-WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm:": "
-WebKit/mac/Plugins/Hosted/HostedNetscapePluginStream.mm:"identity"
-WebKit/mac/Plugins/Hosted/NetscapePluginHostManager.mm:"localization"
-WebKit/mac/Plugins/Hosted/ProxyInstance.mm
-WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"basic"
-WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"digest"
-WebKit/mac/Plugins/WebBaseNetscapePluginView.mm:"true"
-WebKit/mac/Plugins/WebBasePluginPackage.mm:"Java Applet Plugin Enabler"
-WebKit/mac/Plugins/WebNetscapePluginPackage.mm:"RealPlayer Plugin"
-WebKit/mac/Plugins/WebNetscapePluginPackage.mm:"main"
-WebKit/mac/Plugins/WebNetscapePluginStream.mm:" OK\n"
-WebKit/mac/Plugins/WebNetscapePluginStream.mm:": "
-WebKit/mac/Plugins/WebNetscapePluginStream.mm:"identity"
-WebKit/mac/Plugins/WebNetscapePluginView.mm:"height"
-WebKit/mac/Plugins/WebNetscapePluginView.mm:"width"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"dialog"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"fullscreen"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"height"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"menuBarVisible"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"message"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"resizable"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"scrollbarsVisible"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"statusBarVisible"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"toolBarVisible"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"width"
-WebKit/mac/WebCoreSupport/WebChromeClient.mm:"y"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"Down"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"Enter"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"Up"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"applet"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"body"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"center"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"font"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"head"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"menu"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"object"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"strike"
-WebKit/mac/WebCoreSupport/WebEditorClient.mm:"style"
-WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm:"height"
-WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm:"width"
-WebKit/mac/WebCoreSupport/WebInspectorClient.mm:"Menlo"
-WebKit/mac/WebCoreSupport/WebInspectorClient.mm:"Monaco"
-WebKit/mac/WebCoreSupport/WebInspectorClient.mm:"Web Inspector 2"
-WebKit/mac/WebCoreSupport/WebInspectorClient.mm:"inspector"
-WebKit/mac/WebView/WebDashboardRegion.mm:"Circle"
-WebKit/mac/WebView/WebDashboardRegion.mm:"None"
-WebKit/mac/WebView/WebDashboardRegion.mm:"Rectangle"
-WebKit/mac/WebView/WebDashboardRegion.mm:"Unknown"
-WebKit/mac/WebView/WebHTMLView.mm:"'%@'"
-WebKit/mac/WebView/WebHTMLView.mm:"Version:"
-WebKit/mac/WebView/WebHTMLView.mm:"applet"
-WebKit/mac/WebView/WebHTMLView.mm:"baseline"
-WebKit/mac/WebView/WebHTMLView.mm:"black"
-WebKit/mac/WebView/WebHTMLView.mm:"body"
-WebKit/mac/WebView/WebHTMLView.mm:"bold"
-WebKit/mac/WebView/WebHTMLView.mm:"center"
-WebKit/mac/WebView/WebHTMLView.mm:"direction"
-WebKit/mac/WebView/WebHTMLView.mm:"font"
-WebKit/mac/WebView/WebHTMLView.mm:"head"
-WebKit/mac/WebView/WebHTMLView.mm:"italic"
-WebKit/mac/WebView/WebHTMLView.mm:"menu"
-WebKit/mac/WebView/WebHTMLView.mm:"none"
-WebKit/mac/WebView/WebHTMLView.mm:"normal"
-WebKit/mac/WebView/WebHTMLView.mm:"object"
-WebKit/mac/WebView/WebHTMLView.mm:"print"
-WebKit/mac/WebView/WebHTMLView.mm:"screen"
-WebKit/mac/WebView/WebHTMLView.mm:"strike"
-WebKit/mac/WebView/WebHTMLView.mm:"style"
-WebKit/mac/WebView/WebHTMLView.mm:"super"
-WebKit/mac/WebView/WebHTMLView.mm:"transparent"
-WebKit/mac/WebView/WebHTMLView.mm:"underline"
-WebKit/mac/WebView/WebHTMLView.mm:"white"
-WebKit/mac/WebView/WebJSPDFDoc.mm
-WebKit/mac/WebView/WebPDFDocumentExtras.mm
-WebKit/mac/WebView/WebPreferenceKeysPrivate.h
-WebKit/mac/WebView/WebPreferences.mm:"Apple Chancery"
-WebKit/mac/WebView/WebPreferences.mm:"Courier"
-WebKit/mac/WebView/WebPreferences.mm:"ISO-8859-1"
-WebKit/mac/WebView/WebPreferences.mm:"Identifier"
-WebKit/mac/WebView/WebPreferences.mm:"Papyrus"
-WebKit/mac/WebView/WebPreferences.mm:"Values"
-WebKit/mac/WebView/WebRenderLayer.mm:"composited"
-WebKit/mac/WebView/WebVideoFullscreenController.mm:"WebKit playing a video fullscreen."
-WebKit/mac/WebView/WebVideoFullscreenHUDWindowController.mm:"maxValue"
-WebKit/mac/WebView/WebView.mm:"At least one WebView is still open."
-WebKit/mac/WebView/WebView.mm:"At least one WebView was closed with fast teardown."
-WebKit/mac/WebView/WebView.mm:"Preferences"
-WebKit/mac/WebView/WebView.mm:"Search With Google"
-WebKit/mac/WebView/WebView.mm:"control"
-WebKit/mac/WebView/WebView.mm:"data"
-WebKit/mac/WebView/WebView.mm:"decoder"
-WebKit/mac/WebView/WebView.mm:"frame"
-WebKit/mac/WebView/WebView.mm:"return "
-WebKit/win/AccessibleBase.cpp:"Alt+"
-WebKit/win/AccessibleBase.cpp:"Ctrl+"
-WebKit/win/AccessibleBase.cpp:"Shift+"
-WebKit/win/AccessibleBase.cpp:"Win+"
-WebKit/win/ProgIDMacros.h:"OpenSource"
-WebKit/win/ProgIDMacros.h:"WebKit."
-WebKit/win/WebCache.cpp:"images"
-WebKit/win/WebCache.cpp:"scripts"
-WebKit/win/WebCache.cpp:"style sheets"
-WebKit/win/WebCoreSupport/WebInspectorClient.cpp:"Courier New"
-WebKit/win/WebCoreSupport/WebInspectorClient.cpp:"Web Inspector "
-WebKit/win/WebCoreSupport/WebInspectorClient.cpp:"Web Inspector"
-WebKit/win/WebCoreSupport/WebInspectorClient.cpp:"inspector"
-WebKit/win/WebDatabaseManager.cpp:"Databases"
-WebKit/win/WebHistoryItem.cpp:"title"
-WebKit/win/WebKitDLL.cpp
-WebKit/win/WebPreferenceKeysPrivate.h
-WebKit/win/WebPreferences.cpp:"Arial"
-WebKit/win/WebPreferences.cpp:"Comic Sans MS"
-WebKit/win/WebPreferences.cpp:"Courier New"
-WebKit/win/WebPreferences.cpp:"Times New Roman"
-WebKit/win/WebURLResponse.cpp:"Extension"
-WebKit/win/WebView.cpp:")"
-WebKit/win/WebView.cpp:"Cancel"
-WebKit/win/WebView.cpp:"Copy"
-WebKit/win/WebView.cpp:"Cut"
-WebKit/win/WebView.cpp:"Delete"
-WebKit/win/WebView.cpp:"Paste"
-WebKit/win/WebView.cpp:"Redo"
-WebKit/win/WebView.cpp:"Undo"
-WebKit/win/WebView.cpp:"Unknown ("
-WebKit/win/WebView.cpp:"about"
diff --git a/Source/WebCore/UseJSC.cmake b/Source/WebCore/UseJSC.cmake
new file mode 100644
index 0000000..f6d9c90
--- /dev/null
+++ b/Source/WebCore/UseJSC.cmake
@@ -0,0 +1,203 @@
+LIST(APPEND WebCore_INCLUDE_DIRECTORIES
+    "${WEBCORE_DIR}/bindings/js"
+    "${WEBCORE_DIR}/bridge/jsc"
+)
+
+LIST(APPEND WebCore_IDL_INCLUDES
+    bindings/js
+)
+
+LIST(APPEND WebCore_SOURCES
+    bindings/js/DOMObjectHashTableMap.cpp
+    bindings/js/DOMWrapperWorld.cpp
+    bindings/js/GCController.cpp
+    bindings/js/IDBBindingUtilities.cpp
+    bindings/js/JSAttrCustom.cpp
+    bindings/js/JSArrayBufferCustom.cpp
+    bindings/js/JSDataViewCustom.cpp
+    bindings/js/JSCDATASectionCustom.cpp
+    bindings/js/JSCSSFontFaceRuleCustom.cpp
+    bindings/js/JSCSSImportRuleCustom.cpp
+    bindings/js/JSCSSMediaRuleCustom.cpp
+    bindings/js/JSCSSPageRuleCustom.cpp
+    bindings/js/JSCSSRuleCustom.cpp
+    bindings/js/JSCSSRuleListCustom.cpp
+    bindings/js/JSCSSStyleDeclarationCustom.cpp
+    bindings/js/JSCSSStyleRuleCustom.cpp
+    bindings/js/JSCSSValueCustom.cpp
+    bindings/js/JSCallbackData.cpp
+    bindings/js/JSCanvasRenderingContext2DCustom.cpp
+    bindings/js/JSCanvasRenderingContextCustom.cpp
+    bindings/js/JSClipboardCustom.cpp
+    bindings/js/JSConsoleCustom.cpp
+    bindings/js/JSCoordinatesCustom.cpp
+    bindings/js/JSCustomPositionCallback.cpp
+    bindings/js/JSCustomPositionErrorCallback.cpp
+    bindings/js/JSCustomSQLStatementErrorCallback.cpp
+    bindings/js/JSCustomVoidCallback.cpp
+    bindings/js/JSCustomXPathNSResolver.cpp
+    bindings/js/JSDOMApplicationCacheCustom.cpp
+    bindings/js/JSDOMBinding.cpp
+    bindings/js/JSDOMFormDataCustom.cpp
+    bindings/js/JSDOMGlobalObject.cpp
+    bindings/js/JSDOMImplementationCustom.cpp
+    bindings/js/JSDOMMimeTypeArrayCustom.cpp
+    bindings/js/JSDOMPluginArrayCustom.cpp
+    bindings/js/JSDOMPluginCustom.cpp
+    bindings/js/JSDOMStringMapCustom.cpp
+    bindings/js/JSDOMWindowBase.cpp
+    bindings/js/JSDOMWindowCustom.cpp
+    bindings/js/JSDOMWindowShell.cpp
+    bindings/js/JSDOMWrapper.cpp
+    bindings/js/JSDataGridColumnListCustom.cpp
+    bindings/js/JSDataGridDataSource.cpp
+    bindings/js/JSDedicatedWorkerContextCustom.cpp
+    bindings/js/JSDeviceMotionEventCustom.cpp
+    bindings/js/JSDeviceOrientationEventCustom.cpp
+    bindings/js/JSDocumentCustom.cpp
+    bindings/js/JSElementCustom.cpp
+    bindings/js/JSErrorHandler.cpp
+    bindings/js/JSEventCustom.cpp
+    bindings/js/JSEventListener.cpp
+    bindings/js/JSEventSourceCustom.cpp
+    bindings/js/JSEventTarget.cpp
+    bindings/js/JSExceptionBase.cpp
+    bindings/js/JSFileReaderCustom.cpp
+    bindings/js/JSFloat32ArrayCustom.cpp
+    bindings/js/JSGeolocationCustom.cpp
+    bindings/js/JSHTMLAllCollectionCustom.cpp
+    bindings/js/JSHTMLAppletElementCustom.cpp
+    bindings/js/JSHTMLCanvasElementCustom.cpp
+    bindings/js/JSHTMLCollectionCustom.cpp
+    bindings/js/JSHTMLDataGridElementCustom.cpp
+    bindings/js/JSHTMLDocumentCustom.cpp
+    bindings/js/JSHTMLElementCustom.cpp
+    bindings/js/JSHTMLEmbedElementCustom.cpp
+    bindings/js/JSHTMLFormElementCustom.cpp
+    bindings/js/JSHTMLFrameElementCustom.cpp
+    bindings/js/JSHTMLFrameSetElementCustom.cpp
+    bindings/js/JSHTMLInputElementCustom.cpp
+    bindings/js/JSHTMLLinkElementCustom.cpp
+    bindings/js/JSHTMLObjectElementCustom.cpp
+    bindings/js/JSHTMLOptionsCollectionCustom.cpp
+    bindings/js/JSHTMLOutputElementCustom.cpp
+    bindings/js/JSHTMLSelectElementCustom.cpp
+    bindings/js/JSHTMLStyleElementCustom.cpp
+    bindings/js/JSHistoryCustom.cpp
+    bindings/js/JSIDBAnyCustom.cpp
+    bindings/js/JSIDBKeyCustom.cpp
+    bindings/js/JSImageConstructor.cpp
+    bindings/js/JSImageDataCustom.cpp
+    bindings/js/JSInt16ArrayCustom.cpp
+    bindings/js/JSInt32ArrayCustom.cpp
+    bindings/js/JSInt8ArrayCustom.cpp
+    bindings/js/JSInjectedScriptHostCustom.cpp
+    bindings/js/JSInjectedScriptManager.cpp
+    bindings/js/JSInspectorFrontendHostCustom.cpp
+    bindings/js/JSJavaScriptCallFrameCustom.cpp
+    bindings/js/JSLazyEventListener.cpp
+    bindings/js/JSLocationCustom.cpp
+    bindings/js/JSMainThreadExecState.cpp
+    bindings/js/JSMemoryInfoCustom.cpp
+    bindings/js/JSMessageChannelCustom.cpp
+    bindings/js/JSMessageEventCustom.cpp
+    bindings/js/JSMessagePortCustom.cpp
+    bindings/js/JSNamedNodeMapCustom.cpp
+    bindings/js/JSNavigatorCustom.cpp
+    bindings/js/JSNodeCustom.cpp
+    bindings/js/JSNodeFilterCondition.cpp
+    bindings/js/JSNodeFilterCustom.cpp
+    bindings/js/JSNodeIteratorCustom.cpp
+    bindings/js/JSNodeListCustom.cpp
+    bindings/js/JSOptionConstructor.cpp
+    bindings/js/JSPluginElementFunctions.cpp
+    bindings/js/JSProcessingInstructionCustom.cpp
+    bindings/js/JSSQLResultSetRowListCustom.cpp
+    bindings/js/JSSQLTransactionCustom.cpp
+    bindings/js/JSSQLTransactionSyncCustom.cpp
+    bindings/js/JSScriptProfileNodeCustom.cpp
+    bindings/js/JSSharedWorkerCustom.cpp
+    bindings/js/JSStorageCustom.cpp
+    bindings/js/JSStyleSheetCustom.cpp
+    bindings/js/JSStyleSheetListCustom.cpp
+    bindings/js/JSTextCustom.cpp
+    bindings/js/JSTouchCustom.cpp
+    bindings/js/JSTouchListCustom.cpp
+    bindings/js/JSTreeWalkerCustom.cpp
+    bindings/js/JSUint16ArrayCustom.cpp 
+    bindings/js/JSUint32ArrayCustom.cpp
+    bindings/js/JSUint8ArrayCustom.cpp
+    bindings/js/JSWebKitAnimationCustom.cpp
+    bindings/js/JSWebKitAnimationListCustom.cpp
+    bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp
+    bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp
+    bindings/js/JSWebKitCSSMatrixCustom.cpp
+    bindings/js/JSWebKitPointCustom.cpp
+    bindings/js/JSWebSocketCustom.cpp
+    bindings/js/JSWorkerContextBase.cpp
+    bindings/js/JSWorkerContextCustom.cpp
+    bindings/js/JSWorkerCustom.cpp
+    bindings/js/JSXMLHttpRequestCustom.cpp
+    bindings/js/JSXMLHttpRequestUploadCustom.cpp
+    bindings/js/JSXSLTProcessorCustom.cpp
+    bindings/js/JavaScriptCallFrame.cpp
+    bindings/js/PageScriptDebugServer.cpp
+    bindings/js/ScheduledAction.cpp
+    bindings/js/ScriptCachedFrameData.cpp
+    bindings/js/ScriptCallStackFactory.cpp
+    bindings/js/ScriptController.cpp
+    bindings/js/ScriptDebugServer.cpp
+    bindings/js/ScriptEventListener.cpp
+    bindings/js/ScriptFunctionCall.cpp
+    bindings/js/ScriptGCEvent.cpp
+    bindings/js/ScriptObject.cpp
+    bindings/js/ScriptProfile.cpp
+    bindings/js/ScriptProfiler.cpp
+    bindings/js/ScriptState.cpp
+    bindings/js/ScriptValue.cpp
+    bindings/js/SerializedScriptValue.cpp
+    bindings/js/WorkerScriptController.cpp
+    bindings/js/WorkerScriptDebugServer.cpp
+
+    bridge/IdentifierRep.cpp
+    bridge/NP_jsobject.cpp
+    bridge/npruntime.cpp
+    bridge/runtime_array.cpp
+    bridge/runtime_method.cpp
+    bridge/runtime_object.cpp
+    bridge/runtime_root.cpp
+
+    bridge/c/CRuntimeObject.cpp
+    bridge/c/c_class.cpp
+    bridge/c/c_instance.cpp
+    bridge/c/c_runtime.cpp
+    bridge/c/c_utility.cpp
+
+    bridge/jsc/BridgeJSC.cpp
+)
+
+LIST(APPEND SCRIPTS_BINDINGS
+    ${WEBCORE_DIR}/bindings/scripts/CodeGenerator.pm
+)
+
+SET(IDL_INCLUDES "")
+FOREACH (_include ${WebCore_IDL_INCLUDES})
+    LIST(APPEND IDL_INCLUDES --include=${WEBCORE_DIR}/${_include})
+ENDFOREACH ()
+
+SET(FEATURE_DEFINES_JAVASCRIPT "LANGUAGE_JAVASCRIPT=1")
+FOREACH (_feature ${FEATURE_DEFINES})
+    SET(FEATURE_DEFINES_JAVASCRIPT "${FEATURE_DEFINES_JAVASCRIPT} ${_feature}")
+ENDFOREACH ()
+
+# Create JavaScript C++ code given an IDL input
+FOREACH (_file ${WebCore_IDL_FILES})
+    GET_FILENAME_COMPONENT (_name ${_file} NAME_WE)
+    ADD_CUSTOM_COMMAND(
+        OUTPUT  ${DERIVED_SOURCES_DIR}/JS${_name}.cpp ${DERIVED_SOURCES_DIR}/JS${_name}.h
+        MAIN_DEPENDENCY ${_file}
+        DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorJS.pm ${_file}
+        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator JS ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" ${WEBCORE_DIR}/${_file}
+        VERBATIM)
+    LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_DIR}/JS${_name}.cpp)
+ENDFOREACH ()
diff --git a/Source/WebCore/WebCore.exp.in b/Source/WebCore/WebCore.exp.in
index c287bb2..c3de299 100644
--- a/Source/WebCore/WebCore.exp.in
+++ b/Source/WebCore/WebCore.exp.in
@@ -105,7 +105,6 @@
 .objc_class_name_DOMTreeWalker
 .objc_class_name_DOMUIEvent
 .objc_class_name_DOMWheelEvent
-.objc_class_name_WebCoreKeyGenerator
 .objc_class_name_WebCoreViewFactory
 .objc_class_name_WebFontCache
 .objc_class_name_WebScriptObject
@@ -217,6 +216,7 @@ __ZN7WebCore11MemoryCache25removeResourcesWithOriginEPNS_14SecurityOriginE
 __ZN7WebCore11RenderLayer19scrollRectToVisibleERKNS_7IntRectEbRKNS_15ScrollAlignmentES6_
 __ZN7WebCore11globalPointERK8_NSPointP8NSWindow
 __ZN7WebCore11memoryCacheEv
+__ZN7WebCore11startOfWordERKNS_15VisiblePositionENS_9EWordSideE
 __ZN7WebCore11toUserSpaceERK7_NSRectP8NSWindow
 __ZN7WebCore11writeToFileEiPKci
 __ZN7WebCore12ChromeClient20paintCustomScrollbarEPNS_15GraphicsContextERKNS_9FloatRectENS_20ScrollbarControlSizeEjNS_13ScrollbarPartEbffj
@@ -246,10 +246,8 @@ __ZN7WebCore12GCController17garbageCollectNowEv
 __ZN7WebCore12GCController43garbageCollectOnAlternateThreadForDebuggingEb
 __ZN7WebCore12IconDatabase10setEnabledEb
 __ZN7WebCore12IconDatabase11defaultIconERKNS_7IntSizeE
-__ZN7WebCore12IconDatabase14iconForPageURLERKN3WTF6StringERKNS_7IntSizeE
 __ZN7WebCore12IconDatabase14removeAllIconsEv
 __ZN7WebCore12IconDatabase15iconRecordCountEv
-__ZN7WebCore12IconDatabase17iconURLForPageURLERKN3WTF6StringE
 __ZN7WebCore12IconDatabase19pageURLMappingCountEv
 __ZN7WebCore12IconDatabase20allowDatabaseCleanupEv
 __ZN7WebCore12IconDatabase20delayDatabaseCleanupEv   
@@ -262,9 +260,9 @@ __ZN7WebCore12IconDatabase23importIconURLForPageURLERKN3WTF6StringES4_
 __ZN7WebCore12IconDatabase24importIconDataForIconURLEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS1_6StringE
 __ZN7WebCore12IconDatabase25setPrivateBrowsingEnabledEb
 __ZN7WebCore12IconDatabase27checkIntegrityBeforeOpeningEv
-__ZN7WebCore12IconDatabase4openERKN3WTF6StringE
 __ZN7WebCore12IconDatabase5closeEv
 __ZN7WebCore12IconDatabase9setClientEPNS_18IconDatabaseClientE
+__ZN7WebCore12IconDatabaseC1Ev
 __ZN7WebCore12PopupMenuMacC1EPNS_15PopupMenuClientE
 __ZN7WebCore12PrintContext12pagePropertyEPNS_5FrameEPKci
 __ZN7WebCore12PrintContext13numberOfPagesEPNS_5FrameERKNS_9FloatSizeE
@@ -291,6 +289,7 @@ __ZN7WebCore12SharedBuffer12createNSDataEv
 __ZN7WebCore12SharedBuffer24createWithContentsOfFileERKN3WTF6StringE
 __ZN7WebCore12SharedBuffer6appendEPKcj
 __ZN7WebCore12SharedBufferC1EPKci
+__ZN7WebCore12SharedBufferC1EPKhi
 __ZN7WebCore12SharedBufferC1Ev
 __ZN7WebCore12SharedBufferD1Ev
 __ZN7WebCore12SpellChecker8didCheckEiRKN3WTF6VectorINS_19SpellCheckingResultELm0EEE
@@ -298,6 +297,7 @@ __ZN7WebCore12TextEncodingC1ERKN3WTF6StringE
 __ZN7WebCore12TextIterator11rangeLengthEPKNS_5RangeEb
 __ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_7ElementEiib
 __ZN7WebCore12TextIterator7advanceEv
+__ZN7WebCore12TextIterator8subrangeEPNS_5RangeEii
 __ZN7WebCore12TextIteratorC1EPKNS_5RangeENS_20TextIteratorBehaviorE
 __ZN7WebCore12TextIteratorD1Ev
 __ZN7WebCore12WorkerThread17workerThreadCountEv
@@ -319,12 +319,16 @@ __ZN7WebCore13IdentifierRep3getEPKc
 __ZN7WebCore13IdentifierRep3getEi
 __ZN7WebCore13JSHTMLElement6s_infoE
 __ZN7WebCore13KeyboardEventC1ERKN3WTF12AtomicStringEbbPNS_9DOMWindowERKNS1_6StringEjbbbbb
+__ZN7WebCore13ResourceErrorC1EP7NSError
+__ZN7WebCore13ResourceErrorC1EP9__CFError
 __ZN7WebCore13TypingCommand39insertParagraphSeparatorInQuotedContentEPNS_8DocumentE
 __ZN7WebCore13createWrapperEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_4NodeE
+__ZN7WebCore13directoryNameERKN3WTF6StringE
 __ZN7WebCore13toDeviceSpaceERKNS_9FloatRectEP8NSWindow
 __ZN7WebCore13toHTMLElementEPNS_21FormAssociatedElementE
 __ZN7WebCore13toJSDOMWindowEN3JSC7JSValueE
 __ZN7WebCore14CachedResource12removeClientEPNS_20CachedResourceClientE
+__ZN7WebCore14CachedResource16unregisterHandleEPNS_24CachedResourceHandleBaseE
 __ZN7WebCore14CachedResource9addClientEPNS_20CachedResourceClientE
 __ZN7WebCore14DocumentLoader10commitDataEPKci
 __ZN7WebCore14DocumentLoader13attachToFrameEv
@@ -350,6 +354,7 @@ __ZN7WebCore14SVGSMILElement13isSMILElementEPNS_4NodeE
 __ZN7WebCore14SchemeRegistry24registerURLSchemeAsLocalERKN3WTF6StringE
 __ZN7WebCore14SchemeRegistry25registerURLSchemeAsSecureERKN3WTF6StringE
 __ZN7WebCore14SchemeRegistry32registerURLSchemeAsEmptyDocumentERKN3WTF6StringE
+__ZN7WebCore14SchemeRegistry34shouldLoadURLSchemeAsEmptyDocumentERKN3WTF6StringE
 __ZN7WebCore14ScrollableArea17willEndLiveResizeEv
 __ZN7WebCore14ScrollableArea19willStartLiveResizeEv
 __ZN7WebCore14ScrollbarTheme11nativeThemeEv
@@ -364,7 +369,7 @@ __ZN7WebCore14SecurityOrigin32removeOriginAccessWhitelistEntryERKS0_RKN3WTF6Stri
 __ZN7WebCore14SecurityOrigin40setDomainRelaxationForbiddenForURLSchemeEbRKN3WTF6StringE
 __ZN7WebCore14SecurityOrigin6createERKN3WTF6StringES4_i
 __ZN7WebCore14SecurityOrigin6createERKNS_4KURLEi
-__ZN7WebCore14toInputElementEPNS_7ElementE
+__ZN7WebCore14endOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
 __ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS1_6StringESA_SA_RKNS_16ResourceResponseE
 __ZN7WebCore15DOMWrapperWorld13clearWrappersEv
 __ZN7WebCore15DOMWrapperWorldD1Ev
@@ -398,6 +403,7 @@ __ZN7WebCore15GraphicsContext7restoreEv
 __ZN7WebCore15GraphicsContext8fillPathERKNS_4PathE
 __ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectE
 __ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectERKNS_5ColorENS_10ColorSpaceE
+__ZN7WebCore15GraphicsContext9clearRectERKNS_9FloatRectE
 __ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageENS_10ColorSpaceERKNS_8IntPointENS_17CompositeOperatorE
 __ZN7WebCore15GraphicsContext9setShadowERKNS_9FloatSizeEfRKNS_5ColorENS_10ColorSpaceE
 __ZN7WebCore15GraphicsContext9translateEff
@@ -414,6 +420,7 @@ __ZN7WebCore15StringTruncator5widthERKN3WTF6StringERKNS_4FontE
 __ZN7WebCore15VisiblePositionC1ERKNS_8PositionENS_9EAffinityE
 __ZN7WebCore15defaultLanguageEv
 __ZN7WebCore15localizedStringEPKc
+__ZN7WebCore15pathGetFileNameERKN3WTF6StringE
 __ZN7WebCore15reportExceptionEPN3JSC9ExecStateENS0_7JSValueE
 __ZN7WebCore15visitedLinkHashEPKtj
 __ZN7WebCore16AbstractDatabase14setIsAvailableEb
@@ -421,9 +428,11 @@ __ZN7WebCore16DeviceMotionData12Acceleration6createEbdbdbd
 __ZN7WebCore16DeviceMotionData12RotationRate6createEbdbdbd
 __ZN7WebCore16DeviceMotionData6createEN3WTF10PassRefPtrINS0_12AccelerationEEES4_NS2_INS0_12RotationRateEEEbd
 __ZN7WebCore16FontFallbackList15releaseFontDataEv
-__ZN7WebCore16FontPlatformDataC1EP6NSFontfbbNS_15FontOrientationENS_16FontWidthVariantE
+__ZN7WebCore16FontPlatformDataC1EP6NSFontfbbNS_15FontOrientationENS_15TextOrientationENS_16FontWidthVariantE
 __ZN7WebCore16FontPlatformDataD1Ev
 __ZN7WebCore16HTMLInputElement13setAutofilledEb
+__ZN7WebCore16IconDatabaseBase28synchronousIconURLForPageURLERKN3WTF6StringE
+__ZN7WebCore16IconDatabaseBase4openERKN3WTF6StringES4_
 __ZN7WebCore16LegacyWebArchive19createFromSelectionEPNS_5FrameE
 __ZN7WebCore16LegacyWebArchive21rawDataRepresentationEv
 __ZN7WebCore16LegacyWebArchive6createEN3WTF10PassRefPtrINS_15ArchiveResourceEEERNS1_6VectorIS4_Lm0EEERNS5_INS2_IS0_EELm0EEE
@@ -434,7 +443,9 @@ __ZN7WebCore16LegacyWebArchive6createEPNS_5RangeE
 __ZN7WebCore16LegacyWebArchive6createEv
 __ZN7WebCore16MIMETypeRegistry23getMIMETypeForExtensionERKN3WTF6StringE
 __ZN7WebCore16MIMETypeRegistry24isSupportedImageMIMETypeERKN3WTF6StringE
+__ZN7WebCore16MIMETypeRegistry25isUnsupportedTextMIMETypeERKN3WTF6StringE
 __ZN7WebCore16MIMETypeRegistry26getSupportedImageMIMETypesEv
+__ZN7WebCore16MIMETypeRegistry27getUnsupportedTextMIMETypesEv
 __ZN7WebCore16MIMETypeRegistry27isSupportedNonImageMIMETypeERKN3WTF6StringE
 __ZN7WebCore16MIMETypeRegistry29getSupportedNonImageMIMETypesEv
 __ZN7WebCore16MIMETypeRegistry32isSupportedImageResourceMIMETypeERKN3WTF6StringE
@@ -461,6 +472,7 @@ __ZN7WebCore16deleteAllCookiesEv
 __ZN7WebCore16enclosingIntRectERK7_NSRect
 __ZN7WebCore16enclosingIntRectERKNS_9FloatRectE
 __ZN7WebCore16isEndOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
+__ZN7WebCore16startOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
 __ZN7WebCore17CredentialStorage3getERKNS_15ProtectionSpaceE
 __ZN7WebCore17DOMImplementation13isXMLMIMETypeERKN3WTF6StringE
 __ZN7WebCore17DOMImplementation14isTextMIMETypeERKN3WTF6StringE
@@ -468,7 +480,8 @@ __ZN7WebCore17DeviceOrientation6createEbdbdbd
 __ZN7WebCore17GlyphPageTreeNode18treeGlyphPageCountEv
 __ZN7WebCore17HistoryController26saveDocumentAndScrollStateEv
 __ZN7WebCore17nameForCursorTypeENS_6Cursor4TypeE
-__ZN7WebCore17openTemporaryFileEPKcRi
+__ZN7WebCore17openTemporaryFileERKN3WTF6StringERi
+__ZN7WebCore18PlatformStrategies26createLocalizationStrategyEv
 __ZN7WebCore18SearchPopupMenuMacC1EPNS_15PopupMenuClientE
 __ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
 __ZN7WebCore18pluginScriptObjectEPN3JSC9ExecStateEPNS_13JSHTMLElementE
@@ -541,6 +554,7 @@ __ZN7WebCore21mainThreadNormalWorldEv
 __ZN7WebCore21markerTextForListItemEPNS_7ElementE
 __ZN7WebCore21reportThreadViolationEPKcNS_20ThreadViolationRoundE
 __ZN7WebCore21resourceLoadSchedulerEv
+__ZN7WebCore21setGlobalIconDatabaseEPNS_16IconDatabaseBaseE
 __ZN7WebCore21setPlatformStrategiesEPNS_18PlatformStrategiesE
 __ZN7WebCore22ScriptExecutionContext26canSuspendActiveDOMObjectsEv
 __ZN7WebCore22applicationIsAppleMailEv
@@ -554,6 +568,7 @@ __ZN7WebCore23createFragmentFromNodesEPNS_8DocumentERKN3WTF6VectorIPNS_4NodeELm0
 __ZN7WebCore23getHostnamesWithCookiesERN3WTF7HashSetINS0_6StringENS0_10StringHashENS0_10HashTraitsIS2_EEEE
 __ZN7WebCore23overrideDefaultLanguageERKN3WTF6StringE
 __ZN7WebCore24BinaryPropertyListWriter17writePropertyListEv
+__ZN7WebCore24CachedResourceHandleBase11setResourceEPNS_14CachedResourceE
 __ZN7WebCore24DocumentMarkerController13removeMarkersEj
 __ZN7WebCore24DocumentMarkerController14markersForNodeEPNS_4NodeE
 __ZN7WebCore24DocumentMarkerController14markersForNodeEPNS_4NodeE
@@ -642,7 +657,6 @@ __ZN7WebCore4FontaSERKS0_
 __ZN7WebCore4Icon18createIconForFilesERKN3WTF6VectorINS1_6StringELm0EEE
 __ZN7WebCore4IconD1Ev
 __ZN7WebCore4KURL10invalidateEv
-__ZN7WebCore4KURLC1ENS_18ParsedURLStringTagEPKc
 __ZN7WebCore4KURLC1ENS_18ParsedURLStringTagERKN3WTF6StringE
 __ZN7WebCore4KURLC1EP5NSURL
 __ZN7WebCore4KURLC1EPK7__CFURL
@@ -684,6 +698,7 @@ __ZN7WebCore4Path14addRoundedRectERKNS_9FloatRectERKNS_9FloatSizeE
 __ZN7WebCore4PathC1Ev
 __ZN7WebCore4PathD1Ev
 __ZN7WebCore4coreEP20NSURLProtectionSpace
+__ZN7WebCore4coreEP28NSURLAuthenticationChallenge
 __ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_19CSSStyleDeclarationE
 __ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_5RangeE
 __ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectEPNS_8NodeListE
@@ -743,6 +758,7 @@ __ZN7WebCore6Editor26decreaseSelectionListLevelEv
 __ZN7WebCore6Editor26increaseSelectionListLevelEv
 __ZN7WebCore6Editor26writeSelectionToPasteboardERKN3WTF6StringERKNS1_6VectorIS2_Lm0EEE
 __ZN7WebCore6Editor27handleCorrectionPanelResultERKN3WTF6StringE
+__ZN7WebCore6Editor27readSelectionFromPasteboardERKN3WTF6StringE
 __ZN7WebCore6Editor29canDecreaseSelectionListLevelEv
 __ZN7WebCore6Editor29canIncreaseSelectionListLevelEv
 __ZN7WebCore6Editor30applyParagraphStyleToSelectionEPNS_19CSSStyleDeclarationENS_10EditActionE
@@ -787,7 +803,6 @@ __ZN7WebCore7cookiesEPKNS_8DocumentERKNS_4KURLE
 __ZN7WebCore7nsColorERKNS_5ColorE
 __ZN7WebCore8Document11createRangeEv
 __ZN7WebCore8Document12updateLayoutEv
-__ZN7WebCore8Document13setDesignModeENS0_13InheritedBoolE
 __ZN7WebCore8Document13svgExtensionsEv
 __ZN7WebCore8Document14setFocusedNodeEN3WTF10PassRefPtrINS_4NodeEEE
 __ZN7WebCore8Document16isPageBoxVisibleEi
@@ -864,6 +879,7 @@ __ZN7WebCore8Settings29setAuthorAndUserStylesEnabledEb
 __ZN7WebCore8Settings29setDefaultMinDOMTimerIntervalEd
 __ZN7WebCore8Settings29setWebArchiveDebugModeEnabledEb
 __ZN7WebCore8Settings30setAllowFileAccessFromFileURLsEb
+__ZN7WebCore8Settings31setCanvasUsesAcceleratedDrawingEb
 __ZN7WebCore8Settings31setJavaScriptCanAccessClipboardEb
 __ZN7WebCore8Settings31setShrinksStandaloneImagesToFitEb
 __ZN7WebCore8Settings32setAcceleratedCompositingEnabledEb
@@ -959,6 +975,7 @@ __ZN7WebCore9PageGroup13isLinkVisitedEy
 __ZN7WebCore9PageGroup14addVisitedLinkEPKtm
 __ZN7WebCore9PageGroup17closeLocalStorageEv
 __ZN7WebCore9PageGroup18addVisitedLinkHashEy
+__ZN7WebCore9PageGroup18numberOfPageGroupsEv
 __ZN7WebCore9PageGroup20addUserScriptToWorldEPNS_15DOMWrapperWorldERKN3WTF6StringERKNS_4KURLENS3_10PassOwnPtrINS3_6VectorIS4_Lm0EEEEESD_NS_23UserScriptInjectionTimeENS_25UserContentInjectedFramesE
 __ZN7WebCore9PageGroup20removeAllUserContentEv
 __ZN7WebCore9PageGroup21removeAllVisitedLinksEv
@@ -975,6 +992,7 @@ __ZN7WebCore9TimerBase5startEdd
 __ZN7WebCore9TimerBaseC2Ev
 __ZN7WebCore9TimerBaseD2Ev
 __ZN7WebCore9closeFileERi
+__ZN7WebCore9endOfWordERKNS_15VisiblePositionENS_9EWordSideE
 __ZN7WebCore9fontCacheEv
 __ZN7WebCore9makeRangeERKNS_15VisiblePositionES2_
 __ZN7WebCore9pageCacheEv
@@ -1027,7 +1045,6 @@ __ZNK7WebCore11HistoryItem20getTransientPropertyERKN3WTF6StringE
 __ZNK7WebCore11HistoryItem21encodeBackForwardTreeERN3WTF7EncoderE
 __ZNK7WebCore11HistoryItem3urlEv
 __ZNK7WebCore11HistoryItem4copyEv
-__ZNK7WebCore11HistoryItem4iconEv
 __ZNK7WebCore11HistoryItem5titleEv
 __ZNK7WebCore11HistoryItem6targetEv
 __ZNK7WebCore11HistoryItem8childrenEv
@@ -1042,7 +1059,7 @@ __ZNK7WebCore12IconDatabase12databasePathEv
 __ZNK7WebCore12IconDatabase24shouldStopThreadActivityEv
 __ZNK7WebCore12IconDatabase9isEnabledEv
 __ZNK7WebCore12RenderObject14enclosingLayerEv
-__ZNK7WebCore12RenderObject15localToAbsoluteENS_10FloatPointEbb
+__ZNK7WebCore12RenderObject15localToAbsoluteERKNS_10FloatPointEbb
 __ZNK7WebCore12RenderObject4viewEv
 __ZNK7WebCore12RenderObject7childAtEj
 __ZNK7WebCore12RenderWidget14windowClipRectEv
@@ -1070,6 +1087,8 @@ __ZNK7WebCore13HitTestResult18titleDisplayStringEv
 __ZNK7WebCore13HitTestResult5imageEv
 __ZNK7WebCore13HitTestResult5titleERNS_13TextDirectionE
 __ZNK7WebCore13HitTestResult9imageRectEv
+__ZNK7WebCore13ResourceError7cfErrorEv
+__ZNK7WebCore13ResourceError7nsErrorEv
 __ZNK7WebCore13ResourceErrorcvP7NSErrorEv
 __ZNK7WebCore14DocumentLoader10requestURLEv
 __ZNK7WebCore14DocumentLoader11frameLoaderEv
@@ -1106,18 +1125,21 @@ __ZNK7WebCore15ResourceRequest12nsURLRequestEv
 __ZNK7WebCore15VisiblePosition14characterAfterEv
 __ZNK7WebCore15VisiblePosition14localCaretRectERPNS_12RenderObjectE
 __ZNK7WebCore15VisiblePosition19absoluteCaretBoundsEv
-__ZNK7WebCore15VisiblePosition4nextEb
-__ZNK7WebCore15VisiblePosition8previousEb
+__ZNK7WebCore15VisiblePosition4nextENS_27EditingBoundaryCrossingRuleE
+__ZNK7WebCore15VisiblePosition8previousENS_27EditingBoundaryCrossingRuleE
 __ZNK7WebCore16FontFallbackList10fontDataAtEPKNS_4FontEj
 __ZNK7WebCore16HTMLInputElement12autoCompleteEv
+__ZNK7WebCore16HTMLInputElement21lastChangeWasUserEditEv
+__ZNK7WebCore16IconDatabaseBase12databasePathEv
 __ZNK7WebCore16ResourceResponse13nsURLResponseEv
 __ZNK7WebCore16VisibleSelection17isContentEditableEv
 __ZNK7WebCore16VisibleSelection17toNormalizedRangeEv
 __ZNK7WebCore16VisibleSelection19rootEditableElementEv
 __ZNK7WebCore16VisibleSelection23isContentRichlyEditableEv
-__ZNK7WebCore16VisibleSelection5isAllENS_21StayInEditableContentE
+__ZNK7WebCore16VisibleSelection5isAllENS_27EditingBoundaryCrossingRuleE
 __ZNK7WebCore17ResourceErrorBase8lazyInitEv
 __ZNK7WebCore19AnimationController24numberOfActiveAnimationsEv
+__ZNK7WebCore19HTMLTextAreaElement21lastChangeWasUserEditEv
 __ZNK7WebCore19ResourceRequestBase10httpMethodEv
 __ZNK7WebCore19ResourceRequestBase15httpHeaderFieldEPKc
 __ZNK7WebCore19ResourceRequestBase3urlEv
@@ -1175,7 +1197,7 @@ __ZNK7WebCore5Color7getRGBAERdS1_S1_S1_
 __ZNK7WebCore5Frame13ownerRendererEv
 __ZNK7WebCore5Frame14selectionImageEb
 __ZNK7WebCore5Frame15contentRendererEv
-__ZNK7WebCore5Frame15layerTreeAsTextEv
+__ZNK7WebCore5Frame15layerTreeAsTextEb
 __ZNK7WebCore5Frame18documentTypeStringEv
 __ZNK7WebCore5Frame8settingsEv
 __ZNK7WebCore5Frame9domWindowEv
@@ -1198,9 +1220,9 @@ __ZNK7WebCore6Editor17firstRectForRangeEPNS_5RangeE
 __ZNK7WebCore6Editor17selectionHasStyleEiRKN3WTF6StringE
 __ZNK7WebCore6Editor17shouldDeleteRangeEPNS_5RangeE
 __ZNK7WebCore6Editor23getCompositionSelectionERjS1_
+__ZNK7WebCore6Editor26selectionStartHasMarkerForENS_14DocumentMarker10MarkerTypeEii
 __ZNK7WebCore6Editor30applyEditingStyleToBodyElementEv
 __ZNK7WebCore6Editor31fontAttributesForSelectionStartEv
-__ZNK7WebCore6Editor34selectionStartHasSpellingMarkerForEii
 __ZNK7WebCore6Editor37baseWritingDirectionForSelectionStartEv
 __ZNK7WebCore6Editor6canCutEv
 __ZNK7WebCore6Editor7Command11isSupportedEv
@@ -1232,7 +1254,6 @@ __ZNK7WebCore7IntRectcv7_NSRectEv
 __ZNK7WebCore7IntSizecv7_NSSizeEv
 __ZNK7WebCore8Document10renderViewEv
 __ZNK7WebCore8Document11completeURLERKN3WTF6StringE
-__ZNK7WebCore8Document12inDesignModeEv
 __ZNK7WebCore8Document13axObjectCacheEv
 __ZNK7WebCore8Document13nodesFromRectEiijjjjb
 __ZNK7WebCore8Document14getElementByIdERKN3WTF12AtomicStringE
@@ -1266,8 +1287,10 @@ __ZNK7WebCore9FrameView28isEnclosedInCompositingLayerEv
 __ZNK7WebCore9PageCache10frameCountEv
 __ZNK7WebCore9PageCache21autoreleasedPageCountEv
 __ZTVN7WebCore12ChromeClientE
+__ZTVN7WebCore16IconDatabaseBaseE
 __ZTVN7WebCore17FileChooserClientE
 __ZTVN7WebCore17FrameLoaderClientE
+__ZTVN7WebCore18PlatformStrategiesE
 __ZTVN7WebCore25HistoryPropertyListWriterE
 __ZTVN7WebCore28InspectorFrontendClientLocal8SettingsE
 _filenameByFixingIllegalCharacters
@@ -1279,13 +1302,18 @@ _suggestedFilenameWithMIMEType
 _wkAdvanceDefaultButtonPulseAnimation
 _wkCGContextGetShouldSmoothFonts
 _wkCopyCFLocalizationPreferredName
+_wkCopyCFURLResponseSuggestedFilename
 _wkCopyCONNECTProxyResponse
+_wkCopyHTTPCookieStorage
 _wkCopyNSURLResponseStatusLine
+_wkCopyRequestWithStorageSession
 _wkCreateCTLineWithUniCharProvider
 _wkCreateCustomCFReadStream
 _wkCreateNSURLConnectionDelegateProxy
+_wkCreatePrivateStorageSession
 _wkCreateURLNPasteboardFlavorTypeName
 _wkCreateURLPasteboardFlavorTypeName
+_wkDeleteHTTPCookie
 _wkDrawBezeledTextArea
 _wkDrawBezeledTextFieldCell
 _wkDrawCapsLockIndicator
@@ -1293,11 +1321,15 @@ _wkDrawFocusRing
 _wkDrawMediaSliderTrack
 _wkDrawMediaUIPart
 _wkDrawTextFieldCellFocusRing
+_wkGetCFURLResponseHTTPResponse
+_wkGetCFURLResponseMIMEType
+_wkGetCFURLResponseURL
 _wkGetExtensionsForMIMEType
 _wkGetFontInLanguageForCharacter
 _wkGetFontInLanguageForRange
 _wkGetGlyphTransformedAdvances
 _wkGetGlyphsForCharacters
+_wkGetHTTPCookieAcceptPolicy
 _wkGetHTTPPipeliningPriority
 _wkGetHyphenationLocationBeforeIndex
 _wkGetMIMETypeForExtension
@@ -1307,6 +1339,7 @@ _wkGetNSURLResponseMustRevalidate
 _wkGetPreferredExtensionForMIMEType
 _wkGetUserToBaseCTM
 _wkGetWheelEventDeltas
+_wkHTTPCookiesForURL
 _wkHitTestMediaUIPart
 _wkInitializeMaximumHTTPConnectionCountPerHost
 _wkIsLatchingWheelEvent
@@ -1324,11 +1357,13 @@ _wkQTMovieMaxTimeSeekable
 _wkQTMovieSelectPreferredAlternates
 _wkQTMovieSetShowClosedCaptions
 _wkQTMovieViewSetDrawSynchronously
+_wkSetCFURLResponseMIMEType
 _wkSetCGFontRenderingMode
 _wkSetCONNECTProxyAuthorizationForStream
 _wkSetCONNECTProxyForStream
 _wkSetCookieStoragePrivateBrowsingEnabled
 _wkSetDragImage
+_wkSetHTTPCookiesForURL
 _wkSetHTTPPipeliningPriority
 _wkSetNSURLConnectionDefersCallbacks
 _wkSetNSURLRequestShouldContentSniff
@@ -1338,13 +1373,18 @@ _wkSetUpFontCache
 _wkSignalCFReadStreamEnd
 _wkSignalCFReadStreamError
 _wkSignalCFReadStreamHasBytes
-_wkCreatePrivateStorageSession
-_wkCopyRequestWithStorageSession
-_wkCreatePrivateInMemoryHTTPCookieStorage
-_wkGetHTTPCookieAcceptPolicy
-_wkHTTPCookiesForURL
-_wkSetHTTPCookiesForURL
-_wkDeleteHTTPCookie
+_wkSignedPublicKeyAndChallengeString
+
+#if ENABLE(DOM_STORAGE)
+__ZN7WebCore14StorageTracker17initializeTrackerERKN3WTF6StringE
+__ZN7WebCore14StorageTracker16deleteAllOriginsEv
+__ZN7WebCore14StorageTracker12deleteOriginEPNS_14SecurityOriginE
+__ZN7WebCore14StorageTracker7trackerEv
+__ZN7WebCore14StorageTracker7originsERN3WTF6VectorINS1_6RefPtrINS_14SecurityOriginEEELm0EEE
+__ZN7WebCore14StorageTracker9setClientEPNS_20StorageTrackerClientE
+__ZN7WebCore14StorageTracker16syncLocalStorageEv
+__ZN7WebCore14StorageTracker32syncFileSystemAndTrackerDatabaseEv
+#endif
 
 #if !defined(NDEBUG)
 __ZN7WebCore20LogNotYetImplementedE
@@ -1371,6 +1411,7 @@ _wkScrollbarMinimumTotalLengthNeededForThumb
 _wkScrollbarPainterIsHorizontal
 _wkScrollbarPainterKnobAlpha
 _wkScrollbarPainterPaint
+_wkScrollbarPainterForceFlashScrollers
 _wkScrollbarPainterSetDelegate
 _wkScrollbarPainterSetOverlayState
 _wkScrollbarPainterTrackAlpha
@@ -1731,6 +1772,9 @@ __ZN7WebCore16HTMLMediaElement12endScrubbingEv
 __ZN7WebCore16HTMLMediaElement14beginScrubbingEv
 __ZN7WebCore16HTMLMediaElement14exitFullscreenEv
 __ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
+__ZN7WebCore16HTMLMediaElement15clearMediaCacheEv
+__ZN7WebCore16HTMLMediaElement20getSitesInMediaCacheERN3WTF6VectorINS1_6StringELm0EEE
+__ZN7WebCore16HTMLMediaElement22clearMediaCacheForSiteERKN3WTF6StringE
 __ZN7WebCore16HTMLMediaElement4playEb
 __ZN7WebCore16HTMLMediaElement5pauseEb
 __ZN7WebCore16HTMLMediaElement6rewindEf
@@ -1768,6 +1812,7 @@ __ZNK7WebCore4Node16traverseNextNodeEPKS0_
 #endif
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
+__ZN7WebCore16ApplicationCache20deleteCacheForOriginEPNS_14SecurityOriginE
 __ZN7WebCore23ApplicationCacheStorage14quotaForOriginEPKNS_14SecurityOriginERx
 __ZN7WebCore23ApplicationCacheStorage14setMaximumSizeEx
 __ZN7WebCore23ApplicationCacheStorage14usageForOriginEPKNS_14SecurityOriginERx
@@ -1777,7 +1822,6 @@ __ZN7WebCore23ApplicationCacheStorage17setCacheDirectoryERKN3WTF6StringE
 __ZN7WebCore23ApplicationCacheStorage18vacuumDatabaseFileEv
 __ZN7WebCore23ApplicationCacheStorage19getOriginsWithCacheERN3WTF7HashSetINS1_6RefPtrINS_14SecurityOriginEEENS_18SecurityOriginHashENS1_10HashTraitsIS5_EEEE
 __ZN7WebCore23ApplicationCacheStorage21setDefaultOriginQuotaEx
-__ZN7WebCore23ApplicationCacheStorage22deleteEntriesForOriginEPNS_14SecurityOriginE
 __ZN7WebCore23ApplicationCacheStorage26storeUpdatedQuotaForOriginEPKNS_14SecurityOriginEx
 __ZN7WebCore23ApplicationCacheStorage36remainingSizeForOriginExcludingCacheEPKNS_14SecurityOriginEPNS_16ApplicationCacheERx
 __ZN7WebCore23ApplicationCacheStorage5emptyEv
diff --git a/Source/WebCore/WebCore.gyp/WebCore.gyp b/Source/WebCore/WebCore.gyp/WebCore.gyp
index bf570ff..e692f54 100644
--- a/Source/WebCore/WebCore.gyp/WebCore.gyp
+++ b/Source/WebCore/WebCore.gyp/WebCore.gyp
@@ -305,8 +305,39 @@
   },
   'targets': [
     {
+      'target_name': 'inspector_idl',
+      'type': 'none',
+      'actions': [
+        {
+          'action_name': 'generateInspectorProtocolIDL',
+          'inputs': [
+            '../inspector/generate-inspector-idl',
+            '../inspector/Inspector.json',
+          ],
+          'outputs': [
+            '<(SHARED_INTERMEDIATE_DIR)/webcore/Inspector.idl',
+          ],
+          'variables': {
+            'generator_include_dirs': [
+            ],
+          },
+          'action': [
+            'python',
+            '../inspector/generate-inspector-idl',
+            '-o',
+            '<@(_outputs)',
+            '<@(_inputs)'
+          ],
+          'message': 'Generating Inspector protocol sources from Inspector.idl',
+        },
+      ]
+    },
+    {
       'target_name': 'inspector_protocol_sources',
       'type': 'none',
+      'dependencies': [
+        'inspector_idl'
+      ],
       'actions': [
         {
           'action_name': 'generateInspectorProtocolSources',
@@ -319,7 +350,7 @@
             '../bindings/scripts/CodeGenerator.pm',
             '../bindings/scripts/IDLParser.pm',
             '../bindings/scripts/IDLStructure.pm',
-            '../inspector/Inspector.idl',
+            '<(SHARED_INTERMEDIATE_DIR)/webcore/Inspector.idl',
           ],
           'outputs': [
             '<(SHARED_INTERMEDIATE_DIR)/webcore/InspectorBackendDispatcher.cpp',
@@ -335,7 +366,7 @@
           'action': [
             'python',
             'scripts/rule_binding.py',
-            '../inspector/Inspector.idl',
+            '<(SHARED_INTERMEDIATE_DIR)/webcore/Inspector.idl',
             '<(SHARED_INTERMEDIATE_DIR)/webcore',
             '<(SHARED_INTERMEDIATE_DIR)/webkit',
             '--',
@@ -365,14 +396,37 @@
             'perl',
             '../inspector/xxd.pl',
             'InjectedScriptSource_js',
-            '../inspector/InjectedScriptSource.js',
-            '<(SHARED_INTERMEDIATE_DIR)/webkit/InjectedScriptSource.h'
+            '<@(_inputs)',
+            '<@(_outputs)'
           ],
           'message': 'Generating InjectedScriptSource.h from InjectedScriptSource.js',
         },
       ]
     },
     {
+      'target_name': 'debugger_script_source',
+      'type': 'none',
+      'actions': [
+        {
+          'action_name': 'generateDebuggerScriptSource',
+          'inputs': [
+            '../bindings/v8/DebuggerScript.js',
+          ],
+          'outputs': [
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/DebuggerScriptSource.h',
+          ],
+          'action': [
+            'perl',
+            '../inspector/xxd.pl',
+            'DebuggerScriptSource_js',
+            '<@(_inputs)',
+            '<@(_outputs)'
+          ],
+          'message': 'Generating DebuggerScriptSource.h from DebuggerScript.js',
+        },
+      ]
+    },
+    {
       'target_name': 'webcore_bindings_sources',
       'type': 'none',
       'hard_dependency': 1,
@@ -783,6 +837,7 @@
         'webcore_bindings_sources',
         'inspector_protocol_sources',
         'injected_script_source',
+        'debugger_script_source',
         '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:yarr',
         '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
         '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
@@ -1121,12 +1176,15 @@
         'webcore_prerequisites',
       ],
       'sources': [
+        '<@(webcore_privateheader_files)',
         '<@(webcore_files)',
       ],
       'sources/': [
         # Start by excluding everything then include html files only.
         ['exclude', '.*'],
         ['include', 'html/'],
+
+        ['exclude', 'AllInOne\\.cpp$'],
       ],
     },
     {
@@ -1136,6 +1194,7 @@
         'webcore_prerequisites',
       ],
       'sources': [
+        '<@(webcore_privateheader_files)',
         '<@(webcore_files)',
       ],
       'sources/': [
@@ -1148,7 +1207,8 @@
         ['include', 'rendering/style/SVG'],
         ['include', 'rendering/RenderSVG'],
         ['include', 'rendering/SVG'],
-        ['exclude', 'svg/SVGAllInOne\\.cpp$'],
+
+        ['exclude', 'AllInOne\\.cpp$'],
       ],
     },
     {
@@ -1161,38 +1221,32 @@
       # if this hard dependency could be split off the rest.
       'hard_dependency': 1,
       'sources': [
+        '<@(webcore_privateheader_files)',
         '<@(webcore_files)',
 
         # For WebCoreSystemInterface, Mac-only.
         '../../WebKit/mac/WebCoreSupport/WebSystemInterface.mm',
       ],
       'sources/': [
-        # Start by excluding everything then include platform files only.
         ['exclude', '.*'],
         ['include', 'platform/'],
 
-        # Exclude things that don't apply to the Chromium platform on the basis
-        # of their enclosing directories and tags at the ends of their
-        # filenames.
-        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|fftw|gtk|haiku|linux|mac|mkl|opentype|posix|qt|soup|svg|symbian|win|wince|wx)/'],
-        ['exclude', '(?<!Chromium)(Android|Cairo|CF|CG|Curl|Gtk|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|Wx)\\.(cpp|mm?)$'],
-
-        # A few things can't be excluded by patterns.  List them individually.
+        # FIXME: Figure out how to store these patterns in a variable.
+        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|freetype|fftw|gstreamer|gtk|haiku|linux|mac|mkl|opengl|openvg|opentype|pango|posix|qt|soup|svg|symbian|texmap|iphone|win|wince|wx)/'],
+        ['exclude', '(?<!Chromium)(Android|Cairo|CF|CG|Curl|Gtk|JSC|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|WinCE|Wx)\\.(cpp|mm?)$'],
 
         ['include', 'platform/graphics/opentype/OpenTypeSanitizer\\.cpp$'],
 
-        # Exclude some DB-related files.
-        ['exclude', 'platform/sql/SQLiteFileSystem\\.cpp$'],
-
-        # Use platform/MIMETypeRegistryChromium.cpp instead.
+        ['exclude', 'platform/LinkHash\\.cpp$'],
         ['exclude', 'platform/MIMETypeRegistry\\.cpp$'],
-
-        # Theme.cpp is used only if we're using USE_NEW_THEME. We are not for
-        # Windows and Linux. We manually include Theme.cpp for the Mac below.
         ['exclude', 'platform/Theme\\.cpp$'],
-
-        # Use LinkHashChromium.cpp instead
-        ['exclude', 'platform/LinkHash\\.cpp$'],
+        ['exclude', 'platform/graphics/ANGLEWebKitBridge\\.(cpp|h)$'],
+        ['exclude', 'platform/image-encoders/JPEGImageEncoder\\.(cpp|h)$'],
+        ['exclude', 'platform/image-encoders/PNGImageEncoder\\.(cpp|h)$'],
+        ['exclude', 'platform/network/ResourceHandle\\.cpp$'],
+        ['exclude', 'platform/sql/SQLiteFileSystem\\.cpp$'],
+        ['exclude', 'platform/text/LocalizedNumberNone\\.cpp$'],
+        ['exclude', 'platform/text/TextEncodingDetectorNone\\.cpp$'],
 
         ['include', 'thirdparty/glu/libtess/'],
       ],
@@ -1309,6 +1363,12 @@
             # Again, Skia is not used on Mac.
             ['exclude', 'platform/chromium/DragImageChromiumSkia\\.cpp$'],
           ],
+        },{ # OS!="mac"
+          'sources/': [
+            # FIXME: We will eventually compile this too, but for now it's
+            # only used on mac.
+            ['exclude', 'platform/graphics/FontPlatformData\\.cpp$']
+          ],
         }],
         ['OS!="linux" and OS!="freebsd"', {
           'sources/': [
@@ -1332,7 +1392,10 @@
 
             # The Chromium Win currently uses GlyphPageTreeNodeChromiumWin.cpp from
             # platform/graphics/chromium, included by regex above, instead.
-            ['exclude', 'platform/graphics/skia/GlyphPageTreeNodeSkia\\.cpp$']
+            ['exclude', 'platform/graphics/skia/GlyphPageTreeNodeSkia\\.cpp$'],
+
+            # SystemInfo.cpp is useful and we don't want to copy it.
+            ['include', 'platform/win/SystemInfo\\.cpp$'],
           ],
         }],
         ['(OS=="linux" or OS=="win") and "WTF_USE_WEBAUDIO_MKL=1" in feature_defines', {
@@ -1354,18 +1417,18 @@
         'webcore_prerequisites',
       ],
       'sources': [
+        '<@(webcore_privateheader_files)',
         '<@(webcore_files)',
       ],
       'sources/': [
-        # Start by excluding everything then include rendering files only.
         ['exclude', '.*'],
         ['include', 'rendering/'],
 
-        # Exclude things that don't apply to the Chromium platform on the basis
-        # of their enclosing directories and tags at the ends of their
-        # filenames.
-        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|gtk|haiku|html|linux|mac|opentype|platform|posix|qt|soup|svg|symbian|win|wince|wx)/'],
-        ['exclude', '(?<!Chromium)(Android|Cairo|CF|CG|Curl|Gtk|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|Wx)\\.(cpp|mm?)$'],
+        # FIXME: Figure out how to store these patterns in a variable.
+        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|freetype|fftw|gstreamer|gtk|haiku|linux|mac|mkl|opengl|openvg|opentype|pango|posix|qt|soup|svg|symbian|texmap|iphone|win|wince|wx)/'],
+        ['exclude', '(?<!Chromium)(Android|Cairo|CF|CG|Curl|Gtk|JSC|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|WinCE|Wx)\\.(cpp|mm?)$'],
+
+        ['exclude', 'AllInOne\\.cpp$'],
 
         # Exclude most of SVG except css and javascript bindings.
         ['exclude', 'rendering/style/SVG[^/]+.(cpp|h)$'],
@@ -1415,75 +1478,64 @@
       # if this hard dependency could be split off the rest.
       'hard_dependency': 1,
       'sources': [
+        '<@(webcore_privateheader_files)',
         '<@(webcore_files)',
       ],
       'sources/': [
-        # Exclude JSC custom bindings.
-        ['exclude', 'bindings/cpp'],
-        ['exclude', 'bindings/gobject'],
-        ['exclude', 'bindings/js'],
-        ['exclude', 'bindings/objc'],
-
-        # Fortunately, many things can be excluded by using broad patterns.
+        ['exclude', 'html/'],
+        ['exclude', 'platform/'],
+        ['exclude', 'rendering/'],
 
-        # Exclude things that don't apply to the Chromium platform on the basis
-        # of their enclosing directories and tags at the ends of their
-        # filenames.
-        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|gtk|haiku|html|linux|mac|opentype|platform|posix|qt|rendering|soup|svg|symbian|win|wince|wx)/'],
-        ['exclude', '(?<!Chromium)(Android|Cairo|CF|CG|Curl|Gtk|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|Wx)\\.(cpp|mm?)$'],
+        # Exclude most of bindings, except of the V8-related parts.
+        ['exclude', 'bindings/[^/]+/'],
+        ['include', 'bindings/generic/'],
+        ['include', 'bindings/v8/'],
 
-        # JSC-only.
-        ['exclude', 'inspector/JavaScript[^/]*\\.cpp$'],
+        # Exclude most of bridge, except for the V8-related parts.
+        ['exclude', 'bridge/'],
+        ['include', 'bridge/jni/'],
+        ['exclude', 'bridge/jni/[^/]+_jsobject\\.mm$'],
+        ['exclude', 'bridge/jni/[^/]+_objc\\.mm$'],
+        ['exclude', 'bridge/jni/jsc/'],
 
-        # ENABLE_OFFLINE_WEB_APPLICATIONS, exclude most of webcore's impl
-        ['exclude', 'loader/appcache/'],
-        ['include', 'loader/appcache/ApplicationCacheHost\.h$'],
-        ['include', 'loader/appcache/DOMApplicationCache\.(h|cpp)$'],
+        # FIXME: Figure out how to store these patterns in a variable.
+        ['exclude', '(android|brew|cairo|ca|cf|cg|curl|efl|freetype|fftw|gstreamer|gtk|haiku|linux|mac|mkl|opengl|openvg|opentype|pango|posix|qt|soup|svg|symbian|texmap|iphone|win|wince|wx)/'],
+        ['exclude', '(?<!Chromium)(Android|Cairo|CF|CG|Curl|Gtk|JSC|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|WinCE|Wx)\\.(cpp|mm?)$'],
 
-        # Exclude some DB-related files.
-        ['exclude', 'storage/DatabaseTracker\\.cpp$'],
-        ['exclude', 'storage/DatabaseTrackerClient\\.h$'],
-        ['exclude', 'storage/OriginQuotaManager\\.(cpp|h)$'],
-        ['exclude', 'storage/OriginUsageRecord\\.(cpp|h)$'],
-        ['exclude', 'storage/SQLTransactionClient\\.cpp$'],
-
-        # Don't build StorageNamespace.  We have our own implementation.
-        ['exclude', 'storage/StorageNamespace\\.cpp$'],
-
-        # Don't build StorageEventDispatcher.  We have our own implementation.
-        ['exclude', 'storage/StorageEventDispatcher\\.cpp$'],
-
-        # Don't build IDBFactoryBackendInterface.  We have our own implementation.
-        ['exclude', 'storage/IDBFactoryBackendInterface\\.cpp$'],
-
-        # Don't build IDBKeyPathBackendImpl.  We have our own implementation.
-        ['exclude', 'storage/IDBKeyPathBackendImpl\\.cpp$'],
+        ['exclude', 'AllInOne\\.cpp$'],
 
-        # Don't build files needed for WebArchive support, since we disable
-        # this feature.
-        ['exclude', 'loader/archive/cf/LegacyWebArchive\\.cpp$'],
-        ['exclude', 'loader/archive/cf/LegacyWebArchiveMac\\.mm$'],
+        ['exclude', 'dom/StaticStringList\\.cpp$'],
+        ['exclude', 'dom/default/PlatformMessagePortChannel\\.(cpp|h)$'],
+        ['exclude', 'fileapi/LocalFileSystem\\.cpp$'],
+        ['exclude', 'inspector/InspectorFrontendClientLocal\\.cpp$'],
+        ['exclude', 'inspector/JavaScript[^/]*\\.cpp$'],
+        ['exclude', 'loader/UserStyleSheetLoader\\.cpp$'],
+        ['exclude', 'loader/appcache/'],
         ['exclude', 'loader/archive/ArchiveFactory\\.cpp$'],
-
-        # Use loader/icon/IconDatabaseNone.cpp instead.
+        ['exclude', 'loader/archive/cf/LegacyWebArchiveMac\\.mm$'],
+        ['exclude', 'loader/archive/cf/LegacyWebArchive\\.cpp$'],
         ['exclude', 'loader/icon/IconDatabase\\.cpp$'],
-
-        # Exclude some, but not all, of plugins.
+        ['exclude', 'plugins/PluginDataNone\\.cpp$'],
         ['exclude', 'plugins/PluginDatabase\\.cpp$'],
         ['exclude', 'plugins/PluginMainThreadScheduler\\.cpp$'],
+        ['exclude', 'plugins/PluginPackageNone\\.cpp$'],
         ['exclude', 'plugins/PluginPackage\\.cpp$'],
         ['exclude', 'plugins/PluginStream\\.cpp$'],
         ['exclude', 'plugins/PluginView\\.cpp$'],
         ['exclude', 'plugins/npapi\\.cpp$'],
+        ['exclude', 'storage/DatabaseTrackerClient\\.h$'],
+        ['exclude', 'storage/DatabaseTracker\\.cpp$'],
+        ['exclude', 'storage/IDBFactoryBackendInterface\\.cpp$'],
+        ['exclude', 'storage/IDBKeyPathBackendImpl\\.cpp$'],
+        ['exclude', 'storage/OriginQuotaManager\\.(cpp|h)$'],
+        ['exclude', 'storage/OriginUsageRecord\\.(cpp|h)$'],
+        ['exclude', 'storage/SQLTransactionClient\\.cpp$'],
+        ['exclude', 'storage/StorageEventDispatcher\\.cpp$'],
+        ['exclude', 'storage/StorageNamespace\\.cpp$'],
+        ['exclude', 'workers/DefaultSharedWorkerRepository\\.(cpp|h)$'],
 
-        # FIXME: I don't know exactly why these are excluded.  It would
-        # be nice to provide more explicit comments.  Some of these do actually
-        # compile.
-        ['exclude', 'dom/StaticStringList\\.cpp$'],
-        ['exclude', 'loader/UserStyleSheetLoader\\.cpp$'],
-
-        # We use a multi-process version from the WebKit API.
-        ['exclude', 'dom/default/PlatformMessagePortChannel\\.(cpp|h)$'],
+        ['include', 'loader/appcache/ApplicationCacheHost\.h$'],
+        ['include', 'loader/appcache/DOMApplicationCache\.(cpp|h)$'],
       ],
       'link_settings': {
         'mac_bundle_resources': [
diff --git a/Source/WebCore/WebCore.gypi b/Source/WebCore/WebCore.gypi
index 3abfc9c..290b93a 100644
--- a/Source/WebCore/WebCore.gypi
+++ b/Source/WebCore/WebCore.gypi
@@ -1,12 +1,1065 @@
 {
     'variables': {
-        # These headers are part of WebCore's public API in the Apple Mac build.
-        'webcore_publicheader_files': [
-          #FIXME: Add headers.
-        ],
+        'project_dir': ['.'],
         # These headers are part of WebCore's private API in the Apple Mac build.
         'webcore_privateheader_files': [
-          #FIXME: Add headers.
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSPropertyNames.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAbstractView.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAttr.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlob.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlobInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCDATASection.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSCharsetRule.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSFontFaceRule.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSImportRule.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSMediaRule.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSPageRule.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSPrimitiveValue.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSRule.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSRuleList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleDeclaration.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleDeclarationInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleRule.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleSheet.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSUnknownRule.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSValue.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSValueList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCharacterData.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMComment.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCounter.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMImplementation.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocument.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentFragment.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentFragmentInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentFragmentPrivate.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentPrivate.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentType.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMElementTimeControl.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntity.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntityReference.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventListener.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventTarget.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFile.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAnchorElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAppletElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAreaElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBRElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBaseElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBaseFontElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBodyElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLButtonElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCanvasElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCollection.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDListElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDirectoryElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDivElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDocument.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLEmbedElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLEmbedElementPrivate.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFieldSetElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFontElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFormElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameElementPrivate.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameSetElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHRElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHeadElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHeadingElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHtmlElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIFrameElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIFrameElementPrivate.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLImageElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLInputElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLInputElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLInputElementPrivate.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIsIndexElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLIElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLabelElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLegendElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLinkElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMapElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMarqueeElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMenuElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMetaElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLModElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOListElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLObjectElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLObjectElementPrivate.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptGroupElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptionElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptionsCollection.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLParagraphElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLParamElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLPreElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLQuoteElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLScriptElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLSelectElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLStyleElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableCaptionElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableCellElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableColElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableRowElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableSectionElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTextAreaElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTextAreaElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTitleElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLUListElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMKeyboardEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMouseEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMutationEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNamedNodeMap.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNode.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeFilter.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeIterator.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotation.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOverflowEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProcessingInstruction.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProgressEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProgressEventInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRGBColor.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRange.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRangeInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRect.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAltGlyphElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAltGlyphElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAngle.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAngleInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateColorElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateColorElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateTransformElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateTransformElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedAngle.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedAngleInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedBoolean.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedBooleanInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedEnumeration.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedEnumerationInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedInteger.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedIntegerInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLength.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLengthInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLengthList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLengthListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumber.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumberInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumberList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumberListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedPreserveAspectRatio.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedPreserveAspectRatioInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedRect.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedRectInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedString.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedStringInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedTransformList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedTransformListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimationElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimationElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCircleElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCircleElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGClipPathElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGClipPathElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGColor.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGColorInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGComponentTransferFunctionElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGComponentTransferFunctionElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCursorElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCursorElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDefsElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDefsElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDescElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDescElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDocument.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDocumentInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstance.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstanceInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstanceList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstanceListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGEllipseElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGEllipseElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGExternalResourcesRequired.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEBlendElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEBlendElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEColorMatrixElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEColorMatrixElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEComponentTransferElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEComponentTransferElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFECompositeElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFECompositeElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEConvolveMatrixElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEConvolveMatrixElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDiffuseLightingElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDiffuseLightingElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDisplacementMapElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDisplacementMapElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDistantLightElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDistantLightElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFloodElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFloodElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncAElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncAElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncBElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncBElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncGElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncGElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncRElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncRElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEGaussianBlurElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEGaussianBlurElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEImageElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEImageElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeNodeElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeNodeElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMorphologyElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMorphologyElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEOffsetElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEOffsetElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEPointLightElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEPointLightElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpecularLightingElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpecularLightingElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpotLightElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpotLightElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETileElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETileElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETurbulenceElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETurbulenceElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFilterElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFilterElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFilterPrimitiveStandardAttributes.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFitToViewBox.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceFormatElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceNameElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceSrcElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceUriElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGForeignObjectElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGForeignObjectElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGlyphElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGradientElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGradientElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGImageElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGImageElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLangSpace.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLength.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLengthInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLengthList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLengthListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLineElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLineElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLinearGradientElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLinearGradientElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLocatable.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMarkerElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMarkerElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMaskElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMaskElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMatrix.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMatrixInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMetadataElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMetadataElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMissingGlyphElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumber.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumberInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumberList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumberListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPaint.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPaintInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSeg.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegClosePath.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegClosePathInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoAbs.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoAbsInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoRel.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoRelInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPatternElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPatternElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPoint.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPointList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPointListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolygonElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolygonElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolylineElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolylineElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPreserveAspectRatio.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPreserveAspectRatioInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRadialGradientElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRadialGradientElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRect.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRectElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRectElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRenderingIntent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRenderingIntentInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSVGElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSVGElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGScriptElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGScriptElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSetElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSetElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStopElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStopElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStringList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStringListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStylable.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStyleElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStyleElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSwitchElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSwitchElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSymbolElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSymbolElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTRefElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTRefElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTSpanElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTSpanElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTests.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextContentElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextContentElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPathElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPositioningElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPositioningElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTitleElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTitleElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransform.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformListInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformable.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGURIReference.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUnitTypes.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUnitTypesInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUseElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUseElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGViewElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGViewElementInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGZoomAndPan.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGZoomEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGZoomEventInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleSheet.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleSheetList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMText.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTextEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTreeWalker.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUIEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWheelEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathExpression.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathNSResolver.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathResult.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/HTMLNames.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSStyleDeclaration.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDOMWindow.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDocument.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSHTMLElement.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNode.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNodeList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSRange.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/SVGNames.h',
+            'accessibility/AXObjectCache.h',
+            'accessibility/AccessibilityObject.h',
+            'bindings/ScriptControllerBase.h',
+            'bindings/js/DOMObjectHashTableMap.h',
+            'bindings/js/DOMWrapperWorld.h',
+            'bindings/js/GCController.h',
+            'bindings/js/JSDOMBinding.h',
+            'bindings/js/JSDOMGlobalObject.h',
+            'bindings/js/JSDOMWindowBase.h',
+            'bindings/js/JSDOMWindowShell.h',
+            'bindings/js/JSDOMWrapper.h',
+            'bindings/js/JSNodeCustom.h',
+            'bindings/js/JSPluginElementFunctions.h',
+            'bindings/js/ScriptCachedFrameData.h',
+            'bindings/js/ScriptController.h',
+            'bindings/js/ScriptDebugServer.h',
+            'bindings/js/ScriptInstance.h',
+            'bindings/js/ScriptObject.h',
+            'bindings/js/ScriptProfile.h',
+            'bindings/js/ScriptProfileNode.h',
+            'bindings/js/ScriptProfiler.h',
+            'bindings/js/ScriptSourceProvider.h',
+            'bindings/js/ScriptState.h',
+            'bindings/js/ScriptValue.h',
+            'bindings/js/ScriptWrappable.h',
+            'bindings/js/SerializedScriptValue.h',
+            'bindings/js/StringSourceProvider.h',
+            'bindings/objc/DOM.h',
+            'bindings/objc/DOMCSS.h',
+            'bindings/objc/DOMCore.h',
+            'bindings/objc/DOMEventException.h',
+            'bindings/objc/DOMEvents.h',
+            'bindings/objc/DOMException.h',
+            'bindings/objc/DOMExtensions.h',
+            'bindings/objc/DOMHTML.h',
+            'bindings/objc/DOMObject.h',
+            'bindings/objc/DOMPrivate.h',
+            'bindings/objc/DOMRangeException.h',
+            'bindings/objc/DOMRanges.h',
+            'bindings/objc/DOMSVG.h',
+            'bindings/objc/DOMSVGException.h',
+            'bindings/objc/DOMStylesheets.h',
+            'bindings/objc/DOMTraversal.h',
+            'bindings/objc/DOMViews.h',
+            'bindings/objc/DOMXPath.h',
+            'bindings/objc/DOMXPathException.h',
+            'bindings/objc/ExceptionHandlers.h',
+            'bindings/objc/WebScriptObject.h',
+            'bindings/objc/WebScriptObjectPrivate.h',
+            'bridge/Bridge.h',
+            'bridge/IdentifierRep.h',
+            'bridge/jni/JNIUtility.h',
+            'bridge/jni/jni_jsobject.h',
+            'bridge/jsc/BridgeJSC.h',
+            'bridge/npapi.h',
+            'bridge/npruntime.h',
+            'bridge/npruntime_impl.h',
+            'bridge/npruntime_internal.h',
+            'bridge/nptypes.h',
+            'bridge/runtime_method.h',
+            'bridge/runtime_object.h',
+            'bridge/runtime_root.h',
+            'css/CSSComputedStyleDeclaration.h',
+            'css/CSSCursorImageValue.h',
+            'css/CSSHelper.h',
+            'css/CSSImageGeneratorValue.h',
+            'css/CSSImageValue.h',
+            'css/CSSLineBoxContainValue.h',
+            'css/CSSMutableStyleDeclaration.h',
+            'css/CSSMutableValue.h',
+            'css/CSSParserValues.h',
+            'css/CSSPrimitiveValue.h',
+            'css/CSSProperty.h',
+            'css/CSSPropertySourceData.h',
+            'css/CSSReflectValue.h',
+            'css/CSSReflectionDirection.h',
+            'css/CSSSelector.h',
+            'css/CSSStyleDeclaration.h',
+            'css/CSSValue.h',
+            'css/CSSValueList.h',
+            'css/Pair.h',
+            'css/StyleBase.h',
+            'css/WebKitCSSTransformValue.h',
+            'dom/ActiveDOMObject.h',
+            'dom/Attr.h',
+            'dom/Attribute.h',
+            'dom/CSSMappedAttributeDeclaration.h',
+            'dom/CharacterData.h',
+            'dom/CheckedRadioButtons.h',
+            'dom/Clipboard.h',
+            'dom/ClipboardAccessPolicy.h',
+            'dom/ContainerNode.h',
+            'dom/DOMImplementation.h',
+            'dom/DOMTimeStamp.h',
+            'dom/DeviceOrientation.h',
+            'dom/DeviceOrientationClient.h',
+            'dom/Document.h',
+            'dom/DocumentFragment.h',
+            'dom/DocumentMarker.h',
+            'dom/DocumentMarkerController.h',
+            'dom/DocumentOrderedMap.h',
+            'dom/DocumentParser.h',
+            'dom/DocumentTiming.h',
+            'dom/DocumentType.h',
+            'dom/Element.h',
+            'dom/Event.h',
+            'dom/EventListener.h',
+            'dom/EventNames.h',
+            'dom/EventTarget.h',
+            'dom/ExceptionCode.h',
+            'dom/FragmentScriptingPermission.h',
+            'dom/InputElement.h',
+            'dom/KeyboardEvent.h',
+            'dom/MappedAttributeEntry.h',
+            'dom/MessagePort.h',
+            'dom/MessagePortChannel.h',
+            'dom/MouseEvent.h',
+            'dom/MouseRelatedEvent.h',
+            'dom/NamedNodeMap.h',
+            'dom/Node.h',
+            'dom/NodeList.h',
+            'dom/PendingScript.h',
+            'dom/Position.h',
+            'dom/QualifiedName.h',
+            'dom/Range.h',
+            'dom/RangeBoundaryPoint.h',
+            'dom/RegisteredEventListener.h',
+            'dom/ScriptExecutionContext.h',
+            'dom/ScriptRunner.h',
+            'dom/SpaceSplitString.h',
+            'dom/StyledElement.h',
+            'dom/Text.h',
+            'dom/TextEventInputType.h',
+            'dom/UIEvent.h',
+            'dom/UIEventWithKeyState.h',
+            'dom/UserGestureIndicator.h',
+            'dom/UserTypingGestureIndicator.h',
+            'dom/ViewportArguments.h',
+            'dom/XMLDocumentParser.h',
+            'editing/ApplyBlockElementCommand.h',
+            'editing/CompositeEditCommand.h',
+            'editing/CorrectionPanelInfo.h',
+            'editing/DeleteSelectionCommand.h',
+            'editing/EditAction.h',
+            'editing/EditCommand.h',
+            'editing/EditingBehavior.h',
+            'editing/EditingBehaviorTypes.h',
+            'editing/EditingBoundary.h',
+            'editing/EditingStyle.h',
+            'editing/Editor.h',
+            'editing/EditorDeleteAction.h',
+            'editing/EditorInsertAction.h',
+            'editing/FindOptions.h',
+            'editing/HTMLInterchange.h',
+            'editing/MoveSelectionCommand.h',
+            'editing/ReplaceSelectionCommand.h',
+            'editing/SelectionController.h',
+            'editing/SmartReplace.h',
+            'editing/SpellChecker.h',
+            'editing/TextAffinity.h',
+            'editing/TextGranularity.h',
+            'editing/TextIterator.h',
+            'editing/TypingCommand.h',
+            'editing/VisiblePosition.h',
+            'editing/VisibleSelection.h',
+            'editing/WritingDirection.h',
+            'editing/htmlediting.h',
+            'editing/markup.h',
+            'editing/visible_units.h',
+            'history/BackForwardController.h',
+            'history/BackForwardList.h',
+            'history/BackForwardListImpl.h',
+            'history/CachedFrame.h',
+            'history/CachedFramePlatformData.h',
+            'history/CachedPage.h',
+            'history/HistoryItem.h',
+            'history/PageCache.h',
+            'history/cf/HistoryPropertyList.h',
+            'html/CollectionCache.h',
+            'html/CollectionType.h',
+            'html/DateComponents.h',
+            'html/FormAssociatedElement.h',
+            'html/HTMLAppletElement.h',
+            'html/HTMLCollection.h',
+            'html/HTMLDataGridElement.h',
+            'html/HTMLDocument.h',
+            'html/HTMLElement.h',
+            'html/HTMLFormControlElement.h',
+            'html/HTMLFormElement.h',
+            'html/HTMLFrameElement.h',
+            'html/HTMLFrameElementBase.h',
+            'html/HTMLFrameOwnerElement.h',
+            'html/HTMLHeadElement.h',
+            'html/HTMLIFrameElement.h',
+            'html/HTMLInputElement.h',
+            'html/HTMLMediaElement.h',
+            'html/HTMLParserQuirks.h',
+            'html/HTMLPlugInElement.h',
+            'html/HTMLPlugInImageElement.h',
+            'html/HTMLTableCellElement.h',
+            'html/HTMLTablePartElement.h',
+            'html/HTMLTextAreaElement.h',
+            'html/InputType.h',
+            'html/VoidCallback.h',
+            'html/parser/HTMLParserIdioms.h',
+            'inspector/InspectorAgent.h',
+            'inspector/InspectorClient.h',
+            'inspector/InspectorController.h',
+            'inspector/InspectorDOMAgent.h',
+            'inspector/InspectorFrontendClient.h',
+            'inspector/InspectorFrontendClientLocal.h',
+            'inspector/InspectorValues.h',
+            'inspector/ScriptBreakpoint.h',
+            'inspector/ScriptDebugListener.h',
+            'loader/CrossOriginPreflightResultCache.h',
+            'loader/DocumentLoadTiming.h',
+            'loader/DocumentLoader.h',
+            'loader/DocumentWriter.h',
+            'loader/FormState.h',
+            'loader/FormSubmission.h',
+            'loader/FrameLoader.h',
+            'loader/FrameLoaderClient.h',
+            'loader/FrameLoaderStateMachine.h',
+            'loader/FrameLoaderTypes.h',
+            'loader/FrameNetworkingContext.h',
+            'loader/HistoryController.h',
+            'loader/NavigationAction.h',
+            'loader/NavigationScheduler.h',
+            'loader/NetscapePlugInStreamLoader.h',
+            'loader/PolicyCallback.h',
+            'loader/PolicyChecker.h',
+            'loader/ProgressTracker.h',
+            'loader/ResourceLoadNotifier.h',
+            'loader/ResourceLoadScheduler.h',
+            'loader/ResourceLoader.h',
+            'loader/SubframeLoader.h',
+            'loader/SubresourceLoader.h',
+            'loader/SubresourceLoaderClient.h',
+            'loader/SubstituteData.h',
+            'loader/SubstituteResource.h',
+            'loader/TextResourceDecoder.h',
+            'loader/ThreadableLoader.h',
+            'loader/appcache/ApplicationCache.h',
+            'loader/appcache/ApplicationCacheStorage.h',
+            'loader/archive/Archive.h',
+            'loader/archive/ArchiveResource.h',
+            'loader/archive/cf/LegacyWebArchive.h',
+            'loader/cache/CachePolicy.h',
+            'loader/cache/CachedImage.h',
+            'loader/cache/CachedResource.h',
+            'loader/cache/CachedResourceClient.h',
+            'loader/cache/CachedResourceHandle.h',
+            'loader/cache/CachedResourceLoader.h',
+            'loader/cache/CachedResourceRequest.h',
+            'loader/cache/MemoryCache.h',
+            'loader/icon/IconDatabase.h',
+            'loader/icon/IconDatabaseBase.h',
+            'loader/icon/IconDatabaseClient.h',
+            'loader/mac/LoaderNSURLExtras.h',
+            'notifications/NotificationPresenter.h',
+            'page/Chrome.h',
+            'page/ChromeClient.h',
+            'page/Console.h',
+            'page/ContentSecurityPolicy.h',
+            'page/ContextMenuClient.h',
+            'page/ContextMenuController.h',
+            'page/Coordinates.h',
+            'page/DOMWindow.h',
+            'page/DragActions.h',
+            'page/DragClient.h',
+            'page/DragController.h',
+            'page/EditorClient.h',
+            'page/EventHandler.h',
+            'page/FocusController.h',
+            'page/FocusDirection.h',
+            'page/Frame.h',
+            'page/FrameLoadRequest.h',
+            'page/FrameTree.h',
+            'page/FrameView.h',
+            'page/Geolocation.h',
+            'page/GeolocationClient.h',
+            'page/GeolocationController.h',
+            'page/GeolocationError.h',
+            'page/GeolocationPosition.h',
+            'page/GeolocationPositionCache.h',
+            'page/Geoposition.h',
+            'page/GroupSettings.h',
+            'page/HaltablePlugin.h',
+            'page/MediaCanStartListener.h',
+            'page/MemoryInfo.h',
+            'page/Page.h',
+            'page/PageGroup.h',
+            'page/PluginHalterClient.h',
+            'page/PositionCallback.h',
+            'page/PositionError.h',
+            'page/PositionErrorCallback.h',
+            'page/PositionOptions.h',
+            'page/PrintContext.h',
+            'page/SecurityOrigin.h',
+            'page/SecurityOriginHash.h',
+            'page/Settings.h',
+            'page/SpatialNavigation.h',
+            'page/UserContentTypes.h',
+            'page/UserContentURLPattern.h',
+            'page/UserScript.h',
+            'page/UserScriptTypes.h',
+            'page/UserStyleSheet.h',
+            'page/UserStyleSheetTypes.h',
+            'page/WebCoreKeyboardUIMode.h',
+            'page/WindowFeatures.h',
+            'page/animation/AnimationController.h',
+            'page/mac/WebCoreFrameView.h',
+            'page/mac/WebCoreViewFactory.h',
+            'platform/AsyncFileStream.h',
+            'platform/ContextMenu.h',
+            'platform/ContextMenuItem.h',
+            'platform/Cookie.h',
+            'platform/CookieJar.h',
+            'platform/CookiesStrategy.h',
+            'platform/Cursor.h',
+            'platform/DefaultLocalizationStrategy.h',
+            'platform/DragData.h',
+            'platform/DragImage.h',
+            'platform/FileChooser.h',
+            'platform/FileStream.h',
+            'platform/FileStreamClient.h',
+            'platform/FileSystem.h',
+            'platform/HostWindow.h',
+            'platform/KURL.h',
+            'platform/KURLHash.h',
+            'platform/Language.h',
+            'platform/Length.h',
+            'platform/LengthBox.h',
+            'platform/LengthSize.h',
+            'platform/LinkHash.h',
+            'platform/LocalizationStrategy.h',
+            'platform/LocalizedStrings.h',
+            'platform/Logging.h',
+            'platform/MIMETypeRegistry.h',
+            'platform/NotImplemented.h',
+            'platform/PlatformGestureEvent.h',
+            'platform/PlatformGestureRecognizer.cpp',
+            'platform/PlatformGestureRecognizer.h',
+            'platform/PlatformKeyboardEvent.h',
+            'platform/PlatformMenuDescription.h',
+            'platform/PlatformMouseEvent.h',
+            'platform/PlatformScreen.h',
+            'platform/PlatformStrategies.h',
+            'platform/PlatformWheelEvent.h',
+            'platform/PopupMenu.h',
+            'platform/PopupMenuClient.h',
+            'platform/PopupMenuStyle.h',
+            'platform/PurgePriority.h',
+            'platform/SchemeRegistry.h',
+            'platform/ScrollTypes.h',
+            'platform/ScrollView.h',
+            'platform/ScrollableArea.h',
+            'platform/Scrollbar.h',
+            'platform/ScrollbarTheme.h',
+            'platform/SearchPopupMenu.h',
+            'platform/SharedBuffer.h',
+            'platform/SystemTime.h',
+            'platform/Theme.h',
+            'platform/ThemeTypes.h',
+            'platform/ThreadCheck.h',
+            'platform/ThreadGlobalData.h',
+            'platform/Timer.h',
+            'platform/TreeShared.h',
+            'platform/URLString.h',
+            'platform/VisitedLinkStrategy.h',
+            'platform/Widget.h',
+            'platform/WindowsKeyboardCodes.h',
+            'platform/animation/Animation.h',
+            'platform/animation/AnimationList.h',
+            'platform/animation/TimingFunction.h',
+            'platform/cf/BinaryPropertyList.h',
+            'platform/cf/SchedulePair.h',
+            'platform/graphics/BitmapImage.h',
+            'platform/graphics/Color.h',
+            'platform/graphics/ColorSpace.h',
+            'platform/graphics/DashArray.h',
+            'platform/graphics/FloatPoint.h',
+            'platform/graphics/FloatPoint3D.h',
+            'platform/graphics/FloatQuad.h',
+            'platform/graphics/FloatRect.h',
+            'platform/graphics/FloatSize.h',
+            'platform/graphics/Font.h',
+            'platform/graphics/FontBaseline.h',
+            'platform/graphics/FontCache.h',
+            'platform/graphics/FontData.h',
+            'platform/graphics/FontDescription.h',
+            'platform/graphics/FontFallbackList.h',
+            'platform/graphics/FontFamily.h',
+            'platform/graphics/FontMetrics.h',
+            'platform/graphics/FontOrientation.h',
+            'platform/graphics/FontRenderingMode.h',
+            'platform/graphics/FontSelector.h',
+            'platform/graphics/FontSmoothingMode.h',
+            'platform/graphics/FontTraitsMask.h',
+            'platform/graphics/FontWidthVariant.h',
+            'platform/graphics/Generator.h',
+            'platform/graphics/GlyphBuffer.h',
+            'platform/graphics/GlyphMetricsMap.h',
+            'platform/graphics/GlyphPageTreeNode.h',
+            'platform/graphics/Gradient.h',
+            'platform/graphics/GraphicsContext.h',
+            'platform/graphics/GraphicsContext3D.h',
+            'platform/graphics/GraphicsLayer.h',
+            'platform/graphics/GraphicsLayerClient.h',
+            'platform/graphics/GraphicsTypes.h',
+            'platform/graphics/GraphicsTypes3D.h',
+            'platform/graphics/Icon.h',
+            'platform/graphics/Image.h',
+            'platform/graphics/ImageBuffer.h',
+            'platform/graphics/ImageObserver.h',
+            'platform/graphics/ImageSource.h',
+            'platform/graphics/IntPoint.h',
+            'platform/graphics/IntPointHash.h',
+            'platform/graphics/IntRect.h',
+            'platform/graphics/IntRectHash.h',
+            'platform/graphics/IntSize.h',
+            'platform/graphics/IntSizeHash.h',
+            'platform/graphics/MediaPlayer.h',
+            'platform/graphics/Path.h',
+            'platform/graphics/Pattern.h',
+            'platform/graphics/RoundedIntRect.h',
+            'platform/graphics/SimpleFontData.h',
+            'platform/graphics/StringTruncator.h',
+            'platform/graphics/TextRenderingMode.h',
+            'platform/graphics/TextRun.h',
+            'platform/graphics/TypesettingFeatures.h',
+            'platform/graphics/cg/ImageBufferData.h',
+            'platform/graphics/mac/ColorMac.h',
+            'platform/graphics/mac/MediaPlayerProxy.h',
+            'platform/graphics/transforms/AffineTransform.h',
+            'platform/graphics/transforms/TransformOperation.h',
+            'platform/graphics/transforms/TransformOperations.h',
+            'platform/graphics/transforms/TransformationMatrix.h',
+            'platform/gtk/PasteboardHelper.h',
+            'platform/mac/BlockExceptions.h',
+            'platform/mac/ClipboardMac.h',
+            'platform/mac/EmptyProtocolDefinitions.h',
+            'platform/mac/FoundationExtras.h',
+            'platform/mac/PopupMenuMac.h',
+            'platform/mac/RuntimeApplicationChecks.h',
+            'platform/mac/SearchPopupMenuMac.h',
+            'platform/mac/SoftLinking.h',
+            'platform/mac/WebCoreNSStringExtras.h',
+            'platform/mac/WebCoreObjCExtras.h',
+            'platform/mac/WebCoreSystemInterface.h',
+            'platform/mac/WebCoreView.h',
+            'platform/mac/WebFontCache.h',
+            'platform/mock/DeviceOrientationClientMock.h',
+            'platform/mock/GeolocationClientMock.h',
+            'platform/network/AuthenticationChallengeBase.h',
+            'platform/network/AuthenticationClient.h',
+            'platform/network/CookieStorage.h',
+            'platform/network/Credential.h',
+            'platform/network/CredentialStorage.h',
+            'platform/network/FormData.h',
+            'platform/network/HTTPHeaderMap.h',
+            'platform/network/NetworkingContext.h',
+            'platform/network/ProtectionSpace.h',
+            'platform/network/ProtectionSpaceHash.h',
+            'platform/network/ProxyServer.h',
+            'platform/network/ResourceErrorBase.h',
+            'platform/network/ResourceHandle.h',
+            'platform/network/ResourceHandleClient.h',
+            'platform/network/ResourceLoadInfo.h',
+            'platform/network/ResourceLoadPriority.h',
+            'platform/network/ResourceLoadTiming.h',
+            'platform/network/ResourceRequestBase.h',
+            'platform/network/ResourceResponseBase.h',
+            'platform/network/cf/AuthenticationChallenge.h',
+            'platform/network/cf/ResourceError.h',
+            'platform/network/cf/ResourceRequest.h',
+            'platform/network/cf/ResourceResponse.h',
+            'platform/network/mac/AuthenticationMac.h',
+            'platform/network/mac/FormDataStreamMac.h',
+            'platform/network/mac/WebCoreURLResponse.h',
+            'platform/sql/SQLValue.h',
+            'platform/sql/SQLiteDatabase.h',
+            'platform/sql/SQLiteTransaction.h',
+            'platform/text/Base64.h',
+            'platform/text/BidiContext.h',
+            'platform/text/BidiResolver.h',
+            'platform/text/LineEnding.h',
+            'platform/text/PlatformString.h',
+            'platform/text/RegularExpression.h',
+            'platform/text/SegmentedString.h',
+            'platform/text/TextBoundaries.h',
+            'platform/text/TextBreakIterator.h',
+            'platform/text/TextBreakIteratorInternalICU.h',
+            'platform/text/TextCheckerClient.h',
+            'platform/text/TextChecking.h',
+            'platform/text/TextCodec.h',
+            'platform/text/TextCodecICU.h',
+            'platform/text/TextCodecLatin1.h',
+            'platform/text/TextCodecUTF16.h',
+            'platform/text/TextCodecUserDefined.h',
+            'platform/text/TextDirection.h',
+            'platform/text/TextEncoding.h',
+            'platform/text/TextEncodingRegistry.h',
+            'platform/text/TextOrientation.h',
+            'platform/text/TextStream.h',
+            'platform/text/UnicodeRange.h',
+            'platform/text/mac/CharsetData.h',
+            'plugins/PluginData.h',
+            'plugins/PluginMainThreadScheduler.h',
+            'plugins/PluginStrategy.h',
+            'plugins/PluginViewBase.h',
+            'plugins/npfunctions.h',
+            'rendering/ColumnInfo.h',
+            'rendering/GapRects.h',
+            'rendering/HitTestRequest.h',
+            'rendering/HitTestResult.h',
+            'rendering/InlineBox.h',
+            'rendering/InlineFlowBox.h',
+            'rendering/InlineTextBox.h',
+            'rendering/LayoutState.h',
+            'rendering/OverlapTestRequestClient.h',
+            'rendering/PaintInfo.h',
+            'rendering/PaintPhase.h',
+            'rendering/RenderBR.h',
+            'rendering/RenderBlock.h',
+            'rendering/RenderBox.h',
+            'rendering/RenderBoxModelObject.h',
+            'rendering/RenderEmbeddedObject.h',
+            'rendering/RenderImage.h',
+            'rendering/RenderImageResource.h',
+            'rendering/RenderImageResourceStyleImage.h',
+            'rendering/RenderLayer.h',
+            'rendering/RenderLayerBacking.h',
+            'rendering/RenderLineBoxList.h',
+            'rendering/RenderListItem.h',
+            'rendering/RenderObject.h',
+            'rendering/RenderObjectChildList.h',
+            'rendering/RenderOverflow.h',
+            'rendering/RenderPart.h',
+            'rendering/RenderReplaced.h',
+            'rendering/RenderText.h',
+            'rendering/RenderTreeAsText.h',
+            'rendering/RenderView.h',
+            'rendering/RenderWidget.h',
+            'rendering/RootInlineBox.h',
+            'rendering/ScrollBehavior.h',
+            'rendering/style/BorderData.h',
+            'rendering/style/BorderValue.h',
+            'rendering/style/CollapsedBorderValue.h',
+            'rendering/style/ContentData.h',
+            'rendering/style/CounterContent.h',
+            'rendering/style/CounterDirectives.h',
+            'rendering/style/CursorData.h',
+            'rendering/style/CursorList.h',
+            'rendering/style/DataRef.h',
+            'rendering/style/FillLayer.h',
+            'rendering/style/LineClampValue.h',
+            'rendering/style/NinePieceImage.h',
+            'rendering/style/OutlineValue.h',
+            'rendering/style/RenderStyle.h',
+            'rendering/style/RenderStyleConstants.h',
+            'rendering/style/SVGRenderStyle.h',
+            'rendering/style/SVGRenderStyleDefs.h',
+            'rendering/style/ShadowData.h',
+            'rendering/style/StyleBackgroundData.h',
+            'rendering/style/StyleBoxData.h',
+            'rendering/style/StyleCachedImage.h',
+            'rendering/style/StyleDashboardRegion.h',
+            'rendering/style/StyleFlexibleBoxData.h',
+            'rendering/style/StyleGeneratedImage.h',
+            'rendering/style/StyleImage.h',
+            'rendering/style/StyleInheritedData.h',
+            'rendering/style/StyleMarqueeData.h',
+            'rendering/style/StyleMultiColData.h',
+            'rendering/style/StyleRareInheritedData.h',
+            'rendering/style/StyleRareNonInheritedData.h',
+            'rendering/style/StyleReflection.h',
+            'rendering/style/StyleSurroundData.h',
+            'rendering/style/StyleTransformData.h',
+            'rendering/style/StyleVisualData.h',
+            'rendering/svg/SVGResourcesCache.h',
+            'storage/AbstractDatabase.h',
+            'storage/Database.h',
+            'storage/DatabaseDetails.h',
+            'storage/DatabaseTracker.h',
+            'storage/DatabaseTrackerClient.h',
+            'storage/SQLError.h',
+            'storage/SQLResultSet.h',
+            'storage/SQLResultSetRowList.h',
+            'storage/SQLStatement.h',
+            'storage/SQLStatementCallback.h',
+            'storage/SQLStatementErrorCallback.h',
+            'storage/SQLTransaction.h',
+            'storage/SQLTransactionCallback.h',
+            'storage/SQLTransactionErrorCallback.h',
+            'storage/StorageTracker.h',
+            'storage/StorageTrackerClient.h',
+            'svg/SVGAngle.h',
+            'svg/SVGAnimatedAngle.h',
+            'svg/SVGAnimatedBoolean.h',
+            'svg/SVGAnimatedEnumeration.h',
+            'svg/SVGAnimatedInteger.h',
+            'svg/SVGAnimatedLength.h',
+            'svg/SVGAnimatedLengthList.h',
+            'svg/SVGAnimatedNumber.h',
+            'svg/SVGAnimatedNumberList.h',
+            'svg/SVGAnimatedPreserveAspectRatio.h',
+            'svg/SVGAnimatedRect.h',
+            'svg/SVGAnimatedString.h',
+            'svg/SVGAnimatedTransformList.h',
+            'svg/SVGColor.h',
+            'svg/SVGDocumentExtensions.h',
+            'svg/SVGElement.h',
+            'svg/SVGLength.h',
+            'svg/SVGLengthList.h',
+            'svg/SVGLocatable.h',
+            'svg/SVGMatrix.h',
+            'svg/SVGNumberList.h',
+            'svg/SVGPaint.h',
+            'svg/SVGPreserveAspectRatio.h',
+            'svg/SVGTransform.h',
+            'svg/SVGTransformList.h',
+            'svg/animation/SMILTime.h',
+            'svg/animation/SVGSMILElement.h',
+            'svg/properties/SVGAnimatedListPropertyTearOff.h',
+            'svg/properties/SVGAnimatedProperty.h',
+            'svg/properties/SVGAnimatedPropertyDescription.h',
+            'svg/properties/SVGAnimatedPropertyMacros.h',
+            'svg/properties/SVGAnimatedPropertySynchronizer.h',
+            'svg/properties/SVGAnimatedPropertyTearOff.h',
+            'svg/properties/SVGAnimatedStaticPropertyTearOff.h',
+            'svg/properties/SVGAnimatedTransformListPropertyTearOff.h',
+            'svg/properties/SVGListProperty.h',
+            'svg/properties/SVGListPropertyTearOff.h',
+            'svg/properties/SVGPathSegListPropertyTearOff.h',
+            'svg/properties/SVGProperty.h',
+            'svg/properties/SVGPropertyTearOff.h',
+            'svg/properties/SVGPropertyTraits.h',
+            'svg/properties/SVGStaticListPropertyTearOff.h',
+            'svg/properties/SVGStaticPropertyTearOff.h',
+            'svg/properties/SVGStaticPropertyWithParentTearOff.h',
+            'svg/properties/SVGTransformListPropertyTearOff.h',
+            'workers/WorkerRunLoop.h',
+            'workers/WorkerThread.h',
         ],
         'webcore_bindings_idl_files': [
             'css/CSSCharsetRule.idl',
@@ -50,6 +1103,8 @@
             'dom/DOMImplementation.idl',
             'dom/DOMStringList.idl',
             'dom/DOMStringMap.idl',
+            'dom/DataTransferItem.idl',
+            'dom/DataTransferItems.idl',
             'dom/DeviceMotionEvent.idl',
             'dom/DeviceOrientationEvent.idl',
             'dom/Document.idl',
@@ -84,6 +1139,7 @@
             'dom/Range.idl',
             'dom/RangeException.idl',
             'dom/RequestAnimationFrameCallback.idl',
+            'dom/StringCallback.idl',
             'dom/Text.idl',
             'dom/TextEvent.idl',
             'dom/Touch.idl',
@@ -273,6 +1329,8 @@
             'page/SpeechInputEvent.idl',
             'page/SpeechInputResult.idl',
             'page/SpeechInputResultList.idl',
+            'page/WebKitAnimation.idl',
+            'page/WebKitAnimationList.idl',
             'page/WebKitPoint.idl',
             'page/WorkerNavigator.idl',
             'plugins/DOMMimeType.idl',
@@ -501,13 +1559,13 @@
         ],
         'webcore_files': [
             'accessibility/AXObjectCache.cpp',
-            'accessibility/AXObjectCache.h',
             'accessibility/AccessibilityARIAGrid.cpp',
             'accessibility/AccessibilityARIAGrid.h',
             'accessibility/AccessibilityARIAGridCell.cpp',
             'accessibility/AccessibilityARIAGridCell.h',
             'accessibility/AccessibilityARIAGridRow.cpp',
             'accessibility/AccessibilityARIAGridRow.h',
+            'accessibility/AccessibilityAllInOne.cpp',
             'accessibility/AccessibilityImageMapLink.cpp',
             'accessibility/AccessibilityImageMapLink.h',
             'accessibility/AccessibilityList.cpp',
@@ -525,7 +1583,6 @@
             'accessibility/AccessibilityMenuListPopup.cpp',
             'accessibility/AccessibilityMenuListPopup.h',
             'accessibility/AccessibilityObject.cpp',
-            'accessibility/AccessibilityObject.h',
             'accessibility/AccessibilityProgressIndicator.cpp',
             'accessibility/AccessibilityProgressIndicator.h',
             'accessibility/AccessibilityRenderObject.cpp',
@@ -549,10 +1606,13 @@
             'accessibility/chromium/AXObjectCacheChromium.cpp',
             'accessibility/chromium/AccessibilityObjectChromium.cpp',
             'accessibility/chromium/AccessibilityObjectWrapper.h',
+            'accessibility/efl/AccessibilityObjectEfl.cpp',
             'accessibility/gtk/AXObjectCacheAtk.cpp',
             'accessibility/gtk/AccessibilityObjectAtk.cpp',
             'accessibility/gtk/AccessibilityObjectWrapperAtk.cpp',
             'accessibility/gtk/AccessibilityObjectWrapperAtk.h',
+            'accessibility/gtk/WebKitAccessibleHyperlink.cpp',
+            'accessibility/gtk/WebKitAccessibleHyperlink.h',
             'accessibility/mac/AXObjectCacheMac.mm',
             'accessibility/mac/AccessibilityObjectMac.mm',
             'accessibility/mac/AccessibilityObjectWrapper.h',
@@ -563,7 +1623,6 @@
             'accessibility/win/AccessibilityObjectWrapperWin.h',
             'accessibility/wx/AccessibilityObjectWx.cpp',
             'bindings/ScriptControllerBase.cpp',
-            'bindings/ScriptControllerBase.h',
             'bindings/cpp/WebDOMCString.cpp',
             'bindings/cpp/WebDOMCString.h',
             'bindings/cpp/WebDOMCustomVoidCallback.cpp',
@@ -611,11 +1670,8 @@
             'bindings/gobject/WebKitHTMLElementWrapperFactory.h',
             'bindings/js/CachedScriptSourceProvider.h',
             'bindings/js/DOMObjectHashTableMap.cpp',
-            'bindings/js/DOMObjectHashTableMap.h',
             'bindings/js/DOMWrapperWorld.cpp',
-            'bindings/js/DOMWrapperWorld.h',
             'bindings/js/GCController.cpp',
-            'bindings/js/GCController.h',
             'bindings/js/IDBBindingUtilities.cpp',
             'bindings/js/IDBBindingUtilities.h',
             'bindings/js/JSArrayBufferCustom.cpp',
@@ -657,10 +1713,8 @@
             'bindings/js/JSCustomXPathNSResolver.h',
             'bindings/js/JSDOMApplicationCacheCustom.cpp',
             'bindings/js/JSDOMBinding.cpp',
-            'bindings/js/JSDOMBinding.h',
             'bindings/js/JSDOMFormDataCustom.cpp',
             'bindings/js/JSDOMGlobalObject.cpp',
-            'bindings/js/JSDOMGlobalObject.h',
             'bindings/js/JSDOMImplementationCustom.cpp',
             'bindings/js/JSDOMMimeTypeArrayCustom.cpp',
             'bindings/js/JSDOMPluginArrayCustom.cpp',
@@ -668,13 +1722,10 @@
             'bindings/js/JSDOMStringMapCustom.cpp',
             'bindings/js/JSDOMStringMapCustom.h',
             'bindings/js/JSDOMWindowBase.cpp',
-            'bindings/js/JSDOMWindowBase.h',
             'bindings/js/JSDOMWindowCustom.cpp',
             'bindings/js/JSDOMWindowCustom.h',
             'bindings/js/JSDOMWindowShell.cpp',
-            'bindings/js/JSDOMWindowShell.h',
             'bindings/js/JSDOMWrapper.cpp',
-            'bindings/js/JSDOMWrapper.h',
             'bindings/js/JSDataGridColumnListCustom.cpp',
             'bindings/js/JSDataGridDataSource.cpp',
             'bindings/js/JSDataGridDataSource.h',
@@ -733,6 +1784,7 @@
             'bindings/js/JSImageConstructor.h',
             'bindings/js/JSImageDataCustom.cpp',
             'bindings/js/JSInjectedScriptHostCustom.cpp',
+            'bindings/js/JSInjectedScriptManager.cpp',
             'bindings/js/JSInspectorFrontendHostCustom.cpp',
             'bindings/js/JSInt16ArrayCustom.cpp',
             'bindings/js/JSInt32ArrayCustom.cpp',
@@ -753,7 +1805,6 @@
             'bindings/js/JSNamedNodeMapCustom.cpp',
             'bindings/js/JSNavigatorCustom.cpp',
             'bindings/js/JSNodeCustom.cpp',
-            'bindings/js/JSNodeCustom.h',
             'bindings/js/JSNodeFilterCondition.cpp',
             'bindings/js/JSNodeFilterCondition.h',
             'bindings/js/JSNodeFilterCustom.cpp',
@@ -762,7 +1813,6 @@
             'bindings/js/JSOptionConstructor.cpp',
             'bindings/js/JSOptionConstructor.h',
             'bindings/js/JSPluginElementFunctions.cpp',
-            'bindings/js/JSPluginElementFunctions.h',
             'bindings/js/JSProcessingInstructionCustom.cpp',
             'bindings/js/JSSQLResultSetRowListCustom.cpp',
             'bindings/js/JSSQLTransactionCustom.cpp',
@@ -784,6 +1834,8 @@
             'bindings/js/JSUint32ArrayCustom.cpp',
             'bindings/js/JSUint8ArrayCustom.cpp',
             'bindings/js/JSWebGLRenderingContextCustom.cpp',
+            'bindings/js/JSWebKitAnimationCustom.cpp',
+            'bindings/js/JSWebKitAnimationListCustom.cpp',
             'bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp',
             'bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp',
             'bindings/js/JSWebKitCSSMatrixCustom.cpp',
@@ -802,11 +1854,9 @@
             'bindings/js/ScheduledAction.cpp',
             'bindings/js/ScheduledAction.h',
             'bindings/js/ScriptCachedFrameData.cpp',
-            'bindings/js/ScriptCachedFrameData.h',
             'bindings/js/ScriptCallStackFactory.cpp',
             'bindings/js/ScriptCallStackFactory.h',
             'bindings/js/ScriptController.cpp',
-            'bindings/js/ScriptController.h',
             'bindings/js/ScriptControllerBrew.cpp',
             'bindings/js/ScriptControllerEfl.cpp',
             'bindings/js/ScriptControllerGtk.cpp',
@@ -816,7 +1866,6 @@
             'bindings/js/ScriptControllerWin.cpp',
             'bindings/js/ScriptControllerWx.cpp',
             'bindings/js/ScriptDebugServer.cpp',
-            'bindings/js/ScriptDebugServer.h',
             'bindings/js/ScriptEventListener.cpp',
             'bindings/js/ScriptEventListener.h',
             'bindings/js/ScriptFunctionCall.cpp',
@@ -824,72 +1873,39 @@
             'bindings/js/ScriptGCEvent.cpp',
             'bindings/js/ScriptGCEvent.h',
             'bindings/js/ScriptHeapSnapshot.h',
-            'bindings/js/ScriptInstance.h',
             'bindings/js/ScriptObject.cpp',
-            'bindings/js/ScriptObject.h',
             'bindings/js/ScriptProfile.cpp',
-            'bindings/js/ScriptProfile.h',
-            'bindings/js/ScriptProfileNode.h',
             'bindings/js/ScriptProfiler.cpp',
-            'bindings/js/ScriptProfiler.h',
             'bindings/js/ScriptSourceCode.h',
-            'bindings/js/ScriptSourceProvider.h',
             'bindings/js/ScriptState.cpp',
-            'bindings/js/ScriptState.h',
             'bindings/js/ScriptValue.cpp',
-            'bindings/js/ScriptValue.h',
-            'bindings/js/ScriptWrappable.h',
             'bindings/js/SerializedScriptValue.cpp',
-            'bindings/js/SerializedScriptValue.h',
-            'bindings/js/StringSourceProvider.h',
             'bindings/js/WebCoreJSClientData.h',
             'bindings/js/WorkerScriptController.cpp',
             'bindings/js/WorkerScriptController.h',
-            'bindings/objc/DOM.h',
             'bindings/objc/DOM.mm',
             'bindings/objc/DOMAbstractView.mm',
             'bindings/objc/DOMAbstractViewFrame.h',
-            'bindings/objc/DOMCSS.h',
             'bindings/objc/DOMCSS.mm',
-            'bindings/objc/DOMCore.h',
             'bindings/objc/DOMCustomXPathNSResolver.h',
             'bindings/objc/DOMCustomXPathNSResolver.mm',
-            'bindings/objc/DOMEventException.h',
-            'bindings/objc/DOMEvents.h',
             'bindings/objc/DOMEvents.mm',
-            'bindings/objc/DOMException.h',
-            'bindings/objc/DOMExtensions.h',
-            'bindings/objc/DOMHTML.h',
             'bindings/objc/DOMHTML.mm',
             'bindings/objc/DOMImplementationFront.cpp',
             'bindings/objc/DOMImplementationFront.h',
             'bindings/objc/DOMInternal.h',
             'bindings/objc/DOMInternal.mm',
-            'bindings/objc/DOMObject.h',
             'bindings/objc/DOMObject.mm',
-            'bindings/objc/DOMPrivate.h',
-            'bindings/objc/DOMRangeException.h',
-            'bindings/objc/DOMRanges.h',
-            'bindings/objc/DOMSVG.h',
-            'bindings/objc/DOMSVGException.h',
             'bindings/objc/DOMSVGPathSegInternal.mm',
-            'bindings/objc/DOMStylesheets.h',
-            'bindings/objc/DOMTraversal.h',
             'bindings/objc/DOMUtility.mm',
-            'bindings/objc/DOMViews.h',
-            'bindings/objc/DOMXPath.h',
             'bindings/objc/DOMXPath.mm',
-            'bindings/objc/DOMXPathException.h',
-            'bindings/objc/ExceptionHandlers.h',
             'bindings/objc/ExceptionHandlers.mm',
             'bindings/objc/ObjCEventListener.h',
             'bindings/objc/ObjCEventListener.mm',
             'bindings/objc/ObjCNodeFilterCondition.h',
             'bindings/objc/ObjCNodeFilterCondition.mm',
             'bindings/objc/PublicDOMInterfaces.h',
-            'bindings/objc/WebScriptObject.h',
             'bindings/objc/WebScriptObject.mm',
-            'bindings/objc/WebScriptObjectPrivate.h',
             'bindings/v8/ChildThreadDOMData.cpp',
             'bindings/v8/ChildThreadDOMData.h',
             'bindings/v8/DOMData.cpp',
@@ -914,15 +1930,22 @@
             'bindings/v8/OptionsObject.cpp',
             'bindings/v8/OptionsObject.h',
             'bindings/v8/OwnHandle.h',
+            'bindings/v8/PageScriptDebugServer.cpp',
+            'bindings/v8/PageScriptDebugServer.h',
+            'bindings/v8/RetainedDOMInfo.cpp',
+            'bindings/v8/RetainedDOMInfo.h',
+            'bindings/v8/RetainedObjectInfo.h',
             'bindings/v8/ScheduledAction.cpp',
             'bindings/v8/ScheduledAction.h',
             'bindings/v8/ScopedDOMDataStore.cpp',
             'bindings/v8/ScopedDOMDataStore.h',
+            'bindings/v8/ScriptCachedFrameData.cpp',
             'bindings/v8/ScriptCachedFrameData.h',
             'bindings/v8/ScriptCallStackFactory.cpp',
             'bindings/v8/ScriptCallStackFactory.h',
             'bindings/v8/ScriptController.cpp',
             'bindings/v8/ScriptController.h',
+            'bindings/v8/ScriptControllerQt.cpp',
             'bindings/v8/ScriptDebugServer.cpp',
             'bindings/v8/ScriptDebugServer.h',
             'bindings/v8/ScriptEventListener.cpp',
@@ -953,6 +1976,7 @@
             'bindings/v8/ScriptWrappable.h',
             'bindings/v8/SerializedScriptValue.cpp',
             'bindings/v8/SerializedScriptValue.h',
+            'bindings/v8/SharedPersistent.h',
             'bindings/v8/StaticDOMDataStore.cpp',
             'bindings/v8/StaticDOMDataStore.h',
             'bindings/v8/V8AbstractEventListener.cpp',
@@ -1005,6 +2029,8 @@
             'bindings/v8/WorkerContextExecutionProxy.h',
             'bindings/v8/WorkerScriptController.cpp',
             'bindings/v8/WorkerScriptController.h',
+            'bindings/v8/WorkerScriptDebugServer.cpp',
+            'bindings/v8/WorkerScriptDebugServer.h',
             'bindings/v8/WorldContextHandle.cpp',
             'bindings/v8/WorldContextHandle.h',
             'bindings/v8/WrapperTypeInfo.h',
@@ -1038,7 +2064,6 @@
             'bindings/v8/custom/V8DOMWindowCustom.cpp',
             'bindings/v8/custom/V8DataGridColumnListCustom.cpp',
             'bindings/v8/custom/V8DataViewCustom.cpp',
-            'bindings/v8/custom/V8DataViewCustom.h',
             'bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp',
             'bindings/v8/custom/V8DeviceMotionEventCustom.cpp',
             'bindings/v8/custom/V8DeviceOrientationEventCustom.cpp',
@@ -1080,6 +2105,7 @@
             'bindings/v8/custom/V8IDBKeyCustom.cpp',
             'bindings/v8/custom/V8ImageDataCustom.cpp',
             'bindings/v8/custom/V8InjectedScriptHostCustom.cpp',
+            'bindings/v8/custom/V8InjectedScriptManager.cpp',
             'bindings/v8/custom/V8InspectorFrontendHostCustom.cpp',
             'bindings/v8/custom/V8Int16ArrayCustom.cpp',
             'bindings/v8/custom/V8Int32ArrayCustom.cpp',
@@ -1115,6 +2141,7 @@
             'bindings/v8/custom/V8Uint32ArrayCustom.cpp',
             'bindings/v8/custom/V8Uint8ArrayCustom.cpp',
             'bindings/v8/custom/V8WebGLRenderingContextCustom.cpp',
+            'bindings/v8/custom/V8WebKitAnimationCustom.cpp',
             'bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp',
             'bindings/v8/custom/V8WebKitPointConstructor.cpp',
             'bindings/v8/custom/V8WebSocketCustom.cpp',
@@ -1124,19 +2151,45 @@
             'bindings/v8/custom/V8XMLHttpRequestCustom.cpp',
             'bindings/v8/custom/V8XSLTProcessorCustom.cpp',
             'bindings/v8/npruntime.cpp',
-            'bindings/v8/npruntime_impl.h',
-            'bindings/v8/npruntime_internal.h',
             'bindings/v8/npruntime_priv.h',
             'bindings/v8/specialization/V8BindingState.cpp',
             'bindings/v8/specialization/V8BindingState.h',
-            'bridge/Bridge.h',
+            'bridge/IdentifierRep.cpp',
+            'bridge/NP_jsobject.cpp',
+            'bridge/NP_jsobject.h',
+            'bridge/c/CRuntimeObject.cpp',
+            'bridge/c/CRuntimeObject.h',
+            'bridge/c/c_class.cpp',
+            'bridge/c/c_class.h',
+            'bridge/c/c_instance.cpp',
+            'bridge/c/c_instance.h',
+            'bridge/c/c_runtime.cpp',
+            'bridge/c/c_runtime.h',
+            'bridge/c/c_utility.cpp',
+            'bridge/c/c_utility.h',
             'bridge/jni/JNIUtility.cpp',
-            'bridge/jni/JNIUtility.h',
-            'bridge/jni/JavaMethod.cpp',
             'bridge/jni/JavaMethod.h',
+            'bridge/jni/JavaMethodJobject.cpp',
+            'bridge/jni/JavaMethodJobject.h',
             'bridge/jni/JavaString.h',
+            'bridge/jni/JavaType.h',
             'bridge/jni/JobjectWrapper.cpp',
             'bridge/jni/JobjectWrapper.h',
+            'bridge/jni/jni_jsobject.mm',
+            'bridge/jni/jni_objc.mm',
+            'bridge/jni/jsc/JNIUtilityPrivate.cpp',
+            'bridge/jni/jsc/JNIUtilityPrivate.h',
+            'bridge/jni/jsc/JavaArrayJSC.cpp',
+            'bridge/jni/jsc/JavaArrayJSC.h',
+            'bridge/jni/jsc/JavaClassJSC.cpp',
+            'bridge/jni/jsc/JavaClassJSC.h',
+            'bridge/jni/jsc/JavaFieldJSC.cpp',
+            'bridge/jni/jsc/JavaFieldJSC.h',
+            'bridge/jni/jsc/JavaInstanceJSC.cpp',
+            'bridge/jni/jsc/JavaInstanceJSC.h',
+            'bridge/jni/jsc/JavaRuntimeObject.cpp',
+            'bridge/jni/jsc/JavaRuntimeObject.h',
+            'bridge/jni/jsc/JavaStringJSC.h',
             'bridge/jni/v8/JNIUtilityPrivate.cpp',
             'bridge/jni/v8/JNIUtilityPrivate.h',
             'bridge/jni/v8/JavaClassV8.cpp',
@@ -1148,6 +2201,39 @@
             'bridge/jni/v8/JavaNPObjectV8.cpp',
             'bridge/jni/v8/JavaNPObjectV8.h',
             'bridge/jni/v8/JavaStringV8.h',
+            'bridge/jni/v8/JavaValueV8.h',
+            'bridge/jsc/BridgeJSC.cpp',
+            'bridge/npruntime.cpp',
+            'bridge/npruntime_priv.h',
+            'bridge/objc/ObjCRuntimeObject.h',
+            'bridge/objc/ObjCRuntimeObject.mm',
+            'bridge/objc/WebScriptObject.h',
+            'bridge/objc/objc_class.h',
+            'bridge/objc/objc_class.mm',
+            'bridge/objc/objc_header.h',
+            'bridge/objc/objc_instance.h',
+            'bridge/objc/objc_instance.mm',
+            'bridge/objc/objc_runtime.h',
+            'bridge/objc/objc_runtime.mm',
+            'bridge/objc/objc_utility.h',
+            'bridge/objc/objc_utility.mm',
+            'bridge/qt/qt_class.cpp',
+            'bridge/qt/qt_class.h',
+            'bridge/qt/qt_instance.cpp',
+            'bridge/qt/qt_instance.h',
+            'bridge/qt/qt_pixmapruntime.cpp',
+            'bridge/qt/qt_pixmapruntime.h',
+            'bridge/qt/qt_runtime.cpp',
+            'bridge/qt/qt_runtime.h',
+            'bridge/runtime_array.cpp',
+            'bridge/runtime_array.h',
+            'bridge/runtime_method.cpp',
+            'bridge/runtime_object.cpp',
+            'bridge/runtime_root.cpp',
+            'bridge/testbindings.cpp',
+            'bridge/testbindings.mm',
+            'bridge/testqtbindings.cpp',
+            'config.h',
             'css/CSSBorderImageValue.cpp',
             'css/CSSBorderImageValue.h',
             'css/CSSCanvasValue.cpp',
@@ -1155,9 +2241,7 @@
             'css/CSSCharsetRule.cpp',
             'css/CSSCharsetRule.h',
             'css/CSSComputedStyleDeclaration.cpp',
-            'css/CSSComputedStyleDeclaration.h',
             'css/CSSCursorImageValue.cpp',
-            'css/CSSCursorImageValue.h',
             'css/CSSFontFace.cpp',
             'css/CSSFontFace.h',
             'css/CSSFontFaceRule.cpp',
@@ -1172,22 +2256,18 @@
             'css/CSSFunctionValue.h',
             'css/CSSGradientValue.cpp',
             'css/CSSGradientValue.h',
-            'css/CSSHelper.h',
             'css/CSSImageGeneratorValue.cpp',
-            'css/CSSImageGeneratorValue.h',
             'css/CSSImageValue.cpp',
-            'css/CSSImageValue.h',
             'css/CSSImportRule.cpp',
             'css/CSSImportRule.h',
             'css/CSSInheritedValue.cpp',
             'css/CSSInheritedValue.h',
             'css/CSSInitialValue.cpp',
             'css/CSSInitialValue.h',
+            'css/CSSLineBoxContainValue.cpp',
             'css/CSSMediaRule.cpp',
             'css/CSSMediaRule.h',
             'css/CSSMutableStyleDeclaration.cpp',
-            'css/CSSMutableStyleDeclaration.h',
-            'css/CSSMutableValue.h',
             'css/CSSNamespace.h',
             'css/CSSOMUtils.cpp',
             'css/CSSOMUtils.h',
@@ -1196,22 +2276,16 @@
             'css/CSSParser.cpp',
             'css/CSSParser.h',
             'css/CSSParserValues.cpp',
-            'css/CSSParserValues.h',
             'css/CSSPrimitiveValue.cpp',
-            'css/CSSPrimitiveValue.h',
             'css/CSSPrimitiveValueCache.cpp',
             'css/CSSPrimitiveValueCache.h',
             'css/CSSPrimitiveValueMappings.h',
             'css/CSSProperty.cpp',
-            'css/CSSProperty.h',
             'css/CSSPropertyLonghand.cpp',
             'css/CSSPropertyLonghand.h',
             'css/CSSPropertySourceData.cpp',
-            'css/CSSPropertySourceData.h',
             'css/CSSQuirkPrimitiveValue.h',
             'css/CSSReflectValue.cpp',
-            'css/CSSReflectValue.h',
-            'css/CSSReflectionDirection.h',
             'css/CSSRule.cpp',
             'css/CSSRule.h',
             'css/CSSRuleList.cpp',
@@ -1219,11 +2293,11 @@
             'css/CSSSegmentedFontFace.cpp',
             'css/CSSSegmentedFontFace.h',
             'css/CSSSelector.cpp',
-            'css/CSSSelector.h',
             'css/CSSSelectorList.cpp',
             'css/CSSSelectorList.h',
+            'css/CSSStyleApplyProperty.cpp',
+            'css/CSSStyleApplyProperty.h',
             'css/CSSStyleDeclaration.cpp',
-            'css/CSSStyleDeclaration.h',
             'css/CSSStyleRule.cpp',
             'css/CSSStyleRule.h',
             'css/CSSStyleSelector.cpp',
@@ -1235,9 +2309,7 @@
             'css/CSSUnicodeRangeValue.cpp',
             'css/CSSUnicodeRangeValue.h',
             'css/CSSUnknownRule.h',
-            'css/CSSValue.h',
             'css/CSSValueList.cpp',
-            'css/CSSValueList.h',
             'css/Counter.h',
             'css/DashboardRegion.h',
             'css/FontFamilyValue.cpp',
@@ -1260,7 +2332,6 @@
             'css/MediaQueryListListener.h',
             'css/MediaQueryMatcher.cpp',
             'css/MediaQueryMatcher.h',
-            'css/Pair.h',
             'css/RGBColor.cpp',
             'css/RGBColor.h',
             'css/Rect.h',
@@ -1270,7 +2341,6 @@
             'css/ShadowValue.cpp',
             'css/ShadowValue.h',
             'css/StyleBase.cpp',
-            'css/StyleBase.h',
             'css/StyleList.cpp',
             'css/StyleList.h',
             'css/StyleMedia.cpp',
@@ -1286,15 +2356,9 @@
             'css/WebKitCSSMatrix.cpp',
             'css/WebKitCSSMatrix.h',
             'css/WebKitCSSTransformValue.cpp',
-            'css/WebKitCSSTransformValue.h',
             'dom/ActiveDOMObject.cpp',
-            'dom/ActiveDOMObject.h',
-            'dom/AsyncScriptRunner.cpp',
-            'dom/AsyncScriptRunner.h',
             'dom/Attr.cpp',
-            'dom/Attr.h',
             'dom/Attribute.cpp',
-            'dom/Attribute.h',
             'dom/BeforeLoadEvent.h',
             'dom/BeforeProcessEvent.cpp',
             'dom/BeforeProcessEvent.h',
@@ -1305,11 +2369,8 @@
             'dom/CDATASection.cpp',
             'dom/CDATASection.h',
             'dom/CSSMappedAttributeDeclaration.cpp',
-            'dom/CSSMappedAttributeDeclaration.h',
             'dom/CharacterData.cpp',
-            'dom/CharacterData.h',
             'dom/CheckedRadioButtons.cpp',
-            'dom/CheckedRadioButtons.h',
             'dom/ChildNodeList.cpp',
             'dom/ChildNodeList.h',
             'dom/ClassNodeList.cpp',
@@ -1319,8 +2380,6 @@
             'dom/ClientRectList.cpp',
             'dom/ClientRectList.h',
             'dom/Clipboard.cpp',
-            'dom/Clipboard.h',
-            'dom/ClipboardAccessPolicy.h',
             'dom/ClipboardEvent.cpp',
             'dom/ClipboardEvent.h',
             'dom/Comment.cpp',
@@ -1328,19 +2387,20 @@
             'dom/CompositionEvent.cpp',
             'dom/CompositionEvent.h',
             'dom/ContainerNode.cpp',
-            'dom/ContainerNode.h',
             'dom/ContainerNodeAlgorithms.h',
             'dom/CrossThreadTask.h',
             'dom/CustomEvent.cpp',
             'dom/CustomEvent.h',
+            'dom/DOMAllInOne.cpp',
             'dom/DOMCoreException.h',
             'dom/DOMImplementation.cpp',
-            'dom/DOMImplementation.h',
             'dom/DOMStringList.cpp',
             'dom/DOMStringList.h',
             'dom/DOMStringMap.cpp',
             'dom/DOMStringMap.h',
-            'dom/DOMTimeStamp.h',
+            'dom/DataTransferItem.cpp',
+            'dom/DataTransferItem.h',
+            'dom/DataTransferItems.h',
             'dom/DatasetDOMStringMap.cpp',
             'dom/DatasetDOMStringMap.h',
             'dom/DecodedDataDocumentParser.cpp',
@@ -1353,32 +2413,21 @@
             'dom/DeviceMotionEvent.cpp',
             'dom/DeviceMotionEvent.h',
             'dom/DeviceOrientation.cpp',
-            'dom/DeviceOrientation.h',
-            'dom/DeviceOrientationClient.h',
             'dom/DeviceOrientationController.cpp',
             'dom/DeviceOrientationController.h',
             'dom/DeviceOrientationEvent.cpp',
             'dom/DeviceOrientationEvent.h',
             'dom/Document.cpp',
-            'dom/Document.h',
             'dom/DocumentFragment.cpp',
-            'dom/DocumentFragment.h',
-            'dom/DocumentMarker.h',
             'dom/DocumentMarkerController.cpp',
-            'dom/DocumentMarkerController.h',
             'dom/DocumentOrderedMap.cpp',
-            'dom/DocumentOrderedMap.h',
             'dom/DocumentParser.cpp',
-            'dom/DocumentParser.h',
-            'dom/DocumentTiming.h',
             'dom/DocumentType.cpp',
-            'dom/DocumentType.h',
             'dom/DynamicNodeList.cpp',
             'dom/DynamicNodeList.h',
             'dom/EditingText.cpp',
             'dom/EditingText.h',
             'dom/Element.cpp',
-            'dom/Element.h',
             'dom/ElementRareData.h',
             'dom/Entity.h',
             'dom/EntityReference.cpp',
@@ -1386,56 +2435,42 @@
             'dom/ErrorEvent.cpp',
             'dom/ErrorEvent.h',
             'dom/Event.cpp',
-            'dom/Event.h',
             'dom/EventContext.cpp',
             'dom/EventContext.h',
+            'dom/EventDispatcher.cpp',
+            'dom/EventDispatcher.h',
             'dom/EventException.h',
-            'dom/EventListener.h',
             'dom/EventNames.cpp',
-            'dom/EventNames.h',
             'dom/EventQueue.cpp',
             'dom/EventQueue.h',
             'dom/EventTarget.cpp',
-            'dom/EventTarget.h',
             'dom/ExceptionBase.cpp',
             'dom/ExceptionBase.h',
             'dom/ExceptionCode.cpp',
-            'dom/ExceptionCode.h',
-            'dom/FragmentScriptingPermission.h',
             'dom/HashChangeEvent.h',
             'dom/IgnoreDestructiveWriteCountIncrementer.h',
             'dom/InputElement.cpp',
-            'dom/InputElement.h',
             'dom/KeyboardEvent.cpp',
-            'dom/KeyboardEvent.h',
-            'dom/MappedAttributeEntry.h',
             'dom/MessageChannel.cpp',
             'dom/MessageChannel.h',
             'dom/MessageEvent.cpp',
             'dom/MessageEvent.h',
             'dom/MessagePort.cpp',
-            'dom/MessagePort.h',
             'dom/MessagePortChannel.cpp',
-            'dom/MessagePortChannel.h',
             'dom/MouseEvent.cpp',
-            'dom/MouseEvent.h',
             'dom/MouseRelatedEvent.cpp',
-            'dom/MouseRelatedEvent.h',
             'dom/MutationEvent.cpp',
             'dom/MutationEvent.h',
             'dom/NameNodeList.cpp',
             'dom/NameNodeList.h',
             'dom/NamedNodeMap.cpp',
-            'dom/NamedNodeMap.h',
             'dom/Node.cpp',
-            'dom/Node.h',
             'dom/NodeFilter.cpp',
             'dom/NodeFilter.h',
             'dom/NodeFilterCondition.cpp',
             'dom/NodeFilterCondition.h',
             'dom/NodeIterator.cpp',
             'dom/NodeIterator.h',
-            'dom/NodeList.h',
             'dom/NodeRareData.h',
             'dom/NodeRenderStyle.h',
             'dom/NodeWithIndex.h',
@@ -1450,11 +2485,10 @@
             'dom/PageTransitionEvent.cpp',
             'dom/PageTransitionEvent.h',
             'dom/PendingScript.cpp',
-            'dom/PendingScript.h',
             'dom/PopStateEvent.cpp',
             'dom/PopStateEvent.h',
             'dom/Position.cpp',
-            'dom/Position.h',
+            'dom/PositionCreationFunctions.h',
             'dom/PositionIterator.cpp',
             'dom/PositionIterator.h',
             'dom/ProcessingInstruction.cpp',
@@ -1462,21 +2496,17 @@
             'dom/ProgressEvent.cpp',
             'dom/ProgressEvent.h',
             'dom/QualifiedName.cpp',
-            'dom/QualifiedName.h',
             'dom/Range.cpp',
-            'dom/Range.h',
-            'dom/RangeBoundaryPoint.h',
             'dom/RangeException.h',
             'dom/RawDataDocumentParser.h',
             'dom/RegisteredEventListener.cpp',
-            'dom/RegisteredEventListener.h',
             'dom/RequestAnimationFrameCallback.h',
             'dom/ScopedEventQueue.cpp',
             'dom/ScopedEventQueue.h',
             'dom/ScriptElement.cpp',
             'dom/ScriptElement.h',
             'dom/ScriptExecutionContext.cpp',
-            'dom/ScriptExecutionContext.h',
+            'dom/ScriptRunner.cpp',
             'dom/ScriptableDocumentParser.cpp',
             'dom/ScriptableDocumentParser.h',
             'dom/ScriptedAnimationController.cpp',
@@ -1486,46 +2516,39 @@
             'dom/SelectorNodeList.cpp',
             'dom/SelectorNodeList.h',
             'dom/SpaceSplitString.cpp',
-            'dom/SpaceSplitString.h',
             'dom/StaticHashSetNodeList.cpp',
             'dom/StaticHashSetNodeList.h',
             'dom/StaticNodeList.cpp',
             'dom/StaticNodeList.h',
-            'dom/StaticStringList.cpp',
-            'dom/StaticStringList.h',
+            'dom/StringCallback.cpp',
+            'dom/StringCallback.h',
             'dom/StyleElement.cpp',
             'dom/StyleElement.h',
             'dom/StyledElement.cpp',
-            'dom/StyledElement.h',
             'dom/TagNodeList.cpp',
             'dom/TagNodeList.h',
             'dom/Text.cpp',
-            'dom/Text.h',
             'dom/TextEvent.cpp',
             'dom/TextEvent.h',
-            'dom/TextEventInputType.h',
             'dom/Touch.cpp',
             'dom/Touch.h',
             'dom/TouchEvent.cpp',
+            'dom/TouchEvent.h',
             'dom/TouchList.cpp',
             'dom/TouchList.h',
             'dom/TransformSource.h',
             'dom/TransformSourceLibxslt.cpp',
+            'dom/TransformSourceQt.cpp',
             'dom/Traversal.cpp',
             'dom/Traversal.h',
             'dom/TreeDepthLimit.h',
             'dom/TreeWalker.cpp',
             'dom/TreeWalker.h',
             'dom/UIEvent.cpp',
-            'dom/UIEvent.h',
             'dom/UIEventWithKeyState.cpp',
-            'dom/UIEventWithKeyState.h',
             'dom/UserGestureIndicator.cpp',
-            'dom/UserGestureIndicator.h',
             'dom/UserTypingGestureIndicator.cpp',
-            'dom/UserTypingGestureIndicator.h',
             'dom/ViewportArguments.cpp',
-            'dom/ViewportArguments.h',
             'dom/WebKitAnimationEvent.cpp',
             'dom/WebKitAnimationEvent.h',
             'dom/WebKitTransitionEvent.cpp',
@@ -1535,7 +2558,6 @@
             'dom/WindowEventContext.cpp',
             'dom/WindowEventContext.h',
             'dom/XMLDocumentParser.cpp',
-            'dom/XMLDocumentParser.h',
             'dom/XMLDocumentParserLibxml2.cpp',
             'dom/XMLDocumentParserQt.cpp',
             'dom/XMLDocumentParserScope.cpp',
@@ -1545,14 +2567,11 @@
             'editing/AppendNodeCommand.cpp',
             'editing/AppendNodeCommand.h',
             'editing/ApplyBlockElementCommand.cpp',
-            'editing/ApplyBlockElementCommand.h',
             'editing/ApplyStyleCommand.cpp',
             'editing/ApplyStyleCommand.h',
             'editing/BreakBlockquoteCommand.cpp',
             'editing/BreakBlockquoteCommand.h',
             'editing/CompositeEditCommand.cpp',
-            'editing/CompositeEditCommand.h',
-            'editing/CorrectionPanelInfo.h',
             'editing/CreateLinkCommand.cpp',
             'editing/CreateLinkCommand.h',
             'editing/DeleteButton.cpp',
@@ -1562,25 +2581,14 @@
             'editing/DeleteFromTextNodeCommand.cpp',
             'editing/DeleteFromTextNodeCommand.h',
             'editing/DeleteSelectionCommand.cpp',
-            'editing/DeleteSelectionCommand.h',
-            'editing/EditAction.h',
             'editing/EditCommand.cpp',
-            'editing/EditCommand.h',
-            'editing/EditingBehavior.h',
-            'editing/EditingBehaviorTypes.h',
-            'editing/EditingBoundary.h',
+            'editing/EditingAllInOne.cpp',
             'editing/EditingStyle.cpp',
-            'editing/EditingStyle.h',
             'editing/Editor.cpp',
-            'editing/Editor.h',
             'editing/EditorCommand.cpp',
-            'editing/EditorDeleteAction.h',
-            'editing/EditorInsertAction.h',
-            'editing/FindOptions.h',
             'editing/FormatBlockCommand.cpp',
             'editing/FormatBlockCommand.h',
             'editing/HTMLInterchange.cpp',
-            'editing/HTMLInterchange.h',
             'editing/IndentOutdentCommand.cpp',
             'editing/IndentOutdentCommand.h',
             'editing/InsertIntoTextNodeCommand.cpp',
@@ -1604,7 +2612,6 @@
             'editing/ModifySelectionListLevel.cpp',
             'editing/ModifySelectionListLevel.h',
             'editing/MoveSelectionCommand.cpp',
-            'editing/MoveSelectionCommand.h',
             'editing/RemoveCSSPropertyCommand.cpp',
             'editing/RemoveCSSPropertyCommand.h',
             'editing/RemoveFormatCommand.cpp',
@@ -1616,51 +2623,46 @@
             'editing/ReplaceNodeWithSpanCommand.cpp',
             'editing/ReplaceNodeWithSpanCommand.h',
             'editing/ReplaceSelectionCommand.cpp',
-            'editing/ReplaceSelectionCommand.h',
             'editing/SelectionController.cpp',
-            'editing/SelectionController.h',
             'editing/SetNodeAttributeCommand.cpp',
             'editing/SetNodeAttributeCommand.h',
+            'editing/SetSelectionCommand.cpp',
+            'editing/SetSelectionCommand.h',
             'editing/SmartReplace.cpp',
-            'editing/SmartReplace.h',
             'editing/SmartReplaceCF.cpp',
             'editing/SmartReplaceICU.cpp',
             'editing/SpellChecker.cpp',
-            'editing/SpellChecker.h',
+            'editing/SpellingCorrectionCommand.cpp',
+            'editing/SpellingCorrectionCommand.h',
             'editing/SplitElementCommand.cpp',
             'editing/SplitElementCommand.h',
             'editing/SplitTextNodeCommand.cpp',
             'editing/SplitTextNodeCommand.h',
             'editing/SplitTextNodeContainingElementCommand.cpp',
             'editing/SplitTextNodeContainingElementCommand.h',
-            'editing/TextAffinity.h',
             'editing/TextCheckingHelper.cpp',
             'editing/TextCheckingHelper.h',
-            'editing/TextGranularity.h',
             'editing/TextIterator.cpp',
-            'editing/TextIterator.h',
             'editing/TypingCommand.cpp',
-            'editing/TypingCommand.h',
             'editing/UnlinkCommand.cpp',
             'editing/UnlinkCommand.h',
             'editing/VisiblePosition.cpp',
-            'editing/VisiblePosition.h',
             'editing/VisibleSelection.cpp',
-            'editing/VisibleSelection.h',
             'editing/WrapContentsInDummySpanCommand.cpp',
             'editing/WrapContentsInDummySpanCommand.h',
             'editing/android/EditorAndroid.cpp',
+            'editing/brew/EditorBrew.cpp',
             'editing/chromium/EditorChromium.cpp',
             'editing/chromium/SelectionControllerChromium.cpp',
+            'editing/gtk/SelectionControllerGtk.cpp',
+            'editing/haiku/EditorHaiku.cpp',
             'editing/htmlediting.cpp',
-            'editing/htmlediting.h',
             'editing/mac/EditorMac.mm',
             'editing/mac/SelectionControllerMac.mm',
             'editing/markup.cpp',
-            'editing/markup.h',
             'editing/qt/EditorQt.cpp',
+            'editing/qt/SmartReplaceQt.cpp',
             'editing/visible_units.cpp',
-            'editing/visible_units.h',
             'editing/wx/EditorWx.cpp',
             'fileapi/AsyncFileWriter.h',
             'fileapi/AsyncFileWriterClient.h',
@@ -1735,6 +2737,7 @@
             'fileapi/FileWriterSync.cpp',
             'fileapi/FileWriterSync.h',
             'fileapi/Flags.h',
+            'fileapi/LocalFileSystem.cpp',
             'fileapi/LocalFileSystem.h',
             'fileapi/Metadata.h',
             'fileapi/MetadataCallback.h',
@@ -1742,20 +2745,16 @@
             'fileapi/ThreadableBlobRegistry.cpp',
             'fileapi/ThreadableBlobRegistry.h',
             'history/BackForwardController.cpp',
-            'history/BackForwardController.h',
-            'history/BackForwardList.h',
             'history/BackForwardListImpl.cpp',
-            'history/BackForwardListImpl.h',
             'history/CachedFrame.cpp',
-            'history/CachedFrame.h',
-            'history/CachedFramePlatformData.h',
             'history/CachedPage.cpp',
-            'history/CachedPage.h',
             'history/HistoryItem.cpp',
-            'history/HistoryItem.h',
             'history/PageCache.cpp',
-            'history/PageCache.h',
+            'history/android/AndroidWebHistoryBridge.h',
+            'history/android/HistoryItemAndroid.cpp',
+            'history/cf/HistoryPropertyList.cpp',
             'history/mac/HistoryItemMac.mm',
+            'history/qt/HistoryItemQt.cpp',
             'html/AsyncImageResizer.cpp',
             'html/AsyncImageResizer.h',
             'html/BaseButtonInputType.cpp',
@@ -1773,8 +2772,6 @@
             'html/ClassList.cpp',
             'html/ClassList.h',
             'html/CollectionCache.cpp',
-            'html/CollectionCache.h',
-            'html/CollectionType.h',
             'html/ColorInputType.cpp',
             'html/ColorInputType.h',
             'html/DOMDataGridDataSource.cpp',
@@ -1791,8 +2788,8 @@
             'html/DataGridColumn.h',
             'html/DataGridColumnList.cpp',
             'html/DataGridColumnList.h',
+            'html/DataGridDataSource.h',
             'html/DateComponents.cpp',
-            'html/DateComponents.h',
             'html/DateInputType.cpp',
             'html/DateInputType.h',
             'html/DateTimeInputType.cpp',
@@ -1806,7 +2803,6 @@
             'html/FileInputType.cpp',
             'html/FileInputType.h',
             'html/FormAssociatedElement.cpp',
-            'html/FormAssociatedElement.h',
             'html/FormDataList.cpp',
             'html/FormDataList.h',
             'html/HTMLAllCollection.cpp',
@@ -1814,7 +2810,6 @@
             'html/HTMLAnchorElement.cpp',
             'html/HTMLAnchorElement.h',
             'html/HTMLAppletElement.cpp',
-            'html/HTMLAppletElement.h',
             'html/HTMLAreaElement.cpp',
             'html/HTMLAreaElement.h',
             'html/HTMLAudioElement.cpp',
@@ -1834,7 +2829,6 @@
             'html/HTMLCanvasElement.cpp',
             'html/HTMLCanvasElement.h',
             'html/HTMLCollection.cpp',
-            'html/HTMLCollection.h',
             'html/HTMLDListElement.cpp',
             'html/HTMLDListElement.h',
             'html/HTMLDataGridCellElement.cpp',
@@ -1842,7 +2836,6 @@
             'html/HTMLDataGridColElement.cpp',
             'html/HTMLDataGridColElement.h',
             'html/HTMLDataGridElement.cpp',
-            'html/HTMLDataGridElement.h',
             'html/HTMLDataGridRowElement.cpp',
             'html/HTMLDataGridRowElement.h',
             'html/HTMLDataListElement.cpp',
@@ -1854,9 +2847,8 @@
             'html/HTMLDivElement.cpp',
             'html/HTMLDivElement.h',
             'html/HTMLDocument.cpp',
-            'html/HTMLDocument.h',
             'html/HTMLElement.cpp',
-            'html/HTMLElement.h',
+            'html/HTMLElementsAllInOne.cpp',
             'html/HTMLEmbedElement.cpp',
             'html/HTMLEmbedElement.h',
             'html/HTMLFieldSetElement.cpp',
@@ -1866,33 +2858,25 @@
             'html/HTMLFormCollection.cpp',
             'html/HTMLFormCollection.h',
             'html/HTMLFormControlElement.cpp',
-            'html/HTMLFormControlElement.h',
             'html/HTMLFormElement.cpp',
-            'html/HTMLFormElement.h',
             'html/HTMLFrameElement.cpp',
-            'html/HTMLFrameElement.h',
             'html/HTMLFrameElementBase.cpp',
-            'html/HTMLFrameElementBase.h',
             'html/HTMLFrameOwnerElement.cpp',
-            'html/HTMLFrameOwnerElement.h',
             'html/HTMLFrameSetElement.cpp',
             'html/HTMLFrameSetElement.h',
             'html/HTMLHRElement.cpp',
             'html/HTMLHRElement.h',
             'html/HTMLHeadElement.cpp',
-            'html/HTMLHeadElement.h',
             'html/HTMLHeadingElement.cpp',
             'html/HTMLHeadingElement.h',
             'html/HTMLHtmlElement.cpp',
             'html/HTMLHtmlElement.h',
             'html/HTMLIFrameElement.cpp',
-            'html/HTMLIFrameElement.h',
             'html/HTMLImageElement.cpp',
             'html/HTMLImageElement.h',
             'html/HTMLImageLoader.cpp',
             'html/HTMLImageLoader.h',
             'html/HTMLInputElement.cpp',
-            'html/HTMLInputElement.h',
             'html/HTMLIsIndexElement.cpp',
             'html/HTMLIsIndexElement.h',
             'html/HTMLKeygenElement.cpp',
@@ -1910,7 +2894,6 @@
             'html/HTMLMarqueeElement.cpp',
             'html/HTMLMarqueeElement.h',
             'html/HTMLMediaElement.cpp',
-            'html/HTMLMediaElement.h',
             'html/HTMLMenuElement.cpp',
             'html/HTMLMenuElement.h',
             'html/HTMLMetaElement.cpp',
@@ -1921,6 +2904,8 @@
             'html/HTMLModElement.h',
             'html/HTMLNameCollection.cpp',
             'html/HTMLNameCollection.h',
+            'html/HTMLNoScriptElement.cpp',
+            'html/HTMLNoScriptElement.h',
             'html/HTMLOListElement.cpp',
             'html/HTMLOListElement.h',
             'html/HTMLObjectElement.cpp',
@@ -1940,9 +2925,7 @@
             'html/HTMLParserErrorCodes.cpp',
             'html/HTMLParserErrorCodes.h',
             'html/HTMLPlugInElement.cpp',
-            'html/HTMLPlugInElement.h',
             'html/HTMLPlugInImageElement.cpp',
-            'html/HTMLPlugInImageElement.h',
             'html/HTMLPreElement.cpp',
             'html/HTMLPreElement.h',
             'html/HTMLProgressElement.cpp',
@@ -1962,13 +2945,11 @@
             'html/HTMLTableCaptionElement.cpp',
             'html/HTMLTableCaptionElement.h',
             'html/HTMLTableCellElement.cpp',
-            'html/HTMLTableCellElement.h',
             'html/HTMLTableColElement.cpp',
             'html/HTMLTableColElement.h',
             'html/HTMLTableElement.cpp',
             'html/HTMLTableElement.h',
             'html/HTMLTablePartElement.cpp',
-            'html/HTMLTablePartElement.h',
             'html/HTMLTableRowElement.cpp',
             'html/HTMLTableRowElement.h',
             'html/HTMLTableRowsCollection.cpp',
@@ -1976,7 +2957,6 @@
             'html/HTMLTableSectionElement.cpp',
             'html/HTMLTableSectionElement.h',
             'html/HTMLTextAreaElement.cpp',
-            'html/HTMLTextAreaElement.h',
             'html/HTMLTitleElement.cpp',
             'html/HTMLTitleElement.h',
             'html/HTMLUListElement.cpp',
@@ -1996,7 +2976,6 @@
             'html/ImageResizerThread.cpp',
             'html/ImageResizerThread.h',
             'html/InputType.cpp',
-            'html/InputType.h',
             'html/IsIndexInputType.cpp',
             'html/IsIndexInputType.h',
             'html/LabelsNodeList.cpp',
@@ -2043,7 +3022,6 @@
             'html/ValidationMessage.h',
             'html/ValidityState.cpp',
             'html/ValidityState.h',
-            'html/VoidCallback.h',
             'html/WeekInputType.cpp',
             'html/WeekInputType.h',
             'html/canvas/ArrayBuffer.cpp',
@@ -2089,6 +3067,7 @@
             'html/canvas/Uint32Array.h',
             'html/canvas/Uint8Array.cpp',
             'html/canvas/Uint8Array.h',
+            'html/canvas/WebGLActiveInfo.h',
             'html/canvas/WebGLBuffer.cpp',
             'html/canvas/WebGLBuffer.h',
             'html/canvas/WebGLContextAttributes.cpp',
@@ -2131,13 +3110,13 @@
             'html/parser/HTMLEntityParser.h',
             'html/parser/HTMLEntitySearch.cpp',
             'html/parser/HTMLEntitySearch.h',
+            'html/parser/HTMLEntityTable.h',
             'html/parser/HTMLFormattingElementList.cpp',
             'html/parser/HTMLFormattingElementList.h',
             'html/parser/HTMLInputStream.h',
             'html/parser/HTMLMetaCharsetParser.cpp',
             'html/parser/HTMLMetaCharsetParser.h',
             'html/parser/HTMLParserIdioms.cpp',
-            'html/parser/HTMLParserIdioms.h',
             'html/parser/HTMLParserScheduler.cpp',
             'html/parser/HTMLParserScheduler.h',
             'html/parser/HTMLPreloadScanner.cpp',
@@ -2168,14 +3147,47 @@
             'html/shadow/SliderThumbElement.h',
             'html/shadow/TextControlInnerElements.cpp',
             'html/shadow/TextControlInnerElements.h',
+            'icu/unicode/parseerr.h',
+            'icu/unicode/platform.h',
+            'icu/unicode/putil.h',
+            'icu/unicode/ubrk.h',
+            'icu/unicode/uchar.h',
+            'icu/unicode/ucnv.h',
+            'icu/unicode/ucnv_cb.h',
+            'icu/unicode/ucnv_err.h',
+            'icu/unicode/ucol.h',
+            'icu/unicode/ucoleitr.h',
+            'icu/unicode/uconfig.h',
+            'icu/unicode/ucsdet.h',
+            'icu/unicode/uenum.h',
+            'icu/unicode/uidna.h',
+            'icu/unicode/uiter.h',
+            'icu/unicode/uloc.h',
+            'icu/unicode/umachine.h',
+            'icu/unicode/unorm.h',
+            'icu/unicode/urename.h',
+            'icu/unicode/uscript.h',
+            'icu/unicode/usearch.h',
+            'icu/unicode/uset.h',
+            'icu/unicode/ushape.h',
+            'icu/unicode/ustring.h',
+            'icu/unicode/utf.h',
+            'icu/unicode/utf16.h',
+            'icu/unicode/utf8.h',
+            'icu/unicode/utf_old.h',
+            'icu/unicode/utypes.h',
+            'icu/unicode/uversion.h',
             'inspector/ConsoleMessage.cpp',
             'inspector/ConsoleMessage.h',
+            'inspector/DOMNodeHighlighter.cpp',
+            'inspector/DOMNodeHighlighter.h',
             'inspector/InjectedScript.cpp',
             'inspector/InjectedScript.h',
             'inspector/InjectedScriptHost.cpp',
             'inspector/InjectedScriptHost.h',
+            'inspector/InjectedScriptManager.cpp',
+            'inspector/InjectedScriptManager.h',
             'inspector/InspectorAgent.cpp',
-            'inspector/InspectorAgent.h',
             'inspector/InspectorApplicationCacheAgent.cpp',
             'inspector/InspectorApplicationCacheAgent.h',
             'inspector/InspectorBrowserDebuggerAgent.cpp',
@@ -2183,14 +3195,11 @@
             'inspector/InspectorCSSAgent.cpp',
             'inspector/InspectorCSSAgent.h',
             'inspector/InspectorClient.cpp',
-            'inspector/InspectorClient.h',
             'inspector/InspectorConsoleAgent.cpp',
             'inspector/InspectorConsoleAgent.h',
             'inspector/InspectorConsoleInstrumentation.h',
             'inspector/InspectorController.cpp',
-            'inspector/InspectorController.h',
             'inspector/InspectorDOMAgent.cpp',
-            'inspector/InspectorDOMAgent.h',
             'inspector/InspectorDOMStorageAgent.cpp',
             'inspector/InspectorDOMStorageAgent.h',
             'inspector/InspectorDOMStorageResource.cpp',
@@ -2202,11 +3211,13 @@
             'inspector/InspectorDatabaseResource.h',
             'inspector/InspectorDebuggerAgent.cpp',
             'inspector/InspectorDebuggerAgent.h',
-            'inspector/InspectorFrontendClient.h',
+            'inspector/InspectorFrontendClientLocal.cpp',
             'inspector/InspectorFrontendHost.cpp',
             'inspector/InspectorFrontendHost.h',
             'inspector/InspectorInstrumentation.cpp',
             'inspector/InspectorInstrumentation.h',
+            'inspector/InspectorPageAgent.cpp',
+            'inspector/InspectorPageAgent.h',
             'inspector/InspectorProfilerAgent.cpp',
             'inspector/InspectorProfilerAgent.h',
             'inspector/InspectorResourceAgent.cpp',
@@ -2220,94 +3231,66 @@
             'inspector/InspectorTimelineAgent.cpp',
             'inspector/InspectorTimelineAgent.h',
             'inspector/InspectorValues.cpp',
-            'inspector/InspectorValues.h',
             'inspector/InspectorWorkerResource.h',
             'inspector/InstrumentingAgents.h',
+            'inspector/PageDebuggerAgent.cpp',
+            'inspector/PageDebuggerAgent.h',
             'inspector/ScriptArguments.cpp',
             'inspector/ScriptArguments.h',
-            'inspector/ScriptBreakpoint.h',
             'inspector/ScriptCallFrame.cpp',
             'inspector/ScriptCallFrame.h',
             'inspector/ScriptCallStack.cpp',
             'inspector/ScriptCallStack.h',
-            'inspector/ScriptDebugListener.h',
             'inspector/ScriptGCEventListener.h',
             'inspector/TimelineRecordFactory.cpp',
             'inspector/TimelineRecordFactory.h',
+            'inspector/WorkerDebuggerAgent.cpp',
+            'inspector/WorkerDebuggerAgent.h',
             'loader/CachedMetadata.h',
             'loader/CrossOriginAccessControl.cpp',
             'loader/CrossOriginAccessControl.h',
             'loader/CrossOriginPreflightResultCache.cpp',
-            'loader/CrossOriginPreflightResultCache.h',
-            'loader/DocumentLoadTiming.h',
             'loader/DocumentLoader.cpp',
-            'loader/DocumentLoader.h',
             'loader/DocumentThreadableLoader.cpp',
             'loader/DocumentThreadableLoader.h',
             'loader/DocumentThreadableLoaderClient.h',
             'loader/DocumentWriter.cpp',
-            'loader/DocumentWriter.h',
             'loader/EmptyClients.h',
             'loader/FTPDirectoryParser.cpp',
             'loader/FTPDirectoryParser.h',
             'loader/FormState.cpp',
-            'loader/FormState.h',
             'loader/FormSubmission.cpp',
-            'loader/FormSubmission.h',
             'loader/FrameLoader.cpp',
-            'loader/FrameLoader.h',
-            'loader/FrameLoaderClient.h',
             'loader/FrameLoaderStateMachine.cpp',
-            'loader/FrameLoaderStateMachine.h',
-            'loader/FrameLoaderTypes.h',
-            'loader/FrameNetworkingContext.h',
             'loader/HistoryController.cpp',
-            'loader/HistoryController.h',
             'loader/ImageLoader.cpp',
             'loader/ImageLoader.h',
             'loader/MainResourceLoader.cpp',
             'loader/MainResourceLoader.h',
             'loader/NavigationAction.cpp',
-            'loader/NavigationAction.h',
             'loader/NavigationScheduler.cpp',
-            'loader/NavigationScheduler.h',
             'loader/NetscapePlugInStreamLoader.cpp',
-            'loader/NetscapePlugInStreamLoader.h',
             'loader/PingLoader.cpp',
             'loader/PingLoader.h',
             'loader/PlaceholderDocument.cpp',
             'loader/PlaceholderDocument.h',
             'loader/PolicyCallback.cpp',
-            'loader/PolicyCallback.h',
             'loader/PolicyChecker.cpp',
-            'loader/PolicyChecker.h',
             'loader/ProgressTracker.cpp',
-            'loader/ProgressTracker.h',
             'loader/ResourceLoadNotifier.cpp',
-            'loader/ResourceLoadNotifier.h',
             'loader/ResourceLoadScheduler.cpp',
-            'loader/ResourceLoadScheduler.h',
             'loader/ResourceLoader.cpp',
-            'loader/ResourceLoader.h',
             'loader/SinkDocument.cpp',
             'loader/SinkDocument.h',
             'loader/SubframeLoader.cpp',
-            'loader/SubframeLoader.h',
             'loader/SubresourceLoader.cpp',
-            'loader/SubresourceLoader.h',
-            'loader/SubresourceLoaderClient.h',
-            'loader/SubstituteData.h',
-            'loader/SubstituteResource.h',
             'loader/TextResourceDecoder.cpp',
-            'loader/TextResourceDecoder.h',
             'loader/ThreadableLoader.cpp',
-            'loader/ThreadableLoader.h',
             'loader/ThreadableLoaderClient.h',
             'loader/ThreadableLoaderClientWrapper.h',
             'loader/WorkerThreadableLoader.cpp',
             'loader/WorkerThreadableLoader.h',
             'loader/appcache/ApplicationCache.cpp',
-            'loader/appcache/ApplicationCache.h',
             'loader/appcache/ApplicationCacheGroup.cpp',
             'loader/appcache/ApplicationCacheGroup.h',
             'loader/appcache/ApplicationCacheHost.cpp',
@@ -2315,57 +3298,44 @@
             'loader/appcache/ApplicationCacheResource.cpp',
             'loader/appcache/ApplicationCacheResource.h',
             'loader/appcache/ApplicationCacheStorage.cpp',
-            'loader/appcache/ApplicationCacheStorage.h',
             'loader/appcache/DOMApplicationCache.cpp',
             'loader/appcache/DOMApplicationCache.h',
             'loader/appcache/ManifestParser.cpp',
             'loader/appcache/ManifestParser.h',
-            'loader/archive/Archive.h',
             'loader/archive/ArchiveFactory.cpp',
             'loader/archive/ArchiveFactory.h',
             'loader/archive/ArchiveResource.cpp',
-            'loader/archive/ArchiveResource.h',
             'loader/archive/ArchiveResourceCollection.cpp',
             'loader/archive/ArchiveResourceCollection.h',
             'loader/archive/cf/LegacyWebArchive.cpp',
-            'loader/archive/cf/LegacyWebArchive.h',
             'loader/archive/cf/LegacyWebArchiveMac.mm',
-            'loader/cache/CachePolicy.h',
             'loader/cache/CachedCSSStyleSheet.cpp',
             'loader/cache/CachedCSSStyleSheet.h',
             'loader/cache/CachedFont.cpp',
             'loader/cache/CachedFont.h',
             'loader/cache/CachedImage.cpp',
-            'loader/cache/CachedImage.h',
             'loader/cache/CachedResource.cpp',
-            'loader/cache/CachedResource.h',
-            'loader/cache/CachedResourceClient.h',
             'loader/cache/CachedResourceClientWalker.cpp',
             'loader/cache/CachedResourceClientWalker.h',
             'loader/cache/CachedResourceHandle.cpp',
-            'loader/cache/CachedResourceHandle.h',
             'loader/cache/CachedResourceLoader.cpp',
-            'loader/cache/CachedResourceLoader.h',
             'loader/cache/CachedResourceRequest.cpp',
-            'loader/cache/CachedResourceRequest.h',
             'loader/cache/CachedScript.cpp',
             'loader/cache/CachedScript.h',
             'loader/cache/CachedXSLStyleSheet.cpp',
             'loader/cache/CachedXSLStyleSheet.h',
             'loader/cache/MemoryCache.cpp',
-            'loader/cache/MemoryCache.h',
+            'loader/cf/ResourceLoaderCFNet.cpp',
             'loader/icon/IconDatabase.cpp',
-            'loader/icon/IconDatabase.h',
-            'loader/icon/IconDatabaseClient.h',
-            'loader/icon/IconDatabaseNone.cpp',
+            'loader/icon/IconDatabaseBase.cpp',
             'loader/icon/IconLoader.cpp',
             'loader/icon/IconLoader.h',
             'loader/icon/IconRecord.cpp',
             'loader/icon/IconRecord.h',
             'loader/icon/PageURLRecord.cpp',
             'loader/icon/PageURLRecord.h',
+            'loader/icon/wince/IconDatabaseWinCE.cpp',
             'loader/mac/DocumentLoaderMac.cpp',
-            'loader/mac/LoaderNSURLExtras.h',
             'loader/mac/LoaderNSURLExtras.mm',
             'loader/mac/ResourceLoaderMac.mm',
             'loader/win/DocumentLoaderWin.cpp',
@@ -2383,19 +3353,12 @@
             'notifications/NotificationCenter.cpp',
             'notifications/NotificationCenter.h',
             'notifications/NotificationContents.h',
-            'notifications/NotificationPresenter.h',
             'page/BarInfo.cpp',
             'page/BarInfo.h',
             'page/Chrome.cpp',
-            'page/Chrome.h',
-            'page/ChromeClient.h',
             'page/Console.cpp',
-            'page/Console.h',
             'page/ContentSecurityPolicy.cpp',
-            'page/ContentSecurityPolicy.h',
-            'page/ContextMenuClient.h',
             'page/ContextMenuController.cpp',
-            'page/ContextMenuController.h',
             'page/ContextMenuProvider.h',
             'page/Crypto.cpp',
             'page/Crypto.h',
@@ -2404,47 +3367,25 @@
             'page/DOMTimer.cpp',
             'page/DOMTimer.h',
             'page/DOMWindow.cpp',
-            'page/DOMWindow.h',
-            'page/DragActions.h',
-            'page/DragClient.h',
             'page/DragController.cpp',
-            'page/DragController.h',
-            'page/EditorClient.h',
             'page/EventHandler.cpp',
-            'page/EventHandler.h',
             'page/EventSource.cpp',
             'page/EventSource.h',
             'page/FocusController.cpp',
-            'page/FocusController.h',
-            'page/FocusDirection.h',
             'page/Frame.cpp',
-            'page/Frame.h',
             'page/FrameActionScheduler.cpp',
             'page/FrameActionScheduler.h',
-            'page/FrameLoadRequest.h',
             'page/FrameTree.cpp',
-            'page/FrameTree.h',
             'page/FrameView.cpp',
-            'page/FrameView.h',
             'page/Geolocation.cpp',
-            'page/Geolocation.h',
-            'page/GeolocationClient.h',
             'page/GeolocationController.cpp',
-            'page/GeolocationController.h',
-            'page/GeolocationError.h',
-            'page/GeolocationPosition.h',
             'page/GeolocationPositionCache.cpp',
-            'page/GeolocationPositionCache.h',
-            'page/Geoposition.h',
             'page/GroupSettings.cpp',
-            'page/GroupSettings.h',
-            'page/HaltablePlugin.h',
             'page/History.cpp',
             'page/History.h',
             'page/Location.cpp',
             'page/Location.h',
             'page/MemoryInfo.cpp',
-            'page/MemoryInfo.h',
             'page/MouseEventWithHitTestResults.cpp',
             'page/MouseEventWithHitTestResults.h',
             'page/Navigator.cpp',
@@ -2454,9 +3395,7 @@
             'page/OriginAccessEntry.cpp',
             'page/OriginAccessEntry.h',
             'page/Page.cpp',
-            'page/Page.h',
             'page/PageGroup.cpp',
-            'page/PageGroup.h',
             'page/PageGroupLoadDeferrer.cpp',
             'page/PageGroupLoadDeferrer.h',
             'page/Performance.cpp',
@@ -2467,22 +3406,12 @@
             'page/PerformanceTiming.h',
             'page/PluginHalter.cpp',
             'page/PluginHalter.h',
-            'page/PluginHalterClient.h',
-            'page/PositionCallback.h',
-            'page/PositionError.h',
-            'page/PositionErrorCallback.h',
-            'page/PositionOptions.h',
             'page/PrintContext.cpp',
-            'page/PrintContext.h',
             'page/Screen.cpp',
             'page/Screen.h',
             'page/SecurityOrigin.cpp',
-            'page/SecurityOrigin.h',
-            'page/SecurityOriginHash.h',
             'page/Settings.cpp',
-            'page/Settings.h',
             'page/SpatialNavigation.cpp',
-            'page/SpatialNavigation.h',
             'page/SpeechInput.cpp',
             'page/SpeechInput.h',
             'page/SpeechInputClient.h',
@@ -2495,22 +3424,20 @@
             'page/SpeechInputResultList.h',
             'page/SuspendableTimer.cpp',
             'page/SuspendableTimer.h',
-            'page/UserContentTypes.h',
             'page/UserContentURLPattern.cpp',
-            'page/UserContentURLPattern.h',
-            'page/UserScript.h',
-            'page/UserScriptTypes.h',
-            'page/UserStyleSheet.h',
-            'page/UserStyleSheetTypes.h',
+            'page/WebKitAnimation.cpp',
+            'page/WebKitAnimation.h',
+            'page/WebKitAnimationList.cpp',
+            'page/WebKitAnimationList.h',
             'page/WebKitPoint.h',
             'page/WindowFeatures.cpp',
-            'page/WindowFeatures.h',
             'page/WorkerNavigator.cpp',
             'page/WorkerNavigator.h',
+            'page/android/DragControllerAndroid.cpp',
+            'page/android/EventHandlerAndroid.cpp',
             'page/animation/AnimationBase.cpp',
             'page/animation/AnimationBase.h',
             'page/animation/AnimationController.cpp',
-            'page/animation/AnimationController.h',
             'page/animation/AnimationControllerPrivate.h',
             'page/animation/CompositeAnimation.cpp',
             'page/animation/CompositeAnimation.h',
@@ -2518,24 +3445,29 @@
             'page/animation/ImplicitAnimation.h',
             'page/animation/KeyframeAnimation.cpp',
             'page/animation/KeyframeAnimation.h',
+            'page/brew/ChromeClientBrew.h',
+            'page/brew/DragControllerBrew.cpp',
+            'page/brew/EventHandlerBrew.cpp',
+            'page/brew/FrameBrew.cpp',
             'page/chromium/ChromeClientChromium.h',
             'page/chromium/DragControllerChromium.cpp',
             'page/chromium/EventHandlerChromium.cpp',
             'page/chromium/FrameChromium.cpp',
+            'page/efl/DragControllerEfl.cpp',
+            'page/efl/EventHandlerEfl.cpp',
+            'page/efl/FrameEfl.cpp',
             'page/gtk/DragControllerGtk.cpp',
             'page/gtk/EventHandlerGtk.cpp',
             'page/gtk/FrameGtk.cpp',
+            'page/haiku/DragControllerHaiku.cpp',
+            'page/haiku/EventHandlerHaiku.cpp',
+            'page/haiku/FrameHaiku.cpp',
             'page/mac/ChromeMac.mm',
             'page/mac/DragControllerMac.mm',
             'page/mac/EventHandlerMac.mm',
             'page/mac/FrameMac.mm',
             'page/mac/PageMac.cpp',
-            'page/mac/WebCoreFrameView.h',
-            'page/mac/WebCoreKeyboardUIMode.h',
-            'page/mac/WebCoreViewFactory.h',
             'page/mac/WebCoreViewFactory.m',
-            'page/mac/WebDashboardRegion.h',
-            'page/mac/WebDashboardRegion.m',
             'page/qt/DragControllerQt.cpp',
             'page/qt/EventHandlerQt.cpp',
             'page/qt/FrameQt.cpp',
@@ -2545,116 +3477,77 @@
             'page/win/FrameCairoWin.cpp',
             'page/win/FrameWin.cpp',
             'page/win/FrameWin.h',
-            'page/win/PageWin.cpp',
+            'page/wince/FrameWinCE.cpp',
             'page/wx/DragControllerWx.cpp',
             'page/wx/EventHandlerWx.cpp',
+            'page/wx/FrameWx.cpp',
             'platform/Arena.cpp',
             'platform/Arena.h',
-            'platform/AsyncFileStream.h',
             'platform/AsyncFileSystem.cpp',
             'platform/AsyncFileSystem.h',
             'platform/AsyncFileSystemCallbacks.h',
             'platform/AutodrainedPool.h',
             'platform/ContentType.cpp',
             'platform/ContentType.h',
-            'platform/ContextMenu.h',
-            'platform/ContextMenuItem.h',
-            'platform/Cookie.h',
-            'platform/CookieJar.h',
+            'platform/ContextMenu.cpp',
+            'platform/ContextMenuItem.cpp',
             'platform/CrossThreadCopier.cpp',
             'platform/CrossThreadCopier.h',
-            'platform/Cursor.h',
+            'platform/Cursor.cpp',
+            'platform/DefaultLocalizationStrategy.cpp',
             'platform/DragData.cpp',
-            'platform/DragData.h',
             'platform/DragImage.cpp',
-            'platform/DragImage.h',
             'platform/EventLoop.h',
             'platform/FileChooser.cpp',
-            'platform/FileChooser.h',
             'platform/FileMetadata.h',
             'platform/FileStream.cpp',
-            'platform/FileStream.h',
-            'platform/FileStreamClient.h',
             'platform/FileSystem.cpp',
-            'platform/FileSystem.h',
             'platform/FloatConversion.h',
             'platform/GeolocationService.cpp',
             'platform/GeolocationService.h',
-            'platform/HostWindow.h',
+            'platform/HashTools.h',
             'platform/KURL.cpp',
-            'platform/KURL.h',
             'platform/KURLGoogle.cpp',
             'platform/KURLGooglePrivate.h',
-            'platform/KURLHash.h',
             'platform/KillRing.h',
             'platform/KillRingNone.cpp',
             'platform/Language.cpp',
-            'platform/Language.h',
             'platform/Length.cpp',
-            'platform/Length.h',
-            'platform/LengthBox.h',
-            'platform/LengthSize.h',
             'platform/LinkHash.cpp',
-            'platform/LinkHash.h',
-            'platform/LocalizedStrings.h',
+            'platform/LocalizedStrings.cpp',
             'platform/Logging.cpp',
-            'platform/Logging.h',
             'platform/MIMETypeRegistry.cpp',
-            'platform/MIMETypeRegistry.h',
-            'platform/NotImplemented.h',
             'platform/Pasteboard.h',
-            'platform/PlatformKeyboardEvent.h',
-            'platform/PlatformMenuDescription.h',
-            'platform/PlatformMouseEvent.h',
-            'platform/PlatformScreen.h',
-            'platform/PlatformWheelEvent.h',
-            'platform/PopupMenu.h',
-            'platform/PopupMenuClient.h',
-            'platform/PopupMenuStyle.h',
+            'platform/PlatformStrategies.cpp',
+            'platform/PlatformTouchEvent.h',
+            'platform/PlatformTouchPoint.h',
             'platform/PurgeableBuffer.h',
+            'platform/RunLoopTimer.h',
             'platform/SSLKeyGenerator.h',
             'platform/SchemeRegistry.cpp',
-            'platform/SchemeRegistry.h',
             'platform/ScrollAnimator.cpp',
             'platform/ScrollAnimator.h',
             'platform/ScrollAnimatorWin.cpp',
             'platform/ScrollAnimatorWin.h',
-            'platform/ScrollTypes.h',
             'platform/ScrollView.cpp',
-            'platform/ScrollView.h',
             'platform/ScrollableArea.cpp',
-            'platform/ScrollableArea.h',
             'platform/Scrollbar.cpp',
-            'platform/Scrollbar.h',
-            'platform/ScrollbarTheme.h',
             'platform/ScrollbarThemeComposite.cpp',
             'platform/ScrollbarThemeComposite.h',
-            'platform/SearchPopupMenu.h',
             'platform/SecureTextInput.cpp',
             'platform/SecureTextInput.h',
             'platform/SharedBuffer.cpp',
-            'platform/SharedBuffer.h',
             'platform/SharedTimer.h',
             'platform/Sound.h',
-            'platform/StaticConstructors.h',
-            'platform/SystemTime.h',
+            'platform/SuddenTermination.h',
             'platform/Theme.cpp',
-            'platform/Theme.h',
-            'platform/ThemeTypes.h',
-            'platform/ThreadCheck.h',
             'platform/ThreadGlobalData.cpp',
-            'platform/ThreadGlobalData.h',
             'platform/ThreadTimers.cpp',
             'platform/ThreadTimers.h',
             'platform/Timer.cpp',
-            'platform/Timer.h',
-            'platform/TreeShared.h',
-            'platform/URLString.h',
             'platform/UUID.cpp',
             'platform/UUID.h',
             'platform/Widget.cpp',
-            'platform/Widget.h',
-            'platform/WindowsKeyboardCodes.h',
             'platform/android/ClipboardAndroid.cpp',
             'platform/android/ClipboardAndroid.h',
             'platform/android/CursorAndroid.cpp',
@@ -2685,10 +3578,7 @@
             'platform/android/TemporaryLinkStubs.cpp',
             'platform/android/WidgetAndroid.cpp',
             'platform/animation/Animation.cpp',
-            'platform/animation/Animation.h',
             'platform/animation/AnimationList.cpp',
-            'platform/animation/AnimationList.h',
-            'platform/animation/TimingFunction.h',
             'platform/audio/AudioArray.h',
             'platform/audio/AudioBus.cpp',
             'platform/audio/AudioBus.h',
@@ -2742,6 +3632,8 @@
             'platform/audio/ReverbConvolverStage.h',
             'platform/audio/ReverbInputBuffer.cpp',
             'platform/audio/ReverbInputBuffer.h',
+            'platform/audio/SincResampler.cpp',
+            'platform/audio/SincResampler.h',
             'platform/audio/VectorMath.cpp',
             'platform/audio/VectorMath.h',
             'platform/audio/chromium/AudioBusChromium.cpp',
@@ -2787,15 +3679,15 @@
             'platform/brew/TemporaryLinkStubs.cpp',
             'platform/brew/WidgetBrew.cpp',
             'platform/cf/BinaryPropertyList.cpp',
-            'platform/cf/BinaryPropertyList.h',
             'platform/cf/FileSystemCF.cpp',
             'platform/cf/KURLCFNet.cpp',
             'platform/cf/RunLoopTimerCF.cpp',
             'platform/cf/SchedulePair.cpp',
-            'platform/cf/SchedulePair.h',
             'platform/cf/SharedBufferCF.cpp',
             'platform/chromium/ChromiumDataObject.cpp',
             'platform/chromium/ChromiumDataObject.h',
+            'platform/chromium/ChromiumDataObjectLegacy.cpp',
+            'platform/chromium/ChromiumDataObjectLegacy.h',
             'platform/chromium/ClipboardChromium.cpp',
             'platform/chromium/ClipboardChromium.h',
             'platform/chromium/ClipboardChromiumLinux.cpp',
@@ -2808,6 +3700,10 @@
             'platform/chromium/ContextMenuChromium.cpp',
             'platform/chromium/ContextMenuItemChromium.cpp',
             'platform/chromium/CursorChromium.cpp',
+            'platform/chromium/DataTransferItemChromium.cpp',
+            'platform/chromium/DataTransferItemChromium.h',
+            'platform/chromium/DataTransferItemsChromium.cpp',
+            'platform/chromium/DataTransferItemsChromium.h',
             'platform/chromium/DragDataChromium.cpp',
             'platform/chromium/DragDataRef.h',
             'platform/chromium/DragImageChromiumMac.cpp',
@@ -2823,6 +3719,7 @@
             'platform/chromium/FramelessScrollViewClient.h',
             'platform/chromium/KeyCodeConversion.h',
             'platform/chromium/KeyCodeConversionGtk.cpp',
+            'platform/chromium/KeyboardCodes.h',
             'platform/chromium/LanguageChromium.cpp',
             'platform/chromium/LinkHashChromium.cpp',
             'platform/chromium/MIMETypeRegistryChromium.cpp',
@@ -2838,6 +3735,8 @@
             'platform/chromium/PopupMenuChromium.cpp',
             'platform/chromium/PopupMenuChromium.h',
             'platform/chromium/PopupMenuPrivate.h',
+            'platform/chromium/ReadableDataObject.cpp',
+            'platform/chromium/ReadableDataObject.h',
             'platform/chromium/SSLKeyGeneratorChromium.cpp',
             'platform/chromium/ScrollbarThemeChromium.cpp',
             'platform/chromium/ScrollbarThemeChromium.h',
@@ -2857,9 +3756,10 @@
             'platform/chromium/TemporaryLinkStubs.cpp',
             'platform/chromium/ThemeChromiumMac.h',
             'platform/chromium/ThemeChromiumMac.mm',
+            'platform/chromium/TraceEvent.h',
             'platform/chromium/WidgetChromium.cpp',
-            'platform/chromium/WindowsVersion.cpp',
-            'platform/chromium/WindowsVersion.h',
+            'platform/chromium/WritableDataObject.cpp',
+            'platform/chromium/WritableDataObject.h',
             'platform/cocoa/KeyEventCocoa.h',
             'platform/cocoa/KeyEventCocoa.mm',
             'platform/efl/ClipboardEfl.cpp',
@@ -2902,98 +3802,66 @@
             'platform/efl/SystemTimeEfl.cpp',
             'platform/efl/TemporaryLinkStubs.cpp',
             'platform/efl/WidgetEfl.cpp',
+            'platform/graphics/ANGLEWebKitBridge.cpp',
+            'platform/graphics/ANGLEWebKitBridge.h',
             'platform/graphics/BitmapImage.cpp',
-            'platform/graphics/BitmapImage.h',
             'platform/graphics/Color.cpp',
-            'platform/graphics/Color.h',
-            'platform/graphics/DashArray.h',
+            'platform/graphics/ContextShadow.cpp',
+            'platform/graphics/ContextShadow.h',
             'platform/graphics/Extensions3D.h',
             'platform/graphics/FloatPoint.cpp',
-            'platform/graphics/FloatPoint.h',
             'platform/graphics/FloatPoint3D.cpp',
-            'platform/graphics/FloatPoint3D.h',
             'platform/graphics/FloatQuad.cpp',
-            'platform/graphics/FloatQuad.h',
             'platform/graphics/FloatRect.cpp',
-            'platform/graphics/FloatRect.h',
             'platform/graphics/FloatSize.cpp',
-            'platform/graphics/FloatSize.h',
             'platform/graphics/Font.cpp',
-            'platform/graphics/Font.h',
             'platform/graphics/FontCache.cpp',
-            'platform/graphics/FontCache.h',
             'platform/graphics/FontData.cpp',
-            'platform/graphics/FontData.h',
             'platform/graphics/FontDescription.cpp',
-            'platform/graphics/FontDescription.h',
             'platform/graphics/FontFallbackList.cpp',
-            'platform/graphics/FontFallbackList.h',
             'platform/graphics/FontFamily.cpp',
-            'platform/graphics/FontFamily.h',
             'platform/graphics/FontFastPath.cpp',
-            'platform/graphics/FontMetrics.h',
-            'platform/graphics/FontRenderingMode.h',
-            'platform/graphics/FontSelector.h',
-            'platform/graphics/FontSmoothingMode.h',
-            'platform/graphics/FontTraitsMask.h',
+            'platform/graphics/FontPlatformData.cpp',
+            'platform/graphics/FontPlatformData.h',
             'platform/graphics/GeneratedImage.cpp',
             'platform/graphics/GeneratedImage.h',
-            'platform/graphics/Generator.h',
-            'platform/graphics/GlyphBuffer.h',
-            'platform/graphics/GlyphMetricsMap.h',
             'platform/graphics/GlyphPageTreeNode.cpp',
-            'platform/graphics/GlyphPageTreeNode.h',
             'platform/graphics/Gradient.cpp',
-            'platform/graphics/Gradient.h',
             'platform/graphics/GraphicsContext.cpp',
-            'platform/graphics/GraphicsContext.h',
             'platform/graphics/GraphicsContext3D.cpp',
-            'platform/graphics/GraphicsContext3D.h',
-            'platform/graphics/GraphicsContextPrivate.h',
             'platform/graphics/GraphicsLayer.cpp',
-            'platform/graphics/GraphicsLayer.h',
-            'platform/graphics/GraphicsLayerClient.h',
             'platform/graphics/GraphicsTypes.cpp',
-            'platform/graphics/GraphicsTypes.h',
-            'platform/graphics/GraphicsTypes3D.h',
-            'platform/graphics/Icon.h',
             'platform/graphics/Image.cpp',
-            'platform/graphics/Image.h',
             'platform/graphics/ImageBuffer.cpp',
-            'platform/graphics/ImageBuffer.h',
-            'platform/graphics/ImageObserver.h',
             'platform/graphics/ImageSource.cpp',
-            'platform/graphics/ImageSource.h',
-            'platform/graphics/IntPoint.h',
             'platform/graphics/IntRect.cpp',
-            'platform/graphics/IntRect.h',
-            'platform/graphics/IntSize.h',
-            'platform/graphics/IntSizeHash.h',
             'platform/graphics/MediaPlayer.cpp',
-            'platform/graphics/MediaPlayer.cpp',
-            'platform/graphics/MediaPlayer.h',
             'platform/graphics/MediaPlayerPrivate.h',
             'platform/graphics/Path.cpp',
-            'platform/graphics/Path.h',
             'platform/graphics/PathTraversalState.cpp',
             'platform/graphics/PathTraversalState.h',
             'platform/graphics/Pattern.cpp',
-            'platform/graphics/Pattern.h',
             'platform/graphics/RoundedIntRect.cpp',
-            'platform/graphics/RoundedIntRect.h',
             'platform/graphics/SegmentedFontData.cpp',
             'platform/graphics/SegmentedFontData.h',
             'platform/graphics/ShadowBlur.cpp',
             'platform/graphics/ShadowBlur.h',
             'platform/graphics/SimpleFontData.cpp',
-            'platform/graphics/SimpleFontData.h',
             'platform/graphics/StringTruncator.cpp',
-            'platform/graphics/StringTruncator.h',
             'platform/graphics/StrokeStyleApplier.h',
-            'platform/graphics/TextRun.h',
+            'platform/graphics/Tile.h',
+            'platform/graphics/TiledBackingStore.cpp',
+            'platform/graphics/TiledBackingStore.h',
+            'platform/graphics/TiledBackingStoreClient.h',
             'platform/graphics/UnitBezier.h',
+            'platform/graphics/WOFFFileFormat.cpp',
+            'platform/graphics/WOFFFileFormat.h',
             'platform/graphics/WidthIterator.cpp',
             'platform/graphics/WidthIterator.h',
+            'platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp',
+            'platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h',
+            'platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h',
+            'platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm',
             'platform/graphics/brew/IconBrew.cpp',
             'platform/graphics/brew/ImageBrew.cpp',
             'platform/graphics/brew/IntPointBrew.cpp',
@@ -3044,14 +3912,12 @@
             'platform/graphics/cg/FloatPointCG.cpp',
             'platform/graphics/cg/FloatRectCG.cpp',
             'platform/graphics/cg/FloatSizeCG.cpp',
-            'platform/graphics/cg/FontPlatformData.h',
             'platform/graphics/cg/GradientCG.cpp',
             'platform/graphics/cg/GraphicsContext3DCG.cpp',
             'platform/graphics/cg/GraphicsContextCG.cpp',
             'platform/graphics/cg/GraphicsContextCG.h',
             'platform/graphics/cg/GraphicsContextPlatformPrivateCG.h',
             'platform/graphics/cg/ImageBufferCG.cpp',
-            'platform/graphics/cg/ImageBufferData.h',
             'platform/graphics/cg/ImageCG.cpp',
             'platform/graphics/cg/ImageSourceCG.cpp',
             'platform/graphics/cg/ImageSourceCG.h',
@@ -3145,11 +4011,16 @@
             'platform/graphics/chromium/VideoLayerChromium.h',
             'platform/graphics/chromium/WebGLLayerChromium.cpp',
             'platform/graphics/chromium/WebGLLayerChromium.h',
+            'platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp',
+            'platform/graphics/chromium/cc/CCCanvasLayerImpl.h',
             'platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp',
             'platform/graphics/chromium/cc/CCHeadsUpDisplay.h',
             'platform/graphics/chromium/cc/CCLayerImpl.cpp',
             'platform/graphics/chromium/cc/CCLayerImpl.h',
-            'platform/graphics/cocoa/FontPlatformData.h',
+            'platform/graphics/chromium/cc/CCPluginLayerImpl.cpp',
+            'platform/graphics/chromium/cc/CCPluginLayerImpl.h',
+            'platform/graphics/chromium/cc/CCVideoLayerImpl.cpp',
+            'platform/graphics/chromium/cc/CCVideoLayerImpl.h',
             'platform/graphics/cocoa/FontPlatformDataCocoa.mm',
             'platform/graphics/efl/FontEfl.cpp',
             'platform/graphics/efl/IconEfl.cpp',
@@ -3203,13 +4074,23 @@
             'platform/graphics/filters/SourceGraphic.h',
             'platform/graphics/filters/SpotLightSource.cpp',
             'platform/graphics/filters/SpotLightSource.h',
+            'platform/graphics/freetype/FontCacheFreeType.cpp',
+            'platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp',
+            'platform/graphics/freetype/FontPlatformData.h',
+            'platform/graphics/freetype/FontPlatformDataFreeType.cpp',
+            'platform/graphics/freetype/GlyphPageTreeNodeFreeType.cpp',
+            'platform/graphics/freetype/SimpleFontDataFreeType.cpp',
+            'platform/graphics/gpu/BicubicShader.cpp',
+            'platform/graphics/gpu/BicubicShader.h',
+            'platform/graphics/gpu/ConvolutionShader.cpp',
+            'platform/graphics/gpu/ConvolutionShader.h',
             'platform/graphics/gpu/DrawingBuffer.cpp',
             'platform/graphics/gpu/DrawingBuffer.h',
-            'platform/graphics/gpu/LoopBLinnLocalTriangulator.h',
             'platform/graphics/gpu/LoopBlinnClassifier.cpp',
             'platform/graphics/gpu/LoopBlinnClassifier.h',
             'platform/graphics/gpu/LoopBlinnConstants.h',
             'platform/graphics/gpu/LoopBlinnLocalTriangulator.cpp',
+            'platform/graphics/gpu/LoopBlinnLocalTriangulator.h',
             'platform/graphics/gpu/LoopBlinnMathUtils.cpp',
             'platform/graphics/gpu/LoopBlinnMathUtils.h',
             'platform/graphics/gpu/LoopBlinnPathCache.cpp',
@@ -3238,6 +4119,30 @@
             'platform/graphics/gpu/Texture.h',
             'platform/graphics/gpu/TilingData.cpp',
             'platform/graphics/gpu/TilingData.h',
+            'platform/graphics/gpu/mac/DrawingBufferMac.mm',
+            'platform/graphics/gpu/qt/DrawingBufferQt.cpp',
+            'platform/graphics/gstreamer/GOwnPtrGStreamer.cpp',
+            'platform/graphics/gstreamer/GOwnPtrGStreamer.h',
+            'platform/graphics/gstreamer/GRefPtrGStreamer.cpp',
+            'platform/graphics/gstreamer/GRefPtrGStreamer.h',
+            'platform/graphics/gstreamer/GStreamerGWorld.cpp',
+            'platform/graphics/gstreamer/GStreamerGWorld.h',
+            'platform/graphics/gstreamer/ImageGStreamer.h',
+            'platform/graphics/gstreamer/ImageGStreamerCG.mm',
+            'platform/graphics/gstreamer/ImageGStreamerCairo.cpp',
+            'platform/graphics/gstreamer/ImageGStreamerQt.cpp',
+            'platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp',
+            'platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h',
+            'platform/graphics/gstreamer/PlatformVideoWindow.h',
+            'platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp',
+            'platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp',
+            'platform/graphics/gstreamer/PlatformVideoWindowMac.mm',
+            'platform/graphics/gstreamer/PlatformVideoWindowPrivate.h',
+            'platform/graphics/gstreamer/PlatformVideoWindowQt.cpp',
+            'platform/graphics/gstreamer/VideoSinkGStreamer.cpp',
+            'platform/graphics/gstreamer/VideoSinkGStreamer.h',
+            'platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp',
+            'platform/graphics/gstreamer/WebKitWebSourceGStreamer.h',
             'platform/graphics/gtk/ColorGtk.cpp',
             'platform/graphics/gtk/FontGtk.cpp',
             'platform/graphics/gtk/GdkCairoUtilities.cpp',
@@ -3269,7 +4174,6 @@
             'platform/graphics/haiku/SimpleFontDataHaiku.cpp',
             'platform/graphics/haiku/StillImageHaiku.cpp',
             'platform/graphics/haiku/StillImageHaiku.h',
-            'platform/graphics/mac/ColorMac.h',
             'platform/graphics/mac/ColorMac.mm',
             'platform/graphics/mac/ComplexTextController.cpp',
             'platform/graphics/mac/ComplexTextController.h',
@@ -3293,7 +4197,6 @@
             'platform/graphics/mac/IntSizeMac.mm',
             'platform/graphics/mac/MediaPlayerPrivateQTKit.h',
             'platform/graphics/mac/MediaPlayerPrivateQTKit.mm',
-            'platform/graphics/mac/MediaPlayerProxy.h',
             'platform/graphics/mac/SimpleFontDataATSUI.mm',
             'platform/graphics/mac/SimpleFontDataCoreText.cpp',
             'platform/graphics/mac/SimpleFontDataMac.mm',
@@ -3303,10 +4206,38 @@
             'platform/graphics/mac/WebLayer.mm',
             'platform/graphics/mac/WebTiledLayer.h',
             'platform/graphics/mac/WebTiledLayer.mm',
+            'platform/graphics/opengl/Extensions3DOpenGL.cpp',
+            'platform/graphics/opengl/Extensions3DOpenGL.h',
+            'platform/graphics/opengl/GraphicsContext3DOpenGL.cpp',
+            'platform/graphics/opengl/TextureMapperGL.cpp',
+            'platform/graphics/opengl/TextureMapperGL.h',
             'platform/graphics/opentype/OpenTypeSanitizer.cpp',
             'platform/graphics/opentype/OpenTypeSanitizer.h',
             'platform/graphics/opentype/OpenTypeUtilities.cpp',
             'platform/graphics/opentype/OpenTypeUtilities.h',
+            'platform/graphics/openvg/EGLDisplayOpenVG.cpp',
+            'platform/graphics/openvg/EGLDisplayOpenVG.h',
+            'platform/graphics/openvg/EGLUtils.h',
+            'platform/graphics/openvg/GraphicsContextOpenVG.cpp',
+            'platform/graphics/openvg/ImageOpenVG.cpp',
+            'platform/graphics/openvg/PainterOpenVG.cpp',
+            'platform/graphics/openvg/PainterOpenVG.h',
+            'platform/graphics/openvg/PathOpenVG.cpp',
+            'platform/graphics/openvg/PlatformPathOpenVG.h',
+            'platform/graphics/openvg/SharedResourceOpenVG.cpp',
+            'platform/graphics/openvg/SharedResourceOpenVG.h',
+            'platform/graphics/openvg/SurfaceOpenVG.cpp',
+            'platform/graphics/openvg/SurfaceOpenVG.h',
+            'platform/graphics/openvg/TiledImageOpenVG.cpp',
+            'platform/graphics/openvg/TiledImageOpenVG.h',
+            'platform/graphics/openvg/VGUtils.cpp',
+            'platform/graphics/openvg/VGUtils.h',
+            'platform/graphics/pango/FontCachePango.cpp',
+            'platform/graphics/pango/FontCustomPlatformDataPango.cpp',
+            'platform/graphics/pango/FontPlatformData.h',
+            'platform/graphics/pango/FontPlatformDataPango.cpp',
+            'platform/graphics/pango/GlyphPageTreeNodePango.cpp',
+            'platform/graphics/pango/SimpleFontDataPango.cpp',
             'platform/graphics/qt/ColorQt.cpp',
             'platform/graphics/qt/ContextShadowQt.cpp',
             'platform/graphics/qt/Extensions3DQt.cpp',
@@ -3374,8 +4305,13 @@
             'platform/graphics/skia/SkiaUtils.cpp',
             'platform/graphics/skia/SkiaUtils.h',
             'platform/graphics/skia/TransformationMatrixSkia.cpp',
+            'platform/graphics/texmap/GraphicsLayerTextureMapper.cpp',
+            'platform/graphics/texmap/GraphicsLayerTextureMapper.h',
+            'platform/graphics/texmap/TextureMapper.h',
+            'platform/graphics/texmap/TextureMapperNode.cpp',
+            'platform/graphics/texmap/TextureMapperNode.h',
+            'platform/graphics/texmap/TextureMapperPlatformLayer.h',
             'platform/graphics/transforms/AffineTransform.cpp',
-            'platform/graphics/transforms/AffineTransform.h',
             'platform/graphics/transforms/IdentityTransformOperation.h',
             'platform/graphics/transforms/Matrix3DTransformOperation.cpp',
             'platform/graphics/transforms/Matrix3DTransformOperation.h',
@@ -3389,11 +4325,8 @@
             'platform/graphics/transforms/ScaleTransformOperation.h',
             'platform/graphics/transforms/SkewTransformOperation.cpp',
             'platform/graphics/transforms/SkewTransformOperation.h',
-            'platform/graphics/transforms/TransformOperation.h',
             'platform/graphics/transforms/TransformOperations.cpp',
-            'platform/graphics/transforms/TransformOperations.h',
             'platform/graphics/transforms/TransformationMatrix.cpp',
-            'platform/graphics/transforms/TransformationMatrix.h',
             'platform/graphics/transforms/TranslateTransformOperation.cpp',
             'platform/graphics/transforms/TranslateTransformOperation.h',
             'platform/graphics/win/FontCGWin.cpp',
@@ -3542,7 +4475,6 @@
             'platform/gtk/MouseEventGtk.cpp',
             'platform/gtk/PasteboardGtk.cpp',
             'platform/gtk/PasteboardHelper.cpp',
-            'platform/gtk/PasteboardHelper.h',
             'platform/gtk/PlatformScreenGtk.cpp',
             'platform/gtk/PopupMenuGtk.cpp',
             'platform/gtk/PopupMenuGtk.h',
@@ -3614,31 +4546,26 @@
             'platform/image-decoders/ico/ICOImageDecoder.h',
             'platform/image-decoders/jpeg/JPEGImageDecoder.cpp',
             'platform/image-decoders/jpeg/JPEGImageDecoder.h',
+            'platform/image-decoders/openvg/ImageDecoderOpenVG.cpp',
             'platform/image-decoders/png/PNGImageDecoder.cpp',
             'platform/image-decoders/png/PNGImageDecoder.h',
+            'platform/image-decoders/qt/ImageFrameQt.cpp',
             'platform/image-decoders/skia/ImageDecoderSkia.cpp',
             'platform/image-decoders/webp/WEBPImageDecoder.cpp',
             'platform/image-decoders/webp/WEBPImageDecoder.h',
             'platform/image-decoders/wx/ImageDecoderWx.cpp',
-            'platform/image-decoders/zlib/crc32.h',
-            'platform/image-decoders/zlib/deflate.h',
-            'platform/image-decoders/zlib/inffast.h',
-            'platform/image-decoders/zlib/inffixed.h',
-            'platform/image-decoders/zlib/inflate.h',
-            'platform/image-decoders/zlib/inftrees.h',
-            'platform/image-decoders/zlib/mozzconf.h',
-            'platform/image-decoders/zlib/trees.h',
-            'platform/image-decoders/zlib/zconf.h',
-            'platform/image-decoders/zlib/zlib.h',
-            'platform/image-decoders/zlib/zutil.h',
+            'platform/image-encoders/JPEGImageEncoder.cpp',
+            'platform/image-encoders/JPEGImageEncoder.h',
+            'platform/image-encoders/PNGImageEncoder.cpp',
+            'platform/image-encoders/PNGImageEncoder.h',
             'platform/image-encoders/skia/JPEGImageEncoder.cpp',
             'platform/image-encoders/skia/JPEGImageEncoder.h',
             'platform/image-encoders/skia/PNGImageEncoder.cpp',
             'platform/image-encoders/skia/PNGImageEncoder.h',
+            'platform/iphone/KeyEventCodesIPhone.h',
+            'platform/iphone/KeyEventIPhone.mm',
             'platform/mac/AutodrainedPool.mm',
-            'platform/mac/BlockExceptions.h',
             'platform/mac/BlockExceptions.mm',
-            'platform/mac/ClipboardMac.h',
             'platform/mac/ClipboardMac.mm',
             'platform/mac/ContextMenuItemMac.mm',
             'platform/mac/ContextMenuMac.mm',
@@ -3646,11 +4573,11 @@
             'platform/mac/CursorMac.mm',
             'platform/mac/DragDataMac.mm',
             'platform/mac/DragImageMac.mm',
-            'platform/mac/EmptyProtocolDefinitions.h',
             'platform/mac/EventLoopMac.mm',
             'platform/mac/FileChooserMac.mm',
             'platform/mac/FileSystemMac.mm',
-            'platform/mac/FoundationExtras.h',
+            'platform/mac/HTMLConverter.h',
+            'platform/mac/HTMLConverter.mm',
             'platform/mac/KURLMac.mm',
             'platform/mac/KeyEventMac.mm',
             'platform/mac/KillRingMac.mm',
@@ -3664,97 +4591,104 @@
             'platform/mac/PasteboardMac.mm',
             'platform/mac/PlatformMouseEventMac.mm',
             'platform/mac/PlatformScreenMac.mm',
-            'platform/mac/PopupMenuMac.h',
             'platform/mac/PopupMenuMac.mm',
             'platform/mac/PurgeableBufferMac.cpp',
-            'platform/mac/RuntimeApplicationChecks.h',
             'platform/mac/RuntimeApplicationChecks.mm',
-            'platform/mac/SSLKeyGeneratorMac.mm',
+            'platform/mac/SSLKeyGeneratorMac.cpp',
             'platform/mac/SchedulePairMac.mm',
             'platform/mac/ScrollAnimatorMac.h',
             'platform/mac/ScrollAnimatorMac.mm',
             'platform/mac/ScrollViewMac.mm',
             'platform/mac/ScrollbarThemeMac.h',
             'platform/mac/ScrollbarThemeMac.mm',
-            'platform/mac/SearchPopupMenuMac.h',
             'platform/mac/SearchPopupMenuMac.mm',
             'platform/mac/SharedBufferMac.mm',
             'platform/mac/SharedTimerMac.mm',
-            'platform/mac/SoftLinking.h',
             'platform/mac/SoundMac.mm',
             'platform/mac/SuddenTermination.mm',
             'platform/mac/SystemTimeMac.cpp',
             'platform/mac/ThemeMac.h',
             'platform/mac/ThemeMac.mm',
             'platform/mac/ThreadCheck.mm',
-            'platform/mac/WebCoreKeyGenerator.h',
-            'platform/mac/WebCoreKeyGenerator.m',
-            'platform/mac/WebCoreNSStringExtras.h',
             'platform/mac/WebCoreNSStringExtras.mm',
-            'platform/mac/WebCoreObjCExtras.h',
             'platform/mac/WebCoreObjCExtras.mm',
-            'platform/mac/WebCoreSystemInterface.h',
             'platform/mac/WebCoreSystemInterface.mm',
-            'platform/mac/WebCoreView.h',
             'platform/mac/WebCoreView.m',
-            'platform/mac/WebFontCache.h',
             'platform/mac/WebFontCache.mm',
             'platform/mac/WheelEventMac.mm',
             'platform/mac/WidgetMac.mm',
             'platform/mock/DeviceOrientationClientMock.cpp',
-            'platform/mock/DeviceOrientationClientMock.h',
             'platform/mock/GeolocationClientMock.cpp',
-            'platform/mock/GeolocationClientMock.h',
             'platform/mock/GeolocationServiceMock.cpp',
             'platform/mock/GeolocationServiceMock.h',
             'platform/mock/SpeechInputClientMock.cpp',
             'platform/mock/SpeechInputClientMock.h',
             'platform/network/AuthenticationChallengeBase.cpp',
-            'platform/network/AuthenticationChallengeBase.h',
-            'platform/network/AuthenticationClient.h',
             'platform/network/BlobData.cpp',
             'platform/network/BlobData.h',
             'platform/network/BlobRegistry.h',
+            'platform/network/BlobRegistryImpl.cpp',
+            'platform/network/BlobRegistryImpl.h',
+            'platform/network/BlobResourceHandle.cpp',
+            'platform/network/BlobResourceHandle.h',
             'platform/network/BlobStorageData.h',
-            'platform/network/CookieStorage.h',
             'platform/network/Credential.cpp',
-            'platform/network/Credential.h',
+            'platform/network/CredentialStorage.cpp',
             'platform/network/DNS.h',
             'platform/network/DataURL.cpp',
             'platform/network/DataURL.h',
             'platform/network/FormData.cpp',
-            'platform/network/FormData.h',
             'platform/network/FormDataBuilder.cpp',
             'platform/network/FormDataBuilder.h',
             'platform/network/HTTPHeaderMap.cpp',
-            'platform/network/HTTPHeaderMap.h',
             'platform/network/HTTPParsers.cpp',
             'platform/network/HTTPParsers.h',
             'platform/network/NetworkStateNotifier.cpp',
             'platform/network/NetworkStateNotifier.h',
-            'platform/network/NetworkingContext.h',
             'platform/network/ProtectionSpace.cpp',
-            'platform/network/ProtectionSpace.h',
+            'platform/network/ProxyServer.cpp',
             'platform/network/ResourceErrorBase.cpp',
-            'platform/network/ResourceErrorBase.h',
-            'platform/network/ResourceHandleClient.h',
+            'platform/network/ResourceHandle.cpp',
             'platform/network/ResourceHandleInternal.h',
-            'platform/network/ResourceLoadInfo.h',
-            'platform/network/ResourceLoadPriority.h',
-            'platform/network/ResourceLoadTiming.h',
             'platform/network/ResourceRequestBase.cpp',
-            'platform/network/ResourceRequestBase.h',
             'platform/network/ResourceResponseBase.cpp',
-            'platform/network/ResourceResponseBase.h',
             'platform/network/SocketStreamErrorBase.cpp',
             'platform/network/SocketStreamErrorBase.h',
             'platform/network/SocketStreamHandleBase.cpp',
             'platform/network/SocketStreamHandleBase.h',
             'platform/network/SocketStreamHandleClient.h',
+            'platform/network/android/AuthenticationChallenge.h',
+            'platform/network/android/CookieJarAndroid.cpp',
+            'platform/network/android/ProxyServerAndroid.cpp',
+            'platform/network/android/ResourceError.h',
+            'platform/network/android/ResourceHandleAndroid.cpp',
+            'platform/network/android/ResourceLoaderAndroid.h',
+            'platform/network/android/ResourceRequest.h',
+            'platform/network/android/ResourceRequestAndroid.cpp',
+            'platform/network/android/ResourceResponse.h',
+            'platform/network/brew/DNSBrew.cpp',
+            'platform/network/brew/SocketStreamError.h',
+            'platform/network/brew/SocketStreamHandle.h',
+            'platform/network/brew/SocketStreamHandleBrew.cpp',
+            'platform/network/brew/SocketStreamHandlePrivate.h',
             'platform/network/cf/AuthenticationCF.cpp',
             'platform/network/cf/AuthenticationCF.h',
-            'platform/network/cf/AuthenticationChallenge.h',
+            'platform/network/cf/CookieJarCFNet.cpp',
+            'platform/network/cf/CookieStorageCFNet.cpp',
+            'platform/network/cf/CookieStorageCFNet.h',
+            'platform/network/cf/CredentialStorageCFNet.cpp',
             'platform/network/cf/DNSCFNet.cpp',
+            'platform/network/cf/DownloadBundle.h',
+            'platform/network/cf/FormDataStreamCFNet.cpp',
+            'platform/network/cf/FormDataStreamCFNet.h',
+            'platform/network/cf/LoaderRunLoopCF.cpp',
+            'platform/network/cf/LoaderRunLoopCF.h',
+            'platform/network/cf/ProxyServerCFNet.cpp',
+            'platform/network/cf/ResourceErrorCF.cpp',
+            'platform/network/cf/ResourceHandleCFNet.cpp',
+            'platform/network/cf/ResourceRequestCFNet.cpp',
+            'platform/network/cf/ResourceRequestCFNet.h',
+            'platform/network/cf/ResourceResponseCFNet.cpp',
             'platform/network/cf/SocketStreamError.h',
             'platform/network/cf/SocketStreamHandle.h',
             'platform/network/cf/SocketStreamHandleCFNet.cpp',
@@ -3772,31 +4706,36 @@
             'platform/network/curl/AuthenticationChallenge.h',
             'platform/network/curl/CookieJarCurl.cpp',
             'platform/network/curl/DNSCurl.cpp',
+            'platform/network/curl/DownloadBundle.h',
             'platform/network/curl/FormDataStreamCurl.cpp',
             'platform/network/curl/FormDataStreamCurl.h',
+            'platform/network/curl/ProxyServerCurl.cpp',
             'platform/network/curl/ResourceError.h',
             'platform/network/curl/ResourceHandleCurl.cpp',
             'platform/network/curl/ResourceHandleManager.cpp',
             'platform/network/curl/ResourceHandleManager.h',
             'platform/network/curl/ResourceRequest.h',
             'platform/network/curl/ResourceResponse.h',
-            'platform/network/mac/AuthenticationChallenge.h',
-            'platform/network/mac/AuthenticationMac.h',
+            'platform/network/curl/SocketStreamError.h',
+            'platform/network/curl/SocketStreamHandle.h',
+            'platform/network/curl/SocketStreamHandleCurl.cpp',
             'platform/network/mac/AuthenticationMac.mm',
-            'platform/network/mac/FormDataStreamMac.h',
+            'platform/network/mac/CookieStorageMac.mm',
+            'platform/network/mac/CredentialStorageMac.mm',
             'platform/network/mac/FormDataStreamMac.mm',
             'platform/network/mac/NetworkStateNotifierMac.cpp',
-            'platform/network/mac/ResourceError.h',
             'platform/network/mac/ResourceErrorMac.mm',
             'platform/network/mac/ResourceHandleMac.mm',
-            'platform/network/mac/ResourceRequest.h',
             'platform/network/mac/ResourceRequestMac.mm',
-            'platform/network/mac/ResourceResponse.h',
             'platform/network/mac/ResourceResponseMac.mm',
-            'platform/network/mac/WebCoreURLResponse.h',
             'platform/network/mac/WebCoreURLResponse.mm',
             'platform/network/qt/AuthenticationChallenge.h',
             'platform/network/qt/CredentialStorageQt.cpp',
+            'platform/network/qt/DnsPrefetchHelper.cpp',
+            'platform/network/qt/DnsPrefetchHelper.h',
+            'platform/network/qt/NetworkStateNotifierPrivate.h',
+            'platform/network/qt/NetworkStateNotifierQt.cpp',
+            'platform/network/qt/ProxyServerQt.cpp',
             'platform/network/qt/QNetworkReplyHandler.cpp',
             'platform/network/qt/QNetworkReplyHandler.h',
             'platform/network/qt/ResourceError.h',
@@ -3804,27 +4743,42 @@
             'platform/network/qt/ResourceRequest.h',
             'platform/network/qt/ResourceRequestQt.cpp',
             'platform/network/qt/ResourceResponse.h',
+            'platform/network/qt/SocketStreamError.h',
+            'platform/network/qt/SocketStreamHandle.h',
+            'platform/network/qt/SocketStreamHandlePrivate.h',
+            'platform/network/qt/SocketStreamHandleQt.cpp',
             'platform/network/soup/AuthenticationChallenge.h',
             'platform/network/soup/CookieJarSoup.cpp',
             'platform/network/soup/CookieJarSoup.h',
-            'platform/network/soup/DNSSoup.cpp',
+            'platform/network/soup/GOwnPtrSoup.cpp',
+            'platform/network/soup/GOwnPtrSoup.h',
+            'platform/network/soup/ProxyServerSoup.cpp',
             'platform/network/soup/ResourceError.h',
             'platform/network/soup/ResourceHandleSoup.cpp',
             'platform/network/soup/ResourceRequest.h',
+            'platform/network/soup/ResourceRequestSoup.cpp',
             'platform/network/soup/ResourceResponse.h',
+            'platform/network/soup/ResourceResponseSoup.cpp',
             'platform/network/soup/SocketStreamError.h',
             'platform/network/soup/SocketStreamHandle.h',
             'platform/network/soup/SocketStreamHandleSoup.cpp',
-            'platform/network/soup/webkit-soup-auth-dialog.c',
-            'platform/network/soup/webkit-soup-auth-dialog.h',
-            'platform/network/win/CookieJarCFNetWin.cpp',
+            'platform/network/soup/SoupURIUtils.cpp',
+            'platform/network/soup/SoupURIUtils.h',
+            'platform/network/win/AuthenticationChallenge.h',
             'platform/network/win/CookieJarWin.cpp',
             'platform/network/win/CookieStorageWin.cpp',
-            'platform/network/win/CookieStorageWin.h',
+            'platform/network/win/DownloadBundleWin.cpp',
             'platform/network/win/NetworkStateNotifierWin.cpp',
+            'platform/network/win/ProxyServerWin.cpp',
+            'platform/network/win/ResourceError.h',
             'platform/network/win/ResourceHandleWin.cpp',
-            'platform/network/win/ResourceHandleWin.h',
+            'platform/network/win/ResourceRequest.h',
+            'platform/network/win/ResourceResponse.h',
+            'platform/network/win/SocketStreamError.h',
+            'platform/network/win/SocketStreamHandle.h',
+            'platform/network/win/SocketStreamHandleWin.cpp',
             'platform/posix/FileSystemPOSIX.cpp',
+            'platform/posix/SharedBufferPOSIX.cpp',
             'platform/qt/ClipboardQt.cpp',
             'platform/qt/ClipboardQt.h',
             'platform/qt/ContextMenuItemQt.cpp',
@@ -3837,18 +4791,21 @@
             'platform/qt/FileChooserQt.cpp',
             'platform/qt/FileSystemQt.cpp',
             'platform/qt/KURLQt.cpp',
-            'platform/qt/Localizations.cpp',
+            'platform/qt/LanguageQt.cpp',
             'platform/qt/LoggingQt.cpp',
             'platform/qt/MIMETypeRegistryQt.cpp',
-            'platform/qt/MenuEventProxy.h',
             'platform/qt/PasteboardQt.cpp',
+            'platform/qt/PlatformBridge.h',
+            'platform/qt/PlatformBridgeQt.cpp',
             'platform/qt/PlatformKeyboardEventQt.cpp',
             'platform/qt/PlatformMouseEventQt.cpp',
             'platform/qt/PlatformScreenQt.cpp',
-            'platform/qt/PopupMenuQt.cpp',
-            'platform/qt/PopupMenuQt.h',
-            'platform/qt/QWebPopup.cpp',
-            'platform/qt/QWebPopup.h',
+            'platform/qt/PlatformTouchEventQt.cpp',
+            'platform/qt/PlatformTouchPointQt.cpp',
+            'platform/qt/QWebPageClient.h',
+            'platform/qt/QtMobileWebStyle.cpp',
+            'platform/qt/QtMobileWebStyle.h',
+            'platform/qt/QtStyleOptionWebComboBox.h',
             'platform/qt/RenderThemeQt.cpp',
             'platform/qt/RenderThemeQt.h',
             'platform/qt/ScreenQt.cpp',
@@ -3856,8 +4813,6 @@
             'platform/qt/ScrollbarQt.cpp',
             'platform/qt/ScrollbarThemeQt.cpp',
             'platform/qt/ScrollbarThemeQt.h',
-            'platform/qt/SearchPopupMenuQt.cpp',
-            'platform/qt/SearchPopupMenuQt.h',
             'platform/qt/SharedBufferQt.cpp',
             'platform/qt/SharedTimerQt.cpp',
             'platform/qt/SoundQt.cpp',
@@ -3865,81 +4820,65 @@
             'platform/qt/WheelEventQt.cpp',
             'platform/qt/WidgetQt.cpp',
             'platform/sql/SQLValue.cpp',
-            'platform/sql/SQLValue.h',
             'platform/sql/SQLiteAuthorizer.cpp',
             'platform/sql/SQLiteDatabase.cpp',
-            'platform/sql/SQLiteDatabase.h',
             'platform/sql/SQLiteFileSystem.cpp',
             'platform/sql/SQLiteFileSystem.h',
             'platform/sql/SQLiteStatement.cpp',
             'platform/sql/SQLiteStatement.h',
             'platform/sql/SQLiteTransaction.cpp',
-            'platform/sql/SQLiteTransaction.h',
             'platform/sql/chromium/SQLiteFileSystemChromium.cpp',
             'platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp',
             'platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp',
-            'platform/symbian/FloatPointSymbian.cpp',
-            'platform/symbian/FloatRectSymbian.cpp',
-            'platform/symbian/IntPointSymbian.cpp',
-            'platform/symbian/IntRectSymbian.cpp',
-            'platform/symbian/IntSizeSymbian.cpp',
-            'platform/text/AtomicStringImpl.h',
+            'platform/text/AtomicStringKeyedMRUCache.h',
             'platform/text/Base64.cpp',
-            'platform/text/Base64.h',
             'platform/text/BidiContext.cpp',
-            'platform/text/BidiContext.h',
-            'platform/text/BidiResolver.h',
             'platform/text/Hyphenation.cpp',
             'platform/text/Hyphenation.h',
             'platform/text/LineEnding.cpp',
-            'platform/text/LineEnding.h',
             'platform/text/LocalizedNumber.h',
             'platform/text/LocalizedNumberICU.cpp',
+            'platform/text/LocalizedNumberNone.cpp',
             'platform/text/ParserUtilities.h',
-            'platform/text/PlatformString.h',
             'platform/text/RegularExpression.cpp',
-            'platform/text/RegularExpression.h',
             'platform/text/SegmentedString.cpp',
-            'platform/text/SegmentedString.h',
             'platform/text/String.cpp',
-            'platform/text/StringHash.h',
-            'platform/text/StringImpl.h',
             'platform/text/SuffixTree.h',
             'platform/text/TextBoundaries.cpp',
-            'platform/text/TextBoundaries.h',
-            'platform/text/TextBreakIterator.h',
             'platform/text/TextBreakIteratorICU.cpp',
-            'platform/text/TextBreakIteratorInternalICU.h',
-            'platform/text/TextCheckerClient.h',
             'platform/text/TextCodec.cpp',
-            'platform/text/TextCodec.h',
             'platform/text/TextCodecASCIIFastPath.h',
             'platform/text/TextCodecICU.cpp',
-            'platform/text/TextCodecICU.h',
             'platform/text/TextCodecLatin1.cpp',
-            'platform/text/TextCodecLatin1.h',
             'platform/text/TextCodecUTF16.cpp',
-            'platform/text/TextCodecUTF16.h',
             'platform/text/TextCodecUTF8.cpp',
             'platform/text/TextCodecUTF8.h',
             'platform/text/TextCodecUserDefined.cpp',
-            'platform/text/TextCodecUserDefined.h',
-            'platform/text/TextDirection.h',
             'platform/text/TextEncoding.cpp',
-            'platform/text/TextEncoding.h',
             'platform/text/TextEncodingDetector.h',
             'platform/text/TextEncodingDetectorICU.cpp',
+            'platform/text/TextEncodingDetectorNone.cpp',
             'platform/text/TextEncodingRegistry.cpp',
-            'platform/text/TextEncodingRegistry.h',
             'platform/text/TextStream.cpp',
-            'platform/text/TextStream.h',
             'platform/text/UnicodeRange.cpp',
-            'platform/text/UnicodeRange.h',
+            'platform/text/android/HyphenationAndroid.cpp',
+            'platform/text/android/TextBreakIteratorInternalICU.cpp',
+            'platform/text/brew/TextBoundariesBrew.cpp',
+            'platform/text/brew/TextBreakIteratorBrew.cpp',
+            'platform/text/brew/TextCodecBrew.cpp',
+            'platform/text/brew/TextCodecBrew.h',
+            'platform/text/cf/HyphenationCF.cpp',
             'platform/text/cf/StringCF.cpp',
             'platform/text/cf/StringImplCF.cpp',
             'platform/text/chromium/TextBreakIteratorInternalICUChromium.cpp',
+            'platform/text/efl/TextBreakIteratorInternalICUEfl.cpp',
+            'platform/text/gtk/TextBreakIteratorGtk.cpp',
             'platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp',
-            'platform/text/mac/CharsetData.h',
+            'platform/text/gtk/TextCodecGtk.cpp',
+            'platform/text/gtk/TextCodecGtk.h',
+            'platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp',
+            'platform/text/mac/HyphenationMac.mm',
+            'platform/text/mac/LocalizedNumberMac.mm',
             'platform/text/mac/ShapeArabic.c',
             'platform/text/mac/ShapeArabic.h',
             'platform/text/mac/StringImplMac.mm',
@@ -3948,17 +4887,20 @@
             'platform/text/mac/TextBreakIteratorInternalICUMac.mm',
             'platform/text/mac/TextCodecMac.cpp',
             'platform/text/mac/TextCodecMac.h',
-            'platform/text/qt/TextBoundaries.cpp',
+            'platform/text/qt/TextBoundariesQt.cpp',
             'platform/text/qt/TextBreakIteratorQt.cpp',
             'platform/text/qt/TextCodecQt.cpp',
             'platform/text/qt/TextCodecQt.h',
-            'platform/text/symbian/StringImplSymbian.cpp',
-            'platform/text/symbian/StringSymbian.cpp',
             'platform/text/transcoder/FontTranscoder.cpp',
             'platform/text/transcoder/FontTranscoder.h',
             'platform/text/win/TextBreakIteratorInternalICUWin.cpp',
+            'platform/text/wince/TextBreakIteratorWinCE.cpp',
+            'platform/text/wince/TextCodecWinCE.cpp',
+            'platform/text/wince/TextCodecWinCE.h',
             'platform/win/BString.cpp',
             'platform/win/BString.h',
+            'platform/win/BitmapInfo.cpp',
+            'platform/win/BitmapInfo.h',
             'platform/win/COMPtr.h',
             'platform/win/ClipboardUtilitiesWin.cpp',
             'platform/win/ClipboardUtilitiesWin.h',
@@ -3985,26 +4927,43 @@
             'platform/win/PlatformMouseEventWin.cpp',
             'platform/win/PlatformScreenWin.cpp',
             'platform/win/PopupMenuWin.cpp',
+            'platform/win/PopupMenuWin.h',
+            'platform/win/SSLKeyGeneratorWin.cpp',
             'platform/win/ScrollbarThemeSafari.cpp',
             'platform/win/ScrollbarThemeSafari.h',
             'platform/win/ScrollbarThemeWin.cpp',
             'platform/win/ScrollbarThemeWin.h',
             'platform/win/SearchPopupMenuWin.cpp',
+            'platform/win/SearchPopupMenuWin.h',
             'platform/win/SharedBufferWin.cpp',
             'platform/win/SharedTimerWin.cpp',
             'platform/win/SoftLinking.h',
             'platform/win/SoundWin.cpp',
+            'platform/win/SystemInfo.cpp',
+            'platform/win/SystemInfo.h',
             'platform/win/SystemTimeWin.cpp',
             'platform/win/TemporaryLinkStubs.cpp',
             'platform/win/WCDataObject.cpp',
             'platform/win/WCDataObject.h',
+            'platform/win/WebCoreInstanceHandle.cpp',
+            'platform/win/WebCoreInstanceHandle.h',
             'platform/win/WebCoreTextRenderer.cpp',
             'platform/win/WebCoreTextRenderer.h',
             'platform/win/WheelEventWin.cpp',
             'platform/win/WidgetWin.cpp',
+            'platform/win/Win32Handle.h',
             'platform/win/WindowMessageBroadcaster.cpp',
             'platform/win/WindowMessageBroadcaster.h',
             'platform/win/WindowMessageListener.h',
+            'platform/wince/CursorWinCE.cpp',
+            'platform/wince/DragDataWinCE.cpp',
+            'platform/wince/DragImageWinCE.cpp',
+            'platform/wince/FileSystemWinCE.cpp',
+            'platform/wince/KURLWinCE.cpp',
+            'platform/wince/MIMETypeRegistryWinCE.cpp',
+            'platform/wince/PasteboardWinCE.cpp',
+            'platform/wince/SearchPopupMenuWinCE.cpp',
+            'platform/wince/SharedTimerWinCE.cpp',
             'platform/wx/ClipboardWx.cpp',
             'platform/wx/ClipboardWx.h',
             'platform/wx/ContextMenuItemWx.cpp',
@@ -4013,7 +4972,9 @@
             'platform/wx/DragDataWx.cpp',
             'platform/wx/DragImageWx.cpp',
             'platform/wx/EventLoopWx.cpp',
+            'platform/wx/FileChooserWx.cpp',
             'platform/wx/FileSystemWx.cpp',
+            'platform/wx/KURLWx.cpp',
             'platform/wx/KeyEventWin.cpp',
             'platform/wx/KeyboardEventWx.cpp',
             'platform/wx/LocalizedStringsWx.cpp',
@@ -4023,22 +4984,35 @@
             'platform/wx/MouseWheelEventWx.cpp',
             'platform/wx/PasteboardWx.cpp',
             'platform/wx/PopupMenuWx.cpp',
+            'platform/wx/PopupMenuWx.h',
             'platform/wx/RenderThemeWx.cpp',
+            'platform/wx/SSLKeyGeneratorWx.cpp',
             'platform/wx/ScreenWx.cpp',
             'platform/wx/ScrollViewWx.cpp',
+            'platform/wx/ScrollbarThemeWx.cpp',
+            'platform/wx/ScrollbarThemeWx.h',
+            'platform/wx/SearchPopupMenuWx.cpp',
+            'platform/wx/SearchPopupMenuWx.h',
+            'platform/wx/SharedBufferWx.cpp',
             'platform/wx/SharedTimerWx.cpp',
             'platform/wx/SoundWx.cpp',
+            'platform/wx/SystemTimeWx.cpp',
             'platform/wx/TemporaryLinkStubs.cpp',
+            'platform/wx/TextBreakIteratorInternalICUWx.cpp',
             'platform/wx/WidgetWx.cpp',
             'platform/wx/wxcode/fontprops.cpp',
             'platform/wx/wxcode/fontprops.h',
             'platform/wx/wxcode/gtk/fontprops.cpp',
             'platform/wx/wxcode/gtk/non-kerned-drawing.cpp',
-            'platform/wx/wxcode/mac/carbon/fontprops.cpp',
+            'platform/wx/wxcode/gtk/scrollbar_render.cpp',
+            'platform/wx/wxcode/mac/carbon/fontprops.mm',
             'platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp',
+            'platform/wx/wxcode/mac/carbon/scrollbar_render.cpp',
             'platform/wx/wxcode/non-kerned-drawing.h',
+            'platform/wx/wxcode/scrollbar_render.h',
             'platform/wx/wxcode/win/fontprops.cpp',
             'platform/wx/wxcode/win/non-kerned-drawing.cpp',
+            'platform/wx/wxcode/win/scrollbar_render.cpp',
             'plugins/DOMMimeType.cpp',
             'plugins/DOMMimeType.h',
             'plugins/DOMMimeTypeArray.cpp',
@@ -4050,15 +5024,15 @@
             'plugins/IFrameShimSupport.cpp',
             'plugins/IFrameShimSupport.h',
             'plugins/PluginData.cpp',
-            'plugins/PluginData.h',
+            'plugins/PluginDataNone.cpp',
             'plugins/PluginDatabase.cpp',
             'plugins/PluginDatabase.h',
             'plugins/PluginDebug.cpp',
             'plugins/PluginDebug.h',
             'plugins/PluginMainThreadScheduler.cpp',
-            'plugins/PluginMainThreadScheduler.h',
             'plugins/PluginPackage.cpp',
             'plugins/PluginPackage.h',
+            'plugins/PluginPackageNone.cpp',
             'plugins/PluginQuirkSet.h',
             'plugins/PluginStream.cpp',
             'plugins/PluginStream.h',
@@ -4072,23 +5046,25 @@
             'plugins/gtk/PluginViewGtk.cpp',
             'plugins/gtk/gtk2xtbin.h',
             'plugins/gtk/xembed.h',
-            'plugins/mac/PluginDataMac.mm',
             'plugins/mac/PluginPackageMac.cpp',
             'plugins/mac/PluginViewMac.mm',
             'plugins/npapi.cpp',
-            'plugins/npfunctions.h',
-            'plugins/qt/PluginDataQt.cpp',
+            'plugins/qt/PluginContainerQt.cpp',
+            'plugins/qt/PluginContainerQt.h',
             'plugins/qt/PluginPackageQt.cpp',
             'plugins/qt/PluginViewQt.cpp',
-            'plugins/win/PluginDataWin.cpp',
+            'plugins/symbian/PluginContainerSymbian.cpp',
+            'plugins/symbian/PluginContainerSymbian.h',
+            'plugins/symbian/PluginDatabaseSymbian.cpp',
+            'plugins/symbian/PluginPackageSymbian.cpp',
+            'plugins/symbian/PluginViewSymbian.cpp',
+            'plugins/symbian/npinterface.h',
             'plugins/win/PluginDatabaseWin.cpp',
             'plugins/win/PluginMessageThrottlerWin.cpp',
             'plugins/win/PluginMessageThrottlerWin.h',
             'plugins/win/PluginPackageWin.cpp',
             'plugins/win/PluginViewWin.cpp',
             'plugins/wx/PluginDataWx.cpp',
-            'plugins/wx/PluginPackageWx.cpp',
-            'plugins/wx/PluginViewWx.cpp',
             'rendering/AutoTableLayout.cpp',
             'rendering/AutoTableLayout.h',
             'rendering/BidiRun.cpp',
@@ -4099,23 +5075,14 @@
             'rendering/EllipsisBox.h',
             'rendering/FixedTableLayout.cpp',
             'rendering/FixedTableLayout.h',
-            'rendering/GapRects.h',
-            'rendering/HitTestRequest.h',
             'rendering/HitTestResult.cpp',
-            'rendering/HitTestResult.h',
             'rendering/InlineBox.cpp',
-            'rendering/InlineBox.h',
             'rendering/InlineFlowBox.cpp',
-            'rendering/InlineFlowBox.h',
             'rendering/InlineIterator.h',
             'rendering/InlineTextBox.cpp',
-            'rendering/InlineTextBox.h',
             'rendering/LayoutState.cpp',
-            'rendering/LayoutState.h',
             'rendering/MediaControlElements.cpp',
             'rendering/MediaControlElements.h',
-            'rendering/PaintInfo.h',
-            'rendering/PaintPhase.h',
             'rendering/PointerEventsHitRules.cpp',
             'rendering/PointerEventsHitRules.h',
             'rendering/RenderApplet.cpp',
@@ -4123,14 +5090,10 @@
             'rendering/RenderArena.cpp',
             'rendering/RenderArena.h',
             'rendering/RenderBR.cpp',
-            'rendering/RenderBR.h',
             'rendering/RenderBlock.cpp',
-            'rendering/RenderBlock.h',
             'rendering/RenderBlockLineLayout.cpp',
             'rendering/RenderBox.cpp',
-            'rendering/RenderBox.h',
             'rendering/RenderBoxModelObject.cpp',
-            'rendering/RenderBoxModelObject.h',
             'rendering/RenderButton.cpp',
             'rendering/RenderButton.h',
             'rendering/RenderCombineText.cpp',
@@ -4144,7 +5107,6 @@
             'rendering/RenderDetailsMarker.cpp',
             'rendering/RenderDetailsMarker.h',
             'rendering/RenderEmbeddedObject.cpp',
-            'rendering/RenderEmbeddedObject.h',
             'rendering/RenderFieldset.cpp',
             'rendering/RenderFieldset.h',
             'rendering/RenderFileUploadControl.cpp',
@@ -4164,11 +5126,8 @@
             'rendering/RenderIFrame.cpp',
             'rendering/RenderIFrame.h',
             'rendering/RenderImage.cpp',
-            'rendering/RenderImage.h',
             'rendering/RenderImageResource.cpp',
-            'rendering/RenderImageResource.h',
             'rendering/RenderImageResourceStyleImage.cpp',
-            'rendering/RenderImageResourceStyleImage.h',
             'rendering/RenderIndicator.cpp',
             'rendering/RenderIndicator.h',
             'rendering/RenderInline.cpp',
@@ -4176,17 +5135,13 @@
             'rendering/RenderInputSpeech.cpp',
             'rendering/RenderInputSpeech.h',
             'rendering/RenderLayer.cpp',
-            'rendering/RenderLayer.h',
             'rendering/RenderLayerBacking.cpp',
-            'rendering/RenderLayerBacking.h',
             'rendering/RenderLayerCompositor.cpp',
             'rendering/RenderLayerCompositor.h',
             'rendering/RenderLineBoxList.cpp',
-            'rendering/RenderLineBoxList.h',
             'rendering/RenderListBox.cpp',
             'rendering/RenderListBox.h',
             'rendering/RenderListItem.cpp',
-            'rendering/RenderListItem.h',
             'rendering/RenderListMarker.cpp',
             'rendering/RenderListMarker.h',
             'rendering/RenderMarquee.cpp',
@@ -4202,17 +5157,13 @@
             'rendering/RenderMeter.cpp',
             'rendering/RenderMeter.h',
             'rendering/RenderObject.cpp',
-            'rendering/RenderObject.h',
             'rendering/RenderObjectChildList.cpp',
-            'rendering/RenderObjectChildList.h',
             'rendering/RenderPart.cpp',
-            'rendering/RenderPart.h',
             'rendering/RenderProgress.cpp',
             'rendering/RenderProgress.h',
             'rendering/RenderQuote.cpp',
             'rendering/RenderQuote.h',
             'rendering/RenderReplaced.cpp',
-            'rendering/RenderReplaced.h',
             'rendering/RenderReplica.cpp',
             'rendering/RenderReplica.h',
             'rendering/RenderRuby.cpp',
@@ -4245,7 +5196,6 @@
             'rendering/RenderTableSection.cpp',
             'rendering/RenderTableSection.h',
             'rendering/RenderText.cpp',
-            'rendering/RenderText.h',
             'rendering/RenderTextControl.cpp',
             'rendering/RenderTextControl.h',
             'rendering/RenderTextControlMultiLine.cpp',
@@ -4270,25 +5220,26 @@
             'rendering/RenderThemeSafari.h',
             'rendering/RenderThemeWin.cpp',
             'rendering/RenderThemeWin.h',
+            'rendering/RenderThemeWinCE.cpp',
+            'rendering/RenderThemeWinCE.h',
             'rendering/RenderTreeAsText.cpp',
-            'rendering/RenderTreeAsText.h',
             'rendering/RenderVideo.cpp',
             'rendering/RenderVideo.h',
             'rendering/RenderView.cpp',
-            'rendering/RenderView.h',
             'rendering/RenderWidget.cpp',
-            'rendering/RenderWidget.h',
+            'rendering/RenderWidgetProtector.h',
             'rendering/RenderWordBreak.cpp',
             'rendering/RenderWordBreak.h',
+            'rendering/RenderingAllInOne.cpp',
             'rendering/RootInlineBox.cpp',
-            'rendering/RootInlineBox.h',
             'rendering/ScrollBehavior.cpp',
-            'rendering/ScrollBehavior.h',
             'rendering/ShadowElement.cpp',
             'rendering/ShadowElement.h',
             'rendering/TableLayout.h',
+            'rendering/TrailingFloatsRootInlineBox.h',
             'rendering/TransformState.cpp',
             'rendering/TransformState.h',
+            'rendering/VerticalPositionCache.h',
             'rendering/break_lines.cpp',
             'rendering/break_lines.h',
             'rendering/mathml/RenderMathMLBlock.cpp',
@@ -4311,65 +5262,34 @@
             'rendering/mathml/RenderMathMLSubSup.h',
             'rendering/mathml/RenderMathMLUnderOver.cpp',
             'rendering/mathml/RenderMathMLUnderOver.h',
-            'rendering/style/BorderData.h',
-            'rendering/style/BorderValue.h',
-            'rendering/style/CollapsedBorderValue.h',
             'rendering/style/ContentData.cpp',
-            'rendering/style/ContentData.h',
-            'rendering/style/CounterContent.h',
             'rendering/style/CounterDirectives.cpp',
-            'rendering/style/CounterDirectives.h',
-            'rendering/style/CursorData.h',
-            'rendering/style/CursorList.h',
-            'rendering/style/DataRef.h',
             'rendering/style/FillLayer.cpp',
-            'rendering/style/FillLayer.h',
             'rendering/style/KeyframeList.cpp',
             'rendering/style/KeyframeList.h',
             'rendering/style/NinePieceImage.cpp',
-            'rendering/style/NinePieceImage.h',
-            'rendering/style/OutlineValue.h',
             'rendering/style/QuotesData.cpp',
             'rendering/style/QuotesData.h',
             'rendering/style/RenderStyle.cpp',
-            'rendering/style/RenderStyle.h',
-            'rendering/style/RenderStyleConstants.h',
             'rendering/style/SVGRenderStyle.cpp',
-            'rendering/style/SVGRenderStyle.h',
             'rendering/style/SVGRenderStyleDefs.cpp',
-            'rendering/style/SVGRenderStyleDefs.h',
             'rendering/style/ShadowData.cpp',
-            'rendering/style/ShadowData.h',
+            'rendering/style/StyleAllInOne.cpp',
             'rendering/style/StyleBackgroundData.cpp',
-            'rendering/style/StyleBackgroundData.h',
             'rendering/style/StyleBoxData.cpp',
-            'rendering/style/StyleBoxData.h',
             'rendering/style/StyleCachedImage.cpp',
-            'rendering/style/StyleCachedImage.h',
-            'rendering/style/StyleDashboardRegion.h',
             'rendering/style/StyleFlexibleBoxData.cpp',
-            'rendering/style/StyleFlexibleBoxData.h',
             'rendering/style/StyleGeneratedImage.cpp',
-            'rendering/style/StyleGeneratedImage.h',
-            'rendering/style/StyleImage.h',
             'rendering/style/StyleInheritedData.cpp',
-            'rendering/style/StyleInheritedData.h',
             'rendering/style/StyleMarqueeData.cpp',
-            'rendering/style/StyleMarqueeData.h',
             'rendering/style/StyleMultiColData.cpp',
-            'rendering/style/StyleMultiColData.h',
             'rendering/style/StylePendingImage.h',
             'rendering/style/StyleRareInheritedData.cpp',
-            'rendering/style/StyleRareInheritedData.h',
             'rendering/style/StyleRareNonInheritedData.cpp',
-            'rendering/style/StyleRareNonInheritedData.h',
-            'rendering/style/StyleReflection.h',
             'rendering/style/StyleSurroundData.cpp',
-            'rendering/style/StyleSurroundData.h',
             'rendering/style/StyleTransformData.cpp',
-            'rendering/style/StyleTransformData.h',
             'rendering/style/StyleVisualData.cpp',
-            'rendering/style/StyleVisualData.h',
+            'rendering/svg/RenderSVGAllInOne.cpp',
             'rendering/svg/RenderSVGBlock.cpp',
             'rendering/svg/RenderSVGBlock.h',
             'rendering/svg/RenderSVGContainer.cpp',
@@ -4444,7 +5364,6 @@
             'rendering/svg/SVGResources.cpp',
             'rendering/svg/SVGResources.h',
             'rendering/svg/SVGResourcesCache.cpp',
-            'rendering/svg/SVGResourcesCache.h',
             'rendering/svg/SVGResourcesCycleSolver.cpp',
             'rendering/svg/SVGResourcesCycleSolver.h',
             'rendering/svg/SVGRootInlineBox.cpp',
@@ -4471,15 +5390,12 @@
             'rendering/svg/SVGTextQuery.cpp',
             'rendering/svg/SVGTextQuery.h',
             'storage/AbstractDatabase.cpp',
-            'storage/AbstractDatabase.h',
             'storage/ChangeVersionWrapper.cpp',
             'storage/ChangeVersionWrapper.h',
             'storage/Database.cpp',
-            'storage/Database.h',
             'storage/DatabaseAuthorizer.cpp',
             'storage/DatabaseAuthorizer.h',
             'storage/DatabaseCallback.h',
-            'storage/DatabaseDetails.h',
             'storage/DatabaseSync.cpp',
             'storage/DatabaseSync.h',
             'storage/DatabaseTask.cpp',
@@ -4487,11 +5403,8 @@
             'storage/DatabaseThread.cpp',
             'storage/DatabaseThread.h',
             'storage/DatabaseTracker.cpp',
-            'storage/DatabaseTracker.h',
-            'storage/DatabaseTrackerClient.h',
             'storage/IDBAny.cpp',
             'storage/IDBAny.h',
-            'storage/IDBBackingStore.cpp',
             'storage/IDBBackingStore.h',
             'storage/IDBCallbacks.h',
             'storage/IDBCursor.cpp',
@@ -4506,6 +5419,10 @@
             'storage/IDBDatabaseBackendImpl.cpp',
             'storage/IDBDatabaseBackendImpl.h',
             'storage/IDBDatabaseBackendInterface.h',
+            'storage/IDBDatabaseCallbacks.h',
+            'storage/IDBDatabaseCallbacks.h',
+            'storage/IDBDatabaseCallbacksImpl.cpp',
+            'storage/IDBDatabaseCallbacksImpl.h',
             'storage/IDBDatabaseError.h',
             'storage/IDBDatabaseException.h',
             'storage/IDBEventDispatcher.cpp',
@@ -4538,6 +5455,8 @@
             'storage/IDBPendingTransactionMonitor.h',
             'storage/IDBRequest.cpp',
             'storage/IDBRequest.h',
+            'storage/IDBSQLiteBackingStore.cpp',
+            'storage/IDBSQLiteBackingStore.h',
             'storage/IDBTransaction.cpp',
             'storage/IDBTransaction.h',
             'storage/IDBTransactionBackendImpl.cpp',
@@ -4558,26 +5477,18 @@
             'storage/OriginQuotaManager.h',
             'storage/OriginUsageRecord.cpp',
             'storage/OriginUsageRecord.h',
-            'storage/SQLError.h',
+            'storage/SQLCallbackWrapper.h',
             'storage/SQLException.h',
             'storage/SQLResultSet.cpp',
-            'storage/SQLResultSet.h',
             'storage/SQLResultSetRowList.cpp',
-            'storage/SQLResultSetRowList.h',
             'storage/SQLStatement.cpp',
-            'storage/SQLStatement.h',
-            'storage/SQLStatementCallback.h',
-            'storage/SQLStatementErrorCallback.h',
             'storage/SQLStatementSync.cpp',
             'storage/SQLStatementSync.h',
             'storage/SQLTransaction.cpp',
-            'storage/SQLTransaction.h',
-            'storage/SQLTransactionCallback.h',
             'storage/SQLTransactionClient.cpp',
             'storage/SQLTransactionClient.h',
             'storage/SQLTransactionCoordinator.cpp',
             'storage/SQLTransactionCoordinator.h',
-            'storage/SQLTransactionErrorCallback.h',
             'storage/SQLTransactionSync.cpp',
             'storage/SQLTransactionSync.h',
             'storage/SQLTransactionSyncCallback.h',
@@ -4600,6 +5511,7 @@
             'storage/StorageNamespaceImpl.h',
             'storage/StorageSyncManager.cpp',
             'storage/StorageSyncManager.h',
+            'storage/StorageTracker.cpp',
             'storage/chromium/DatabaseObserver.h',
             'storage/chromium/DatabaseTrackerChromium.cpp',
             'storage/chromium/IDBFactoryBackendInterface.cpp',
@@ -4607,6 +5519,10 @@
             'storage/chromium/QuotaTracker.cpp',
             'storage/chromium/QuotaTracker.h',
             'storage/chromium/SQLTransactionClientChromium.cpp',
+            'storage/wince/DatabaseThreadWinCE.cpp',
+            'storage/wince/DatabaseThreadWinCE.h',
+            'storage/wince/LocalStorageThreadWinCE.cpp',
+            'storage/wince/LocalStorageThreadWinCE.h',
             'svg/ColorDistance.cpp',
             'svg/ColorDistance.h',
             'svg/ElementTimeControl.h',
@@ -4620,7 +5536,6 @@
             'svg/SVGAltGlyphElement.cpp',
             'svg/SVGAltGlyphElement.h',
             'svg/SVGAngle.cpp',
-            'svg/SVGAngle.h',
             'svg/SVGAnimateColorElement.cpp',
             'svg/SVGAnimateColorElement.h',
             'svg/SVGAnimateElement.cpp',
@@ -4629,18 +5544,6 @@
             'svg/SVGAnimateMotionElement.h',
             'svg/SVGAnimateTransformElement.cpp',
             'svg/SVGAnimateTransformElement.h',
-            'svg/SVGAnimatedAngle.h',
-            'svg/SVGAnimatedBoolean.h',
-            'svg/SVGAnimatedEnumeration.h',
-            'svg/SVGAnimatedInteger.h',
-            'svg/SVGAnimatedLength.h',
-            'svg/SVGAnimatedLengthList.h',
-            'svg/SVGAnimatedNumber.h',
-            'svg/SVGAnimatedNumberList.h',
-            'svg/SVGAnimatedPreserveAspectRatio.h',
-            'svg/SVGAnimatedRect.h',
-            'svg/SVGAnimatedString.h',
-            'svg/SVGAnimatedTransformList.h',
             'svg/SVGAnimationElement.cpp',
             'svg/SVGAnimationElement.h',
             'svg/SVGCircleElement.cpp',
@@ -4648,7 +5551,6 @@
             'svg/SVGClipPathElement.cpp',
             'svg/SVGClipPathElement.h',
             'svg/SVGColor.cpp',
-            'svg/SVGColor.h',
             'svg/SVGComponentTransferFunctionElement.cpp',
             'svg/SVGComponentTransferFunctionElement.h',
             'svg/SVGCursorElement.cpp',
@@ -4660,9 +5562,7 @@
             'svg/SVGDocument.cpp',
             'svg/SVGDocument.h',
             'svg/SVGDocumentExtensions.cpp',
-            'svg/SVGDocumentExtensions.h',
             'svg/SVGElement.cpp',
-            'svg/SVGElement.h',
             'svg/SVGElementInstance.cpp',
             'svg/SVGElementInstance.h',
             'svg/SVGElementInstanceList.cpp',
@@ -4762,30 +5662,24 @@
             'svg/SVGLangSpace.cpp',
             'svg/SVGLangSpace.h',
             'svg/SVGLength.cpp',
-            'svg/SVGLength.h',
             'svg/SVGLengthList.cpp',
-            'svg/SVGLengthList.h',
             'svg/SVGLineElement.cpp',
             'svg/SVGLineElement.h',
             'svg/SVGLinearGradientElement.cpp',
             'svg/SVGLinearGradientElement.h',
             'svg/SVGLocatable.cpp',
-            'svg/SVGLocatable.h',
             'svg/SVGMPathElement.cpp',
             'svg/SVGMPathElement.h',
             'svg/SVGMarkerElement.cpp',
             'svg/SVGMarkerElement.h',
             'svg/SVGMaskElement.cpp',
             'svg/SVGMaskElement.h',
-            'svg/SVGMatrix.h',
             'svg/SVGMetadataElement.cpp',
             'svg/SVGMetadataElement.h',
             'svg/SVGMissingGlyphElement.cpp',
             'svg/SVGMissingGlyphElement.h',
             'svg/SVGNumberList.cpp',
-            'svg/SVGNumberList.h',
             'svg/SVGPaint.cpp',
-            'svg/SVGPaint.h',
             'svg/SVGParserUtilities.cpp',
             'svg/SVGParserUtilities.h',
             'svg/SVGPathBlender.cpp',
@@ -4840,7 +5734,6 @@
             'svg/SVGPolylineElement.cpp',
             'svg/SVGPolylineElement.h',
             'svg/SVGPreserveAspectRatio.cpp',
-            'svg/SVGPreserveAspectRatio.h',
             'svg/SVGRadialGradientElement.cpp',
             'svg/SVGRadialGradientElement.h',
             'svg/SVGRect.h',
@@ -4888,11 +5781,9 @@
             'svg/SVGTitleElement.cpp',
             'svg/SVGTitleElement.h',
             'svg/SVGTransform.cpp',
-            'svg/SVGTransform.h',
             'svg/SVGTransformDistance.cpp',
             'svg/SVGTransformDistance.h',
             'svg/SVGTransformList.cpp',
-            'svg/SVGTransformList.h',
             'svg/SVGTransformable.cpp',
             'svg/SVGTransformable.h',
             'svg/SVGURIReference.cpp',
@@ -4911,11 +5802,9 @@
             'svg/SVGZoomEvent.cpp',
             'svg/SVGZoomEvent.h',
             'svg/animation/SMILTime.cpp',
-            'svg/animation/SMILTime.h',
             'svg/animation/SMILTimeContainer.cpp',
             'svg/animation/SMILTimeContainer.h',
             'svg/animation/SVGSMILElement.cpp',
-            'svg/animation/SVGSMILElement.h',
             'svg/graphics/SVGImage.cpp',
             'svg/graphics/SVGImage.h',
             'svg/graphics/filters/SVGFEImage.cpp',
@@ -4924,27 +5813,10 @@
             'svg/graphics/filters/SVGFilter.h',
             'svg/graphics/filters/SVGFilterBuilder.cpp',
             'svg/graphics/filters/SVGFilterBuilder.h',
-            'svg/properties/SVGAnimatedListPropertyTearOff.h',
             'svg/properties/SVGAnimatedPathSegListPropertyTearOff.h',
-            'svg/properties/SVGAnimatedProperty.h',
-            'svg/properties/SVGAnimatedPropertyDescription.h',
-            'svg/properties/SVGAnimatedPropertyMacros.h',
-            'svg/properties/SVGAnimatedPropertySynchronizer.h',
-            'svg/properties/SVGAnimatedPropertySynchronizer.h',
-            'svg/properties/SVGAnimatedPropertyTearOff.h',
-            'svg/properties/SVGAnimatedStaticPropertyTearOff.h',
-            'svg/properties/SVGAnimatedTransformListPropertyTearOff.h',
-            'svg/properties/SVGListProperty.h',
-            'svg/properties/SVGListPropertyTearOff.h',
             'svg/properties/SVGPathSegListPropertyTearOff.cpp',
-            'svg/properties/SVGPathSegListPropertyTearOff.h',
-            'svg/properties/SVGProperty.h',
-            'svg/properties/SVGPropertyTearOff.h',
-            'svg/properties/SVGPropertyTraits.h',
-            'svg/properties/SVGStaticListPropertyTearOff.h',
-            'svg/properties/SVGStaticPropertyTearOff.h',
-            'svg/properties/SVGStaticPropertyWithParentTearOff.h',
-            'svg/properties/SVGTransformListPropertyTearOff.h',
+            'thirdparty/glu/gluos.h',
+            'thirdparty/glu/internal_glu.h',
             'thirdparty/glu/libtess/dict-list.h',
             'thirdparty/glu/libtess/dict.c',
             'thirdparty/glu/libtess/dict.h',
@@ -5038,12 +5910,88 @@
             'websockets/WebSocketHandshakeResponse.h',
             'websockets/WorkerThreadableWebSocketChannel.cpp',
             'websockets/WorkerThreadableWebSocketChannel.h',
+            # FIXME: For some reason including these files and excluding them
+            # in the GYP file causes GYP not to create a valid Xcode project.
+            # 'wml/WMLAElement.cpp',
+            # 'wml/WMLAElement.h',
+            # 'wml/WMLAccessElement.cpp',
+            # 'wml/WMLAccessElement.h',
+            # 'wml/WMLAnchorElement.cpp',
+            # 'wml/WMLAnchorElement.h',
+            # 'wml/WMLBRElement.cpp',
+            # 'wml/WMLBRElement.h',
+            # 'wml/WMLCardElement.cpp',
+            # 'wml/WMLCardElement.h',
+            # 'wml/WMLDoElement.cpp',
+            # 'wml/WMLDoElement.h',
+            # 'wml/WMLDocument.cpp',
+            # 'wml/WMLDocument.h',
+            # 'wml/WMLElement.cpp',
+            # 'wml/WMLElement.h',
+            # 'wml/WMLErrorHandling.cpp',
+            # 'wml/WMLErrorHandling.h',
+            # 'wml/WMLEventHandlingElement.cpp',
+            # 'wml/WMLEventHandlingElement.h',
+            # 'wml/WMLFieldSetElement.cpp',
+            # 'wml/WMLFieldSetElement.h',
+            # 'wml/WMLFormControlElement.cpp',
+            # 'wml/WMLFormControlElement.h',
+            # 'wml/WMLGoElement.cpp',
+            # 'wml/WMLGoElement.h',
+            # 'wml/WMLImageElement.cpp',
+            # 'wml/WMLImageElement.h',
+            # 'wml/WMLImageLoader.cpp',
+            # 'wml/WMLImageLoader.h',
+            # 'wml/WMLInputElement.cpp',
+            # 'wml/WMLInputElement.h',
+            # 'wml/WMLInsertedLegendElement.cpp',
+            # 'wml/WMLInsertedLegendElement.h',
+            # 'wml/WMLIntrinsicEvent.cpp',
+            # 'wml/WMLIntrinsicEvent.h',
+            # 'wml/WMLIntrinsicEventHandler.cpp',
+            # 'wml/WMLIntrinsicEventHandler.h',
+            # 'wml/WMLMetaElement.cpp',
+            # 'wml/WMLMetaElement.h',
+            # 'wml/WMLNoopElement.cpp',
+            # 'wml/WMLNoopElement.h',
+            # 'wml/WMLOnEventElement.cpp',
+            # 'wml/WMLOnEventElement.h',
+            # 'wml/WMLOptGroupElement.cpp',
+            # 'wml/WMLOptGroupElement.h',
+            # 'wml/WMLOptionElement.cpp',
+            # 'wml/WMLOptionElement.h',
+            # 'wml/WMLPElement.cpp',
+            # 'wml/WMLPElement.h',
+            # 'wml/WMLPageState.cpp',
+            # 'wml/WMLPageState.h',
+            # 'wml/WMLPostfieldElement.cpp',
+            # 'wml/WMLPostfieldElement.h',
+            # 'wml/WMLPrevElement.cpp',
+            # 'wml/WMLPrevElement.h',
+            # 'wml/WMLRefreshElement.cpp',
+            # 'wml/WMLRefreshElement.h',
+            # 'wml/WMLSelectElement.cpp',
+            # 'wml/WMLSelectElement.h',
+            # 'wml/WMLSetvarElement.cpp',
+            # 'wml/WMLSetvarElement.h',
+            # 'wml/WMLTableElement.cpp',
+            # 'wml/WMLTableElement.h',
+            # 'wml/WMLTaskElement.cpp',
+            # 'wml/WMLTaskElement.h',
+            # 'wml/WMLTemplateElement.cpp',
+            # 'wml/WMLTemplateElement.h',
+            # 'wml/WMLTimerElement.cpp',
+            # 'wml/WMLTimerElement.h',
+            # 'wml/WMLVariables.cpp',
+            # 'wml/WMLVariables.h',
             'workers/AbstractWorker.cpp',
             'workers/AbstractWorker.h',
             'workers/DedicatedWorkerContext.cpp',
             'workers/DedicatedWorkerContext.h',
             'workers/DedicatedWorkerThread.cpp',
             'workers/DedicatedWorkerThread.h',
+            'workers/DefaultSharedWorkerRepository.cpp',
+            'workers/DefaultSharedWorkerRepository.h',
             'workers/SharedWorker.cpp',
             'workers/SharedWorker.h',
             'workers/SharedWorkerContext.cpp',
@@ -5064,12 +6012,10 @@
             'workers/WorkerObjectProxy.h',
             'workers/WorkerReportingProxy.h',
             'workers/WorkerRunLoop.cpp',
-            'workers/WorkerRunLoop.h',
             'workers/WorkerScriptLoader.cpp',
             'workers/WorkerScriptLoader.h',
             'workers/WorkerScriptLoaderClient.h',
             'workers/WorkerThread.cpp',
-            'workers/WorkerThread.h',
             'xml/DOMParser.cpp',
             'xml/DOMParser.h',
             'xml/NativeXPathNSResolver.cpp',
@@ -5121,16 +6067,54 @@
             'xml/XSLImportRule.h',
             'xml/XSLStyleSheet.h',
             'xml/XSLStyleSheetLibxslt.cpp',
+            'xml/XSLStyleSheetQt.cpp',
             'xml/XSLTExtensions.cpp',
             'xml/XSLTExtensions.h',
             'xml/XSLTProcessor.cpp',
             'xml/XSLTProcessor.h',
             'xml/XSLTProcessorLibxslt.cpp',
+            'xml/XSLTProcessorQt.cpp',
             'xml/XSLTUnicodeSort.cpp',
             'xml/XSLTUnicodeSort.h',
         ],
+        'webcore_resource_files': [
+            'English.lproj/Localizable.strings',
+            'English.lproj/localizedStrings.js',
+            'Resources/aliasCursor.png',
+            'Resources/cellCursor.png',
+            'Resources/contextMenuCursor.png',
+            'Resources/copyCursor.png',
+            'Resources/crossHairCursor.png',
+            'Resources/deleteButton.tiff',
+            'Resources/deleteButtonPressed.tiff',
+            'Resources/eastResizeCursor.png',
+            'Resources/eastWestResizeCursor.png',
+            'Resources/helpCursor.png',
+            'Resources/inputSpeech.tiff',
+            'Resources/linkCursor.png',
+            'Resources/missingImage.tiff',
+            'Resources/moveCursor.png',
+            'Resources/noDropCursor.png',
+            'Resources/noneCursor.png',
+            'Resources/northEastResizeCursor.png',
+            'Resources/northEastSouthWestResizeCursor.png',
+            'Resources/northResizeCursor.png',
+            'Resources/northSouthResizeCursor.png',
+            'Resources/northWestResizeCursor.png',
+            'Resources/northWestSouthEastResizeCursor.png',
+            'Resources/notAllowedCursor.png',
+            'Resources/progressCursor.png',
+            'Resources/southEastResizeCursor.png',
+            'Resources/southResizeCursor.png',
+            'Resources/southWestResizeCursor.png',
+            'Resources/textAreaResizeCorner.tiff',
+            'Resources/verticalTextCursor.png',
+            'Resources/waitCursor.png',
+            'Resources/westResizeCursor.png',
+            'Resources/zoomInCursor.png',
+            'Resources/zoomOutCursor.png',
+        ],
         'webinspector_files': [
-
             'inspector/front-end/inspector.html',
             'inspector/front-end/ApplicationCacheItemsView.js',
             'inspector/front-end/AuditCategories.js',
@@ -5209,6 +6193,7 @@
             'inspector/front-end/ResourceCategory.js',
             'inspector/front-end/ResourceCookiesView.js',
             'inspector/front-end/ResourceHeadersView.js',
+            'inspector/front-end/ResourceJSONView.js',
             'inspector/front-end/ResourceTimingView.js',
             'inspector/front-end/ResourceTreeModel.js',
             'inspector/front-end/ResourceView.js',
@@ -5226,6 +6211,7 @@
             'inspector/front-end/SidebarPane.js',
             'inspector/front-end/SidebarTreeElement.js',
             'inspector/front-end/SourceCSSTokenizer.js',
+            'inspector/front-end/SourceFile.js',
             'inspector/front-end/SourceFrame.js',
             'inspector/front-end/SourceFrameContent.js',
             'inspector/front-end/SourceHTMLTokenizer.js',
@@ -5317,6 +6303,7 @@
             'inspector/front-end/Images/graphLabelCalloutRight.png',
             'inspector/front-end/Images/helpButtonGlyph.png',
             'inspector/front-end/Images/largerResourcesButtonGlyph.png',
+            'inspector/front-end/Images/garbageCollectButtonGlyph.png',
             'inspector/front-end/Images/localStorage.png',
             'inspector/front-end/Images/networkIcon.png',
             'inspector/front-end/Images/nodeSearchButtonGlyph.png',
@@ -5425,7 +6412,6 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSGrammar.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSPropertyNames.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSPropertyNames.gperf',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSPropertyNames.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSPropertyNames.in',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSValueKeywords.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSValueKeywords.gperf',
@@ -5433,1412 +6419,476 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/CSSValueKeywords.in',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/CharsetData.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/ColorData.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAbstractView.h',
+            # This list does not contain all the Objective-C bindings files
+            # that we generate.  We run all the IDL files through the
+            # Objective-C code generator, but not all of them even build.
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAbstractViewInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAbstractViewPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAbstractWorker.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAbstractWorker.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAbstractWorkerInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMArrayBuffer.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMArrayBuffer.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMArrayBufferInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMArrayBufferView.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMArrayBufferView.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMArrayBufferViewInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAttr.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAttr.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAttrInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAttrPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioBuffer.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioBuffer.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioBufferInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioBufferSourceNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioBufferSourceNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioBufferSourceNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioChannelMerger.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioChannelMerger.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioChannelMergerInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioChannelSplitter.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioChannelSplitter.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioChannelSplitterInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioContext.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioContext.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioContextInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioDestinationNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioDestinationNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioDestinationNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioGain.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioGain.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioGainInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioGainNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioGainNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioGainNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioListener.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioListener.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioListenerInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioPannerNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioPannerNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioPannerNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioParam.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioParam.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioParamInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioProcessingEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioProcessingEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioProcessingEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioSourceNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioSourceNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMAudioSourceNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBarInfo.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBarInfo.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBarInfoInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBeforeLoadEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBeforeLoadEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBeforeLoadEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBeforeProcessEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBeforeProcessEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBeforeProcessEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlob.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlob.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlobBuilder.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlobBuilder.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlobBuilderInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlobInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMBlobPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCDATASection.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCDATASection.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCDATASectionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSCharsetRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSCharsetRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSCharsetRuleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSFontFaceRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSFontFaceRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSFontFaceRuleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSImportRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSImportRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSImportRuleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSMediaRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSMediaRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSMediaRuleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSPageRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSPageRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSPageRuleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSPrimitiveValue.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSPrimitiveValue.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSPrimitiveValueInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSRuleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSRuleList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSRuleList.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSRuleListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleDeclaration.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleDeclaration.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleDeclarationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleRuleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleSheet.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleSheet.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSStyleSheetInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSUnknownRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSUnknownRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSUnknownRuleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSValue.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSValue.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSValueInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSValueList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSValueList.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCSSValueListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasGradient.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasGradient.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasGradientInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasPattern.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasPattern.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasPatternInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasRenderingContext.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasRenderingContext.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasRenderingContext2D.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasRenderingContext2D.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasRenderingContext2DInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCanvasRenderingContextInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCharacterData.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCharacterData.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCharacterDataInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClientRect.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClientRect.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClientRectInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClientRectList.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClientRectList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClientRectListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClipboard.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClipboard.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMClipboardInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMComment.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMComment.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCommentInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCompositionEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCompositionEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCompositionEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMConsole.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMConsole.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMConsoleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMConvolverNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMConvolverNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMConvolverNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCoordinates.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCoordinates.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCoordinatesInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCounter.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCounter.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCounterInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCrypto.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCrypto.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCryptoInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCustomEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCustomEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMCustomEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMApplicationCache.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMApplicationCache.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMApplicationCacheInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMCoreException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMCoreException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMCoreExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFileSystem.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFileSystem.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFileSystemInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFileSystemSync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFileSystemSync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFileSystemSyncInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFormData.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFormData.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMFormDataInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMImplementation.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMImplementation.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMImplementationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMMimeTypeArray.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMMimeTypeArray.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMMimeTypeArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMParser.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMParser.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMParserInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMPluginArray.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMPluginArray.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMPluginArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMSelection.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMSelection.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMSelectionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMSettableTokenList.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMSettableTokenList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMSettableTokenListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMStringList.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMStringList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMStringListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMStringMap.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMStringMap.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMStringMapInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMTokenList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMTokenList.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMTokenListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMURL.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMURL.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDOMURLInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataGridColumn.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataGridColumn.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataGridColumnInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataGridColumnList.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataGridColumnList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataGridColumnListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataView.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataView.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDataViewInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabase.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabase.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabaseCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabaseCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabaseCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabaseInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabaseSync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabaseSync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDatabaseSyncInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDedicatedWorkerContext.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDedicatedWorkerContext.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDedicatedWorkerContextInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDelayNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDelayNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDelayNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDeviceMotionEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDeviceMotionEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDeviceMotionEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDeviceOrientationEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDeviceOrientationEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDeviceOrientationEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryEntry.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryEntry.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryEntryInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryEntrySync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryEntrySync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryEntrySyncInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryReader.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryReader.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryReaderInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryReaderSync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryReaderSync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDirectoryReaderSyncInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocument.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocument.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentFragment.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentFragment.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentFragmentInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentFragmentPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentType.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentType.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMDocumentTypeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMElementTimeControl.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntity.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntity.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntityInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntityReference.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntityReference.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntityReferenceInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntriesCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntriesCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntriesCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntry.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntry.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryArray.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryArray.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryArraySync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryArraySync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryArraySyncInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntryInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntrySync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntrySync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEntrySyncInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMErrorCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMErrorCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMErrorCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMErrorEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMErrorEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMErrorEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventListener.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventSource.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventSource.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventSourceInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMEventTarget.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFile.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFile.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileEntry.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileEntry.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileEntryInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileEntrySync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileEntrySync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileEntrySyncInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileError.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileError.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileErrorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFilePrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileReader.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileReader.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileReaderInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileReaderSync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileReaderSync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileReaderSyncInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileSystemCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileSystemCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileSystemCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriter.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriter.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriterCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriterCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriterCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriterInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriterSync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriterSync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFileWriterSyncInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFlags.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFlags.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFlagsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFloat32Array.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFloat32Array.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMFloat32ArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMGeolocation.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMGeolocation.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMGeolocationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMGeoposition.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMGeoposition.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMGeopositionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAllCollection.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAllCollection.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAllCollectionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAnchorElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAnchorElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAnchorElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAnchorElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAppletElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAppletElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAppletElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAreaElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAreaElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAreaElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAudioElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAudioElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLAudioElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBRElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBRElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBRElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBaseElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBaseElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBaseElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBaseFontElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBaseFontElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBaseFontElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBlockquoteElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBlockquoteElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBlockquoteElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBodyElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBodyElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLBodyElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLButtonElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLButtonElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLButtonElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLButtonElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCanvasElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCanvasElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCanvasElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCanvasElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCollection.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCollection.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLCollectionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDListElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDListElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDListElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridCellElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridCellElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridCellElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridColElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridColElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridColElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridRowElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridRowElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataGridRowElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataListElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataListElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDataListElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDetailsElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDetailsElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDetailsElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDirectoryElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDirectoryElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDirectoryElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDivElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDivElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDivElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDocument.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDocument.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLDocumentInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLEmbedElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLEmbedElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLEmbedElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLEmbedElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFieldSetElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFieldSetElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFieldSetElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFieldSetElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFontElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFontElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFontElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFormElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFormElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFormElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFormElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameSetElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameSetElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLFrameSetElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHRElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHRElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHRElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHeadElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHeadElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHeadElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHeadingElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHeadingElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHeadingElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHtmlElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHtmlElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHtmlElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLHtmlElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIFrameElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIFrameElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIFrameElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIFrameElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLImageElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLImageElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLImageElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLInputElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLInputElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLInputElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLInputElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIsIndexElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIsIndexElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLIsIndexElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLKeygenElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLKeygenElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLKeygenElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLIElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLIElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLIElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLabelElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLabelElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLabelElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLabelElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLegendElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLegendElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLegendElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLinkElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLinkElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLLinkElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMapElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMapElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMapElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMarqueeElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMarqueeElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMarqueeElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMarqueeElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMediaElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMediaElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMediaElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMenuElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMenuElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMenuElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMetaElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMetaElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMetaElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMeterElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMeterElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLMeterElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLModElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLModElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLModElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOListElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOListElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOListElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLObjectElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLObjectElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLObjectElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLObjectElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptGroupElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptGroupElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptGroupElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptionElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptionElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptionElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptionsCollection.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptionsCollection.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOptionsCollectionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOutputElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOutputElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLOutputElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLParagraphElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLParagraphElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLParagraphElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLParamElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLParamElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLParamElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLPreElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLPreElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLPreElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLProgressElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLProgressElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLProgressElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLQuoteElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLQuoteElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLQuoteElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLScriptElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLScriptElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLScriptElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLScriptElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLSelectElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLSelectElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLSelectElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLSelectElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLSourceElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLSourceElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLSourceElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLStyleElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLStyleElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLStyleElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableCaptionElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableCaptionElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableCaptionElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableCellElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableCellElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableCellElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableColElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableColElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableColElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableRowElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableRowElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableRowElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableSectionElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableSectionElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTableSectionElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTextAreaElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTextAreaElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTextAreaElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTextAreaElementPrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTitleElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTitleElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLTitleElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLUListElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLUListElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLUListElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLVideoElement.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLVideoElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHTMLVideoElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHashChangeEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHashChangeEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHashChangeEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHighPass2FilterNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHighPass2FilterNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHighPass2FilterNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHistory.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHistory.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMHistoryInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBAny.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBAny.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBAnyInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBCursor.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBCursor.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBCursorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabase.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabase.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabaseError.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabaseError.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabaseErrorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabaseException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabaseException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabaseExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBDatabaseInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBFactory.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBFactory.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBFactoryInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBIndex.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBIndex.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBIndexInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBKey.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBKey.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBKeyInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBKeyRange.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBKeyRange.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBKeyRangeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBObjectStore.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBObjectStore.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBObjectStoreInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBRequest.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBRequest.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBRequestInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBTransaction.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBTransaction.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMIDBTransactionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMImageData.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMImageData.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMImageDataInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInjectedScriptHost.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInjectedScriptHost.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInjectedScriptHostInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInspectorFrontendHost.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInspectorFrontendHost.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInspectorFrontendHostInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt16Array.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt16Array.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt16ArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt32Array.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt32Array.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt32ArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt8Array.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt8Array.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMInt8ArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMJavaScriptAudioNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMJavaScriptAudioNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMJavaScriptAudioNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMKeyboardEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMKeyboardEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMKeyboardEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMLocation.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMLocation.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMLocationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMLowPass2FilterNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMLowPass2FilterNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMLowPass2FilterNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaError.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaError.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaErrorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaList.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaQueryList.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaQueryList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaQueryListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMediaQueryListListener.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMemoryInfo.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMemoryInfo.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMemoryInfoInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessageChannel.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessageChannel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessageChannelInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessageEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessageEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessageEventInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessagePort.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessagePort.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMessagePortInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMetadata.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMetadata.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMetadataCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMetadataCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMetadataCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMetadataInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMouseEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMouseEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMouseEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMutationEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMutationEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMMutationEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNamedNodeMap.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNamedNodeMap.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNamedNodeMapInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNavigator.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNavigator.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNavigatorInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNode.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNode.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeFilter.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeIterator.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeIterator.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeIteratorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeList.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNodeListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotation.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotation.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotification.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotification.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotificationCenter.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotificationCenter.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotificationCenterInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMNotificationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESStandardDerivatives.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESStandardDerivatives.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESStandardDerivativesInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESTextureFloat.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESTextureFloat.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESTextureFloatInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESVertexArrayObject.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESVertexArrayObject.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOESVertexArrayObjectInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOverflowEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOverflowEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMOverflowEventInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPageTransitionEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPageTransitionEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPageTransitionEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformance.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformance.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformanceInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformanceNavigation.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformanceNavigation.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformanceNavigationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformanceTiming.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformanceTiming.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPerformanceTimingInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPopStateEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPopStateEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPopStateEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPositionError.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPositionError.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMPositionErrorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProcessingInstruction.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProcessingInstruction.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProcessingInstructionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProgressEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProgressEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMProgressEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRGBColor.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRGBColor.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRGBColorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRange.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRange.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRangeException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRangeException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRangeExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRangeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRangePrivate.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRealtimeAnalyserNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRealtimeAnalyserNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRealtimeAnalyserNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRect.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRect.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMRectInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLError.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLError.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLErrorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLResultSet.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLResultSet.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLResultSetInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLResultSetRowList.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLResultSetRowList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLResultSetRowListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLStatementCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLStatementCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLStatementCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLStatementErrorCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLStatementErrorCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLStatementErrorCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransaction.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransaction.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionErrorCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionErrorCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionErrorCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionSync.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionSync.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionSyncCallback.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionSyncCallback.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionSyncCallbackInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSQLTransactionSyncInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAltGlyphElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAltGlyphElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAltGlyphElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAltGlyphElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAngle.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAngle.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAngleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateColorElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateColorElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateColorElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateTransformElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateTransformElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimateTransformElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedAngle.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedAngle.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedAngleInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedBoolean.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedBoolean.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedBooleanInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedEnumeration.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedEnumeration.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedEnumerationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedInteger.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedInteger.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedIntegerInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLength.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLength.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLengthInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLengthList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLengthList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedLengthListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumber.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumber.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumberInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumberList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumberList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedNumberListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedPreserveAspectRatio.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedPreserveAspectRatio.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedPreserveAspectRatioInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedRect.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedRect.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedRectInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedString.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedString.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedStringInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedTransformList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedTransformList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimatedTransformListInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimationElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimationElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimationElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGAnimationElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCircleElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCircleElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCircleElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCircleElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGClipPathElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGClipPathElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGClipPathElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGClipPathElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGColor.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGColor.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGColorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGComponentTransferFunctionElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGComponentTransferFunctionElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGComponentTransferFunctionElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCursorElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCursorElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCursorElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGCursorElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDefsElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDefsElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDefsElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDefsElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDescElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDescElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDescElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDescElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDocument.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDocument.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGDocumentInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstance.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstance.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstance.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstanceInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstanceList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstanceList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInstanceListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGEllipseElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGEllipseElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGEllipseElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGEllipseElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGExternalResourcesRequired.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEBlendElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEBlendElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEBlendElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEBlendElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEColorMatrixElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEColorMatrixElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEColorMatrixElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEColorMatrixElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEComponentTransferElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEComponentTransferElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEComponentTransferElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEComponentTransferElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFECompositeElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFECompositeElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFECompositeElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFECompositeElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEConvolveMatrixElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEConvolveMatrixElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEConvolveMatrixElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEConvolveMatrixElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDiffuseLightingElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDiffuseLightingElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDiffuseLightingElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDiffuseLightingElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDisplacementMapElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDisplacementMapElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDisplacementMapElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDisplacementMapElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDistantLightElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDistantLightElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEDistantLightElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFloodElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFloodElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFloodElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFloodElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncAElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncAElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncAElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncBElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncBElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncBElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncGElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncGElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncGElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncRElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncRElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEFuncRElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEGaussianBlurElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEGaussianBlurElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEGaussianBlurElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEGaussianBlurElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEImageElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEImageElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEImageElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEImageElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeNodeElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeNodeElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMergeNodeElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMorphologyElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMorphologyElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMorphologyElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEMorphologyElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEOffsetElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEOffsetElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEOffsetElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEOffsetElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEPointLightElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEPointLightElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFEPointLightElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpecularLightingElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpecularLightingElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpecularLightingElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpecularLightingElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpotLightElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpotLightElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFESpotLightElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETileElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETileElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETileElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETileElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETurbulenceElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETurbulenceElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETurbulenceElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFETurbulenceElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFilterElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFilterElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFilterElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFilterElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFilterPrimitiveStandardAttributes.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFitToViewBox.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceFormatElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceFormatElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceFormatElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceNameElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceNameElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceNameElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceSrcElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceSrcElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceSrcElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceUriElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceUriElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGFontFaceUriElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGForeignObjectElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGForeignObjectElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGForeignObjectElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGForeignObjectElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGlyphElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGlyphElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGlyphElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGradientElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGradientElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGradientElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGGradientElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGHKernElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGHKernElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGHKernElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGImageElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGImageElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGImageElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGImageElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLangSpace.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLength.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLength.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLengthInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLengthList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLengthList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLengthListInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLineElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLineElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLineElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLineElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLinearGradientElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLinearGradientElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLinearGradientElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGLocatable.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMarkerElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMarkerElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMarkerElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMarkerElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMaskElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMaskElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMaskElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMaskElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMatrix.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMatrix.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMatrixInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMetadataElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMetadataElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMetadataElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMissingGlyphElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMissingGlyphElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGMissingGlyphElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumber.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumber.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumberInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumberList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumberList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGNumberListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPaint.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPaint.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPaintInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSeg.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSeg.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegArcRelInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegClosePath.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegClosePath.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegClosePathInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicRelInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoCubicSmoothRelInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticRelInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegCurvetoQuadraticSmoothRelInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoHorizontalRelInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoRelInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegLinetoVerticalRelInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoAbs.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoAbs.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoAbsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoRel.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoRel.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPathSegMovetoRelInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPatternElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPatternElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPatternElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPatternElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPoint.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPoint.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPointInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPointList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPointList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPointListInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolygonElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolygonElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolygonElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolygonElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolylineElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolylineElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolylineElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPolylineElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPreserveAspectRatio.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPreserveAspectRatio.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGPreserveAspectRatioInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRadialGradientElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRadialGradientElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRadialGradientElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRect.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRect.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRectElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRectElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRectElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRectElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRectInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRenderingIntent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRenderingIntent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGRenderingIntentInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSVGElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSVGElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSVGElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSVGElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGScriptElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGScriptElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGScriptElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGScriptElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSetElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSetElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSetElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStopElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStopElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStopElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStopElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStringList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStringList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStringListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStylable.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStyleElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStyleElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStyleElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGStyleElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSwitchElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSwitchElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSwitchElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSwitchElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSymbolElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSymbolElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSymbolElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGSymbolElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTRefElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTRefElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTRefElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTRefElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTSpanElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTSpanElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTSpanElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTests.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextContentElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextContentElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextContentElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextContentElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPathElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPathElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPathElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPathElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPositioningElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPositioningElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTextPositioningElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTitleElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTitleElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTitleElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTitleElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransform.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransform.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGTransformable.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGURIReference.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUnitTypes.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUnitTypes.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUnitTypesInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUseElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUseElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUseElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGUseElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGVKernElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGVKernElement.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGVKernElementInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGViewElement.dep',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGViewElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGViewElement.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGViewElementInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGZoomAndPan.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGZoomEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGZoomEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSVGZoomEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScreen.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScreen.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScreenInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScriptProfile.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScriptProfile.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScriptProfileInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScriptProfileNode.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScriptProfileNode.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMScriptProfileNodeInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSharedWorker.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSharedWorker.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSharedWorkerContext.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSharedWorkerContext.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSharedWorkerContextInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSharedWorkerInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputResult.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputResult.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputResultInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputResultList.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputResultList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMSpeechInputResultListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStorage.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStorage.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStorageEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStorageEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStorageEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStorageInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleMedia.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleMedia.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleMediaInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleSheet.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleSheet.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleSheetInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleSheetList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleSheetList.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMStyleSheetListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMText.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMText.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTextEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTextEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTextEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTextInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTextMetrics.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTextMetrics.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTextMetricsInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTimeRanges.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTimeRanges.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTimeRangesInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouch.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouch.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouchEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouchEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouchEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouchInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouchList.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouchList.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTouchListInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTreeWalker.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTreeWalker.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMTreeWalkerInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUIEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUIEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUIEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint16Array.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint16Array.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint16ArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint32Array.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint32Array.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint32ArrayInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint8Array.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint8Array.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMUint8ArrayInternal.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMValidityState.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMValidityState.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMValidityStateInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLActiveInfo.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLActiveInfo.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLActiveInfoInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLBuffer.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLBuffer.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLBufferInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLContextAttributes.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLContextAttributes.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLContextAttributesInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLFramebuffer.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLFramebuffer.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLFramebufferInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLProgram.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLProgram.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLProgramInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLRenderbuffer.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLRenderbuffer.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLRenderbufferInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLRenderingContext.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLRenderingContext.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLRenderingContextInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLShader.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLShader.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLShaderInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLTexture.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLTexture.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLTextureInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLUniformLocation.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLUniformLocation.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLUniformLocationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLVertexArrayObjectOES.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLVertexArrayObjectOES.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebGLVertexArrayObjectOESInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitAnimation.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitAnimation.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitAnimationEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitAnimationEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitAnimationEventInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitAnimationList.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitAnimationList.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitCSSKeyframeRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitCSSKeyframeRule.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitCSSKeyframeRuleInternal.h',
@@ -6851,70 +6901,18 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitCSSTransformValue.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitCSSTransformValue.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitCSSTransformValueInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitLoseContext.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitLoseContext.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitLoseContextInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitPoint.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitPoint.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitPointInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitTransitionEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitTransitionEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebKitTransitionEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebSocket.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebSocket.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWebSocketInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWheelEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWheelEvent.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWheelEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorker.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorker.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerContext.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerContext.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerContextInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerLocation.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerLocation.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerLocationInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerNavigator.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerNavigator.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMWorkerNavigatorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequest.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequest.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestProgressEvent.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestProgressEvent.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestProgressEventInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestUpload.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestUpload.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLHttpRequestUploadInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLSerializer.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLSerializer.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXMLSerializerInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathEvaluator.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathEvaluator.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathEvaluatorInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathException.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathException.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathExceptionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathExpression.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathExpression.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathExpressionInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathNSResolver.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathResult.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathResult.mm',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXPathResultInternal.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXSLTProcessor.h',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXSLTProcessor.mm',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/DOMXSLTProcessorInternal.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/DebuggerScriptSource.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/DocTypeStrings.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/HTMLElementFactory.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/HTMLElementFactory.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/HTMLEntityTable.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/HTMLNames.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/HTMLNames.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/HeaderDetection.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/InjectedScriptSource.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/InspectorBackendDispatcher.cpp',
@@ -6989,7 +6987,6 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSRuleList.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSRuleList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSStyleDeclaration.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSStyleDeclaration.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSStyleRule.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSStyleRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSCSSStyleSheet.cpp',
@@ -7067,7 +7064,6 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDOMURL.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDOMURL.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDOMWindow.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDOMWindow.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDataGridColumn.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDataGridColumn.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDataGridColumnList.cpp',
@@ -7097,13 +7093,11 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDirectoryReaderSync.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDirectoryReaderSync.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDocument.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDocument.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDocumentFragment.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDocumentFragment.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDocumentType.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSDocumentType.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSElement.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSElementTimeControl.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSElementTimeControl.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSEntity.cpp',
@@ -7213,7 +7207,6 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSHTMLDocument.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSHTMLDocument.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSHTMLElement.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSHTMLElement.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSHTMLElementWrapperFactory.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSHTMLElementWrapperFactory.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSHTMLEmbedElement.cpp',
@@ -7399,13 +7392,11 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNavigator.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNavigator.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNode.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNode.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNodeFilter.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNodeFilter.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNodeIterator.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNodeIterator.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNodeList.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNodeList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNotation.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNotation.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSNotification.cpp',
@@ -7439,7 +7430,6 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSRGBColor.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSRGBColor.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSRange.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSRange.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSRangeException.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSRangeException.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSRealtimeAnalyserNode.cpp',
@@ -7885,8 +7875,12 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebGLUniformLocation.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebGLVertexArrayObjectOES.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebGLVertexArrayObjectOES.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitAnimation.cpp',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitAnimation.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitAnimationEvent.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitAnimationEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitAnimationList.cpp',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitAnimationList.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitCSSKeyframeRule.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitCSSKeyframeRule.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSWebKitCSSKeyframesRule.cpp',
@@ -7942,7 +7936,6 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/SVGElementFactory.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/SVGElementFactory.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/SVGNames.cpp',
-            '<(PRODUCT_DIR)/DerivedSources/WebCore/SVGNames.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/UserAgentStyleSheets.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/UserAgentStyleSheetsData.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/WMLElementFactory.cpp',
@@ -7958,5 +7951,8 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/XPathGrammar.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/tokenizer.cpp',
         ],
+        'export_file_generator_files': [
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/ExportFileGenerator.cpp',
+        ],
     }
 }
diff --git a/Source/WebCore/WebCore.order b/Source/WebCore/WebCore.order
index 65c7d84..af1a2ab 100644
--- a/Source/WebCore/WebCore.order
+++ b/Source/WebCore/WebCore.order
@@ -16003,7 +16003,7 @@ __ZNK7WebCore16PDFDocumentImage4sizeEv
 __ZN7WebCore5Image26nativeImageForCurrentFrameEv
 __ZN7WebCore5Image14resetAnimationEv
 __ZN7WebCore11RenderLayer29updateRepaintRectsAfterScrollEb
-__ZNK7WebCore5Frame15layerTreeAsTextEv
+__ZNK7WebCore5Frame15layerTreeAsTextEb
 __ZNK7WebCore13GraphicsLayer15layerTreeAsTextEj
 __ZNK7WebCore13GraphicsLayer9dumpLayerERNS_10TextStreamEij
 __ZN7WebCoreL11writeIndentERNS_10TextStreamEi
diff --git a/Source/WebCore/WebCore.pri b/Source/WebCore/WebCore.pri
index 3946384..3644184 100644
--- a/Source/WebCore/WebCore.pri
+++ b/Source/WebCore/WebCore.pri
@@ -91,6 +91,7 @@ WEBCORE_INCLUDEPATH = \
     $$SOURCE_DIR/WebCore/platform/audio \
     $$SOURCE_DIR/WebCore/platform/graphics \
     $$SOURCE_DIR/WebCore/platform/graphics/filters \
+    $$SOURCE_DIR/WebCore/platform/graphics/texmap \
     $$SOURCE_DIR/WebCore/platform/graphics/transforms \
     $$SOURCE_DIR/WebCore/platform/image-decoders \
     $$SOURCE_DIR/WebCore/platform/mock \
@@ -311,6 +312,7 @@ contains (CONFIG, text_breaking_with_icu) {
 }
 
 win32-* {
+    INCLUDEPATH += $$SOURCE_DIR/WebCore/platform/win
     LIBS += -lgdi32
     LIBS += -lole32
     LIBS += -luser32
diff --git a/Source/WebCore/WebCore.pro b/Source/WebCore/WebCore.pro
index 583df14..2ac917a 100644
--- a/Source/WebCore/WebCore.pro
+++ b/Source/WebCore/WebCore.pro
@@ -13,6 +13,9 @@ CONFIG += staticlib
 
 DESTDIR = $$WEBCORE_DESTDIR
 
+DEFINES += BUILDING_WEBKIT
+DEFINES += QT_MAKEDLL
+
 contains(DEFINES, WTF_USE_QT_MOBILE_THEME=1) {
     DEFINES += ENABLE_NO_LISTBOX_RENDERING=1
 }
@@ -90,6 +93,7 @@ v8 {
         bindings/v8/DOMDataStore.cpp \
         bindings/v8/MainThreadDOMData.cpp \
         bindings/v8/NPV8Object.cpp \
+        bindings/v8/RetainedDOMInfo.cpp \
         bindings/v8/ScheduledAction.cpp \
         bindings/v8/ScopedDOMDataStore.cpp \
         bindings/v8/ScriptCachedFrameData.cpp \
@@ -203,6 +207,7 @@ v8 {
         bindings/v8/custom/V8StorageCustom.cpp \
         bindings/v8/custom/V8StyleSheetCustom.cpp \
         bindings/v8/custom/V8StyleSheetListCustom.cpp \
+        bindings/v8/custom/V8WebKitAnimationCustom.cpp \
         bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp \
         bindings/v8/custom/V8WebKitPointConstructor.cpp \
         bindings/v8/custom/V8WorkerContextCustom.cpp \
@@ -300,6 +305,7 @@ v8 {
         bindings/js/JSImageConstructor.cpp \
         bindings/js/JSImageDataCustom.cpp \
         bindings/js/JSInjectedScriptHostCustom.cpp \
+        bindings/js/JSInjectedScriptManager.cpp \
         bindings/js/JSInspectorFrontendHostCustom.cpp \
         bindings/js/JSInt16ArrayCustom.cpp \
         bindings/js/JSInt32ArrayCustom.cpp \
@@ -332,12 +338,15 @@ v8 {
         bindings/js/JSUint16ArrayCustom.cpp \
         bindings/js/JSUint32ArrayCustom.cpp \
         bindings/js/JSUint8ArrayCustom.cpp \
+        bindings/js/JSWebKitAnimationCustom.cpp \
+        bindings/js/JSWebKitAnimationListCustom.cpp \
         bindings/js/JSWebKitCSSKeyframeRuleCustom.cpp \
         bindings/js/JSWebKitCSSKeyframesRuleCustom.cpp \
         bindings/js/JSWebKitCSSMatrixCustom.cpp \
         bindings/js/JSWebKitPointCustom.cpp \
         bindings/js/JSXMLHttpRequestCustom.cpp \
         bindings/js/JSXMLHttpRequestUploadCustom.cpp \
+        bindings/js/PageScriptDebugServer.cpp \
         bindings/js/ScheduledAction.cpp \
         bindings/js/ScriptCachedFrameData.cpp \
         bindings/js/ScriptCallStackFactory.cpp \
@@ -389,6 +398,7 @@ SOURCES += \
     css/CSSImportRule.cpp \
     css/CSSInheritedValue.cpp \
     css/CSSInitialValue.cpp \
+    css/CSSLineBoxContainValue.cpp \
     css/CSSMediaRule.cpp \
     css/CSSMutableStyleDeclaration.cpp \
     css/CSSOMUtils.cpp \
@@ -406,6 +416,7 @@ SOURCES += \
     css/CSSSelector.cpp \
     css/CSSSelectorList.cpp \
     css/CSSSegmentedFontFace.cpp \
+    css/CSSStyleApplyProperty.cpp \
     css/CSSStyleDeclaration.cpp \
     css/CSSStyleRule.cpp \
     css/CSSStyleSelector.cpp \
@@ -435,7 +446,6 @@ SOURCES += \
     css/WebKitCSSMatrix.cpp \
     css/WebKitCSSTransformValue.cpp \
     dom/ActiveDOMObject.cpp \
-    dom/AsyncScriptRunner.cpp \
     dom/Attr.cpp \
     dom/Attribute.cpp \
     dom/BeforeProcessEvent.cpp \
@@ -479,6 +489,7 @@ SOURCES += \
     dom/ErrorEvent.cpp \
     dom/Event.cpp \
     dom/EventContext.cpp \
+    dom/EventDispatcher.cpp \
     dom/EventNames.cpp \
     dom/EventTarget.cpp \
     dom/EventQueue.cpp \
@@ -519,6 +530,7 @@ SOURCES += \
     dom/ScriptableDocumentParser.cpp \
     dom/ScriptElement.cpp \
     dom/ScriptExecutionContext.cpp \
+    dom/ScriptRunner.cpp \
     dom/SelectElement.cpp \
     dom/SelectorNodeList.cpp \
     dom/SpaceSplitString.cpp \
@@ -791,8 +803,10 @@ SOURCES += \
     html/shadow/SliderThumbElement.cpp \
     html/shadow/TextControlInnerElements.cpp \
     inspector/ConsoleMessage.cpp \
+    inspector/DOMNodeHighlighter.cpp \
     inspector/InjectedScript.cpp \
     inspector/InjectedScriptHost.cpp \
+    inspector/InjectedScriptManager.cpp \
     inspector/InspectorAgent.cpp \
     inspector/InspectorApplicationCacheAgent.cpp \
     inspector/InspectorBrowserDebuggerAgent.cpp \
@@ -809,6 +823,7 @@ SOURCES += \
     inspector/InspectorFrontendClientLocal.cpp \
     inspector/InspectorFrontendHost.cpp \
     inspector/InspectorInstrumentation.cpp \
+    inspector/InspectorPageAgent.cpp \
     inspector/InspectorProfilerAgent.cpp \
     inspector/InspectorResourceAgent.cpp \
     inspector/InspectorRuntimeAgent.cpp \
@@ -816,10 +831,12 @@ SOURCES += \
     inspector/InspectorStyleSheet.cpp \
     inspector/InspectorTimelineAgent.cpp \
     inspector/InspectorValues.cpp \
+    inspector/PageDebuggerAgent.cpp \
     inspector/ScriptArguments.cpp \
     inspector/ScriptCallFrame.cpp \
     inspector/ScriptCallStack.cpp \
     inspector/TimelineRecordFactory.cpp \
+    inspector/WorkerDebuggerAgent.cpp \
     loader/archive/ArchiveResource.cpp \
     loader/archive/ArchiveResourceCollection.cpp \
     loader/cache/MemoryCache.cpp \
@@ -844,6 +861,7 @@ SOURCES += \
     loader/FrameLoaderStateMachine.cpp \
     loader/HistoryController.cpp \
     loader/FTPDirectoryParser.cpp \
+    loader/icon/IconDatabaseBase.cpp \
     loader/icon/IconLoader.cpp \
     loader/ImageLoader.cpp \
     loader/MainResourceLoader.cpp \
@@ -870,6 +888,8 @@ SOURCES += \
     page/animation/CompositeAnimation.cpp \
     page/animation/ImplicitAnimation.cpp \
     page/animation/KeyframeAnimation.cpp \
+    page/WebKitAnimation.cpp \
+    page/WebKitAnimationList.cpp \
     page/BarInfo.cpp \
     page/Chrome.cpp \
     page/Console.cpp \
@@ -928,6 +948,7 @@ SOURCES += \
     platform/text/LocalizedNumberNone.cpp \
     platform/ContentType.cpp \
     platform/CrossThreadCopier.cpp \
+    platform/DefaultLocalizationStrategy.cpp \
     platform/DragData.cpp \
     platform/DragImage.cpp \
     platform/FileChooser.cpp \
@@ -1198,6 +1219,8 @@ v8 {
         bindings/v8/npruntime_priv.h \
         bindings/v8/NPV8Object.h \
         bindings/v8/OwnHandle.h \
+        bindings/v8/RetainedDOMInfo.h \
+        bindings/v8/RetainedObjectInfo.h \
         bindings/v8/ScheduledAction.h \
         bindings/v8/ScopedDOMDataStore.h \
         bindings/v8/ScriptCachedFrameData.h \
@@ -1281,9 +1304,11 @@ v8 {
         bindings/js/JSStorageCustom.h \
         bindings/js/JSWorkerContextBase.h \
         bindings/js/JavaScriptCallFrame.h \
+        bindings/js/PageScriptDebugServer.h \
         bindings/js/ScheduledAction.h \
         bindings/js/ScriptCachedFrameData.h \
         bindings/js/ScriptController.h \
+        bindings/js/ScriptDebugServer.h \
         bindings/js/ScriptEventListener.h \
         bindings/js/ScriptFunctionCall.h \
         bindings/js/ScriptGCEvent.h \
@@ -1301,6 +1326,7 @@ v8 {
         bindings/js/StringSourceProvider.h \
         bindings/js/WebCoreJSClientData.h \
         bindings/js/WorkerScriptController.h \
+        bindings/js/WorkerScriptDebugServer.h \
         bridge/Bridge.h \
         bridge/c/CRuntimeObject.h \
         bridge/c/c_class.h \
@@ -1356,6 +1382,7 @@ HEADERS += \
     css/CSSSegmentedFontFace.h \
     css/CSSSelector.h \
     css/CSSSelectorList.h \
+    css/CSSStyleApplyProperty.h \
     css/CSSStyleDeclaration.h \
     css/CSSStyleRule.h \
     css/CSSStyleSelector.h \
@@ -1706,8 +1733,10 @@ HEADERS += \
     html/parser/HTMLViewSourceParser.h \
     html/parser/XSSFilter.h \
     inspector/ConsoleMessage.h \
+    inspector/DOMNodeHighlighter.h \
     inspector/InjectedScript.h \
     inspector/InjectedScriptHost.h \
+    inspector/InjectedScriptManager.h \
     inspector/InspectorAgent.h \
     inspector/InspectorApplicationCacheAgent.h \
     inspector/InspectorBrowserDebuggerAgent.h \
@@ -1725,6 +1754,7 @@ HEADERS += \
     inspector/InspectorFrontendClientLocal.h \
     inspector/InspectorFrontendHost.h \
     inspector/InspectorInstrumentation.h \
+    inspector/InspectorPageAgent.h \
     inspector/InspectorProfilerAgent.h \
     inspector/InspectorResourceAgent.h \
     inspector/InspectorRuntimeAgent.h \
@@ -1732,8 +1762,10 @@ HEADERS += \
     inspector/InspectorStyleSheet.h \
     inspector/InspectorTimelineAgent.h \
     inspector/InstrumentingAgents.h \
+    inspector/PageDebuggerAgent.h \
     inspector/ScriptGCEventListener.h \
     inspector/TimelineRecordFactory.h \
+    inspector/WorkerDebuggerAgent.h \
     loader/appcache/ApplicationCacheGroup.h \
     loader/appcache/ApplicationCacheHost.h \
     loader/appcache/ApplicationCache.h \
@@ -1763,6 +1795,7 @@ HEADERS += \
     loader/FrameLoaderStateMachine.h \
     loader/FTPDirectoryParser.h \
     loader/icon/IconDatabase.h \
+    loader/icon/IconDatabaseBase.h \
     loader/icon/IconLoader.h \
     loader/icon/IconRecord.h \
     loader/icon/PageURLRecord.h \
@@ -1833,6 +1866,8 @@ HEADERS += \
     page/SpeechInputListener.h \
     page/SpeechInputResult.h \
     page/SpeechInputResultList.h \
+    page/WebKitAnimation.h \
+    page/WebKitAnimationList.h \
     page/WindowFeatures.h \
     page/WorkerNavigator.h \
     platform/animation/Animation.h \
@@ -1842,6 +1877,7 @@ HEADERS += \
     platform/ContentType.h \
     platform/ContextMenu.h \
     platform/CrossThreadCopier.h \
+    platform/DefaultLocalizationStrategy.h \
     platform/DragData.h \
     platform/DragImage.h \
     platform/FileChooser.h \
@@ -1927,6 +1963,7 @@ HEADERS += \
     platform/Length.h \
     platform/text/LineEnding.h \
     platform/text/TextCheckerClient.h \
+    platform/text/TextChecking.h \
     platform/LinkHash.h \
     platform/Logging.h \
     platform/Language.h \
@@ -2523,7 +2560,9 @@ contains(DEFINES, ENABLE_SMOOTH_SCROLLING=1) {
 }
 
 win32-*|wince* {
+    HEADERS += platform/win/SystemInfo.h
     SOURCES += \
+        platform/win/SystemInfo.cpp \
         platform/win/SystemTimeWin.cpp \
         platform/graphics/win/TransformationMatrixWin.cpp
 }
@@ -2692,6 +2731,16 @@ contains(DEFINES, ENABLE_INDEXED_DATABASE=1) {
         storage/IDBTransaction.cpp
 }
 
+contains(DEFINES, ENABLE_DATA_TRANSFER_ITEMS=1) {
+    HEADERS += \
+        dom/DataTransferItem.h \
+        dom/DataTransferItems.h \
+        dom/StringCallback.h
+    SOURCES += \
+        dom/DataTransferItem.cpp \
+        dom/StringCallback.cpp
+}
+
 contains(DEFINES, ENABLE_DOM_STORAGE=1) {
     HEADERS += \
         storage/AbstractDatabase.h \
@@ -2707,6 +2756,7 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/LocalStorageThread.h \
         storage/OriginQuotaManager.h \
         storage/OriginUsageRecord.h \
+        storage/SQLCallbackWrapper.h \
         storage/SQLResultSet.h \
         storage/SQLResultSetRowList.h \
         storage/SQLStatement.h \
@@ -2725,7 +2775,9 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/StorageMap.h \
         storage/StorageNamespace.h \
         storage/StorageNamespaceImpl.h \
-        storage/StorageSyncManager.h
+        storage/StorageSyncManager.h \
+        storage/StorageTracker.h \
+        storage/StorageTrackerClient.h
 
     !v8 {
         SOURCES += \
@@ -2742,7 +2794,8 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/StorageMap.cpp \
         storage/StorageNamespace.cpp \
         storage/StorageNamespaceImpl.cpp \
-        storage/StorageSyncManager.cpp
+        storage/StorageSyncManager.cpp \
+        storage/StorageTracker.cpp
 }
 
 contains(DEFINES, ENABLE_FILE_SYSTEM=1) {
@@ -2816,9 +2869,6 @@ contains(DEFINES, ENABLE_ICONDATABASE=1) {
         loader/icon/IconDatabase.cpp \
         loader/icon/IconRecord.cpp \
         loader/icon/PageURLRecord.cpp
-} else {
-    SOURCES += \
-        loader/icon/IconDatabaseNone.cpp
 }
 
 contains(DEFINES, ENABLE_WORKERS=1) {
@@ -2828,7 +2878,8 @@ contains(DEFINES, ENABLE_WORKERS=1) {
             bindings/js/JSWorkerContextBase.cpp \
             bindings/js/JSWorkerContextCustom.cpp \
             bindings/js/JSWorkerCustom.cpp \
-            bindings/js/WorkerScriptController.cpp
+            bindings/js/WorkerScriptController.cpp \
+            bindings/js/WorkerScriptDebugServer.cpp
     }
     SOURCES += \
         loader/WorkerThreadableLoader.cpp \
@@ -3369,9 +3420,9 @@ contains(DEFINES, ENABLE_WEBGL=1) {
         html/canvas/OESStandardDerivatives.h \
         html/canvas/OESTextureFloat.h \
         html/canvas/OESVertexArrayObject.h \
-        html/canvas/OESVertexArray.h \
         html/canvas/WebGLTexture.h \
         html/canvas/WebGLUniformLocation.h \
+        html/canvas/WebGLVertexArrayObjectOES.h \
         html/canvas/WebKitLoseContext.h \
         platform/graphics/Extensions3D.h \
         platform/graphics/GraphicsContext3D.h \
@@ -3398,9 +3449,9 @@ contains(DEFINES, ENABLE_WEBGL=1) {
         html/canvas/OESStandardDerivatives.cpp \
         html/canvas/OESTextureFloat.cpp \
         html/canvas/OESVertexArrayObject.cpp \
-        html/canvas/OESVertexArray.cpp \
         html/canvas/WebGLTexture.cpp \
         html/canvas/WebGLUniformLocation.cpp \
+        html/canvas/WebGLVertexArrayObjectOES.cpp \
         html/canvas/WebKitLoseContext.cpp \
         platform/graphics/GraphicsContext3D.cpp \
         platform/graphics/gpu/DrawingBuffer.cpp \
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWin.vcproj b/Source/WebCore/WebCore.vcproj/QTMovieWin.vcproj
index 3c9cc6f..3e944b7 100644
--- a/Source/WebCore/WebCore.vcproj/QTMovieWin.vcproj
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWin.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\QTMovieWinCommon.vsprops"
+			InheritedPropertySheets=".\QTMovieWinDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -79,7 +79,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\QTMovieWinCommon.vsprops"
+			InheritedPropertySheets=".\QTMovieWinRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -140,7 +140,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\QTMovieWinCommon.vsprops"
+			InheritedPropertySheets=".\QTMovieWinDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -199,9 +199,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\QTMovieWinCommon.vsprops"
+			InheritedPropertySheets=".\QTMovieWinProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -263,7 +263,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\QTMovieWinCommon.vsprops"
+			InheritedPropertySheets=".\QTMovieWinReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -324,7 +324,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\QTMovieWinCommon.vsprops"
+			InheritedPropertySheets=".\QTMovieWinDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWinDebug.vsprops b/Source/WebCore/WebCore.vcproj/QTMovieWinDebug.vsprops
new file mode 100644
index 0000000..158353e
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWinDebug.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="QTMovieWinDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\QTMovieWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWinDebugAll.vsprops b/Source/WebCore/WebCore.vcproj/QTMovieWinDebugAll.vsprops
new file mode 100644
index 0000000..9d2bb0f
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWinDebugAll.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="QTMovieWinDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\QTMovieWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWinDebugCairoCFLite.vsprops b/Source/WebCore/WebCore.vcproj/QTMovieWinDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..74bdd57
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWinDebugCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="QTMovieWinDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\QTMovieWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWinProduction.vsprops b/Source/WebCore/WebCore.vcproj/QTMovieWinProduction.vsprops
new file mode 100644
index 0000000..5001f2b
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWinProduction.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="QTMovieWinProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\QTMovieWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWinRelease.vsprops b/Source/WebCore/WebCore.vcproj/QTMovieWinRelease.vsprops
new file mode 100644
index 0000000..aab50d9
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWinRelease.vsprops
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="QTMovieWinRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\QTMovieWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/QTMovieWinReleaseCairoCFLite.vsprops b/Source/WebCore/WebCore.vcproj/QTMovieWinReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..df313d2
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/QTMovieWinReleaseCairoCFLite.vsprops
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="QTMovieWinReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\QTMovieWinCommon.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.make b/Source/WebCore/WebCore.vcproj/WebCore.make
index 1be2edd..be313dc 100644
--- a/Source/WebCore/WebCore.vcproj/WebCore.make
+++ b/Source/WebCore/WebCore.vcproj/WebCore.make
@@ -1,11 +1,10 @@
 !IF "$(BUILDSTYLE)"=="DEBUG"
 BUILDSTYLE=Debug_All
 !ELSE
-BUILDSTYLE=Release_LTCG
+BUILDSTYLE=Production
 !ENDIF
 
 install:
-    set PRODUCTION=1
 	set WebKitLibrariesDir=$(SRCROOT)\AppleInternal
 	set WebKitOutputDir=$(OBJROOT)
 	set ConfigurationBuildDir=$(OBJROOT)\$(BUILDSTYLE)
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.sln b/Source/WebCore/WebCore.vcproj/WebCore.sln
index 4290107..0ab426b 100644
--- a/Source/WebCore/WebCore.vcproj/WebCore.sln
+++ b/Source/WebCore/WebCore.vcproj/WebCore.sln
@@ -15,7 +15,7 @@ Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug_All|Win32 = Debug_All|Win32
 		Debug|Win32 = Debug|Win32
-		Release_LTCG|Win32 = Release_LTCG|Win32
+		Production|Win32 = Production|Win32
 		Release|Win32 = Release|Win32
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
@@ -23,24 +23,24 @@ Global
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug|Win32.ActiveCfg = Debug|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug|Win32.Build.0 = Debug|Win32
-		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Production|Win32.ActiveCfg = Production|Win32
+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Production|Win32.Build.0 = Production|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.ActiveCfg = Release|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.Build.0 = Release|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.ActiveCfg = Debug|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.Build.0 = Debug|Win32
-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Production|Win32.ActiveCfg = Production|Win32
+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Production|Win32.Build.0 = Production|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.ActiveCfg = Release|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.Build.0 = Release|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug|Win32.ActiveCfg = Debug|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug|Win32.Build.0 = Debug|Win32
-		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Production|Win32.ActiveCfg = Production|Win32
+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Production|Win32.Build.0 = Production|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release|Win32.ActiveCfg = Release|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release|Win32.Build.0 = Release|Win32
 	EndGlobalSection
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.submit.sln b/Source/WebCore/WebCore.vcproj/WebCore.submit.sln
index 344af4b..8373b03 100644
--- a/Source/WebCore/WebCore.vcproj/WebCore.submit.sln
+++ b/Source/WebCore/WebCore.vcproj/WebCore.submit.sln
@@ -17,7 +17,7 @@ Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug_All|Win32 = Debug_All|Win32
 		Debug|Win32 = Debug|Win32
-		Release_LTCG|Win32 = Release_LTCG|Win32
+		Production|Win32 = Production|Win32
 		Release|Win32 = Release|Win32
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
@@ -25,24 +25,24 @@ Global
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug|Win32.ActiveCfg = Debug|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug|Win32.Build.0 = Debug|Win32
-		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Production|Win32.ActiveCfg = Production|Win32
+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Production|Win32.Build.0 = Production|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.ActiveCfg = Release|Win32
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.Build.0 = Release|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.ActiveCfg = Debug|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug|Win32.Build.0 = Debug|Win32
-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Production|Win32.ActiveCfg = Production|Win32
+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Production|Win32.Build.0 = Production|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.ActiveCfg = Release|Win32
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.Build.0 = Release|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.ActiveCfg = Debug_All|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.Build.0 = Debug_All|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug|Win32.ActiveCfg = Debug|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug|Win32.Build.0 = Debug|Win32
-		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release_LTCG|Win32.ActiveCfg = Release_LTCG|Win32
-		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release_LTCG|Win32.Build.0 = Release_LTCG|Win32
+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Production|Win32.ActiveCfg = Production|Win32
+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Production|Win32.Build.0 = Production|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release|Win32.ActiveCfg = Release|Win32
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release|Win32.Build.0 = Release|Win32
 	EndGlobalSection
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.vcproj b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
index 847c04f..f00a591 100755
--- a/Source/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -18,7 +18,7 @@
 		<Configuration
 			Name="Debug|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCG.vsprops;.\WebCoreCFNetwork.vsprops;.\WebCorePthreads.vsprops;.\WebCoreMediaQT.vsprops;.\WebCoreQuartzCore.vsprops"
+			InheritedPropertySheets=".\WebCoreDebug.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -72,7 +72,7 @@
 		<Configuration
 			Name="Release|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCG.vsprops;.\WebCoreCFNetwork.vsprops;.\WebCorePthreads.vsprops;.\WebCoreMediaQT.vsprops;.\WebCoreQuartzCore.vsprops"
+			InheritedPropertySheets=".\WebCoreRelease.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -126,7 +126,7 @@
 		<Configuration
 			Name="Debug_Cairo_CFLite|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCairo.vsprops;.\WebCoreCURL.vsprops"
+			InheritedPropertySheets=".\WebCoreDebugCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -180,7 +180,7 @@
 		<Configuration
 			Name="Release_Cairo_CFLite|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCairo.vsprops;.\WebCoreCURL.vsprops"
+			InheritedPropertySheets=".\WebCoreReleaseCairoCFLite.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -234,7 +234,7 @@
 		<Configuration
 			Name="Debug_All|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCG.vsprops;.\WebCoreCFNetwork.vsprops;.\WebCorePthreads.vsprops;.\WebCoreMediaQT.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;.\WebCoreQuartzCore.vsprops"
+			InheritedPropertySheets=".\WebCoreDebugAll.vsprops"
 			CharacterSet="1"
 			>
 			<Tool
@@ -286,9 +286,9 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="4"
-			InheritedPropertySheets="$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;$(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;.\WebCoreCommon.vsprops;.\WebCoreCG.vsprops;.\WebCoreCFNetwork.vsprops;.\WebCorePthreads.vsprops;.\WebCoreMediaQT.vsprops;.\WebCoreQuartzCore.vsprops"
+			InheritedPropertySheets=".\WebCoreProduction.vsprops"
 			CharacterSet="1"
 			WholeProgramOptimization="1"
 			>
@@ -405,7 +405,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -476,7 +476,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -537,7 +537,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -621,7 +621,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -677,7 +677,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -733,7 +733,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -789,7 +789,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -845,7 +845,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -901,7 +901,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -957,7 +957,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1013,7 +1013,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1069,7 +1069,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1125,7 +1125,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1181,7 +1181,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1237,7 +1237,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1293,7 +1293,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1349,7 +1349,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1405,7 +1405,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1461,7 +1461,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1517,7 +1517,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1573,7 +1573,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1629,7 +1629,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1685,7 +1685,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1741,7 +1741,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1797,7 +1797,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1853,7 +1853,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1909,7 +1909,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -1965,7 +1965,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2021,7 +2021,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2077,7 +2077,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2133,7 +2133,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2189,7 +2189,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2245,7 +2245,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2301,7 +2301,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2357,7 +2357,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2413,7 +2413,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2469,7 +2469,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2525,7 +2525,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2581,7 +2581,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2637,7 +2637,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2693,7 +2693,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2749,7 +2749,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2805,7 +2805,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2818,6 +2818,118 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSDataTransferItem.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSDataTransferItem.h"
+				>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSDataTransferItems.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSDataTransferItems.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\WebCore\DerivedSources\JSDedicatedWorkerContext.cpp"
 				>
 				<FileConfiguration
@@ -2861,7 +2973,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2917,7 +3029,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -2973,7 +3085,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3029,7 +3141,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3093,7 +3205,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3157,7 +3269,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3213,7 +3325,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3269,7 +3381,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3325,7 +3437,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3381,7 +3493,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3437,7 +3549,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3501,7 +3613,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3557,7 +3669,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3613,7 +3725,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3669,7 +3781,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3725,7 +3837,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3781,7 +3893,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3837,7 +3949,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3893,7 +4005,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -3949,7 +4061,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4005,7 +4117,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4061,7 +4173,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4117,7 +4229,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4173,7 +4285,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4229,7 +4341,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4289,7 +4401,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4345,7 +4457,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4401,7 +4513,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4457,7 +4569,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4513,7 +4625,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4569,7 +4681,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4633,7 +4745,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4697,7 +4809,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4753,7 +4865,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4809,7 +4921,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4865,7 +4977,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4921,7 +5033,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -4977,7 +5089,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5057,7 +5169,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5121,7 +5233,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5177,7 +5289,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5241,7 +5353,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5297,7 +5409,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5361,7 +5473,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5417,7 +5529,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5473,7 +5585,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5529,7 +5641,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5585,7 +5697,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5641,7 +5753,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5697,7 +5809,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5753,7 +5865,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5809,7 +5921,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5865,7 +5977,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5921,7 +6033,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -5977,7 +6089,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6033,7 +6145,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6089,7 +6201,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6145,7 +6257,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6201,7 +6313,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6257,7 +6369,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6313,7 +6425,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6369,7 +6481,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6425,7 +6537,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6481,7 +6593,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6537,7 +6649,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6593,7 +6705,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6649,7 +6761,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6705,7 +6817,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6761,7 +6873,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6817,7 +6929,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6873,7 +6985,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6929,7 +7041,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -6985,7 +7097,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7041,7 +7153,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7097,7 +7209,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7153,7 +7265,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7209,7 +7321,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7265,7 +7377,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7321,7 +7433,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7377,7 +7489,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7433,7 +7545,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7489,7 +7601,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7545,7 +7657,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7601,7 +7713,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7657,7 +7769,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7713,7 +7825,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7769,7 +7881,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7825,7 +7937,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7881,7 +7993,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7937,7 +8049,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -7993,7 +8105,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8049,7 +8161,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8105,7 +8217,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8161,7 +8273,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8217,7 +8329,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8273,7 +8385,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8329,7 +8441,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8385,7 +8497,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8441,7 +8553,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8497,7 +8609,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8553,7 +8665,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8609,7 +8721,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8665,7 +8777,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8721,7 +8833,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8777,7 +8889,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8833,7 +8945,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8889,7 +9001,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -8945,7 +9057,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9001,7 +9113,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9057,7 +9169,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9113,7 +9225,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9169,7 +9281,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9225,7 +9337,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9281,7 +9393,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9337,7 +9449,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9393,7 +9505,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9449,7 +9561,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9505,7 +9617,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9561,7 +9673,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9617,7 +9729,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9673,7 +9785,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9729,7 +9841,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9785,7 +9897,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9841,7 +9953,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9897,7 +10009,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -9953,7 +10065,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10005,7 +10117,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10057,7 +10169,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10109,7 +10221,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10165,7 +10277,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10221,7 +10333,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10277,7 +10389,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10333,7 +10445,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10389,7 +10501,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10445,7 +10557,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10497,7 +10609,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10553,7 +10665,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10609,7 +10721,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10665,7 +10777,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10721,7 +10833,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10777,7 +10889,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10833,7 +10945,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10889,7 +11001,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -10945,7 +11057,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11001,7 +11113,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11057,7 +11169,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11113,7 +11225,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11169,7 +11281,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11249,7 +11361,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11305,7 +11417,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11361,7 +11473,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11417,7 +11529,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11473,7 +11585,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11529,7 +11641,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11585,7 +11697,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11641,7 +11753,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11697,7 +11809,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11753,7 +11865,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11809,7 +11921,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11865,7 +11977,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11921,7 +12033,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -11977,7 +12089,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12033,7 +12145,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12089,7 +12201,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12145,7 +12257,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12201,7 +12313,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12257,7 +12369,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12313,7 +12425,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12369,7 +12481,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12425,7 +12537,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12481,7 +12593,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12537,7 +12649,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12593,7 +12705,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12649,7 +12761,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12705,7 +12817,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12761,7 +12873,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12817,7 +12929,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12873,7 +12985,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12929,7 +13041,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -12985,7 +13097,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13041,7 +13153,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13097,7 +13209,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13153,7 +13265,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13209,7 +13321,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13265,7 +13377,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13321,7 +13433,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13377,7 +13489,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13433,7 +13545,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13446,6 +13558,62 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSStringCallback.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSStringCallback.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSStyleMedia.cpp"
 				>
 				<FileConfiguration
@@ -13489,7 +13657,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13545,7 +13713,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13601,7 +13769,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13657,7 +13825,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13713,7 +13881,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13769,7 +13937,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13825,7 +13993,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13881,7 +14049,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13937,7 +14105,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -13993,7 +14161,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14049,7 +14217,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14105,7 +14273,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14161,7 +14329,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14217,7 +14385,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14273,7 +14441,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14329,7 +14497,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14385,7 +14553,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14441,7 +14609,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14497,7 +14665,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14553,7 +14721,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14609,7 +14777,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14665,7 +14833,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14721,7 +14889,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14777,7 +14945,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14833,7 +15001,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14889,7 +15057,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -14945,7 +15113,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15001,7 +15169,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15057,7 +15225,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15113,7 +15281,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15169,7 +15337,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15225,7 +15393,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15281,7 +15449,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15345,7 +15513,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15401,7 +15569,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15457,7 +15625,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15513,7 +15681,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15569,7 +15737,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15625,7 +15793,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15681,7 +15849,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15737,7 +15905,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15793,7 +15961,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15849,7 +16017,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15905,7 +16073,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -15961,7 +16129,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16017,7 +16185,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16073,7 +16241,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16129,7 +16297,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16185,7 +16353,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16241,7 +16409,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16297,7 +16465,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16353,7 +16521,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16409,7 +16577,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16465,7 +16633,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16521,7 +16689,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16577,7 +16745,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16633,7 +16801,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16689,7 +16857,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16745,7 +16913,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16801,7 +16969,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16857,7 +17025,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16913,7 +17081,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -16969,7 +17137,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17025,7 +17193,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17081,7 +17249,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17137,7 +17305,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17193,7 +17361,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17249,7 +17417,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17305,7 +17473,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17361,7 +17529,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17417,7 +17585,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17473,7 +17641,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17529,7 +17697,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17585,7 +17753,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17641,7 +17809,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17697,7 +17865,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17753,7 +17921,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17809,7 +17977,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17865,7 +18033,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17921,7 +18089,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -17977,7 +18145,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18033,7 +18201,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18089,7 +18257,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18145,7 +18313,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18201,7 +18369,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18257,7 +18425,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18313,7 +18481,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18369,7 +18537,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18425,7 +18593,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18481,7 +18649,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18537,7 +18705,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18593,7 +18761,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18649,7 +18817,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18705,7 +18873,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18761,7 +18929,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18817,7 +18985,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18873,7 +19041,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18929,7 +19097,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -18985,7 +19153,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19041,7 +19209,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19097,7 +19265,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19153,7 +19321,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19209,7 +19377,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19265,7 +19433,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19321,7 +19489,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19377,7 +19545,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19433,7 +19601,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19489,7 +19657,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19545,7 +19713,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19601,7 +19769,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19657,7 +19825,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19713,7 +19881,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19769,7 +19937,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19825,7 +19993,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19881,7 +20049,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19937,7 +20105,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -19993,7 +20161,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20049,7 +20217,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20105,7 +20273,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20161,7 +20329,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20217,7 +20385,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20273,7 +20441,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20329,7 +20497,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20385,7 +20553,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20441,7 +20609,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20497,7 +20665,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20553,7 +20721,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20609,7 +20777,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20665,7 +20833,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20721,7 +20889,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20777,7 +20945,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20833,7 +21001,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20889,7 +21057,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -20945,7 +21113,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21001,7 +21169,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21057,7 +21225,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21113,7 +21281,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21169,7 +21337,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21225,7 +21393,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21281,7 +21449,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21337,7 +21505,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21393,7 +21561,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21449,7 +21617,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21505,7 +21673,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21518,6 +21686,62 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimation.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimation.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimationEvent.cpp"
 				>
 				<FileConfiguration
@@ -21561,7 +21785,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21574,6 +21798,62 @@
 				>
 			</File>
 			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimationList.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimationList.h"
+				>
+			</File>
+			<File
 				RelativePath="$(ConfigurationBuildDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframeRule.cpp"
 				>
 				<FileConfiguration
@@ -21617,7 +21897,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21673,7 +21953,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21729,7 +22009,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21785,7 +22065,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21841,7 +22121,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21897,7 +22177,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -21953,7 +22233,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22009,7 +22289,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22065,7 +22345,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22121,7 +22401,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22181,7 +22461,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22237,7 +22517,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22293,7 +22573,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22349,7 +22629,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22405,7 +22685,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22461,7 +22741,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22517,7 +22797,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22573,7 +22853,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22629,7 +22909,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22685,7 +22965,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22741,7 +23021,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22797,7 +23077,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22853,7 +23133,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -22949,7 +23229,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23005,7 +23285,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23095,7 +23375,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -23161,7 +23441,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23217,7 +23497,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23273,7 +23553,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23329,7 +23609,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23385,7 +23665,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23441,7 +23721,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23497,7 +23777,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23553,7 +23833,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23633,7 +23913,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23689,7 +23969,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23745,7 +24025,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23801,7 +24081,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23857,7 +24137,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23913,7 +24193,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -23969,7 +24249,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -24025,7 +24305,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -24081,7 +24361,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -24137,7 +24417,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -24193,7 +24473,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -24249,7 +24529,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -24460,14 +24740,14 @@
 			<File
 				RelativePath="..\page\Frame.h"
 				>
-			<File
-				RelativePath="..\page\FrameActionScheduler.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\page\FrameActionScheduler.h"
-				>
-			</File>
+				<File
+					RelativePath="..\page\FrameActionScheduler.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\page\FrameActionScheduler.h"
+					>
+				</File>
 			</File>
 			<File
 				RelativePath="..\page\FrameLoadRequest.h"
@@ -24766,6 +25046,22 @@
 				>
 			</File>
 			<File
+				RelativePath="..\page\WebKitAnimation.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\WebKitAnimation.h"
+				>
+			</File>
+			<File
+				RelativePath="..\page\WebKitAnimationList.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\WebKitAnimationList.h"
+				>
+			</File>
+			<File
 				RelativePath="..\page\WebKitPoint.h"
 				>
 			</File>
@@ -24816,7 +25112,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -25169,6 +25465,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\loader\icon\IconDatabaseBase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\loader\icon\IconDatabaseBase.h"
+					>
+				</File>
+				<File
 					RelativePath="..\loader\icon\IconDatabaseClient.h"
 					>
 				</File>
@@ -25486,6 +25790,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\platform\DefaultLocalizationStrategy.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\platform\DefaultLocalizationStrategy.h"
+				>
+			</File>
+			<File
 				RelativePath="..\platform\DragImage.cpp"
 				>
 			</File>
@@ -25928,7 +26240,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -25993,6 +26305,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\win\LocalizedStringsWin.cpp"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\win\LoggingWin.cpp"
 					>
 				</File>
@@ -26005,6 +26321,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\win\PathWalker.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\win\PathWalker.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\win\PlatformMouseEventWin.cpp"
 					>
 				</File>
@@ -26129,7 +26453,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						>
 						<Tool
 							Name="VCCLCompilerTool"
@@ -26199,7 +26523,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						>
 						<Tool
 							Name="VCCLCompilerTool"
@@ -26264,6 +26588,18 @@
 					RelativePath="..\platform\cf\SharedBufferCF.cpp"
 					>
 				</File>
+				<Filter
+					Name="win"
+					>
+					<File
+						RelativePath="..\platform\cf\win\CertificateCFWin.cpp"
+						>
+					</File>
+					<File
+						RelativePath="..\platform\cf\win\CertificateCFWin.h"
+						>
+					</File>
+				</Filter>
 			</Filter>
 			<Filter
 				Name="graphics"
@@ -26316,7 +26652,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -26352,7 +26688,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -26444,7 +26780,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						>
 						<Tool
 							Name="VCCLCompilerTool"
@@ -26505,6 +26841,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\graphics\FontPlatformData.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FontPlatformData.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\graphics\FontRenderingMode.h"
 					>
 				</File>
@@ -26640,7 +26984,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -26831,7 +27175,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -26867,7 +27211,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -26943,7 +27287,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							>
 							<Tool
 								Name="VCCLCompilerTool"
@@ -26979,7 +27323,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -27035,7 +27379,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -27099,7 +27443,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -27315,7 +27659,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -27399,46 +27743,6 @@
 							/>
 						</FileConfiguration>
 					</File>
-					<Filter
-						Name="cairo"
-						>
-						<File
-							RelativePath="..\platform\graphics\win\cairo\FontPlatformData.h"
-							>
-							<FileConfiguration
-								Name="Debug|Win32"
-								ExcludedFromBuild="true"
-								>
-								<Tool
-									Name="VCCustomBuildTool"
-								/>
-							</FileConfiguration>
-							<FileConfiguration
-								Name="Release|Win32"
-								ExcludedFromBuild="true"
-								>
-								<Tool
-									Name="VCCustomBuildTool"
-								/>
-							</FileConfiguration>
-							<FileConfiguration
-								Name="Debug_All|Win32"
-								ExcludedFromBuild="true"
-								>
-								<Tool
-									Name="VCCustomBuildTool"
-								/>
-							</FileConfiguration>
-							<FileConfiguration
-								Name="Release_LTCG|Win32"
-								ExcludedFromBuild="true"
-								>
-								<Tool
-									Name="VCCustomBuildTool"
-								/>
-							</FileConfiguration>
-						</File>
-					</Filter>
 				</Filter>
 				<Filter
 					Name="cg"
@@ -27895,7 +28199,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -27931,7 +28235,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -27967,7 +28271,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28003,7 +28307,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28039,7 +28343,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28075,7 +28379,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28111,7 +28415,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28147,7 +28451,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28183,7 +28487,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28219,7 +28523,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28255,7 +28559,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28291,7 +28595,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28327,7 +28631,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28363,7 +28667,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28399,7 +28703,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28435,7 +28739,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28471,7 +28775,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -28507,7 +28811,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29643,7 +29947,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29679,7 +29983,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29715,7 +30019,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29751,7 +30055,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29787,7 +30091,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29823,7 +30127,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29859,7 +30163,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29895,7 +30199,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29931,7 +30235,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -29967,7 +30271,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30003,7 +30307,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30039,7 +30343,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30075,7 +30379,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30249,6 +30553,14 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\text\TextCheckerClient.h"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\text\TextChecking.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\text\TextCodec.cpp"
 					>
 				</File>
@@ -30304,7 +30616,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						>
 						<Tool
 							Name="VCCLCompilerTool"
@@ -30337,7 +30649,7 @@
 					>
 				</File>
 				<File
-					RelativePath="..\platform\text\TextCodecUTF8.h"
+					RelativePath="..\platform\text\TextCodecUTF16.h"
 					>
 				</File>
 				<File
@@ -30345,11 +30657,7 @@
 					>
 				</File>
 				<File
-					RelativePath="..\platform\text\TextCodecUTF16.h"
-					>
-				</File>
-				<File
-					RelativePath="..\platform\text\TextCheckerClient.h"
+					RelativePath="..\platform\text\TextCodecUTF8.h"
 					>
 				</File>
 				<File
@@ -30472,7 +30780,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -30508,7 +30816,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -30547,7 +30855,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30587,7 +30895,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30623,7 +30931,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30659,7 +30967,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30695,7 +31003,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30751,7 +31059,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30787,7 +31095,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30843,7 +31151,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30879,7 +31187,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30919,7 +31227,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30955,7 +31263,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -30991,7 +31299,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -31027,7 +31335,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -31067,7 +31375,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -31103,7 +31411,7 @@
 							/>
 						</FileConfiguration>
 						<FileConfiguration
-							Name="Release_LTCG|Win32"
+							Name="Production|Win32"
 							ExcludedFromBuild="true"
 							>
 							<Tool
@@ -31165,7 +31473,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						>
 						<Tool
 							Name="VCCLCompilerTool"
@@ -31227,7 +31535,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						>
 						<Tool
 							Name="VCCLCompilerTool"
@@ -31434,6 +31742,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\css\CSSLineBoxContainValue.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\css\CSSLineBoxContainValue.h"
+				>
+			</File>
+			<File
 				RelativePath="..\css\CSSMediaRule.cpp"
 				>
 			</File>
@@ -31586,6 +31902,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\css\CSSStyleApplyProperty.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\css\CSSStyleApplyProperty.h"
+				>
+			</File>
+			<File
 				RelativePath="..\css\CSSStyleDeclaration.cpp"
 				>
 			</File>
@@ -31909,7 +32233,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -31965,7 +32289,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32021,7 +32345,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32077,7 +32401,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32133,7 +32457,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32189,7 +32513,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32253,7 +32577,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32309,7 +32633,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32365,7 +32689,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32425,7 +32749,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32481,7 +32805,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32537,7 +32861,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32601,7 +32925,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32657,7 +32981,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32713,7 +33037,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32769,7 +33093,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32825,7 +33149,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32877,7 +33201,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32933,7 +33257,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -32989,7 +33313,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33045,7 +33369,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33101,7 +33425,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33157,7 +33481,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33213,7 +33537,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33269,7 +33593,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33325,7 +33649,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33381,7 +33705,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33437,7 +33761,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33493,7 +33817,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33549,7 +33873,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33605,7 +33929,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33661,7 +33985,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33717,7 +34041,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33773,7 +34097,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33829,7 +34153,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33885,7 +34209,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33941,7 +34265,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -33997,7 +34321,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34053,7 +34377,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34109,7 +34433,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34169,7 +34493,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34225,7 +34549,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34289,7 +34613,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34345,7 +34669,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34401,7 +34725,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34457,7 +34781,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34513,7 +34837,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34569,7 +34893,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34625,7 +34949,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34681,7 +35005,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34753,7 +35077,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34809,7 +35133,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34865,7 +35189,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34921,7 +35245,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -34977,7 +35301,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35033,7 +35357,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35089,7 +35413,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35145,7 +35469,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35201,7 +35525,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35257,7 +35581,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35313,7 +35637,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35369,7 +35693,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35425,7 +35749,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35481,7 +35805,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35537,7 +35861,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35593,7 +35917,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35653,7 +35977,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35709,7 +36033,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35769,7 +36093,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35825,7 +36149,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35881,7 +36205,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35937,7 +36261,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -35993,7 +36317,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36049,7 +36373,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36105,7 +36429,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36161,7 +36485,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36217,7 +36541,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36273,7 +36597,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36329,7 +36653,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36385,7 +36709,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36441,7 +36765,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36497,7 +36821,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36553,7 +36877,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36609,7 +36933,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36665,7 +36989,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36721,7 +37045,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36777,7 +37101,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36833,7 +37157,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36889,7 +37213,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36945,7 +37269,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -36997,7 +37321,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37053,7 +37377,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37109,7 +37433,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37165,7 +37489,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37221,7 +37545,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37277,7 +37601,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37333,7 +37657,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37389,7 +37713,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37445,7 +37769,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37501,7 +37825,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37557,7 +37881,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37653,7 +37977,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37700,7 +38024,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					>
 					<Tool
 						Name="VCCustomBuildTool"
@@ -37751,7 +38075,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37807,7 +38131,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37863,7 +38187,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37919,7 +38243,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -37975,7 +38299,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38031,7 +38355,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38087,7 +38411,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38143,7 +38467,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38203,7 +38527,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38259,7 +38583,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38315,7 +38639,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38371,7 +38695,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38427,7 +38751,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38483,7 +38807,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38539,7 +38863,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38603,7 +38927,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -38758,7 +39082,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -38818,7 +39142,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -38886,7 +39210,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -38942,7 +39266,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -38998,7 +39322,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39058,7 +39382,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39114,7 +39438,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39174,7 +39498,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39234,7 +39558,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39290,7 +39614,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39346,7 +39670,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39402,7 +39726,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39458,7 +39782,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39518,7 +39842,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39574,7 +39898,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39630,7 +39954,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39690,7 +40014,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39746,7 +40070,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39806,7 +40130,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39862,7 +40186,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39918,7 +40242,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -39974,7 +40298,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40030,7 +40354,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40090,7 +40414,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40146,7 +40470,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40161,6 +40485,54 @@
 				<File
 					RelativePath="..\rendering\svg\RenderSVGPath.cpp"
 					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\rendering\svg\RenderSVGPath.h"
@@ -40210,7 +40582,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40266,7 +40638,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40322,7 +40694,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40378,7 +40750,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40434,7 +40806,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40490,7 +40862,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40546,7 +40918,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40602,7 +40974,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40662,7 +41034,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40718,7 +41090,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40774,7 +41146,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40830,7 +41202,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40886,7 +41258,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40942,7 +41314,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -40998,7 +41370,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -41064,19 +41436,19 @@
 				>
 			</File>
 			<File
-				RelativePath="..\xml\XMLTreeViewer.cpp"
+				RelativePath="..\xml\XMLSerializer.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\xml\XMLTreeViewer.h"
+				RelativePath="..\xml\XMLSerializer.h"
 				>
 			</File>
 			<File
-				RelativePath="..\xml\XMLSerializer.cpp"
+				RelativePath="..\xml\XMLTreeViewer.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\xml\XMLSerializer.h"
+				RelativePath="..\xml\XMLTreeViewer.h"
 				>
 			</File>
 			<File
@@ -41192,7 +41564,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
@@ -41353,7 +41725,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41366,62 +41738,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\dom\AsyncScriptRunner.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_LTCG|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="..\dom\AsyncScriptRunner.h"
-				>
-			</File>
-			<File
 				RelativePath="..\dom\AtomicStringList.h"
 				>
 			</File>
@@ -41469,7 +41785,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41525,7 +41841,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41585,7 +41901,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41641,7 +41957,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41697,7 +42013,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41753,7 +42069,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41809,7 +42125,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41865,7 +42181,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41921,7 +42237,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -41977,7 +42293,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42033,7 +42349,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42089,7 +42405,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42145,7 +42461,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42205,7 +42521,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42261,7 +42577,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42317,7 +42633,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42373,7 +42689,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42433,7 +42749,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42489,7 +42805,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42545,7 +42861,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42558,6 +42874,66 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\DataTransferItem.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\DataTransferItem.h"
+				>
+			</File>
+			<File
+				RelativePath="..\dom\DataTransferItems.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\DecodedDataDocumentParser.cpp"
 				>
 				<FileConfiguration
@@ -42601,7 +42977,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42661,7 +43037,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42717,7 +43093,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42773,7 +43149,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42829,7 +43205,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42889,7 +43265,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -42945,7 +43321,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43001,7 +43377,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43057,7 +43433,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43117,7 +43493,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43173,7 +43549,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43229,7 +43605,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43289,7 +43665,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43353,7 +43729,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43409,7 +43785,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43465,7 +43841,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43525,7 +43901,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43581,7 +43957,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43637,7 +44013,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43697,7 +44073,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43753,7 +44129,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43809,7 +44185,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43865,7 +44241,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43878,6 +44254,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\EventDispatcher.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\EventDispatcher.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\EventException.h"
 				>
 			</File>
@@ -43929,7 +44361,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -43977,7 +44409,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44033,7 +44465,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44113,7 +44545,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44169,7 +44601,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44233,7 +44665,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44289,7 +44721,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44349,7 +44781,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44405,7 +44837,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44461,7 +44893,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44517,7 +44949,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44573,7 +45005,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44629,7 +45061,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44685,7 +45117,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44749,7 +45181,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44813,7 +45245,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44869,7 +45301,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44925,7 +45357,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -44981,7 +45413,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45037,7 +45469,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45093,7 +45525,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45149,7 +45581,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45205,7 +45637,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45261,7 +45693,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45325,7 +45757,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45381,7 +45813,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45437,7 +45869,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45493,7 +45925,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45549,7 +45981,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45613,7 +46045,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45677,7 +46109,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45733,7 +46165,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45789,7 +46221,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45845,7 +46277,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45901,7 +46333,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -45914,6 +46346,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\ScriptRunner.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\ScriptRunner.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\SelectElement.cpp"
 				>
 				<FileConfiguration
@@ -45957,7 +46445,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46013,7 +46501,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46069,7 +46557,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46125,7 +46613,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46181,7 +46669,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46194,6 +46682,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\StringCallback.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\StringCallback.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\StyledElement.cpp"
 				>
 				<FileConfiguration
@@ -46237,7 +46781,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46293,7 +46837,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46349,7 +46893,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46405,7 +46949,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46461,7 +47005,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46525,7 +47069,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46577,7 +47121,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46637,7 +47181,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46693,7 +47237,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46749,7 +47293,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46805,7 +47349,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46861,7 +47405,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46917,7 +47461,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -46973,7 +47517,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47029,7 +47573,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47085,7 +47629,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47141,7 +47685,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47197,7 +47741,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47257,7 +47801,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47485,7 +48029,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47541,7 +48085,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47597,7 +48141,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47653,7 +48197,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47713,7 +48257,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47769,7 +48313,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47825,7 +48369,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47881,7 +48425,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47937,7 +48481,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -47997,7 +48541,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48069,7 +48613,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48125,7 +48669,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48181,7 +48725,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48245,7 +48789,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48301,7 +48845,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48357,7 +48901,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48413,7 +48957,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48469,7 +49013,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48525,7 +49069,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48581,7 +49125,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48637,7 +49181,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48693,7 +49237,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48749,7 +49293,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48805,7 +49349,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48861,7 +49405,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48917,7 +49461,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -48973,7 +49517,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49029,7 +49573,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49085,7 +49629,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49141,7 +49685,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49197,7 +49741,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49249,7 +49793,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49305,7 +49849,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49361,7 +49905,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49417,7 +49961,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49473,7 +50017,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49529,7 +50073,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49585,7 +50129,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49641,7 +50185,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49693,7 +50237,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49749,7 +50293,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49805,7 +50349,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49861,7 +50405,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49921,7 +50465,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -49981,7 +50525,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -50037,7 +50581,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -50093,7 +50637,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -50149,7 +50693,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -50205,7 +50749,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -50261,7 +50805,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -50317,7 +50861,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -50334,6 +50878,22 @@
 			Name="html"
 			>
 			<File
+				RelativePath="..\html\canvas\ArrayBuffer.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\ArrayBuffer.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\ArrayBufferView.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\ArrayBufferView.h"
+				>
+			</File>
+			<File
 				RelativePath="..\fileapi\AsyncFileWriter.h"
 				>
 			</File>
@@ -50414,22 +50974,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\html\canvas\ArrayBuffer.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\ArrayBuffer.h"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\ArrayBufferView.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\ArrayBufferView.h"
-				>
-			</File>
-			<File
 				RelativePath="..\html\canvas\CanvasGradient.cpp"
 				>
 			</File>
@@ -50478,70 +51022,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\html\canvas\DataView.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\DataView.h"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\Float32Array.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\Float32Array.h"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\Int32Array.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\Int32Array.h"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\Int16Array.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\Int16Array.h"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\Int8Array.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\Int8Array.h"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\UInt16Array.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\UInt16Array.h"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\UInt32Array.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\UInt32Array.h"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\UInt8Array.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\html\canvas\UInt8Array.h"
-				>
-			</File>
-			<File
 				RelativePath="..\html\CheckboxInputType.cpp"
 				>
 			</File>
@@ -50598,6 +51078,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\html\canvas\DataView.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\DataView.h"
+				>
+			</File>
+			<File
 				RelativePath="..\html\DateComponents.cpp"
 				>
 			</File>
@@ -50942,6 +51430,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\html\canvas\Float32Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Float32Array.h"
+				>
+			</File>
+			<File
 				RelativePath="..\html\FormAssociatedElement.cpp"
 				>
 			</File>
@@ -51025,7 +51521,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51081,7 +51577,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51137,7 +51633,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51193,7 +51689,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51249,7 +51745,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51305,7 +51801,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51361,7 +51857,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51417,7 +51913,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51473,7 +51969,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51529,7 +52025,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51585,7 +52081,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51649,7 +52145,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51705,7 +52201,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51761,7 +52257,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51817,7 +52313,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51873,7 +52369,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51929,7 +52425,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -51985,7 +52481,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52041,7 +52537,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52097,7 +52593,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52161,7 +52657,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52221,7 +52717,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52277,7 +52773,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52333,7 +52829,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52397,7 +52893,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52453,7 +52949,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52509,7 +53005,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52565,7 +53061,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52621,7 +53117,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52677,7 +53173,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52733,7 +53229,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52789,7 +53285,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52845,7 +53341,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52901,7 +53397,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -52957,7 +53453,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53013,7 +53509,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53077,7 +53573,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53133,7 +53629,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53189,7 +53685,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53245,7 +53741,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53301,7 +53797,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53357,7 +53853,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53413,7 +53909,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53469,7 +53965,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53525,7 +54021,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53581,7 +54077,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53637,7 +54133,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53693,7 +54189,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53749,7 +54245,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53805,7 +54301,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53869,7 +54365,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53925,7 +54421,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -53981,7 +54477,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54037,7 +54533,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54093,7 +54589,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54165,7 +54661,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54221,7 +54717,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54285,7 +54781,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54341,7 +54837,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54397,7 +54893,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54453,7 +54949,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54509,7 +55005,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54565,7 +55061,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54621,7 +55117,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54677,7 +55173,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54733,7 +55229,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54789,7 +55285,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54845,7 +55341,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54901,7 +55397,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -54957,7 +55453,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55013,7 +55509,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55069,7 +55565,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55125,7 +55621,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55189,7 +55685,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55245,7 +55741,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55301,7 +55797,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55357,7 +55853,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55413,7 +55909,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -55474,6 +55970,30 @@
 				>
 			</File>
 			<File
+				RelativePath="..\html\canvas\Int16Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Int16Array.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Int32Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Int32Array.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Int8Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\Int8Array.h"
+				>
+			</File>
+			<File
 				RelativePath="..\html\IsIndexInputType.cpp"
 				>
 			</File>
@@ -55650,6 +56170,30 @@
 				>
 			</File>
 			<File
+				RelativePath="..\html\canvas\UInt16Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\UInt16Array.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\UInt32Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\UInt32Array.h"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\UInt8Array.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\canvas\UInt8Array.h"
+				>
+			</File>
+			<File
 				RelativePath="..\html\URLInputType.cpp"
 				>
 			</File>
@@ -55880,14 +56424,14 @@
 					RelativePath="..\html\shadow\SliderThumbElement.h"
 					>
 				</File>
-                <File
-                    RelativePath="..\html\shadow\TextControlInnerElements.cpp"
-                    >
-                </File>
-                <File
-                    RelativePath="..\html\shadow\TextControlInnerElements.h"
-                    >
-                </File>
+				<File
+					RelativePath="..\html\shadow\TextControlInnerElements.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\html\shadow\TextControlInnerElements.h"
+					>
+				</File>
 			</Filter>
 		</Filter>
 		<Filter
@@ -55992,7 +56536,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56048,7 +56592,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56104,7 +56648,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56160,7 +56704,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56216,7 +56760,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56272,7 +56816,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56324,7 +56868,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56384,7 +56928,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56440,7 +56984,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56492,7 +57036,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56544,7 +57088,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56596,7 +57140,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56648,7 +57192,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56700,7 +57244,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56752,7 +57296,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56804,7 +57348,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56856,7 +57400,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56908,7 +57452,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -56960,7 +57504,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57012,7 +57556,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57064,7 +57608,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57120,7 +57664,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57172,7 +57716,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57224,7 +57768,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57280,7 +57824,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57336,7 +57880,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57388,7 +57932,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57444,7 +57988,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57500,7 +58044,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57552,7 +58096,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57604,7 +58148,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57656,7 +58200,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57708,7 +58252,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57760,7 +58304,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57820,7 +58364,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57872,7 +58416,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57924,7 +58468,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -57980,7 +58524,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58032,7 +58576,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58049,7 +58593,7 @@
 					>
 					<FileConfiguration
 						Name="Debug|Win32"
-					ExcludedFromBuild="true"
+						ExcludedFromBuild="true"
 						>
 						<Tool
 							Name="VCCLCompilerTool"
@@ -58088,7 +58632,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58140,7 +58684,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58192,7 +58736,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58244,7 +58788,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58296,7 +58840,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58352,7 +58896,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58408,7 +58952,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58464,7 +59008,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58520,7 +59064,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58576,7 +59120,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58636,7 +59180,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58692,7 +59236,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58744,7 +59288,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58800,7 +59344,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58852,7 +59396,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58908,7 +59452,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -58968,7 +59512,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59020,7 +59564,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59076,7 +59620,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59128,7 +59672,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59184,7 +59728,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59236,7 +59780,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59288,7 +59832,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59340,7 +59884,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59392,7 +59936,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59444,7 +59988,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59500,7 +60044,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59552,7 +60096,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59604,7 +60148,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59656,7 +60200,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59712,7 +60256,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59764,7 +60308,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59820,7 +60364,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59872,7 +60416,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59924,7 +60468,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -59980,7 +60524,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60032,7 +60576,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60088,7 +60632,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60140,7 +60684,59 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
+					RelativePath="..\bindings\js\JSInjectedScriptManager.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60192,7 +60788,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60244,7 +60840,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60296,7 +60892,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60352,7 +60948,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60408,7 +61004,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60464,7 +61060,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60516,7 +61112,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60568,7 +61164,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60620,7 +61216,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60676,7 +61272,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60728,7 +61324,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60780,7 +61376,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60836,7 +61432,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60892,7 +61488,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60944,7 +61540,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -60996,7 +61592,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61048,7 +61644,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61104,7 +61700,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61160,7 +61756,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61212,7 +61808,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61264,7 +61860,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61316,7 +61912,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61368,7 +61964,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61420,7 +62016,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61472,7 +62068,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61528,7 +62124,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61580,7 +62176,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61632,7 +62228,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61684,7 +62280,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61736,7 +62332,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61788,7 +62384,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61840,7 +62436,111 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
+					RelativePath="..\bindings\js\JSWebKitAnimationCustom.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
+					RelativePath="..\bindings\js\JSWebKitAnimationListCustom.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61892,7 +62592,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61944,7 +62644,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -61996,7 +62696,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62048,7 +62748,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62100,7 +62800,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62152,7 +62852,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62208,7 +62908,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62260,7 +62960,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62312,7 +63012,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62364,7 +63064,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62416,7 +63116,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62429,6 +63129,62 @@
 					>
 				</File>
 				<File
+					RelativePath="..\bindings\js\PageScriptDebugServer.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
+					RelativePath="..\bindings\js\PageScriptDebugServer.h"
+					>
+				</File>
+				<File
 					RelativePath="..\bindings\js\ScheduledAction.cpp"
 					>
 					<FileConfiguration
@@ -62472,7 +63228,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62528,7 +63284,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62584,7 +63340,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62640,7 +63396,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62696,7 +63452,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62748,7 +63504,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62804,7 +63560,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62860,7 +63616,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -62916,7 +63672,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -63000,7 +63756,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -63064,7 +63820,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -63132,7 +63888,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -63196,7 +63952,7 @@
 						/>
 					</FileConfiguration>
 					<FileConfiguration
-						Name="Release_LTCG|Win32"
+						Name="Production|Win32"
 						ExcludedFromBuild="true"
 						>
 						<Tool
@@ -63208,6 +63964,62 @@
 					RelativePath="..\bindings\js\WorkerScriptController.h"
 					>
 				</File>
+				<File
+					RelativePath="..\bindings\js\WorkerScriptDebugServer.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
+					RelativePath="..\bindings\js\PageScriptDebugServer.h"
+					>
+				</File>
 			</Filter>
 			<Filter
 				Name="scripts"
@@ -63697,7 +64509,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -63777,7 +64589,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -63841,7 +64653,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -63933,7 +64745,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -64181,7 +64993,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -64245,7 +65057,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -64381,7 +65193,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					ExcludedFromBuild="true"
 					>
 					<Tool
@@ -65154,7 +65966,7 @@
 				>
 			</File>
 			<File
-				RelativePath="..\storage\SQLCallback.h"
+				RelativePath="..\storage\SQLCallbackWrapper.h"
 				>
 			</File>
 			<File
@@ -65326,6 +66138,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\storage\StorageTracker.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\storage\StorageTracker.h"
+				>
+			</File>
+			<File
 				RelativePath="..\storage\VersionChangeCallback.h"
 				>
 			</File>
@@ -65486,6 +66306,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\DOMNodeHighlighter.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\DOMNodeHighlighter.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\InjectedScript.cpp"
 				>
 			</File>
@@ -65502,6 +66330,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\InjectedScriptManager.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\InjectedScriptManager.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\InspectorAgent.cpp"
 				>
 			</File>
@@ -65646,6 +66482,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\InspectorPageAgent.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\InspectorPageAgent.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\InspectorProfilerAgent.h"
 				>
 			</File>
@@ -65706,6 +66550,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\inspector\PageDebuggerAgent.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\PageDebuggerAgent.h"
+				>
+			</File>
+			<File
 				RelativePath="..\inspector\ScriptArguments.cpp"
 				>
 			</File>
@@ -65745,6 +66597,14 @@
 				RelativePath="..\inspector\TimelineRecordFactory.h"
 				>
 			</File>
+			<File
+				RelativePath="..\inspector\WorkerDebuggerAgent.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\inspector\WorkerDebuggerAgent.h"
+				>
+			</File>
 			<Filter
 				Name="front-end"
 				>
@@ -66097,6 +66957,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\ResourceJSONView.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\ResourcesPanel.js"
 					>
 				</File>
@@ -66165,6 +67029,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\SourceFile.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\SourceFrame.js"
 					>
 				</File>
@@ -66553,7 +67421,7 @@
 					/>
 				</FileConfiguration>
 				<FileConfiguration
-					Name="Release_LTCG|Win32"
+					Name="Production|Win32"
 					>
 					<Tool
 						Name="VCCLCompilerTool"
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreDebug.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreDebug.vsprops
new file mode 100644
index 0000000..d5bcbd8
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/WebCoreDebug.vsprops
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebCoreDebug"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\WebCoreCommon.vsprops;
+      .\WebCoreCG.vsprops;
+      .\WebCoreCFNetwork.vsprops;
+      .\WebCorePthreads.vsprops;
+      .\WebCoreMediaQT.vsprops;
+      .\WebCoreQuartzCore.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreDebugAll.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreDebugAll.vsprops
new file mode 100644
index 0000000..ce6ec7a
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/WebCoreDebugAll.vsprops
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebCoreDebugAll"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      .\WebCoreCommon.vsprops;
+      .\WebCoreCG.vsprops;
+      .\WebCoreCFNetwork.vsprops;
+      .\WebCorePthreads.vsprops;
+      .\WebCoreMediaQT.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_all.vsprops;
+      .\WebCoreQuartzCore.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreDebugCairoCFLite.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreDebugCairoCFLite.vsprops
new file mode 100644
index 0000000..588694a
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/WebCoreDebugCairoCFLite.vsprops
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebCoreDebugCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops;
+      .\WebCoreCommon.vsprops;
+      .\WebCoreCairo.vsprops;
+      .\WebCoreCURL.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj b/Source/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
index 60bf017..23bedfb 100644
--- a/Source/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
@@ -51,7 +51,7 @@
 			/>
 		</Configuration>
 		<Configuration
-			Name="Release_LTCG|Win32"
+			Name="Production|Win32"
 			ConfigurationType="0"
 			InheritedPropertySheets=".\WebCoreGeneratedCommon.vsprops"
 			>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreProduction.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreProduction.vsprops
new file mode 100644
index 0000000..af07ec2
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/WebCoreProduction.vsprops
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebCoreProduction"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\production.vsprops;
+      .\WebCoreCommon.vsprops;
+      .\WebCoreCG.vsprops;
+      .\WebCoreCFNetwork.vsprops;
+      .\WebCorePthreads.vsprops;
+      .\WebCoreMediaQT.vsprops;
+      .\WebCoreQuartzCore.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreRelease.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreRelease.vsprops
new file mode 100644
index 0000000..f1c9d03
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/WebCoreRelease.vsprops
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebCoreRelease"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefines.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      .\WebCoreCommon.vsprops;
+      .\WebCoreCG.vsprops;
+      .\WebCoreCFNetwork.vsprops;
+      .\WebCorePthreads.vsprops;
+      .\WebCoreMediaQT.vsprops;
+      .\WebCoreQuartzCore.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreReleaseCairoCFLite.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreReleaseCairoCFLite.vsprops
new file mode 100644
index 0000000..613c9b1
--- /dev/null
+++ b/Source/WebCore/WebCore.vcproj/WebCoreReleaseCairoCFLite.vsprops
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioPropertySheet
+	ProjectType="Visual C++"
+	Version="8.00"
+	Name="WebCoreReleaseCairoCFLite"
+	InheritedPropertySheets="
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\FeatureDefinesCairo.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\common.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\release.vsprops;
+      $(WebKitVSPropsRedirectionDir)..\..\..\WebKitLibraries\win\tools\vsprops\WinCairo.vsprops;
+      .\WebCoreCommon.vsprops;
+      .\WebCoreCairo.vsprops;
+      .\WebCoreCURL.vsprops"
+	>
+</VisualStudioPropertySheet>
diff --git a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
index c6c74df..98d2452 100755
--- a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
+++ b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
@@ -36,6 +36,7 @@ xcopy /y /d "%ProjectDir%..\css\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\platform\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\platform\animation\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\platform\cf\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
+xcopy /y /d "%ProjectDir%..\platform\cf\win\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\platform\graphics\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\platform\graphics\%1\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\platform\graphics\transforms\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index 403a618..45ea664 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -54,7 +54,11 @@
 		06E81ED70AB5D5E900C87837 /* LocalCurrentGraphicsContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 06E81ED60AB5D5E900C87837 /* LocalCurrentGraphicsContext.h */; };
 		06E81EEC0AB5DA9700C87837 /* LocalCurrentGraphicsContext.mm in Sources */ = {isa = PBXBuildFile; fileRef = 06E81EEB0AB5DA9700C87837 /* LocalCurrentGraphicsContext.mm */; };
 		0709FC4E1025DEE30059CDBA /* AccessibilitySlider.h in Headers */ = {isa = PBXBuildFile; fileRef = 0709FC4D1025DEE30059CDBA /* AccessibilitySlider.h */; };
+		072C8B11131C518600A4FCE9 /* MediaPlayerPrivateAVFoundation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 076F0D0912B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.cpp */; };
+		072C8B12131C518B00A4FCE9 /* MediaPlayerPrivateAVFoundationObjC.mm in Sources */ = {isa = PBXBuildFile; fileRef = 076F0D0C12B8192700C26AA4 /* MediaPlayerPrivateAVFoundationObjC.mm */; };
 		0735EE6A0F40C5E4004A2604 /* MediaPlayerProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 0735EE690F40C5E4004A2604 /* MediaPlayerProxy.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		076F0D0E12B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.h in Headers */ = {isa = PBXBuildFile; fileRef = 076F0D0A12B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.h */; };
+		076F0D0F12B8192700C26AA4 /* MediaPlayerPrivateAVFoundationObjC.h in Headers */ = {isa = PBXBuildFile; fileRef = 076F0D0B12B8192700C26AA4 /* MediaPlayerPrivateAVFoundationObjC.h */; };
 		07B0113F1032242200FBDC33 /* AccessibilityMediaControls.h in Headers */ = {isa = PBXBuildFile; fileRef = 07B0113E1032242200FBDC33 /* AccessibilityMediaControls.h */; };
 		080081960ED3B2DD00C53BC0 /* WMLAnchorElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 080081940ED3B2DD00C53BC0 /* WMLAnchorElement.cpp */; };
 		080081970ED3B2DD00C53BC0 /* WMLAnchorElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 080081950ED3B2DD00C53BC0 /* WMLAnchorElement.h */; };
@@ -458,9 +462,9 @@
 		1A85B2B70A1B2AC700D8C87C /* JSHTMLDivElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A85B2B50A1B2AC700D8C87C /* JSHTMLDivElement.h */; };
 		1A8F6B020DB53006001DB794 /* SubstituteResource.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A8F6B010DB53006001DB794 /* SubstituteResource.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1A8F6BBC0DB55CDC001DB794 /* ApplicationCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A8F6BB10DB55CDC001DB794 /* ApplicationCache.cpp */; };
-		1A8F6BBD0DB55CDC001DB794 /* ApplicationCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A8F6BB20DB55CDC001DB794 /* ApplicationCache.h */; };
+		1A8F6BBD0DB55CDC001DB794 /* ApplicationCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A8F6BB20DB55CDC001DB794 /* ApplicationCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1A8F6BBE0DB55CDC001DB794 /* ApplicationCacheGroup.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A8F6BB30DB55CDC001DB794 /* ApplicationCacheGroup.cpp */; };
-		1A8F6BBF0DB55CDC001DB794 /* ApplicationCacheGroup.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A8F6BB40DB55CDC001DB794 /* ApplicationCacheGroup.h */; };
+		1A8F6BBF0DB55CDC001DB794 /* ApplicationCacheGroup.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A8F6BB40DB55CDC001DB794 /* ApplicationCacheGroup.h */; settings = {ATTRIBUTES = (); }; };
 		1A8F6BC00DB55CDC001DB794 /* ApplicationCacheResource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A8F6BB50DB55CDC001DB794 /* ApplicationCacheResource.cpp */; };
 		1A8F6BC10DB55CDC001DB794 /* ApplicationCacheResource.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A8F6BB60DB55CDC001DB794 /* ApplicationCacheResource.h */; };
 		1A8F6BC20DB55CDC001DB794 /* DOMApplicationCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A8F6BB70DB55CDC001DB794 /* DOMApplicationCache.cpp */; };
@@ -641,6 +645,7 @@
 		20D629271253690B00081543 /* InspectorInstrumentation.h in Headers */ = {isa = PBXBuildFile; fileRef = 20D629251253690B00081543 /* InspectorInstrumentation.h */; };
 		22885E641301AE4C00526E68 /* JSDOMImplementationCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 22885E631301AE4C00526E68 /* JSDOMImplementationCustom.cpp */; };
 		228C284510D82500009D0D0E /* ScriptWrappable.h in Headers */ = {isa = PBXBuildFile; fileRef = 228C284410D82500009D0D0E /* ScriptWrappable.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		245D80A313280E40003492A6 /* SQLCallbackWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 245D80A213280E40003492A6 /* SQLCallbackWrapper.h */; };
 		24F54EAC101FE914000AE741 /* ApplicationCacheHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 24F54EAA101FE914000AE741 /* ApplicationCacheHost.cpp */; };
 		24F54EAD101FE914000AE741 /* ApplicationCacheHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 24F54EAB101FE914000AE741 /* ApplicationCacheHost.h */; settings = {ATTRIBUTES = (); }; };
 		2542F4DA1166C25A00E89A86 /* UserGestureIndicator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2542F4D81166C25A00E89A86 /* UserGestureIndicator.cpp */; };
@@ -769,6 +774,20 @@
 		316FE1180E6E1DA700BF6088 /* ImplicitAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = 316FE10E0E6E1DA700BF6088 /* ImplicitAnimation.h */; };
 		316FE1190E6E1DA700BF6088 /* KeyframeAnimation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 316FE10F0E6E1DA700BF6088 /* KeyframeAnimation.cpp */; };
 		316FE11A0E6E1DA700BF6088 /* KeyframeAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = 316FE1100E6E1DA700BF6088 /* KeyframeAnimation.h */; };
+		3194616213020B20004BB3F8 /* JSWebKitAnimation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3194616013020B20004BB3F8 /* JSWebKitAnimation.cpp */; };
+		3194616313020B20004BB3F8 /* JSWebKitAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = 3194616113020B20004BB3F8 /* JSWebKitAnimation.h */; };
+		3194616A13020B66004BB3F8 /* DOMWebKitAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = 3194616813020B66004BB3F8 /* DOMWebKitAnimation.h */; };
+		3194616B13020B66004BB3F8 /* DOMWebKitAnimation.mm in Sources */ = {isa = PBXBuildFile; fileRef = 3194616913020B66004BB3F8 /* DOMWebKitAnimation.mm */; };
+		319461FE13022BB8004BB3F8 /* JSWebKitAnimationList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 319461FC13022BB8004BB3F8 /* JSWebKitAnimationList.cpp */; };
+		319461FF13022BB8004BB3F8 /* JSWebKitAnimationList.h in Headers */ = {isa = PBXBuildFile; fileRef = 319461FD13022BB8004BB3F8 /* JSWebKitAnimationList.h */; };
+		3194620413022BF1004BB3F8 /* DOMWebKitAnimationList.h in Headers */ = {isa = PBXBuildFile; fileRef = 3194620213022BF1004BB3F8 /* DOMWebKitAnimationList.h */; };
+		3194620513022BF1004BB3F8 /* DOMWebKitAnimationList.mm in Sources */ = {isa = PBXBuildFile; fileRef = 3194620313022BF1004BB3F8 /* DOMWebKitAnimationList.mm */; };
+		3194623213022F65004BB3F8 /* JSWebKitAnimationListCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3194623113022F65004BB3F8 /* JSWebKitAnimationListCustom.cpp */; };
+		319E68871327C911004AC91A /* JSWebKitAnimationCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 319E68861327C911004AC91A /* JSWebKitAnimationCustom.cpp */; };
+		319E69B213299BBD004AC91A /* WebKitAnimation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 319E69AC13299BBD004AC91A /* WebKitAnimation.cpp */; };
+		319E69B313299BBD004AC91A /* WebKitAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = 319E69AD13299BBD004AC91A /* WebKitAnimation.h */; };
+		319E69B513299BBD004AC91A /* WebKitAnimationList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 319E69AF13299BBD004AC91A /* WebKitAnimationList.cpp */; };
+		319E69B613299BBD004AC91A /* WebKitAnimationList.h in Headers */ = {isa = PBXBuildFile; fileRef = 319E69B013299BBD004AC91A /* WebKitAnimationList.h */; };
 		31C0FF210E4CEB6E007D6FE5 /* WebKitAnimationEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 31C0FF1B0E4CEB6E007D6FE5 /* WebKitAnimationEvent.cpp */; };
 		31C0FF220E4CEB6E007D6FE5 /* WebKitAnimationEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 31C0FF1C0E4CEB6E007D6FE5 /* WebKitAnimationEvent.h */; };
 		31C0FF240E4CEB6E007D6FE5 /* WebKitTransitionEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 31C0FF1E0E4CEB6E007D6FE5 /* WebKitTransitionEvent.cpp */; };
@@ -851,6 +870,9 @@
 		37F818FD0D657606005E1F05 /* WebCoreURLResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 37F818FB0D657606005E1F05 /* WebCoreURLResponse.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		37F818FE0D657606005E1F05 /* WebCoreURLResponse.mm in Sources */ = {isa = PBXBuildFile; fileRef = 37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */; };
 		37FD4298118368460093C029 /* TreeDepthLimit.h in Headers */ = {isa = PBXBuildFile; fileRef = 37FD4297118368460093C029 /* TreeDepthLimit.h */; };
+		3AB02D2A12D4F91600FBB694 /* StorageTracker.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AB02D2812D4F91600FBB694 /* StorageTracker.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		3AB02D2B12D4F91600FBB694 /* StorageTracker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3AB02D2912D4F91600FBB694 /* StorageTracker.cpp */; };
+		3AC3680012EF7A09006A3D6F /* StorageTrackerClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AC367FE12EF7A09006A3D6F /* StorageTrackerClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		3AC648B2129E146500C3EB25 /* EditingBoundary.h in Headers */ = {isa = PBXBuildFile; fileRef = 3AC648B1129E146500C3EB25 /* EditingBoundary.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41002CCD0F66EDEF009E660D /* ScriptFunctionCall.h in Headers */ = {isa = PBXBuildFile; fileRef = 41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */; };
 		41002CCE0F66EDEF009E660D /* ScriptFunctionCall.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41002CCC0F66EDEF009E660D /* ScriptFunctionCall.cpp */; };
@@ -880,6 +902,8 @@
 		416E75CC0EDF90C700360E1D /* ScriptCallFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 416E75CA0EDF90C700360E1D /* ScriptCallFrame.cpp */; };
 		41885B9311B6FDA6003383BB /* FormSubmission.h in Headers */ = {isa = PBXBuildFile; fileRef = 41885B9111B6FDA6003383BB /* FormSubmission.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41885B9411B6FDA6003383BB /* FormSubmission.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41885B9211B6FDA6003383BB /* FormSubmission.cpp */; };
+		418A06D0133C04D500CD379C /* EventDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 418A06CE133C04D500CD379C /* EventDispatcher.h */; };
+		418A06D1133C04D500CD379C /* EventDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 418A06CF133C04D500CD379C /* EventDispatcher.cpp */; };
 		418F88040FF957AE0080F045 /* JSAbstractWorker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 418F88020FF957AE0080F045 /* JSAbstractWorker.cpp */; };
 		418F88050FF957AF0080F045 /* JSAbstractWorker.h in Headers */ = {isa = PBXBuildFile; fileRef = 418F88030FF957AE0080F045 /* JSAbstractWorker.h */; };
 		41A3D58E101C152D00316D07 /* DedicatedWorkerThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41A3D58C101C152D00316D07 /* DedicatedWorkerThread.cpp */; };
@@ -979,7 +1003,6 @@
 		44311CD812E4E24B000A8D19 /* DOMDocumentPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 44311CD512E4E22D000A8D19 /* DOMDocumentPrivate.h */; };
 		44311CD912E4E257000A8D19 /* DOMDocumentFragmentPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 44311CD412E4E22D000A8D19 /* DOMDocumentFragmentPrivate.h */; };
 		44311F8212E4E66C000A8D19 /* DOMDocumentFragmentInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 85E711450AC5D5340053270F /* DOMDocumentFragmentInternal.h */; };
-		445C8DB710015FC90031531A /* IconDatabaseNone.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 445C8DB610015FC90031531A /* IconDatabaseNone.cpp */; };
 		447D69030FA626810015CCB1 /* RuntimeApplicationChecks.h in Headers */ = {isa = PBXBuildFile; fileRef = 447D69010FA626810015CCB1 /* RuntimeApplicationChecks.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		447D69040FA626810015CCB1 /* RuntimeApplicationChecks.mm in Sources */ = {isa = PBXBuildFile; fileRef = 447D69020FA626810015CCB1 /* RuntimeApplicationChecks.mm */; };
 		448A29BF0A46D9CB0030759F /* JSHTMLOptionsCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = 448A29BD0A46D9CB0030759F /* JSHTMLOptionsCollection.h */; };
@@ -1211,6 +1234,8 @@
 		4E19592C0A39DACC00220FE5 /* MediaQueryEvaluator.h in Headers */ = {isa = PBXBuildFile; fileRef = 4E1959260A39DACC00220FE5 /* MediaQueryEvaluator.h */; };
 		4E19592D0A39DACC00220FE5 /* MediaQueryExp.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4E1959270A39DACC00220FE5 /* MediaQueryExp.cpp */; };
 		4E19592E0A39DACC00220FE5 /* MediaQueryExp.h in Headers */ = {isa = PBXBuildFile; fileRef = 4E1959280A39DACC00220FE5 /* MediaQueryExp.h */; };
+		4F1442281339FD6200E0D6F8 /* DOMNodeHighlighter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F1442261339FD6200E0D6F8 /* DOMNodeHighlighter.cpp */; };
+		4F1442291339FD6200E0D6F8 /* DOMNodeHighlighter.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F1442271339FD6200E0D6F8 /* DOMNodeHighlighter.h */; };
 		4F1534DE11B532EC0021FD86 /* EditingBehavior.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F1534DD11B532EC0021FD86 /* EditingBehavior.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F1534E011B533020021FD86 /* EditingBehaviorTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F1534DF11B533020021FD86 /* EditingBehaviorTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F2D205412EAE7B3005C2874 /* InspectorAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F2D205212EAE7B3005C2874 /* InspectorAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1218,6 +1243,8 @@
 		4F3289B511A42AAB005ABE7E /* InspectorValues.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F3289B311A42AAB005ABE7E /* InspectorValues.cpp */; };
 		4F3289B611A42AAB005ABE7E /* InspectorValues.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F3289B411A42AAB005ABE7E /* InspectorValues.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4F4F5FFB11CBD2E100A186BF /* InspectorFrontend.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F4F5FFA11CBD2D200A186BF /* InspectorFrontend.cpp */; };
+		4F6FDD641341DEDD001F8EE3 /* InspectorPageAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F6FDD621341DEDD001F8EE3 /* InspectorPageAgent.cpp */; };
+		4F6FDD651341DEDD001F8EE3 /* InspectorPageAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F6FDD631341DEDD001F8EE3 /* InspectorPageAgent.h */; };
 		4F707A9911EF679400ACDA69 /* InspectorBackendDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F707A9711EF679400ACDA69 /* InspectorBackendDispatcher.cpp */; };
 		4F707A9A11EF679400ACDA69 /* InspectorBackendDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F707A9811EF679400ACDA69 /* InspectorBackendDispatcher.h */; };
 		4FA3B90A125CD12200300BAD /* InspectorState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4FA3B908125CD12100300BAD /* InspectorState.cpp */; };
@@ -1299,6 +1326,8 @@
 		5160F4980B0AA75F00C1D2AF /* HistoryItemMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 5160F4970B0AA75F00C1D2AF /* HistoryItemMac.mm */; };
 		5162C7F411F77EFB00612EFE /* SchemeRegistry.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5162C7F211F77EFA00612EFE /* SchemeRegistry.cpp */; };
 		5162C7F511F77EFB00612EFE /* SchemeRegistry.h in Headers */ = {isa = PBXBuildFile; fileRef = 5162C7F311F77EFB00612EFE /* SchemeRegistry.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		516953971329A3C800B92D04 /* IconDatabaseBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 516953951329A3C800B92D04 /* IconDatabaseBase.cpp */; };
+		516953981329A3C800B92D04 /* IconDatabaseBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 516953961329A3C800B92D04 /* IconDatabaseBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		516BB7940CE91E6800512F79 /* JSTreeWalkerCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 516BB7920CE91E6800512F79 /* JSTreeWalkerCustom.cpp */; };
 		51721FBB11D2790700638B42 /* BeforeProcessEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 51721FB911D2790700638B42 /* BeforeProcessEvent.h */; };
 		51721FD211D27EF200638B42 /* JSBeforeProcessEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51721FD011D27EF200638B42 /* JSBeforeProcessEvent.cpp */; };
@@ -1377,7 +1406,6 @@
 		590E1B4B11E4EF700069F784 /* JSDeviceOrientationEventCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 590E1B4A11E4EF700069F784 /* JSDeviceOrientationEventCustom.cpp */; };
 		59309A1111F4AE5800250603 /* DeviceOrientationClientMock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 59309A1011F4AE5800250603 /* DeviceOrientationClientMock.cpp */; };
 		59309A1311F4AE6A00250603 /* DeviceOrientationClientMock.h in Headers */ = {isa = PBXBuildFile; fileRef = 59309A1211F4AE6A00250603 /* DeviceOrientationClientMock.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		593D3EAD132532840057E7EE /* JavaMethod.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 593D3EAC132532840057E7EE /* JavaMethod.cpp */; };
 		593D3EAF1325328C0057E7EE /* JavaMethod.h in Headers */ = {isa = PBXBuildFile; fileRef = 593D3EAE1325328C0057E7EE /* JavaMethod.h */; };
 		593D3EB1132532950057E7EE /* JavaString.h in Headers */ = {isa = PBXBuildFile; fileRef = 593D3EB0132532950057E7EE /* JavaString.h */; };
 		596229781133EFD700DC4CBB /* GeolocationPositionCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 596229771133EFD700DC4CBB /* GeolocationPositionCache.cpp */; };
@@ -1388,6 +1416,8 @@
 		598D77DF132541FA00761B22 /* JavaArrayJSC.h in Headers */ = {isa = PBXBuildFile; fileRef = 598D77DE132541FA00761B22 /* JavaArrayJSC.h */; };
 		598D77E11325420400761B22 /* JavaFieldJSC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 598D77E01325420400761B22 /* JavaFieldJSC.cpp */; };
 		598D77E31325420E00761B22 /* JavaFieldJSC.h in Headers */ = {isa = PBXBuildFile; fileRef = 598D77E21325420E00761B22 /* JavaFieldJSC.h */; };
+		599C671C1343438900C3423C /* JavaMethodJobject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 599C671B1343438900C3423C /* JavaMethodJobject.cpp */; };
+		599C671E1343439400C3423C /* JavaMethodJobject.h in Headers */ = {isa = PBXBuildFile; fileRef = 599C671D1343439400C3423C /* JavaMethodJobject.h */; };
 		599E759011055A1F00D904FA /* Bridge.h in Headers */ = {isa = PBXBuildFile; fileRef = 599E758F11055A1F00D904FA /* Bridge.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		59A85EA2119D68D900DEF1EF /* DeviceOrientationEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 59A85EA1119D68D900DEF1EF /* DeviceOrientationEvent.cpp */; };
 		59A85EA4119D68EC00DEF1EF /* DeviceOrientationEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 59A85EA3119D68EC00DEF1EF /* DeviceOrientationEvent.h */; };
@@ -1398,6 +1428,7 @@
 		59A8F1D811A69520001AC34A /* DeviceOrientationClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 59A8F1D711A69520001AC34A /* DeviceOrientationClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		59A9E7B01104758800DFB4C1 /* JavaInstanceJSC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 59A9E7AF1104758800DFB4C1 /* JavaInstanceJSC.cpp */; };
 		59A9E7B21104759400DFB4C1 /* JavaInstanceJSC.h in Headers */ = {isa = PBXBuildFile; fileRef = 59A9E7B11104759400DFB4C1 /* JavaInstanceJSC.h */; };
+		59B0EEA7132A6F2A004331C7 /* JavaType.h in Headers */ = {isa = PBXBuildFile; fileRef = 59B0EEA6132A6F2A004331C7 /* JavaType.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		59B597731108656B007159E8 /* BridgeJSC.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 59B597721108656B007159E8 /* BridgeJSC.cpp */; };
 		59B5977511086579007159E8 /* BridgeJSC.h in Headers */ = {isa = PBXBuildFile; fileRef = 59B5977411086579007159E8 /* BridgeJSC.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		59BC393F11054A1300FD85DB /* JavaStringJSC.h in Headers */ = {isa = PBXBuildFile; fileRef = 59BC393E11054A1300FD85DB /* JavaStringJSC.h */; };
@@ -1414,6 +1445,7 @@
 		5A574F29131DB96D00471B88 /* QuotesData.h in Headers */ = {isa = PBXBuildFile; fileRef = 5A574F27131DB96D00471B88 /* QuotesData.h */; };
 		5D15E3AB0F9E6AC1009E0E3F /* XMLDocumentParserScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5D15E3A90F9E6AC1009E0E3F /* XMLDocumentParserScope.cpp */; };
 		5D15E3AC0F9E6AC1009E0E3F /* XMLDocumentParserScope.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D15E3AA0F9E6AC1009E0E3F /* XMLDocumentParserScope.h */; };
+		5D4F51DF132725480016F541 /* HTMLConverter.mm in Sources */ = {isa = PBXBuildFile; fileRef = C5392D341326AD0100043D35 /* HTMLConverter.mm */; };
 		5D874F130D161D3200796C3B /* NetscapePlugInStreamLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93E227DD0AF589AD00D48324 /* NetscapePlugInStreamLoader.cpp */; };
 		5D87BB8311E3ED8600702B6F /* ExportFileGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5D87BB8211E3ED8600702B6F /* ExportFileGenerator.cpp */; };
 		5D88EE9111407FD300BC3ABC /* DOMSVGFEMorphologyElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 84224189107E786F00766A87 /* DOMSVGFEMorphologyElement.h */; };
@@ -1641,6 +1673,7 @@
 		7AFD4A8B1131C2760035B883 /* ScriptBreakpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AFD4A8A1131C2760035B883 /* ScriptBreakpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7AFD4FF4113277B60035B883 /* ScriptDebugListener.h in Headers */ = {isa = PBXBuildFile; fileRef = 7AFD4FF3113277B60035B883 /* ScriptDebugListener.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7E33CD01127F340D00BE8F17 /* PurgePriority.h in Headers */ = {isa = PBXBuildFile; fileRef = 7E33CD00127F340D00BE8F17 /* PurgePriority.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		7E37EF2E1339208800B29250 /* SubresourceLoaderCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7E37EF2D1339208800B29250 /* SubresourceLoaderCF.cpp */; };
 		7EE6845F12D26E3800E79415 /* AuthenticationCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7EE6844C12D26E3800E79415 /* AuthenticationCF.cpp */; };
 		7EE6846012D26E3800E79415 /* AuthenticationCF.h in Headers */ = {isa = PBXBuildFile; fileRef = 7EE6844D12D26E3800E79415 /* AuthenticationCF.h */; };
 		7EE6846112D26E3800E79415 /* AuthenticationChallenge.h in Headers */ = {isa = PBXBuildFile; fileRef = 7EE6844E12D26E3800E79415 /* AuthenticationChallenge.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1661,9 +1694,16 @@
 		7EE6847012D26E3800E79415 /* ResourceResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 7EE6845D12D26E3800E79415 /* ResourceResponse.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7EE6847112D26E3800E79415 /* ResourceResponseCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7EE6845E12D26E3800E79415 /* ResourceResponseCFNet.cpp */; };
 		7EE6847512D26E7000E79415 /* ResourceLoaderCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7EE6847412D26E7000E79415 /* ResourceLoaderCFNet.cpp */; };
+		809DD1DF130DE2AD00CAE3ED /* CSSStyleApplyProperty.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 809DD1DD130DE2AD00CAE3ED /* CSSStyleApplyProperty.cpp */; };
+		809DD1E0130DE2AD00CAE3ED /* CSSStyleApplyProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = 809DD1DE130DE2AD00CAE3ED /* CSSStyleApplyProperty.h */; };
+		8102C5881325BB1100DDE67A /* StringCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8102C5871325BB1100DDE67A /* StringCallback.cpp */; };
+		815E6167132587AA00B622B0 /* DataTransferItem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 815E6166132587AA00B622B0 /* DataTransferItem.cpp */; };
 		81A7325E1210189B00FC0D9E /* IDBCursor.h in Headers */ = {isa = PBXBuildFile; fileRef = 81A7325D1210189B00FC0D9E /* IDBCursor.h */; };
 		81A73260121018A400FC0D9E /* IDBCursor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 81A7325F121018A400FC0D9E /* IDBCursor.cpp */; };
 		81A73278121019E100FC0D9E /* IDBCursorBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 81A73277121019E100FC0D9E /* IDBCursorBackendImpl.h */; };
+		81AC5999131636E60009A7E0 /* DataTransferItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 81AC5997131636E60009A7E0 /* DataTransferItem.h */; };
+		81AC599A131636E60009A7E0 /* DataTransferItems.h in Headers */ = {isa = PBXBuildFile; fileRef = 81AC5998131636E60009A7E0 /* DataTransferItems.h */; };
+		81AC6C36131C57D30009A7E0 /* StringCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 81AC6C35131C57D30009A7E0 /* StringCallback.h */; };
 		81BE209811F4AB8D00915DFA /* IDBCursorBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 81BE209311F4AB8D00915DFA /* IDBCursorBackendImpl.cpp */; };
 		81BE209911F4AB8D00915DFA /* IDBCursorBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 81BE209411F4AB8D00915DFA /* IDBCursorBackendInterface.h */; };
 		81BE20D211F4BC3200915DFA /* JSIDBCursor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 81BE20A711F4B66F00915DFA /* JSIDBCursor.cpp */; };
@@ -1752,6 +1792,7 @@
 		84A81F3E0FC7DFF000955300 /* SourceAlpha.h in Headers */ = {isa = PBXBuildFile; fileRef = 84A81F3C0FC7DFF000955300 /* SourceAlpha.h */; };
 		84A81F410FC7E02700955300 /* SourceGraphic.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84A81F3F0FC7E02700955300 /* SourceGraphic.cpp */; };
 		84A81F420FC7E02700955300 /* SourceGraphic.h in Headers */ = {isa = PBXBuildFile; fileRef = 84A81F400FC7E02700955300 /* SourceGraphic.h */; };
+		84B62685133138F90095A489 /* FontPlatformData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84B62684133138F90095A489 /* FontPlatformData.cpp */; };
 		84B6B977120F13E500B8EFAF /* SVGPathSegListSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84B6B975120F13E500B8EFAF /* SVGPathSegListSource.cpp */; };
 		84B6B978120F13E500B8EFAF /* SVGPathSegListSource.h in Headers */ = {isa = PBXBuildFile; fileRef = 84B6B976120F13E500B8EFAF /* SVGPathSegListSource.h */; };
 		84C5B2FA1216DC810088B53A /* SVGPathTraversalStateBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84C5B2F81216DC810088B53A /* SVGPathTraversalStateBuilder.cpp */; };
@@ -2706,8 +2747,8 @@
 		89D08DA112228451001241DF /* AsyncFileSystemCallbacks.h in Headers */ = {isa = PBXBuildFile; fileRef = 89D08D9E12228451001241DF /* AsyncFileSystemCallbacks.h */; };
 		8A12E35D11FA33280025836A /* DocumentLoadTiming.h in Headers */ = {isa = PBXBuildFile; fileRef = 8A12E35C11FA33280025836A /* DocumentLoadTiming.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		8A309C9F123950BE00CB9204 /* NestingLevelIncrementer.h in Headers */ = {isa = PBXBuildFile; fileRef = 8A309C9E123950BE00CB9204 /* NestingLevelIncrementer.h */; };
-		8A413AE01207BBA50082016E /* AsyncScriptRunner.h in Headers */ = {isa = PBXBuildFile; fileRef = 8A413ADE1207BBA50082016E /* AsyncScriptRunner.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		8A413AE11207BBA50082016E /* AsyncScriptRunner.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8A413ADF1207BBA50082016E /* AsyncScriptRunner.cpp */; };
+		8A413AE01207BBA50082016E /* ScriptRunner.h in Headers */ = {isa = PBXBuildFile; fileRef = 8A413ADE1207BBA50082016E /* ScriptRunner.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		8A413AE11207BBA50082016E /* ScriptRunner.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8A413ADF1207BBA50082016E /* ScriptRunner.cpp */; };
 		8A7CC96B12076D73001D4588 /* PendingScript.h in Headers */ = {isa = PBXBuildFile; fileRef = 8A7CC96A12076D73001D4588 /* PendingScript.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		8A7CC97012076F8A001D4588 /* PendingScript.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8A7CC96F12076F8A001D4588 /* PendingScript.cpp */; };
 		8A81BF8511DCFD9000DA2B98 /* ResourceLoadTiming.h in Headers */ = {isa = PBXBuildFile; fileRef = 8A81BF8411DCFD9000DA2B98 /* ResourceLoadTiming.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2945,7 +2986,6 @@
 		93F199B808245E59001E9ABC /* Scrollbar.h in Headers */ = {isa = PBXBuildFile; fileRef = BC7B2AF80450824100A8000F /* Scrollbar.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93F199BB08245E59001E9ABC /* WebCoreKeyboardUIMode.h in Headers */ = {isa = PBXBuildFile; fileRef = BE983D95052A2E0A00892D85 /* WebCoreKeyboardUIMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93F199BE08245E59001E9ABC /* BlockExceptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 65A640F00533BB1F0085E777 /* BlockExceptions.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		93F199C208245E59001E9ABC /* WebCoreKeyGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = 84B2B1F7056BEF3A00D2B771 /* WebCoreKeyGenerator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93F199DE08245E59001E9ABC /* Position.h in Headers */ = {isa = PBXBuildFile; fileRef = BE91FC8B06133666005E3790 /* Position.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93F199E508245E59001E9ABC /* HTMLCanvasElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 51F6A3D60663BF04004D2919 /* HTMLCanvasElement.h */; };
 		93F199E708245E59001E9ABC /* ClipboardMac.h in Headers */ = {isa = PBXBuildFile; fileRef = 2D90660B0665D937006B6F1A /* ClipboardMac.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2961,8 +3001,7 @@
 		93F19ABC08245E59001E9ABC /* XMLDocumentParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F523D30902DE4476018635CA /* XMLDocumentParser.cpp */; };
 		93F19AD508245E59001E9ABC /* RenderTreeAsText.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93955A4203D72932008635CE /* RenderTreeAsText.cpp */; };
 		93F19AE108245E59001E9ABC /* BlockExceptions.mm in Sources */ = {isa = PBXBuildFile; fileRef = 65F80697054D9F86008BF776 /* BlockExceptions.mm */; };
-		93F19AE508245E59001E9ABC /* WebCoreKeyGenerator.m in Sources */ = {isa = PBXBuildFile; fileRef = 84B2B1F8056BEF3A00D2B771 /* WebCoreKeyGenerator.m */; };
-		93F19AE608245E59001E9ABC /* SSLKeyGeneratorMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 84B2B24F056BF15F00D2B771 /* SSLKeyGeneratorMac.mm */; };
+		93F19AE608245E59001E9ABC /* SSLKeyGeneratorMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 84B2B24F056BF15F00D2B771 /* SSLKeyGeneratorMac.cpp */; };
 		93F19AF808245E59001E9ABC /* Position.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BE91FC8C06133666005E3790 /* Position.cpp */; };
 		93F19AFD08245E59001E9ABC /* HTMLCanvasElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51F6A3D50663BF04004D2919 /* HTMLCanvasElement.cpp */; };
 		93F19AFF08245E59001E9ABC /* ClipboardMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 2D90660C0665D937006B6F1A /* ClipboardMac.mm */; };
@@ -3173,6 +3212,7 @@
 		A77979280D6B9E64003851B9 /* JSImageData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A77979240D6B9E64003851B9 /* JSImageData.cpp */; };
 		A77979290D6B9E64003851B9 /* JSImageData.h in Headers */ = {isa = PBXBuildFile; fileRef = A77979250D6B9E64003851B9 /* JSImageData.h */; };
 		A77B41A012E675A90054343D /* TextEventInputType.h in Headers */ = {isa = PBXBuildFile; fileRef = A77B419F12E675A90054343D /* TextEventInputType.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A77D0012133B0AEB00D6658C /* TextChecking.h in Headers */ = {isa = PBXBuildFile; fileRef = A77D0011133B0AEB00D6658C /* TextChecking.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A784941B0B5FE507001E237A /* Clipboard.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A784941A0B5FE507001E237A /* Clipboard.cpp */; };
 		A78FE13B12366B1000ACE8D0 /* SpellChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A78FE13912366B1000ACE8D0 /* SpellChecker.cpp */; };
 		A78FE13C12366B1000ACE8D0 /* SpellChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = A78FE13A12366B1000ACE8D0 /* SpellChecker.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -4043,7 +4083,6 @@
 		ABDDFE7A0A5C6E7000A3E11D /* RenderMenuList.h in Headers */ = {isa = PBXBuildFile; fileRef = ABDDFE740A5C6E7000A3E11D /* RenderMenuList.h */; };
 		ABFE7E120D32FAF60066F4D2 /* MediaControlElements.cpp in Sources */ = {isa = PBXBuildFile; fileRef = ABFE7E100D32FAF50066F4D2 /* MediaControlElements.cpp */; };
 		ABFE7E130D32FAF60066F4D2 /* MediaControlElements.h in Headers */ = {isa = PBXBuildFile; fileRef = ABFE7E110D32FAF50066F4D2 /* MediaControlElements.h */; };
-		ADDF1AD61257CD9A0003A759 /* RenderSVGPath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = ADDF1AD41257CD9A0003A759 /* RenderSVGPath.cpp */; };
 		ADDF1AD71257CD9A0003A759 /* RenderSVGPath.h in Headers */ = {isa = PBXBuildFile; fileRef = ADDF1AD51257CD9A0003A759 /* RenderSVGPath.h */; };
 		B0149E7D11A4B21500196A7B /* AsyncImageResizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B0149E7911A4B21500196A7B /* AsyncImageResizer.cpp */; };
 		B0149E7E11A4B21500196A7B /* AsyncImageResizer.h in Headers */ = {isa = PBXBuildFile; fileRef = B0149E7A11A4B21500196A7B /* AsyncImageResizer.h */; };
@@ -5005,6 +5044,8 @@
 		BC772C4E0C4EB3040083285F /* MIMETypeRegistry.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC772C4C0C4EB3040083285F /* MIMETypeRegistry.cpp */; };
 		BC772C4F0C4EB3040083285F /* MIMETypeRegistry.h in Headers */ = {isa = PBXBuildFile; fileRef = BC772C4D0C4EB3040083285F /* MIMETypeRegistry.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC772C5E0C4EB3440083285F /* MIMETypeRegistryMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC772C5D0C4EB3440083285F /* MIMETypeRegistryMac.mm */; };
+		BC772E131331620C001EC9CE /* CSSLineBoxContainValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC772E121331620C001EC9CE /* CSSLineBoxContainValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC772E16133162C2001EC9CE /* CSSLineBoxContainValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC772E15133162C2001EC9CE /* CSSLineBoxContainValue.cpp */; };
 		BC77CB870FEBF5AF0070887B /* HTMLDataGridColElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BC77CB860FEBF5AF0070887B /* HTMLDataGridColElement.h */; };
 		BC77CBAA0FEBF6C90070887B /* HTMLDataGridColElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC77CBA90FEBF6C90070887B /* HTMLDataGridColElement.cpp */; };
 		BC77CBD30FEBF8310070887B /* JSHTMLDataGridColElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC77CBD10FEBF8310070887B /* JSHTMLDataGridColElement.cpp */; };
@@ -5137,6 +5178,8 @@
 		BCC065880F3CE2A700CD2D87 /* JSClientRect.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC065840F3CE2A700CD2D87 /* JSClientRect.h */; };
 		BCC065890F3CE2A700CD2D87 /* JSClientRectList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC065850F3CE2A700CD2D87 /* JSClientRectList.cpp */; };
 		BCC0658A0F3CE2A700CD2D87 /* JSClientRectList.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC065860F3CE2A700CD2D87 /* JSClientRectList.h */; };
+		BCC36EB81342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC36EB61342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp */; };
+		BCC36EB91342AA3F004BEEF7 /* DefaultLocalizationStrategy.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC36EB71342AA3F004BEEF7 /* DefaultLocalizationStrategy.h */; };
 		BCC438780E886CC700533DD5 /* JSHTMLInputElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC438770E886CC700533DD5 /* JSHTMLInputElementCustom.cpp */; };
 		BCC573350D695BBE006EF517 /* DOMProgressEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BCC573330D695BBE006EF517 /* DOMProgressEvent.h */; };
 		BCC573360D695BBE006EF517 /* DOMProgressEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCC573340D695BBE006EF517 /* DOMProgressEvent.mm */; };
@@ -5156,6 +5199,7 @@
 		BCD0E0FC0E972C3500265DEA /* SecurityOriginHash.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD0E0F90E972C3500265DEA /* SecurityOriginHash.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCD0FBD00DBD625E00B2F630 /* DOMAbstractView.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCD0FBCF0DBD625E00B2F630 /* DOMAbstractView.mm */; };
 		BCD0FC4F0DBD720B00B2F630 /* DOMRGBColorInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD0FC4E0DBD720B00B2F630 /* DOMRGBColorInternal.h */; };
+		BCD3F9831326C93700098A60 /* TextOrientation.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD3F9821326C93700098A60 /* TextOrientation.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCD41ABB0C060DE800C0E446 /* JSHTMLFrameSetElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD41ABA0C060DE800C0E446 /* JSHTMLFrameSetElementCustom.cpp */; };
 		BCD533640ED6848900887468 /* CachedScriptSourceProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD533630ED6848900887468 /* CachedScriptSourceProvider.h */; };
 		BCD9C2620C17AA67005C90A2 /* JSDOMWindowCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD9C25E0C17AA67005C90A2 /* JSDOMWindowCustom.cpp */; };
@@ -5592,6 +5636,9 @@
 		ED501DC60B249F2900AE18D9 /* EditorMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = ED501DC50B249F2900AE18D9 /* EditorMac.mm */; };
 		EDE3A5000C7A430600956A37 /* ColorMac.h in Headers */ = {isa = PBXBuildFile; fileRef = EDE3A4FF0C7A430600956A37 /* ColorMac.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		EDEC98030AED7E170059137F /* WebCorePrefix.h in Headers */ = {isa = PBXBuildFile; fileRef = EDEC98020AED7E170059137F /* WebCorePrefix.h */; };
+		F316396B1329481A00A649CB /* InjectedScriptManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F31639691329481A00A649CB /* InjectedScriptManager.cpp */; };
+		F316396C1329481A00A649CB /* InjectedScriptManager.h in Headers */ = {isa = PBXBuildFile; fileRef = F316396A1329481A00A649CB /* InjectedScriptManager.h */; };
+		F316396E1329487600A649CB /* JSInjectedScriptManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F316396D1329487600A649CB /* JSInjectedScriptManager.cpp */; };
 		F3335BF812E07DC300D33011 /* InspectorConsoleAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F3335BF612E07DC300D33011 /* InspectorConsoleAgent.cpp */; };
 		F3335BF912E07DC300D33011 /* InspectorConsoleAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = F3335BF712E07DC300D33011 /* InspectorConsoleAgent.h */; };
 		F33F0282120947F200E5743A /* ScriptProfile.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F33F0281120947F200E5743A /* ScriptProfile.cpp */; };
@@ -5600,6 +5647,14 @@
 		F344C7141125B82C00F26EEE /* InspectorFrontendClient.h in Headers */ = {isa = PBXBuildFile; fileRef = F344C7121125B82C00F26EEE /* InspectorFrontendClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F344C75311294D9D00F26EEE /* InspectorFrontendClientLocal.h in Headers */ = {isa = PBXBuildFile; fileRef = F344C75211294D9D00F26EEE /* InspectorFrontendClientLocal.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F344C75811294FF600F26EEE /* InspectorFrontendClientLocal.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F344C75711294FF600F26EEE /* InspectorFrontendClientLocal.cpp */; };
+		F34742DC134362F000531BC2 /* PageDebuggerAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F34742DA134362F000531BC2 /* PageDebuggerAgent.cpp */; };
+		F34742DD134362F000531BC2 /* PageDebuggerAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = F34742DB134362F000531BC2 /* PageDebuggerAgent.h */; };
+		F34742E01343631F00531BC2 /* WorkerDebuggerAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F34742DE1343631F00531BC2 /* WorkerDebuggerAgent.cpp */; };
+		F34742E11343631F00531BC2 /* WorkerDebuggerAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = F34742DF1343631F00531BC2 /* WorkerDebuggerAgent.h */; };
+		F34742E41343633C00531BC2 /* PageScriptDebugServer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F34742E21343633C00531BC2 /* PageScriptDebugServer.cpp */; };
+		F34742E51343633C00531BC2 /* PageScriptDebugServer.h in Headers */ = {isa = PBXBuildFile; fileRef = F34742E31343633C00531BC2 /* PageScriptDebugServer.h */; };
+		F34742E81343635000531BC2 /* WorkerScriptDebugServer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F34742E61343635000531BC2 /* WorkerScriptDebugServer.cpp */; };
+		F34742E91343635000531BC2 /* WorkerScriptDebugServer.h in Headers */ = {isa = PBXBuildFile; fileRef = F34742E71343635000531BC2 /* WorkerScriptDebugServer.h */; };
 		F3644AFF1119805900E0D537 /* InjectedScript.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F3644AFD1119805900E0D537 /* InjectedScript.cpp */; };
 		F3644B001119805900E0D537 /* InjectedScript.h in Headers */ = {isa = PBXBuildFile; fileRef = F3644AFE1119805900E0D537 /* InjectedScript.h */; };
 		F375CC071150D300008DDB81 /* InspectorWorkerResource.h in Headers */ = {isa = PBXBuildFile; fileRef = F375CC061150D300008DDB81 /* InspectorWorkerResource.h */; };
@@ -6357,6 +6412,10 @@
 		0709FC4D1025DEE30059CDBA /* AccessibilitySlider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilitySlider.h; sourceTree = "<group>"; };
 		070DD8F50F01868000727DEB /* mediaControls.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = mediaControls.css; sourceTree = "<group>"; };
 		0735EE690F40C5E4004A2604 /* MediaPlayerProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerProxy.h; sourceTree = "<group>"; };
+		076F0D0912B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaPlayerPrivateAVFoundation.cpp; sourceTree = "<group>"; };
+		076F0D0A12B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerPrivateAVFoundation.h; sourceTree = "<group>"; };
+		076F0D0B12B8192700C26AA4 /* MediaPlayerPrivateAVFoundationObjC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerPrivateAVFoundationObjC.h; sourceTree = "<group>"; };
+		076F0D0C12B8192700C26AA4 /* MediaPlayerPrivateAVFoundationObjC.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = MediaPlayerPrivateAVFoundationObjC.mm; sourceTree = "<group>"; };
 		079F5E4B0F3BEBEA005E0782 /* MediaPlayerPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerPrivate.h; sourceTree = "<group>"; };
 		07AFE5900F1446BD00841617 /* mediaControlsQuickTime.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.css; path = mediaControlsQuickTime.css; sourceTree = "<group>"; };
 		07B0113E1032242200FBDC33 /* AccessibilityMediaControls.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityMediaControls.h; sourceTree = "<group>"; };
@@ -6986,6 +7045,7 @@
 		22885E631301AE4C00526E68 /* JSDOMImplementationCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMImplementationCustom.cpp; sourceTree = "<group>"; };
 		228C284410D82500009D0D0E /* ScriptWrappable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptWrappable.h; sourceTree = "<group>"; };
 		2442BBF81194C9D300D49469 /* HashChangeEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HashChangeEvent.h; sourceTree = "<group>"; };
+		245D80A213280E40003492A6 /* SQLCallbackWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLCallbackWrapper.h; sourceTree = "<group>"; };
 		24F54EAA101FE914000AE741 /* ApplicationCacheHost.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ApplicationCacheHost.cpp; sourceTree = "<group>"; };
 		24F54EAB101FE914000AE741 /* ApplicationCacheHost.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ApplicationCacheHost.h; sourceTree = "<group>"; };
 		2542F4D81166C25A00E89A86 /* UserGestureIndicator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UserGestureIndicator.cpp; sourceTree = "<group>"; };
@@ -7144,6 +7204,22 @@
 		316FE10E0E6E1DA700BF6088 /* ImplicitAnimation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ImplicitAnimation.h; path = animation/ImplicitAnimation.h; sourceTree = "<group>"; };
 		316FE10F0E6E1DA700BF6088 /* KeyframeAnimation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = KeyframeAnimation.cpp; path = animation/KeyframeAnimation.cpp; sourceTree = "<group>"; };
 		316FE1100E6E1DA700BF6088 /* KeyframeAnimation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = KeyframeAnimation.h; path = animation/KeyframeAnimation.h; sourceTree = "<group>"; };
+		3194616013020B20004BB3F8 /* JSWebKitAnimation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitAnimation.cpp; sourceTree = "<group>"; };
+		3194616113020B20004BB3F8 /* JSWebKitAnimation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebKitAnimation.h; sourceTree = "<group>"; };
+		3194616813020B66004BB3F8 /* DOMWebKitAnimation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWebKitAnimation.h; sourceTree = "<group>"; };
+		3194616913020B66004BB3F8 /* DOMWebKitAnimation.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMWebKitAnimation.mm; sourceTree = "<group>"; };
+		319461FC13022BB8004BB3F8 /* JSWebKitAnimationList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitAnimationList.cpp; sourceTree = "<group>"; };
+		319461FD13022BB8004BB3F8 /* JSWebKitAnimationList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebKitAnimationList.h; sourceTree = "<group>"; };
+		3194620213022BF1004BB3F8 /* DOMWebKitAnimationList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWebKitAnimationList.h; sourceTree = "<group>"; };
+		3194620313022BF1004BB3F8 /* DOMWebKitAnimationList.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMWebKitAnimationList.mm; sourceTree = "<group>"; };
+		3194623113022F65004BB3F8 /* JSWebKitAnimationListCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitAnimationListCustom.cpp; sourceTree = "<group>"; };
+		319E68861327C911004AC91A /* JSWebKitAnimationCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitAnimationCustom.cpp; sourceTree = "<group>"; };
+		319E69AC13299BBD004AC91A /* WebKitAnimation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitAnimation.cpp; sourceTree = "<group>"; };
+		319E69AD13299BBD004AC91A /* WebKitAnimation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitAnimation.h; sourceTree = "<group>"; };
+		319E69AE13299BBD004AC91A /* WebKitAnimation.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebKitAnimation.idl; sourceTree = "<group>"; };
+		319E69AF13299BBD004AC91A /* WebKitAnimationList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitAnimationList.cpp; sourceTree = "<group>"; };
+		319E69B013299BBD004AC91A /* WebKitAnimationList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitAnimationList.h; sourceTree = "<group>"; };
+		319E69B113299BBD004AC91A /* WebKitAnimationList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebKitAnimationList.idl; sourceTree = "<group>"; };
 		31C0FF1B0E4CEB6E007D6FE5 /* WebKitAnimationEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitAnimationEvent.cpp; sourceTree = "<group>"; };
 		31C0FF1C0E4CEB6E007D6FE5 /* WebKitAnimationEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitAnimationEvent.h; sourceTree = "<group>"; };
 		31C0FF1D0E4CEB6E007D6FE5 /* WebKitAnimationEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebKitAnimationEvent.idl; sourceTree = "<group>"; };
@@ -7232,6 +7308,9 @@
 		37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreURLResponse.mm; sourceTree = "<group>"; };
 		37FC96DA1104ED71003E1FAD /* TrailingFloatsRootInlineBox.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TrailingFloatsRootInlineBox.h; sourceTree = "<group>"; };
 		37FD4297118368460093C029 /* TreeDepthLimit.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TreeDepthLimit.h; sourceTree = "<group>"; };
+		3AB02D2812D4F91600FBB694 /* StorageTracker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageTracker.h; sourceTree = "<group>"; };
+		3AB02D2912D4F91600FBB694 /* StorageTracker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageTracker.cpp; sourceTree = "<group>"; };
+		3AC367FE12EF7A09006A3D6F /* StorageTrackerClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageTrackerClient.h; sourceTree = "<group>"; };
 		3AC648B1129E146500C3EB25 /* EditingBoundary.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingBoundary.h; sourceTree = "<group>"; };
 		41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptFunctionCall.h; sourceTree = "<group>"; };
 		41002CCC0F66EDEF009E660D /* ScriptFunctionCall.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptFunctionCall.cpp; sourceTree = "<group>"; };
@@ -7262,6 +7341,8 @@
 		416E75CA0EDF90C700360E1D /* ScriptCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptCallFrame.cpp; sourceTree = "<group>"; };
 		41885B9111B6FDA6003383BB /* FormSubmission.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FormSubmission.h; sourceTree = "<group>"; };
 		41885B9211B6FDA6003383BB /* FormSubmission.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FormSubmission.cpp; sourceTree = "<group>"; };
+		418A06CE133C04D500CD379C /* EventDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventDispatcher.h; sourceTree = "<group>"; };
+		418A06CF133C04D500CD379C /* EventDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventDispatcher.cpp; sourceTree = "<group>"; };
 		418F88020FF957AE0080F045 /* JSAbstractWorker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSAbstractWorker.cpp; sourceTree = "<group>"; };
 		418F88030FF957AE0080F045 /* JSAbstractWorker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSAbstractWorker.h; sourceTree = "<group>"; };
 		41A3D58C101C152D00316D07 /* DedicatedWorkerThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DedicatedWorkerThread.cpp; path = workers/DedicatedWorkerThread.cpp; sourceTree = "<group>"; };
@@ -7393,7 +7474,6 @@
 		4429AB070CB84F81007647C5 /* DOMTextEventInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMTextEventInternal.h; sourceTree = "<group>"; };
 		44311CD412E4E22D000A8D19 /* DOMDocumentFragmentPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMDocumentFragmentPrivate.h; sourceTree = "<group>"; };
 		44311CD512E4E22D000A8D19 /* DOMDocumentPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMDocumentPrivate.h; sourceTree = "<group>"; };
-		445C8DB610015FC90031531A /* IconDatabaseNone.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IconDatabaseNone.cpp; sourceTree = "<group>"; };
 		447D69010FA626810015CCB1 /* RuntimeApplicationChecks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RuntimeApplicationChecks.h; sourceTree = "<group>"; };
 		447D69020FA626810015CCB1 /* RuntimeApplicationChecks.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = RuntimeApplicationChecks.mm; sourceTree = "<group>"; };
 		448A29BD0A46D9CB0030759F /* JSHTMLOptionsCollection.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLOptionsCollection.h; sourceTree = "<group>"; };
@@ -7666,6 +7746,8 @@
 		4E1959260A39DACC00220FE5 /* MediaQueryEvaluator.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MediaQueryEvaluator.h; sourceTree = "<group>"; };
 		4E1959270A39DACC00220FE5 /* MediaQueryExp.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = MediaQueryExp.cpp; sourceTree = "<group>"; };
 		4E1959280A39DACC00220FE5 /* MediaQueryExp.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MediaQueryExp.h; sourceTree = "<group>"; };
+		4F1442261339FD6200E0D6F8 /* DOMNodeHighlighter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMNodeHighlighter.cpp; sourceTree = "<group>"; };
+		4F1442271339FD6200E0D6F8 /* DOMNodeHighlighter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMNodeHighlighter.h; sourceTree = "<group>"; };
 		4F1534DD11B532EC0021FD86 /* EditingBehavior.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingBehavior.h; sourceTree = "<group>"; };
 		4F1534DF11B533020021FD86 /* EditingBehaviorTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditingBehaviorTypes.h; sourceTree = "<group>"; };
 		4F2D205212EAE7B3005C2874 /* InspectorAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorAgent.h; sourceTree = "<group>"; };
@@ -7674,6 +7756,8 @@
 		4F3289B411A42AAB005ABE7E /* InspectorValues.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorValues.h; sourceTree = "<group>"; };
 		4F4F5FFA11CBD2D200A186BF /* InspectorFrontend.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFrontend.cpp; sourceTree = "<group>"; };
 		4F4F5FFC11CBD30100A186BF /* InspectorFrontend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontend.h; sourceTree = "<group>"; };
+		4F6FDD621341DEDD001F8EE3 /* InspectorPageAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorPageAgent.cpp; sourceTree = "<group>"; };
+		4F6FDD631341DEDD001F8EE3 /* InspectorPageAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorPageAgent.h; sourceTree = "<group>"; };
 		4F707A9711EF679400ACDA69 /* InspectorBackendDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorBackendDispatcher.cpp; sourceTree = "<group>"; };
 		4F707A9811EF679400ACDA69 /* InspectorBackendDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorBackendDispatcher.h; sourceTree = "<group>"; };
 		4FA3B908125CD12100300BAD /* InspectorState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorState.cpp; sourceTree = "<group>"; };
@@ -7755,6 +7839,8 @@
 		5160F4970B0AA75F00C1D2AF /* HistoryItemMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = HistoryItemMac.mm; path = mac/HistoryItemMac.mm; sourceTree = "<group>"; };
 		5162C7F211F77EFA00612EFE /* SchemeRegistry.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SchemeRegistry.cpp; sourceTree = "<group>"; };
 		5162C7F311F77EFB00612EFE /* SchemeRegistry.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SchemeRegistry.h; sourceTree = "<group>"; };
+		516953951329A3C800B92D04 /* IconDatabaseBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IconDatabaseBase.cpp; sourceTree = "<group>"; };
+		516953961329A3C800B92D04 /* IconDatabaseBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IconDatabaseBase.h; sourceTree = "<group>"; };
 		516BB7920CE91E6800512F79 /* JSTreeWalkerCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTreeWalkerCustom.cpp; sourceTree = "<group>"; };
 		51721FB911D2790700638B42 /* BeforeProcessEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BeforeProcessEvent.h; sourceTree = "<group>"; };
 		51721FBA11D2790700638B42 /* BeforeProcessEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = BeforeProcessEvent.idl; sourceTree = "<group>"; };
@@ -7847,7 +7933,6 @@
 		590E1B4A11E4EF700069F784 /* JSDeviceOrientationEventCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDeviceOrientationEventCustom.cpp; sourceTree = "<group>"; };
 		59309A1011F4AE5800250603 /* DeviceOrientationClientMock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DeviceOrientationClientMock.cpp; path = mock/DeviceOrientationClientMock.cpp; sourceTree = "<group>"; };
 		59309A1211F4AE6A00250603 /* DeviceOrientationClientMock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DeviceOrientationClientMock.h; path = mock/DeviceOrientationClientMock.h; sourceTree = "<group>"; };
-		593D3EAC132532840057E7EE /* JavaMethod.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JavaMethod.cpp; sourceTree = "<group>"; };
 		593D3EAE1325328C0057E7EE /* JavaMethod.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaMethod.h; sourceTree = "<group>"; };
 		593D3EB0132532950057E7EE /* JavaString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaString.h; sourceTree = "<group>"; };
 		596229771133EFD700DC4CBB /* GeolocationPositionCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GeolocationPositionCache.cpp; sourceTree = "<group>"; };
@@ -7859,6 +7944,8 @@
 		598D77DE132541FA00761B22 /* JavaArrayJSC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JavaArrayJSC.h; path = jsc/JavaArrayJSC.h; sourceTree = "<group>"; };
 		598D77E01325420400761B22 /* JavaFieldJSC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JavaFieldJSC.cpp; path = jsc/JavaFieldJSC.cpp; sourceTree = "<group>"; };
 		598D77E21325420E00761B22 /* JavaFieldJSC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JavaFieldJSC.h; path = jsc/JavaFieldJSC.h; sourceTree = "<group>"; };
+		599C671B1343438900C3423C /* JavaMethodJobject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JavaMethodJobject.cpp; sourceTree = "<group>"; };
+		599C671D1343439400C3423C /* JavaMethodJobject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaMethodJobject.h; sourceTree = "<group>"; };
 		599E758F11055A1F00D904FA /* Bridge.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Bridge.h; path = bridge/Bridge.h; sourceTree = "<group>"; };
 		59A85EA1119D68D900DEF1EF /* DeviceOrientationEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DeviceOrientationEvent.cpp; sourceTree = "<group>"; };
 		59A85EA3119D68EC00DEF1EF /* DeviceOrientationEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeviceOrientationEvent.h; sourceTree = "<group>"; };
@@ -7870,6 +7957,7 @@
 		59A8F1D711A69520001AC34A /* DeviceOrientationClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeviceOrientationClient.h; sourceTree = "<group>"; };
 		59A9E7AF1104758800DFB4C1 /* JavaInstanceJSC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JavaInstanceJSC.cpp; path = jsc/JavaInstanceJSC.cpp; sourceTree = "<group>"; };
 		59A9E7B11104759400DFB4C1 /* JavaInstanceJSC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JavaInstanceJSC.h; path = jsc/JavaInstanceJSC.h; sourceTree = "<group>"; };
+		59B0EEA6132A6F2A004331C7 /* JavaType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JavaType.h; sourceTree = "<group>"; };
 		59B597721108656B007159E8 /* BridgeJSC.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = BridgeJSC.cpp; path = bridge/jsc/BridgeJSC.cpp; sourceTree = "<group>"; };
 		59B5977411086579007159E8 /* BridgeJSC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = BridgeJSC.h; path = bridge/jsc/BridgeJSC.h; sourceTree = "<group>"; };
 		59BC393E11054A1300FD85DB /* JavaStringJSC.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = JavaStringJSC.h; path = jsc/JavaStringJSC.h; sourceTree = "<group>"; };
@@ -8135,6 +8223,7 @@
 		7AFD4A8A1131C2760035B883 /* ScriptBreakpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptBreakpoint.h; sourceTree = "<group>"; };
 		7AFD4FF3113277B60035B883 /* ScriptDebugListener.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptDebugListener.h; sourceTree = "<group>"; };
 		7E33CD00127F340D00BE8F17 /* PurgePriority.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PurgePriority.h; sourceTree = "<group>"; };
+		7E37EF2D1339208800B29250 /* SubresourceLoaderCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SubresourceLoaderCF.cpp; path = cf/SubresourceLoaderCF.cpp; sourceTree = "<group>"; };
 		7EE6844C12D26E3800E79415 /* AuthenticationCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AuthenticationCF.cpp; sourceTree = "<group>"; };
 		7EE6844D12D26E3800E79415 /* AuthenticationCF.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AuthenticationCF.h; sourceTree = "<group>"; };
 		7EE6844E12D26E3800E79415 /* AuthenticationChallenge.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AuthenticationChallenge.h; sourceTree = "<group>"; };
@@ -8155,9 +8244,19 @@
 		7EE6845D12D26E3800E79415 /* ResourceResponse.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResourceResponse.h; sourceTree = "<group>"; };
 		7EE6845E12D26E3800E79415 /* ResourceResponseCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResourceResponseCFNet.cpp; sourceTree = "<group>"; };
 		7EE6847412D26E7000E79415 /* ResourceLoaderCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ResourceLoaderCFNet.cpp; path = cf/ResourceLoaderCFNet.cpp; sourceTree = "<group>"; };
+		809DD1DD130DE2AD00CAE3ED /* CSSStyleApplyProperty.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSStyleApplyProperty.cpp; sourceTree = "<group>"; };
+		809DD1DE130DE2AD00CAE3ED /* CSSStyleApplyProperty.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSStyleApplyProperty.h; sourceTree = "<group>"; };
+		8102C5871325BB1100DDE67A /* StringCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StringCallback.cpp; sourceTree = "<group>"; };
+		815E6166132587AA00B622B0 /* DataTransferItem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DataTransferItem.cpp; sourceTree = "<group>"; };
 		81A7325D1210189B00FC0D9E /* IDBCursor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBCursor.h; sourceTree = "<group>"; };
 		81A7325F121018A400FC0D9E /* IDBCursor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBCursor.cpp; sourceTree = "<group>"; };
 		81A73277121019E100FC0D9E /* IDBCursorBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBCursorBackendImpl.h; sourceTree = "<group>"; };
+		81AC5997131636E60009A7E0 /* DataTransferItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataTransferItem.h; sourceTree = "<group>"; };
+		81AC5998131636E60009A7E0 /* DataTransferItems.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataTransferItems.h; sourceTree = "<group>"; };
+		81AC5AE81316392E0009A7E0 /* DataTransferItem.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DataTransferItem.idl; sourceTree = "<group>"; };
+		81AC5AE91316392E0009A7E0 /* DataTransferItems.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DataTransferItems.idl; sourceTree = "<group>"; };
+		81AC6C34131C57C20009A7E0 /* StringCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = StringCallback.idl; sourceTree = "<group>"; };
+		81AC6C35131C57D30009A7E0 /* StringCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringCallback.h; sourceTree = "<group>"; };
 		81BE209311F4AB8D00915DFA /* IDBCursorBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBCursorBackendImpl.cpp; sourceTree = "<group>"; };
 		81BE209411F4AB8D00915DFA /* IDBCursorBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBCursorBackendInterface.h; sourceTree = "<group>"; };
 		81BE209C11F4ABBD00915DFA /* IDBCursor.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBCursor.idl; sourceTree = "<group>"; };
@@ -8249,9 +8348,8 @@
 		84A81F3C0FC7DFF000955300 /* SourceAlpha.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SourceAlpha.h; path = filters/SourceAlpha.h; sourceTree = "<group>"; };
 		84A81F3F0FC7E02700955300 /* SourceGraphic.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SourceGraphic.cpp; path = filters/SourceGraphic.cpp; sourceTree = "<group>"; };
 		84A81F400FC7E02700955300 /* SourceGraphic.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SourceGraphic.h; path = filters/SourceGraphic.h; sourceTree = "<group>"; };
-		84B2B1F7056BEF3A00D2B771 /* WebCoreKeyGenerator.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebCoreKeyGenerator.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
-		84B2B1F8056BEF3A00D2B771 /* WebCoreKeyGenerator.m */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebCoreKeyGenerator.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
-		84B2B24F056BF15F00D2B771 /* SSLKeyGeneratorMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = SSLKeyGeneratorMac.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		84B2B24F056BF15F00D2B771 /* SSLKeyGeneratorMac.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SSLKeyGeneratorMac.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		84B62684133138F90095A489 /* FontPlatformData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontPlatformData.cpp; sourceTree = "<group>"; };
 		84B6B975120F13E500B8EFAF /* SVGPathSegListSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGPathSegListSource.cpp; sourceTree = "<group>"; };
 		84B6B976120F13E500B8EFAF /* SVGPathSegListSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGPathSegListSource.h; sourceTree = "<group>"; };
 		84C5B2F81216DC810088B53A /* SVGPathTraversalStateBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGPathTraversalStateBuilder.cpp; sourceTree = "<group>"; };
@@ -9151,8 +9249,8 @@
 		89D08D9E12228451001241DF /* AsyncFileSystemCallbacks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AsyncFileSystemCallbacks.h; sourceTree = "<group>"; };
 		8A12E35C11FA33280025836A /* DocumentLoadTiming.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentLoadTiming.h; sourceTree = "<group>"; };
 		8A309C9E123950BE00CB9204 /* NestingLevelIncrementer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NestingLevelIncrementer.h; path = parser/NestingLevelIncrementer.h; sourceTree = "<group>"; };
-		8A413ADE1207BBA50082016E /* AsyncScriptRunner.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AsyncScriptRunner.h; sourceTree = "<group>"; };
-		8A413ADF1207BBA50082016E /* AsyncScriptRunner.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AsyncScriptRunner.cpp; sourceTree = "<group>"; };
+		8A413ADE1207BBA50082016E /* ScriptRunner.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptRunner.h; sourceTree = "<group>"; };
+		8A413ADF1207BBA50082016E /* ScriptRunner.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptRunner.cpp; sourceTree = "<group>"; };
 		8A7CC96A12076D73001D4588 /* PendingScript.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PendingScript.h; sourceTree = "<group>"; };
 		8A7CC96F12076F8A001D4588 /* PendingScript.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PendingScript.cpp; sourceTree = "<group>"; };
 		8A81BF8411DCFD9000DA2B98 /* ResourceLoadTiming.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResourceLoadTiming.h; sourceTree = "<group>"; };
@@ -9622,6 +9720,7 @@
 		A77979240D6B9E64003851B9 /* JSImageData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSImageData.cpp; sourceTree = "<group>"; };
 		A77979250D6B9E64003851B9 /* JSImageData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSImageData.h; sourceTree = "<group>"; };
 		A77B419F12E675A90054343D /* TextEventInputType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextEventInputType.h; sourceTree = "<group>"; };
+		A77D0011133B0AEB00D6658C /* TextChecking.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextChecking.h; sourceTree = "<group>"; };
 		A784941A0B5FE507001E237A /* Clipboard.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Clipboard.cpp; sourceTree = "<group>"; };
 		A78FE13912366B1000ACE8D0 /* SpellChecker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpellChecker.cpp; sourceTree = "<group>"; };
 		A78FE13A12366B1000ACE8D0 /* SpellChecker.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; path = SpellChecker.h; sourceTree = "<group>"; };
@@ -11369,6 +11468,8 @@
 		BC772C4C0C4EB3040083285F /* MIMETypeRegistry.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = MIMETypeRegistry.cpp; sourceTree = "<group>"; };
 		BC772C4D0C4EB3040083285F /* MIMETypeRegistry.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MIMETypeRegistry.h; sourceTree = "<group>"; };
 		BC772C5D0C4EB3440083285F /* MIMETypeRegistryMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = MIMETypeRegistryMac.mm; sourceTree = "<group>"; };
+		BC772E121331620C001EC9CE /* CSSLineBoxContainValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSLineBoxContainValue.h; sourceTree = "<group>"; };
+		BC772E15133162C2001EC9CE /* CSSLineBoxContainValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSLineBoxContainValue.cpp; sourceTree = "<group>"; };
 		BC77CB860FEBF5AF0070887B /* HTMLDataGridColElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLDataGridColElement.h; sourceTree = "<group>"; };
 		BC77CB880FEBF5BA0070887B /* HTMLDataGridColElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLDataGridColElement.idl; sourceTree = "<group>"; };
 		BC77CBA90FEBF6C90070887B /* HTMLDataGridColElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLDataGridColElement.cpp; sourceTree = "<group>"; };
@@ -11409,7 +11510,6 @@
 		BC7FA6800D1F167900DB22A9 /* SelectorNodeList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SelectorNodeList.cpp; sourceTree = "<group>"; };
 		BC80C9850CD294EE00A0B7B3 /* CSSTimingFunctionValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSTimingFunctionValue.cpp; sourceTree = "<group>"; };
 		BC80C9860CD294EE00A0B7B3 /* CSSTimingFunctionValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSTimingFunctionValue.h; sourceTree = "<group>"; };
-		BC814A4112F8C34A007B2C32 /* HeaderDetection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HeaderDetection.h; sourceTree = "<group>"; };
 		BC8243250D0CE8A200460C8F /* JSSQLError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLError.h; sourceTree = "<group>"; };
 		BC8243260D0CE8A200460C8F /* JSSQLTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLTransaction.h; sourceTree = "<group>"; };
 		BC8243E60D0CFD7500460C8F /* WindowFeatures.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WindowFeatures.cpp; sourceTree = "<group>"; };
@@ -11516,6 +11616,8 @@
 		BCC065840F3CE2A700CD2D87 /* JSClientRect.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSClientRect.h; sourceTree = "<group>"; };
 		BCC065850F3CE2A700CD2D87 /* JSClientRectList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSClientRectList.cpp; sourceTree = "<group>"; };
 		BCC065860F3CE2A700CD2D87 /* JSClientRectList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSClientRectList.h; sourceTree = "<group>"; };
+		BCC36EB61342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DefaultLocalizationStrategy.cpp; sourceTree = "<group>"; };
+		BCC36EB71342AA3F004BEEF7 /* DefaultLocalizationStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DefaultLocalizationStrategy.h; sourceTree = "<group>"; };
 		BCC438770E886CC700533DD5 /* JSHTMLInputElementCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLInputElementCustom.cpp; sourceTree = "<group>"; };
 		BCC573330D695BBE006EF517 /* DOMProgressEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMProgressEvent.h; sourceTree = "<group>"; };
 		BCC573340D695BBE006EF517 /* DOMProgressEvent.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMProgressEvent.mm; sourceTree = "<group>"; };
@@ -11535,6 +11637,7 @@
 		BCD0E0F90E972C3500265DEA /* SecurityOriginHash.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SecurityOriginHash.h; sourceTree = "<group>"; };
 		BCD0FBCF0DBD625E00B2F630 /* DOMAbstractView.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMAbstractView.mm; sourceTree = "<group>"; };
 		BCD0FC4E0DBD720B00B2F630 /* DOMRGBColorInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMRGBColorInternal.h; sourceTree = "<group>"; };
+		BCD3F9821326C93700098A60 /* TextOrientation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextOrientation.h; sourceTree = "<group>"; };
 		BCD41ABA0C060DE800C0E446 /* JSHTMLFrameSetElementCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLFrameSetElementCustom.cpp; sourceTree = "<group>"; };
 		BCD533630ED6848900887468 /* CachedScriptSourceProvider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedScriptSourceProvider.h; sourceTree = "<group>"; };
 		BCD9C25E0C17AA67005C90A2 /* JSDOMWindowCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMWindowCustom.cpp; sourceTree = "<group>"; };
@@ -11678,6 +11781,8 @@
 		C5137CF111A58378004ADB99 /* JSDOMStringList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMStringList.h; sourceTree = "<group>"; };
 		C5160EE81004543A00A7CEE2 /* StorageAreaImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageAreaImpl.cpp; sourceTree = "<group>"; };
 		C5160EE91004543A00A7CEE2 /* StorageAreaImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageAreaImpl.h; sourceTree = "<group>"; };
+		C5392D331326AD0100043D35 /* HTMLConverter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLConverter.h; sourceTree = "<group>"; };
+		C5392D341326AD0100043D35 /* HTMLConverter.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = HTMLConverter.mm; sourceTree = "<group>"; };
 		C544274911A57E7A0063A749 /* DOMStringList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMStringList.h; sourceTree = "<group>"; };
 		C544274A11A57E7A0063A749 /* DOMStringList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMStringList.idl; sourceTree = "<group>"; };
 		C55610F011A704EB00B82D27 /* DOMStringList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMStringList.cpp; sourceTree = "<group>"; };
@@ -11757,6 +11862,7 @@
 		CA3BF67B10D99BAE00E6CE53 /* ScrollAnimator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScrollAnimator.cpp; sourceTree = "<group>"; };
 		CA3BF67D10D99BAE00E6CE53 /* ScrollAnimator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollAnimator.h; sourceTree = "<group>"; };
 		CD4E0AFA11F7BC27009D3811 /* fullscreen.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.css; path = fullscreen.css; sourceTree = "<group>"; };
+		CDBD93BA1333BD4B002570E3 /* fullscreenQuickTime.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.css; path = fullscreenQuickTime.css; sourceTree = "<group>"; };
 		CDEA7C821276230400B846DD /* RenderFullScreen.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderFullScreen.h; sourceTree = "<group>"; };
 		CDEA7C831276230400B846DD /* RenderFullScreen.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderFullScreen.cpp; sourceTree = "<group>"; };
 		CE02F0C311E83ADD00C6684A /* ScriptControllerBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptControllerBase.h; sourceTree = "<group>"; };
@@ -12012,6 +12118,9 @@
 		ED501DC50B249F2900AE18D9 /* EditorMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = EditorMac.mm; path = mac/EditorMac.mm; sourceTree = "<group>"; };
 		EDE3A4FF0C7A430600956A37 /* ColorMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ColorMac.h; sourceTree = "<group>"; };
 		EDEC98020AED7E170059137F /* WebCorePrefix.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebCorePrefix.h; sourceTree = "<group>"; tabWidth = 4; usesTabs = 0; };
+		F31639691329481A00A649CB /* InjectedScriptManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScriptManager.cpp; sourceTree = "<group>"; };
+		F316396A1329481A00A649CB /* InjectedScriptManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScriptManager.h; sourceTree = "<group>"; };
+		F316396D1329487600A649CB /* JSInjectedScriptManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInjectedScriptManager.cpp; sourceTree = "<group>"; };
 		F3335BF612E07DC300D33011 /* InspectorConsoleAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorConsoleAgent.cpp; sourceTree = "<group>"; };
 		F3335BF712E07DC300D33011 /* InspectorConsoleAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorConsoleAgent.h; sourceTree = "<group>"; };
 		F33F0281120947F200E5743A /* ScriptProfile.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptProfile.cpp; sourceTree = "<group>"; };
@@ -12020,6 +12129,14 @@
 		F344C7121125B82C00F26EEE /* InspectorFrontendClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontendClient.h; sourceTree = "<group>"; };
 		F344C75211294D9D00F26EEE /* InspectorFrontendClientLocal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontendClientLocal.h; sourceTree = "<group>"; };
 		F344C75711294FF600F26EEE /* InspectorFrontendClientLocal.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorFrontendClientLocal.cpp; sourceTree = "<group>"; };
+		F34742DA134362F000531BC2 /* PageDebuggerAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageDebuggerAgent.cpp; sourceTree = "<group>"; };
+		F34742DB134362F000531BC2 /* PageDebuggerAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageDebuggerAgent.h; sourceTree = "<group>"; };
+		F34742DE1343631F00531BC2 /* WorkerDebuggerAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerDebuggerAgent.cpp; sourceTree = "<group>"; };
+		F34742DF1343631F00531BC2 /* WorkerDebuggerAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerDebuggerAgent.h; sourceTree = "<group>"; };
+		F34742E21343633C00531BC2 /* PageScriptDebugServer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageScriptDebugServer.cpp; sourceTree = "<group>"; };
+		F34742E31343633C00531BC2 /* PageScriptDebugServer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageScriptDebugServer.h; sourceTree = "<group>"; };
+		F34742E61343635000531BC2 /* WorkerScriptDebugServer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerScriptDebugServer.cpp; sourceTree = "<group>"; };
+		F34742E71343635000531BC2 /* WorkerScriptDebugServer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerScriptDebugServer.h; sourceTree = "<group>"; };
 		F3644AFD1119805900E0D537 /* InjectedScript.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedScript.cpp; sourceTree = "<group>"; };
 		F3644AFE1119805900E0D537 /* InjectedScript.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedScript.h; sourceTree = "<group>"; };
 		F375CC061150D300008DDB81 /* InspectorWorkerResource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorWorkerResource.h; sourceTree = "<group>"; };
@@ -12404,6 +12521,17 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
+		076F0D0812B8192700C26AA4 /* avfoundation */ = {
+			isa = PBXGroup;
+			children = (
+				076F0D0912B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.cpp */,
+				076F0D0A12B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.h */,
+				076F0D0B12B8192700C26AA4 /* MediaPlayerPrivateAVFoundationObjC.h */,
+				076F0D0C12B8192700C26AA4 /* MediaPlayerPrivateAVFoundationObjC.mm */,
+			);
+			path = avfoundation;
+			sourceTree = "<group>";
+		};
 		081CDFBD126ECFE800D215CA /* properties */ = {
 			isa = PBXGroup;
 			children = (
@@ -12745,16 +12873,18 @@
 		1A569CCE0D7E2B82007C3983 /* jni */ = {
 			isa = PBXGroup;
 			children = (
-				593D3EB0132532950057E7EE /* JavaString.h */,
+				599C671D1343439400C3423C /* JavaMethodJobject.h */,
+				599C671B1343438900C3423C /* JavaMethodJobject.cpp */,
 				593D3EAE1325328C0057E7EE /* JavaMethod.h */,
-				593D3EAC132532840057E7EE /* JavaMethod.cpp */,
-				59695083132105A500C3ED18 /* JobjectWrapper.cpp */,
-				596950811321059900C3ED18 /* JobjectWrapper.h */,
+				593D3EB0132532950057E7EE /* JavaString.h */,
+				59B0EEA6132A6F2A004331C7 /* JavaType.h */,
 				1A569CD40D7E2B82007C3983 /* jni_jsobject.h */,
 				1A569CD30D7E2B82007C3983 /* jni_jsobject.mm */,
 				1A569CD50D7E2B82007C3983 /* jni_objc.mm */,
 				59EE122F1106081F00885116 /* JNIUtility.cpp */,
 				59EE12311106082900885116 /* JNIUtility.h */,
+				59695083132105A500C3ED18 /* JobjectWrapper.cpp */,
+				596950811321059900C3ED18 /* JobjectWrapper.h */,
 				599D1E2F10C97D4C00E0EF12 /* jsc */,
 			);
 			name = jni;
@@ -12912,6 +13042,7 @@
 				51A926790D53F0570063ECC2 /* OriginQuotaManager.h */,
 				51A9267A0D53F0570063ECC2 /* OriginUsageRecord.cpp */,
 				51A9267B0D53F0570063ECC2 /* OriginUsageRecord.h */,
+				245D80A213280E40003492A6 /* SQLCallbackWrapper.h */,
 				51EC92570CE90DB400F90308 /* SQLError.h */,
 				51EC92580CE90DB400F90308 /* SQLError.idl */,
 				B56EBA8311C9FF8100B04477 /* SQLException.h */,
@@ -12967,6 +13098,9 @@
 				C55E38BB10040D5D00A56BDB /* StorageNamespaceImpl.h */,
 				C5102D930FD9AA2D00FAFF04 /* StorageSyncManager.cpp */,
 				C5102D920FD9AA2D00FAFF04 /* StorageSyncManager.h */,
+				3AB02D2912D4F91600FBB694 /* StorageTracker.cpp */,
+				3AB02D2812D4F91600FBB694 /* StorageTracker.h */,
+				3AC367FE12EF7A09006A3D6F /* StorageTrackerClient.h */,
 			);
 			indentWidth = 4;
 			path = storage;
@@ -13002,11 +13136,15 @@
 				1C81B9590E97330800266E07 /* front-end */,
 				41F0618D0F5F069800A07EAC /* ConsoleMessage.cpp */,
 				41F0618C0F5F069800A07EAC /* ConsoleMessage.h */,
+				4F1442261339FD6200E0D6F8 /* DOMNodeHighlighter.cpp */,
+				4F1442271339FD6200E0D6F8 /* DOMNodeHighlighter.h */,
 				F3644AFD1119805900E0D537 /* InjectedScript.cpp */,
 				F3644AFE1119805900E0D537 /* InjectedScript.h */,
 				7A0E76F610BF08ED00A0276E /* InjectedScriptHost.cpp */,
 				7A0E76F710BF08ED00A0276E /* InjectedScriptHost.h */,
 				7A0E76F810BF08ED00A0276E /* InjectedScriptHost.idl */,
+				F31639691329481A00A649CB /* InjectedScriptManager.cpp */,
+				F316396A1329481A00A649CB /* InjectedScriptManager.h */,
 				7A563F9512DF5C9100F4536D /* InjectedScriptSource.js */,
 				4F2D205312EAE7B3005C2874 /* InspectorAgent.cpp */,
 				4F2D205212EAE7B3005C2874 /* InspectorAgent.h */,
@@ -13044,6 +13182,8 @@
 				7A0E770D10C00A8800A0276E /* InspectorFrontendHost.idl */,
 				20D629241253690B00081543 /* InspectorInstrumentation.cpp */,
 				20D629251253690B00081543 /* InspectorInstrumentation.h */,
+				4F6FDD621341DEDD001F8EE3 /* InspectorPageAgent.cpp */,
+				4F6FDD631341DEDD001F8EE3 /* InspectorPageAgent.h */,
 				9F0D6B2C121BFEBA006C0288 /* InspectorProfilerAgent.cpp */,
 				9F0D6B2D121BFEBA006C0288 /* InspectorProfilerAgent.h */,
 				82AB1771125C826700C5069D /* InspectorResourceAgent.cpp */,
@@ -13062,6 +13202,8 @@
 				F3ABFE0B130E9DA000E7F7D1 /* InstrumentingAgents.h */,
 				1C81BA050E97348300266E07 /* JavaScriptCallFrame.idl */,
 				BCC64F5F0DCFB84E0081EF3B /* localizedStrings.js */,
+				F34742DA134362F000531BC2 /* PageDebuggerAgent.cpp */,
+				F34742DB134362F000531BC2 /* PageDebuggerAgent.h */,
 				F39BE95912673BF400E0A674 /* ScriptArguments.cpp */,
 				F39BE95A12673BF400E0A674 /* ScriptArguments.h */,
 				7AFD4A8A1131C2760035B883 /* ScriptBreakpoint.h */,
@@ -13074,6 +13216,8 @@
 				9FA37EF01172FD4100C4CD55 /* ScriptProfileNode.idl */,
 				7553CFE7108F473F00EA281E /* TimelineRecordFactory.cpp */,
 				7553CFE6108F473F00EA281E /* TimelineRecordFactory.h */,
+				F34742DE1343631F00531BC2 /* WorkerDebuggerAgent.cpp */,
+				F34742DF1343631F00531BC2 /* WorkerDebuggerAgent.h */,
 			);
 			path = inspector;
 			sourceTree = "<group>";
@@ -13606,8 +13750,9 @@
 			children = (
 				5126E6B90A2E3B12005C29FA /* IconDatabase.cpp */,
 				5126E6BA0A2E3B12005C29FA /* IconDatabase.h */,
+				516953951329A3C800B92D04 /* IconDatabaseBase.cpp */,
+				516953961329A3C800B92D04 /* IconDatabaseBase.h */,
 				51E1ECB80C91C90400DC255B /* IconDatabaseClient.h */,
-				445C8DB610015FC90031531A /* IconDatabaseNone.cpp */,
 				513F14510AB634C400094DDF /* IconLoader.cpp */,
 				513F14520AB634C400094DDF /* IconLoader.h */,
 				51E1ECBA0C91C90400DC255B /* IconRecord.cpp */,
@@ -13711,12 +13856,12 @@
 		599D1E2F10C97D4C00E0EF12 /* jsc */ = {
 			isa = PBXGroup;
 			children = (
-				598D77E21325420E00761B22 /* JavaFieldJSC.h */,
-				598D77E01325420400761B22 /* JavaFieldJSC.cpp */,
-				598D77DE132541FA00761B22 /* JavaArrayJSC.h */,
 				598D77DC132541EE00761B22 /* JavaArrayJSC.cpp */,
+				598D77DE132541FA00761B22 /* JavaArrayJSC.h */,
 				59E560A81105336F00AA1258 /* JavaClassJSC.cpp */,
 				59E560A61105336600AA1258 /* JavaClassJSC.h */,
+				598D77E01325420400761B22 /* JavaFieldJSC.cpp */,
+				598D77E21325420E00761B22 /* JavaFieldJSC.h */,
 				59A9E7AF1104758800DFB4C1 /* JavaInstanceJSC.cpp */,
 				59A9E7B11104759400DFB4C1 /* JavaInstanceJSC.h */,
 				E1698263113467F300894115 /* JavaRuntimeObject.cpp */,
@@ -13800,7 +13945,6 @@
 				6565814709D13043000E61D7 /* CSSValueKeywords.gperf */,
 				6565814809D13043000E61D7 /* CSSValueKeywords.h */,
 				E406F3FA1198304D009D59D6 /* DocTypeStrings.cpp */,
-				BC814A4112F8C34A007B2C32 /* HeaderDetection.h */,
 				A17C81200F2A5CF7005DAAEB /* HTMLElementFactory.cpp */,
 				A17C81210F2A5CF7005DAAEB /* HTMLElementFactory.h */,
 				A8BC04911214F69600B5F122 /* HTMLEntityTable.cpp */,
@@ -13939,6 +14083,8 @@
 				066C772C0AB603D200238CC4 /* FileChooserMac.mm */,
 				514B3F750C722055000530DF /* FileSystemMac.mm */,
 				935C476C09AC4D6300A6AAB4 /* FoundationExtras.h */,
+				C5392D331326AD0100043D35 /* HTMLConverter.h */,
+				C5392D341326AD0100043D35 /* HTMLConverter.mm */,
 				935C476E09AC4D7300A6AAB4 /* KeyEventMac.mm */,
 				521D46F511AEC98100514613 /* KillRingMac.mm */,
 				6593923909AE435C002C531F /* KURLMac.mm */,
@@ -13969,14 +14115,12 @@
 				93309E9F099EB78C0056E581 /* SharedTimerMac.mm */,
 				0A4844980CA44CB200B7BD48 /* SoftLinking.h */,
 				4B3043C80AE0371D00A82647 /* SoundMac.mm */,
-				84B2B24F056BF15F00D2B771 /* SSLKeyGeneratorMac.mm */,
+				84B2B24F056BF15F00D2B771 /* SSLKeyGeneratorMac.cpp */,
 				93B2D8170F9920EE006AE6B2 /* SuddenTermination.mm */,
 				6582A15509999D6D00BEEB6D /* SystemTimeMac.cpp */,
 				BCE659E50EA92FB2007E4533 /* ThemeMac.h */,
 				BCE659E80EA92FFA007E4533 /* ThemeMac.mm */,
 				51DF6D7F0B92A18E00C2DC85 /* ThreadCheck.mm */,
-				84B2B1F7056BEF3A00D2B771 /* WebCoreKeyGenerator.h */,
-				84B2B1F8056BEF3A00D2B771 /* WebCoreKeyGenerator.m */,
 				934D9BA60B8C1175007B42A9 /* WebCoreNSStringExtras.h */,
 				934D9BA40B8C116B007B42A9 /* WebCoreNSStringExtras.mm */,
 				DD05FE0B0B8BA3C6009ACDFE /* WebCoreObjCExtras.h */,
@@ -14141,6 +14285,12 @@
 				BC8BF150105813BF00A40A07 /* UserStyleSheet.h */,
 				BC8BF1591058141800A40A07 /* UserStyleSheetTypes.h */,
 				BE983D95052A2E0A00892D85 /* WebCoreKeyboardUIMode.h */,
+				319E69AC13299BBD004AC91A /* WebKitAnimation.cpp */,
+				319E69AD13299BBD004AC91A /* WebKitAnimation.h */,
+				319E69AE13299BBD004AC91A /* WebKitAnimation.idl */,
+				319E69AF13299BBD004AC91A /* WebKitAnimationList.cpp */,
+				319E69B013299BBD004AC91A /* WebKitAnimationList.h */,
+				319E69B113299BBD004AC91A /* WebKitAnimationList.idl */,
 				494BD7930F55C8EE00747828 /* WebKitPoint.h */,
 				494BD7940F55C8EE00747828 /* WebKitPoint.idl */,
 				BC8243E60D0CFD7500460C8F /* WindowFeatures.cpp */,
@@ -14158,6 +14308,7 @@
 			isa = PBXGroup;
 			children = (
 				7EE6847412D26E7000E79415 /* ResourceLoaderCFNet.cpp */,
+				7E37EF2D1339208800B29250 /* SubresourceLoaderCF.cpp */,
 			);
 			name = cf;
 			sourceTree = "<group>";
@@ -14994,6 +15145,10 @@
 				85BA4D0A0AA688680088052D /* DOMHTMLUListElement.mm */,
 				15C770A4100D41CD005BA267 /* DOMValidityState.h */,
 				15C770A3100D41CD005BA267 /* DOMValidityState.mm */,
+				3194616813020B66004BB3F8 /* DOMWebKitAnimation.h */,
+				3194616913020B66004BB3F8 /* DOMWebKitAnimation.mm */,
+				3194620213022BF1004BB3F8 /* DOMWebKitAnimationList.h */,
+				3194620313022BF1004BB3F8 /* DOMWebKitAnimationList.mm */,
 			);
 			name = HTML;
 			sourceTree = "<group>";
@@ -16321,6 +16476,10 @@
 				0C45342610CDBBFA00869157 /* JSWebGLUniformLocation.h */,
 				77EF62F112F9DB7400C77BD2 /* JSWebGLVertexArrayObjectOES.cpp */,
 				77EF62F212F9DB7400C77BD2 /* JSWebGLVertexArrayObjectOES.h */,
+				3194616013020B20004BB3F8 /* JSWebKitAnimation.cpp */,
+				3194616113020B20004BB3F8 /* JSWebKitAnimation.h */,
+				319461FC13022BB8004BB3F8 /* JSWebKitAnimationList.cpp */,
+				319461FD13022BB8004BB3F8 /* JSWebKitAnimationList.h */,
 				93F1D5BE12D5335600832BEC /* JSWebKitLoseContext.cpp */,
 				93F1D5BF12D5335600832BEC /* JSWebKitLoseContext.h */,
 			);
@@ -17491,6 +17650,7 @@
 		B2A015910AF6CD53006BCE0E /* graphics */ = {
 			isa = PBXGroup;
 			children = (
+				076F0D0812B8192700C26AA4 /* avfoundation */,
 				499B3EC0128CCC1800E726C2 /* ca */,
 				B27535290B053814002CE64F /* cg */,
 				B5320D68122A24E9002D1440 /* cocoa */,
@@ -17535,6 +17695,8 @@
 				72626E010EF022FE00A07E20 /* FontFastPath.cpp */,
 				0845680712B90DA600960A9F /* FontMetrics.h */,
 				F7A034C3126BF6BE007DC19E /* FontOrientation.h */,
+				84B62684133138F90095A489 /* FontPlatformData.cpp */,
+				B5320D69122A24E9002D1440 /* FontPlatformData.h */,
 				37ACCE410DA2980F0089E602 /* FontRenderingMode.h */,
 				B2C3DA5A0D006CD600EF6F26 /* FontSelector.h */,
 				37202198106213C600F25C4B /* FontSmoothingMode.h */,
@@ -17643,6 +17805,7 @@
 				B2C3DA070D006C1D00EF6F26 /* TextBreakIteratorICU.cpp */,
 				B2C3DA080D006C1D00EF6F26 /* TextBreakIteratorInternalICU.h */,
 				A7151BD712F1558F005A0F64 /* TextCheckerClient.h */,
+				A77D0011133B0AEB00D6658C /* TextChecking.h */,
 				B2C3DA090D006C1D00EF6F26 /* TextCodec.cpp */,
 				B2C3DA0A0D006C1D00EF6F26 /* TextCodec.h */,
 				26E98A0F130A9FCA008EB7B2 /* TextCodecASCIIFastPath.h */,
@@ -17663,6 +17826,7 @@
 				C105DA610F3AA68F001DD44F /* TextEncodingDetectorICU.cpp */,
 				B2C3DA180D006C1D00EF6F26 /* TextEncodingRegistry.cpp */,
 				B2C3DA190D006C1D00EF6F26 /* TextEncodingRegistry.h */,
+				BCD3F9821326C93700098A60 /* TextOrientation.h */,
 				B2C3DA1A0D006C1D00EF6F26 /* TextStream.cpp */,
 				B2C3DA1B0D006C1D00EF6F26 /* TextStream.h */,
 				B2C3DA1C0D006C1D00EF6F26 /* UnicodeRange.cpp */,
@@ -17726,7 +17890,6 @@
 		B5320D68122A24E9002D1440 /* cocoa */ = {
 			isa = PBXGroup;
 			children = (
-				B5320D69122A24E9002D1440 /* FontPlatformData.h */,
 				B5320D6A122A24E9002D1440 /* FontPlatformDataCocoa.mm */,
 			);
 			path = cocoa;
@@ -17818,6 +17981,8 @@
 				14CD8D81106B529000A46D23 /* JSSharedWorkerCustom.cpp */,
 				E1C36D320EB0A094007410BC /* JSWorkerContextBase.cpp */,
 				E1C36D330EB0A094007410BC /* JSWorkerContextBase.h */,
+				F34742E21343633C00531BC2 /* PageScriptDebugServer.cpp */,
+				F34742E31343633C00531BC2 /* PageScriptDebugServer.h */,
 				BCA378BA0D15F64200B793D6 /* ScheduledAction.cpp */,
 				BCA378BB0D15F64200B793D6 /* ScheduledAction.h */,
 				41F1D21E0EF35C2A00DA8753 /* ScriptCachedFrameData.cpp */,
@@ -17857,6 +18022,8 @@
 				BC53D910114310CC000D817E /* WebCoreJSClientData.h */,
 				E1A643FC0EC097A000779668 /* WorkerScriptController.cpp */,
 				E1A643F10EC0972500779668 /* WorkerScriptController.h */,
+				F34742E61343635000531BC2 /* WorkerScriptDebugServer.cpp */,
+				F34742E71343635000531BC2 /* WorkerScriptDebugServer.h */,
 			);
 			path = js;
 			sourceTree = "<group>";
@@ -17985,6 +18152,7 @@
 				C585A65D11D4FAB2004C3E4B /* JSIDBKeyCustom.cpp */,
 				A7D0318D0E93540300E24ACD /* JSImageDataCustom.cpp */,
 				7A0E76D410BF050700A0276E /* JSInjectedScriptHostCustom.cpp */,
+				F316396D1329487600A649CB /* JSInjectedScriptManager.cpp */,
 				7A74ECBC101839DA00BF939E /* JSInspectorFrontendHostCustom.cpp */,
 				49EECF7410508D9C00099FAB /* JSInt16ArrayCustom.cpp */,
 				49EECF7310508D9C00099FAB /* JSInt32ArrayCustom.cpp */,
@@ -18020,6 +18188,8 @@
 				49EECF7610508D9C00099FAB /* JSUint32ArrayCustom.cpp */,
 				49EECF7510508D9C00099FAB /* JSUint8ArrayCustom.cpp */,
 				49EED14C1051971A00099FAB /* JSWebGLRenderingContextCustom.cpp */,
+				319E68861327C911004AC91A /* JSWebKitAnimationCustom.cpp */,
+				3194623113022F65004BB3F8 /* JSWebKitAnimationListCustom.cpp */,
 				E1AD14C41297354900ACA989 /* JSWebKitCSSKeyframeRuleCustom.cpp */,
 				E1AD14B4129734CA00ACA989 /* JSWebKitCSSKeyframesRuleCustom.cpp */,
 				BC275B7C11C5D23500C9206C /* JSWebKitCSSMatrixCustom.cpp */,
@@ -18037,8 +18207,6 @@
 		BC8C8FAA0DDCD2F200B592F4 /* style */ = {
 			isa = PBXGroup;
 			children = (
-				5A574F26131DB96D00471B88 /* QuotesData.cpp */,
-				5A574F27131DB96D00471B88 /* QuotesData.h */,
 				BC5EB5E00E81BE8700B25965 /* BorderData.h */,
 				BC5EB5DA0E81B7EA00B25965 /* BorderValue.h */,
 				BC5EB5DE0E81B9AB00B25965 /* CollapsedBorderValue.h */,
@@ -18058,6 +18226,8 @@
 				BCEF43DF0E674110001C1287 /* NinePieceImage.cpp */,
 				BCEF43DC0E674012001C1287 /* NinePieceImage.h */,
 				BC5EB5DC0E81B8DD00B25965 /* OutlineValue.h */,
+				5A574F26131DB96D00471B88 /* QuotesData.cpp */,
+				5A574F27131DB96D00471B88 /* QuotesData.h */,
 				BC8C8FAB0DDCD31B00B592F4 /* RenderStyle.cpp */,
 				BC8C8FAC0DDCD31B00B592F4 /* RenderStyle.h */,
 				BC5EB6670E81CB7100B25965 /* RenderStyleConstants.h */,
@@ -18327,6 +18497,8 @@
 				2E4346570F546A9900B0F1BA /* CrossThreadCopier.h */,
 				E11AF15011B9A1A300805103 /* Cursor.cpp */,
 				F587868402DE3B8601EA4122 /* Cursor.h */,
+				BCC36EB61342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp */,
+				BCC36EB71342AA3F004BEEF7 /* DefaultLocalizationStrategy.h */,
 				A79546420B5C4CB4007B438F /* DragData.cpp */,
 				A7B6E69D0B291A9600D0529F /* DragData.h */,
 				A7CFB3CF0B7ED10A0070C32D /* DragImage.cpp */,
@@ -18606,6 +18778,8 @@
 				A80E6CD70A1989CA007FB8C5 /* CSSInheritedValue.h */,
 				A80E6CD80A1989CA007FB8C5 /* CSSInitialValue.cpp */,
 				A80E6CDE0A1989CA007FB8C5 /* CSSInitialValue.h */,
+				BC772E15133162C2001EC9CE /* CSSLineBoxContainValue.cpp */,
+				BC772E121331620C001EC9CE /* CSSLineBoxContainValue.h */,
 				A80E6CD20A1989CA007FB8C5 /* CSSMediaRule.cpp */,
 				A80E6CD90A1989CA007FB8C5 /* CSSMediaRule.h */,
 				85C56CA20AA89C1000D95755 /* CSSMediaRule.idl */,
@@ -18625,8 +18799,8 @@
 				A80E6CDB0A1989CA007FB8C5 /* CSSPrimitiveValue.cpp */,
 				A80E6CBC0A1989CA007FB8C5 /* CSSPrimitiveValue.h */,
 				9307059009E0C75800B17FE4 /* CSSPrimitiveValue.idl */,
-				E49BD9F9131FD2ED003C56F0 /* CSSPrimitiveValueCache.h */,
 				E49BDA0A131FD3E5003C56F0 /* CSSPrimitiveValueCache.cpp */,
+				E49BD9F9131FD2ED003C56F0 /* CSSPrimitiveValueCache.h */,
 				E1ED8AC20CC49BE000BFC557 /* CSSPrimitiveValueMappings.h */,
 				A80E6CCD0A1989CA007FB8C5 /* CSSProperty.cpp */,
 				A80E6CD50A1989CA007FB8C5 /* CSSProperty.h */,
@@ -18651,6 +18825,8 @@
 				A80E734B0A199C77007FB8C5 /* CSSSelector.h */,
 				E4C178950EE6903800824D69 /* CSSSelectorList.cpp */,
 				E4C178960EE6903800824D69 /* CSSSelectorList.h */,
+				809DD1DD130DE2AD00CAE3ED /* CSSStyleApplyProperty.cpp */,
+				809DD1DE130DE2AD00CAE3ED /* CSSStyleApplyProperty.h */,
 				A80E6E0E0A19911C007FB8C5 /* CSSStyleDeclaration.cpp */,
 				A80E6E0D0A19911C007FB8C5 /* CSSStyleDeclaration.h */,
 				142011AE0A003117008303F9 /* CSSStyleDeclaration.idl */,
@@ -18681,6 +18857,7 @@
 				A80E6CC70A1989CA007FB8C5 /* FontValue.cpp */,
 				A80E6CC30A1989CA007FB8C5 /* FontValue.h */,
 				CD4E0AFA11F7BC27009D3811 /* fullscreen.css */,
+				CDBD93BA1333BD4B002570E3 /* fullscreenQuickTime.css */,
 				93CA4C9909DF93FA00DF8677 /* html.css */,
 				93CA4C9A09DF93FA00DF8677 /* make-css-file-arrays.pl */,
 				93CA4C9B09DF93FA00DF8677 /* makeprop.pl */,
@@ -18966,8 +19143,6 @@
 			children = (
 				E1C4DE6D0EA75C650023CCD6 /* ActiveDOMObject.cpp */,
 				E1C4DE680EA75C1E0023CCD6 /* ActiveDOMObject.h */,
-				8A413ADF1207BBA50082016E /* AsyncScriptRunner.cpp */,
-				8A413ADE1207BBA50082016E /* AsyncScriptRunner.h */,
 				A8C4A7FC09D563270003AC8D /* Attr.cpp */,
 				A8C4A7FB09D563270003AC8D /* Attr.h */,
 				93EEC1E509C2877700C515D1 /* Attr.idl */,
@@ -19023,6 +19198,11 @@
 				62CD32581157E57C0063B0A7 /* CustomEvent.idl */,
 				BC64641B11D7F416006455B0 /* DatasetDOMStringMap.cpp */,
 				BC64641A11D7F416006455B0 /* DatasetDOMStringMap.h */,
+				815E6166132587AA00B622B0 /* DataTransferItem.cpp */,
+				81AC5997131636E60009A7E0 /* DataTransferItem.h */,
+				81AC5AE81316392E0009A7E0 /* DataTransferItem.idl */,
+				81AC5998131636E60009A7E0 /* DataTransferItems.h */,
+				81AC5AE91316392E0009A7E0 /* DataTransferItems.idl */,
 				A8C228A011D5722E00D5A7D3 /* DecodedDataDocumentParser.cpp */,
 				A8C2289F11D5722E00D5A7D3 /* DecodedDataDocumentParser.h */,
 				31FB1A4F120A5D0600DC02A0 /* DeviceMotionClient.h */,
@@ -19091,6 +19271,8 @@
 				14E836D209F8512000B85AE4 /* Event.idl */,
 				4138D3341244054800323D33 /* EventContext.cpp */,
 				4138D3331244054800323D33 /* EventContext.h */,
+				418A06CF133C04D500CD379C /* EventDispatcher.cpp */,
+				418A06CE133C04D500CD379C /* EventDispatcher.h */,
 				BC60D9090D2A17CE00B9918F /* EventException.h */,
 				BC60D90A0D2A17CE00B9918F /* EventException.idl */,
 				935FBC4409BA00B900E230B1 /* EventListener.h */,
@@ -19205,6 +19387,8 @@
 				08A484760E5272C500C3FE76 /* ScriptElement.h */,
 				E11C9DAF0EB3699500E409DB /* ScriptExecutionContext.cpp */,
 				E11C9D9A0EB3681200E409DB /* ScriptExecutionContext.h */,
+				8A413ADF1207BBA50082016E /* ScriptRunner.cpp */,
+				8A413ADE1207BBA50082016E /* ScriptRunner.h */,
 				084AEBE20FB505FA0038483E /* SelectElement.cpp */,
 				084AEBE30FB505FA0038483E /* SelectElement.h */,
 				BC7FA6800D1F167900DB22A9 /* SelectorNodeList.cpp */,
@@ -19215,6 +19399,9 @@
 				CEA3949B11D45CDA003094CF /* StaticHashSetNodeList.h */,
 				BC7FA62C0D1F0EFF00DB22A9 /* StaticNodeList.cpp */,
 				BC7FA62B0D1F0EFF00DB22A9 /* StaticNodeList.h */,
+				8102C5871325BB1100DDE67A /* StringCallback.cpp */,
+				81AC6C35131C57D30009A7E0 /* StringCallback.h */,
+				81AC6C34131C57C20009A7E0 /* StringCallback.idl */,
 				A8C4A7EC09D563270003AC8D /* StyledElement.cpp */,
 				A8C4A7EB09D563270003AC8D /* StyledElement.h */,
 				AA4C3A740B2B1679002334A2 /* StyleElement.cpp */,
@@ -19560,7 +19747,6 @@
 				976D6C77122B8A3D001FD1F7 /* AsyncFileWriter.h in Headers */,
 				976D6C93122B8A3D001FD1F7 /* AsyncFileWriterClient.h in Headers */,
 				B0149E7E11A4B21500196A7B /* AsyncImageResizer.h in Headers */,
-				8A413AE01207BBA50082016E /* AsyncScriptRunner.h in Headers */,
 				37C61F0112095C87007A3C67 /* AtomicStringKeyedMRUCache.h in Headers */,
 				A8C4A80D09D563270003AC8D /* Attr.h in Headers */,
 				A8C4A80B09D563270003AC8D /* Attribute.h in Headers */,
@@ -19719,6 +19905,8 @@
 				FD31602912B0267600C1A359 /* ConvolverNode.h in Headers */,
 				D8B6152F1032495100C8554A /* Cookie.h in Headers */,
 				9352088209BD45E900F2038D /* CookieJar.h in Headers */,
+				339B5B63131DAA3200F48D02 /* CookiesStrategy.h in Headers */,
+				33D0212D131DB37B004091A8 /* CookieStorage.h in Headers */,
 				7EE6846412D26E3800E79415 /* CookieStorageCFNet.h in Headers */,
 				FE6FD4880F676E5700092873 /* Coordinates.h in Headers */,
 				B8A6A6D5127B338D008673BA /* CorrectionPanelInfo.h in Headers */,
@@ -19754,6 +19942,7 @@
 				A80E6CF60A1989CA007FB8C5 /* CSSImportRule.h in Headers */,
 				A80E6D010A1989CA007FB8C5 /* CSSInheritedValue.h in Headers */,
 				A80E6D080A1989CA007FB8C5 /* CSSInitialValue.h in Headers */,
+				BC772E131331620C001EC9CE /* CSSLineBoxContainValue.h in Headers */,
 				A8C4A80909D563270003AC8D /* CSSMappedAttributeDeclaration.h in Headers */,
 				A80E6D030A1989CA007FB8C5 /* CSSMediaRule.h in Headers */,
 				A80E6DFC0A199067007FB8C5 /* CSSMutableStyleDeclaration.h in Headers */,
@@ -19765,6 +19954,7 @@
 				BC02A4B70E0997B9004B6D2B /* CSSParserValues.h in Headers */,
 				977B3863122883E900B81FF8 /* CSSPreloadScanner.h in Headers */,
 				A80E6CE60A1989CA007FB8C5 /* CSSPrimitiveValue.h in Headers */,
+				E49BD9FA131FD2ED003C56F0 /* CSSPrimitiveValueCache.h in Headers */,
 				E1ED8AC30CC49BE000BFC557 /* CSSPrimitiveValueMappings.h in Headers */,
 				A80E6CFF0A1989CA007FB8C5 /* CSSProperty.h in Headers */,
 				0F6ECD450F252F3700BDE271 /* CSSPropertyLonghand.h in Headers */,
@@ -19778,6 +19968,7 @@
 				371F51A10D262FA000ECE0D5 /* CSSSegmentedFontFace.h in Headers */,
 				A80E73520A199C77007FB8C5 /* CSSSelector.h in Headers */,
 				E4C1789B0EE6903800824D69 /* CSSSelectorList.h in Headers */,
+				809DD1E0130DE2AD00CAE3ED /* CSSStyleApplyProperty.h in Headers */,
 				A80E6E0F0A19911C007FB8C5 /* CSSStyleDeclaration.h in Headers */,
 				A80E6D0C0A1989CA007FB8C5 /* CSSStyleRule.h in Headers */,
 				BC772B400C4EA91E0083285F /* CSSStyleSelector.h in Headers */,
@@ -19808,6 +19999,8 @@
 				BCBCAE370FF19385000762AE /* DataGridDataSource.h in Headers */,
 				BC22746F0E83664500E7F975 /* DataRef.h in Headers */,
 				BC64641C11D7F416006455B0 /* DatasetDOMStringMap.h in Headers */,
+				81AC5999131636E60009A7E0 /* DataTransferItem.h in Headers */,
+				81AC599A131636E60009A7E0 /* DataTransferItems.h in Headers */,
 				2E97CCEB12939CB800C5C8FF /* DataView.h in Headers */,
 				F5D3A57D106B83B300545297 /* DateComponents.h in Headers */,
 				F55B3DB61251F12D003EF269 /* DateInputType.h in Headers */,
@@ -20090,6 +20283,7 @@
 				85E711D20AC5D5350053270F /* DOMNamedNodeMapInternal.h in Headers */,
 				853BF4DB0ABB6B55008647BB /* DOMNode.h in Headers */,
 				854075260AD6C66700620C57 /* DOMNodeFilter.h in Headers */,
+				4F1442291339FD6200E0D6F8 /* DOMNodeHighlighter.h in Headers */,
 				85B498FB0ADB340200925CBB /* DOMNodeInternal.h in Headers */,
 				85526C370AB0A17E000302EA /* DOMNodeIterator.h in Headers */,
 				850B41C20AD9E7E700A6ED4F /* DOMNodeIteratorInternal.h in Headers */,
@@ -20589,8 +20783,10 @@
 				2E37DFDB12DBAFB800A6B233 /* DOMURL.h in Headers */,
 				15C770A6100D41CD005BA267 /* DOMValidityState.h in Headers */,
 				BC1A37C0097C715F0019F3D8 /* DOMViews.h in Headers */,
+				3194616A13020B66004BB3F8 /* DOMWebKitAnimation.h in Headers */,
 				31C0FF490E4CEFDD007D6FE5 /* DOMWebKitAnimationEvent.h in Headers */,
 				31C0FF4B0E4CEFDD007D6FE5 /* DOMWebKitAnimationEventInternal.h in Headers */,
+				3194620413022BF1004BB3F8 /* DOMWebKitAnimationList.h in Headers */,
 				316FE07D0E6CCC2800BF6088 /* DOMWebKitCSSKeyframeRule.h in Headers */,
 				316FE07F0E6CCC2800BF6088 /* DOMWebKitCSSKeyframeRuleInternal.h in Headers */,
 				316FE0800E6CCC2800BF6088 /* DOMWebKitCSSKeyframesRule.h in Headers */,
@@ -20651,6 +20847,7 @@
 				2ECF7AE210162B5800427DE7 /* ErrorEvent.h in Headers */,
 				85031B420A44EFC700F992E0 /* Event.h in Headers */,
 				4138D3351244054800323D33 /* EventContext.h in Headers */,
+				418A06D0133C04D500CD379C /* EventDispatcher.h in Headers */,
 				BC60D90C0D2A17CE00B9918F /* EventException.h in Headers */,
 				93C09A530B064DB3005ABD4D /* EventHandler.h in Headers */,
 				935FBC4509BA00B900E230B1 /* EventListener.h in Headers */,
@@ -20928,6 +21125,7 @@
 				375CD232119D43C800A2A859 /* Hyphenation.h in Headers */,
 				B275356E0B053814002CE64F /* Icon.h in Headers */,
 				5126E6BC0A2E3B12005C29FA /* IconDatabase.h in Headers */,
+				516953981329A3C800B92D04 /* IconDatabaseBase.h in Headers */,
 				51E1ECBE0C91C90400DC255B /* IconDatabaseClient.h in Headers */,
 				513F14540AB634C400094DDF /* IconLoader.h in Headers */,
 				51E1ECC10C91C90400DC255B /* IconRecord.h in Headers */,
@@ -20975,6 +21173,7 @@
 				DB23C2CC0A508D29002489EB /* IndentOutdentCommand.h in Headers */,
 				F3644B001119805900E0D537 /* InjectedScript.h in Headers */,
 				7A0E76FA10BF08ED00A0276E /* InjectedScriptHost.h in Headers */,
+				F316396C1329481A00A649CB /* InjectedScriptManager.h in Headers */,
 				A8CFF5E50A155A05000A4234 /* InlineBox.h in Headers */,
 				A8CFF5E30A155A05000A4234 /* InlineFlowBox.h in Headers */,
 				BCE789161120D6080060ECE5 /* InlineIterator.h in Headers */,
@@ -21007,6 +21206,7 @@
 				F344C75311294D9D00F26EEE /* InspectorFrontendClientLocal.h in Headers */,
 				7A0E770F10C00A8800A0276E /* InspectorFrontendHost.h in Headers */,
 				20D629271253690B00081543 /* InspectorInstrumentation.h in Headers */,
+				4F6FDD651341DEDD001F8EE3 /* InspectorPageAgent.h in Headers */,
 				9F0D6B2F121BFEBA006C0288 /* InspectorProfilerAgent.h in Headers */,
 				82AB1776125C826700C5069D /* InspectorResourceAgent.h in Headers */,
 				7AF11A5A12E727490061F23C /* InspectorRuntimeAgent.h in Headers */,
@@ -21027,15 +21227,21 @@
 				B27535750B053814002CE64F /* IntSize.h in Headers */,
 				B27535760B053814002CE64F /* IntSizeHash.h in Headers */,
 				F55B3DC41251F12D003EF269 /* IsIndexInputType.h in Headers */,
+				598D77DF132541FA00761B22 /* JavaArrayJSC.h in Headers */,
 				59E560A71105336600AA1258 /* JavaClassJSC.h in Headers */,
+				598D77E31325420E00761B22 /* JavaFieldJSC.h in Headers */,
 				59A9E7B21104759400DFB4C1 /* JavaInstanceJSC.h in Headers */,
+				593D3EAF1325328C0057E7EE /* JavaMethod.h in Headers */,
 				E16982681134680700894115 /* JavaRuntimeObject.h in Headers */,
 				FD31603612B0267600C1A359 /* JavaScriptAudioNode.h in Headers */,
 				1C81BA0A0E97348300266E07 /* JavaScriptCallFrame.h in Headers */,
+				593D3EB1132532950057E7EE /* JavaString.h in Headers */,
 				59BC393F11054A1300FD85DB /* JavaStringJSC.h in Headers */,
+				59B0EEA7132A6F2A004331C7 /* JavaType.h in Headers */,
 				1A569D040D7E2B82007C3983 /* jni_jsobject.h in Headers */,
 				59EE12321106082900885116 /* JNIUtility.h in Headers */,
 				59EE122E1106080F00885116 /* JNIUtilityPrivate.h in Headers */,
+				596950821321059900C3ED18 /* JobjectWrapper.h in Headers */,
 				93309DF4099E64920056E581 /* JoinTextNodesCommand.h in Headers */,
 				418F88050FF957AF0080F045 /* JSAbstractWorker.h in Headers */,
 				49EECF01105070C400099FAB /* JSArrayBuffer.h in Headers */,
@@ -21502,7 +21708,9 @@
 				49C7B9A51042D2D30009D447 /* JSWebGLTexture.h in Headers */,
 				0C45342810CDBBFA00869157 /* JSWebGLUniformLocation.h in Headers */,
 				77EF62F412F9DB7400C77BD2 /* JSWebGLVertexArrayObjectOES.h in Headers */,
+				3194616313020B20004BB3F8 /* JSWebKitAnimation.h in Headers */,
 				31C0FF3E0E4CEFAC007D6FE5 /* JSWebKitAnimationEvent.h in Headers */,
+				319461FF13022BB8004BB3F8 /* JSWebKitAnimationList.h in Headers */,
 				316FE0720E6CCBEE00BF6088 /* JSWebKitCSSKeyframeRule.h in Headers */,
 				316FE0740E6CCBEE00BF6088 /* JSWebKitCSSKeyframesRule.h in Headers */,
 				498391400F1E767500C23782 /* JSWebKitCSSMatrix.h in Headers */,
@@ -21585,6 +21793,8 @@
 				4E1959220A39DABA00220FE5 /* MediaFeatureNames.h in Headers */,
 				A8EA800E0A19516E00A8EF5F /* MediaList.h in Headers */,
 				E44613E40CD681A200FADA75 /* MediaPlayer.h in Headers */,
+				076F0D0E12B8192700C26AA4 /* MediaPlayerPrivateAVFoundation.h in Headers */,
+				076F0D0F12B8192700C26AA4 /* MediaPlayerPrivateAVFoundationObjC.h in Headers */,
 				E44613E60CD681A900FADA75 /* MediaPlayerPrivateQTKit.h in Headers */,
 				0735EE6A0F40C5E4004A2604 /* MediaPlayerProxy.h in Headers */,
 				4E19592A0A39DACC00220FE5 /* MediaQuery.h in Headers */,
@@ -21739,6 +21949,7 @@
 				E4D687790ED7AE4F006EA978 /* PurgeableBuffer.h in Headers */,
 				7E33CD01127F340D00BE8F17 /* PurgePriority.h in Headers */,
 				550A0BCA085F6039007353D6 /* QualifiedName.h in Headers */,
+				5A574F29131DB96D00471B88 /* QuotesData.h in Headers */,
 				B22279720D00BF220071B782 /* RadialGradientAttributes.h in Headers */,
 				F55B3DCC1251F12D003EF269 /* RadioInputType.h in Headers */,
 				93F1991808245E59001E9ABC /* Range.h in Headers */,
@@ -21810,6 +22021,7 @@
 				BCFA930810333193007B25D1 /* RenderOverflow.h in Headers */,
 				A871DED70A1530C700B12A68 /* RenderPart.h in Headers */,
 				A43BF59D1149292800C643CA /* RenderProgress.h in Headers */,
+				5A574F25131DB93900471B88 /* RenderQuote.h in Headers */,
 				A871DFE30A15376B00B12A68 /* RenderReplaced.h in Headers */,
 				BCA846D70DC67A350026C309 /* RenderReplica.h in Headers */,
 				1479FAEE109AE37500DED655 /* RenderRuby.h in Headers */,
@@ -21933,6 +22145,7 @@
 				9F72304F11184B4100AD0126 /* ScriptProfile.h in Headers */,
 				9FA37EE41172FC8000C4CD55 /* ScriptProfileNode.h in Headers */,
 				9F72305111184B4100AD0126 /* ScriptProfiler.h in Headers */,
+				8A413AE01207BBA50082016E /* ScriptRunner.h in Headers */,
 				934CC10A0EDB223900A658F2 /* ScriptSourceCode.h in Headers */,
 				CE54FD381016D9A6008B44C8 /* ScriptSourceProvider.h in Headers */,
 				41C760B10EDE03D300C1655F /* ScriptState.h in Headers */,
@@ -22007,6 +22220,7 @@
 				93309E14099E64920056E581 /* SplitTextNodeCommand.h in Headers */,
 				93309E16099E64920056E581 /* SplitTextNodeContainingElementCommand.h in Headers */,
 				84730D931248F0B300D3A9C9 /* SpotLightSource.h in Headers */,
+				245D80A313280E40003492A6 /* SQLCallbackWrapper.h in Headers */,
 				51EC92590CE90DB400F90308 /* SQLError.h in Headers */,
 				B56EBA8511C9FF8100B04477 /* SQLException.h in Headers */,
 				1A22464A0CC98DDB00C05240 /* SQLiteDatabase.h in Headers */,
@@ -22040,6 +22254,9 @@
 				C50D0E830FF4272900AC2644 /* StorageNamespace.h in Headers */,
 				C55E38BF10040D5D00A56BDB /* StorageNamespaceImpl.h in Headers */,
 				C5102D940FD9AA2D00FAFF04 /* StorageSyncManager.h in Headers */,
+				3AB02D2A12D4F91600FBB694 /* StorageTracker.h in Headers */,
+				3AC3680012EF7A09006A3D6F /* StorageTrackerClient.h in Headers */,
+				81AC6C36131C57D30009A7E0 /* StringCallback.h in Headers */,
 				65488D6B0DD5A83D009D83B2 /* StringSourceProvider.h in Headers */,
 				B23540F30D00782E002382FA /* StringTruncator.h in Headers */,
 				849F77760EFEC6200090849D /* StrokeStyleApplier.h in Headers */,
@@ -22299,6 +22516,7 @@
 				B2C3DA360D006C1D00EF6F26 /* TextBreakIterator.h in Headers */,
 				B2C3DA380D006C1D00EF6F26 /* TextBreakIteratorInternalICU.h in Headers */,
 				A7151BD812F1558F005A0F64 /* TextCheckerClient.h in Headers */,
+				A77D0012133B0AEB00D6658C /* TextChecking.h in Headers */,
 				A7DBF8DE1276919C006B6008 /* TextCheckingHelper.h in Headers */,
 				B2C3DA3A0D006C1D00EF6F26 /* TextCodec.h in Headers */,
 				26E98A10130A9FCA008EB7B2 /* TextCodecASCIIFastPath.h in Headers */,
@@ -22322,6 +22540,7 @@
 				F55B3DDA1251F12D003EF269 /* TextInputType.h in Headers */,
 				93309E1C099E64920056E581 /* TextIterator.h in Headers */,
 				BCEF45E90E687767001C1287 /* TextMetrics.h in Headers */,
+				BCD3F9831326C93700098A60 /* TextOrientation.h in Headers */,
 				930FC68A1072B9280045293E /* TextRenderingMode.h in Headers */,
 				93F198F608245E59001E9ABC /* TextResourceDecoder.h in Headers */,
 				A824B4650E2EF2EA0081A7B7 /* TextRun.h in Headers */,
@@ -22391,7 +22610,6 @@
 				93F199A808245E59001E9ABC /* WebCoreFrameView.h in Headers */,
 				BC53D911114310CC000D817E /* WebCoreJSClientData.h in Headers */,
 				93F199BB08245E59001E9ABC /* WebCoreKeyboardUIMode.h in Headers */,
-				93F199C208245E59001E9ABC /* WebCoreKeyGenerator.h in Headers */,
 				934D9BA70B8C1175007B42A9 /* WebCoreNSStringExtras.h in Headers */,
 				DD05FE0D0B8BA3C6009ACDFE /* WebCoreObjCExtras.h in Headers */,
 				EDEC98030AED7E170059137F /* WebCorePrefix.h in Headers */,
@@ -22416,7 +22634,9 @@
 				49C7B9E61042D32F0009D447 /* WebGLTexture.h in Headers */,
 				0C3F1F5B10C8871200D72CE1 /* WebGLUniformLocation.h in Headers */,
 				77A17A7812F28642004E02F6 /* WebGLVertexArrayObjectOES.h in Headers */,
+				319E69B313299BBD004AC91A /* WebKitAnimation.h in Headers */,
 				31C0FF220E4CEB6E007D6FE5 /* WebKitAnimationEvent.h in Headers */,
+				319E69B613299BBD004AC91A /* WebKitAnimationList.h in Headers */,
 				31288E730E3005D6003619AE /* WebKitCSSKeyframeRule.h in Headers */,
 				31288E750E3005D6003619AE /* WebKitCSSKeyframesRule.h in Headers */,
 				498391590F1E776900C23782 /* WebKitCSSMatrix.h in Headers */,
@@ -22534,16 +22754,12 @@
 				93F199ED08245E59001E9ABC /* XSLTProcessor.h in Headers */,
 				E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */,
 				977E2E0F12F0FC9C00C13379 /* XSSFilter.h in Headers */,
-				E49BD9FA131FD2ED003C56F0 /* CSSPrimitiveValueCache.h in Headers */,
-				5A574F25131DB93900471B88 /* RenderQuote.h in Headers */,
-				5A574F29131DB96D00471B88 /* QuotesData.h in Headers */,
-				339B5B63131DAA3200F48D02 /* CookiesStrategy.h in Headers */,
-				33D0212D131DB37B004091A8 /* CookieStorage.h in Headers */,
-				596950821321059900C3ED18 /* JobjectWrapper.h in Headers */,
-				593D3EAF1325328C0057E7EE /* JavaMethod.h in Headers */,
-				593D3EB1132532950057E7EE /* JavaString.h in Headers */,
-				598D77DF132541FA00761B22 /* JavaArrayJSC.h in Headers */,
-				598D77E31325420E00761B22 /* JavaFieldJSC.h in Headers */,
+				BCC36EB91342AA3F004BEEF7 /* DefaultLocalizationStrategy.h in Headers */,
+				599C671E1343439400C3423C /* JavaMethodJobject.h in Headers */,
+				F34742DD134362F000531BC2 /* PageDebuggerAgent.h in Headers */,
+				F34742E11343631F00531BC2 /* WorkerDebuggerAgent.h in Headers */,
+				F34742E51343633C00531BC2 /* PageScriptDebugServer.h in Headers */,
+				F34742E91343635000531BC2 /* WorkerScriptDebugServer.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -22876,7 +23092,6 @@
 				49EECDDF10503C2400099FAB /* ArrayBufferView.cpp in Sources */,
 				89D08D9F12228451001241DF /* AsyncFileSystem.cpp in Sources */,
 				B0149E7D11A4B21500196A7B /* AsyncImageResizer.cpp in Sources */,
-				8A413AE11207BBA50082016E /* AsyncScriptRunner.cpp in Sources */,
 				A8C4A80E09D563270003AC8D /* Attr.cpp in Sources */,
 				A8C4A80C09D563270003AC8D /* Attribute.cpp in Sources */,
 				FD315FF612B0267600C1A359 /* AudioBasicProcessorNode.cpp in Sources */,
@@ -23037,6 +23252,7 @@
 				A80E6CEB0A1989CA007FB8C5 /* CSSImportRule.cpp in Sources */,
 				A80E6CF00A1989CA007FB8C5 /* CSSInheritedValue.cpp in Sources */,
 				A80E6D020A1989CA007FB8C5 /* CSSInitialValue.cpp in Sources */,
+				BC772E16133162C2001EC9CE /* CSSLineBoxContainValue.cpp in Sources */,
 				A8C4A80A09D563270003AC8D /* CSSMappedAttributeDeclaration.cpp in Sources */,
 				A80E6CFC0A1989CA007FB8C5 /* CSSMediaRule.cpp in Sources */,
 				A80E6DFB0A199067007FB8C5 /* CSSMutableStyleDeclaration.cpp in Sources */,
@@ -23046,6 +23262,7 @@
 				BC02A5400E099C5A004B6D2B /* CSSParserValues.cpp in Sources */,
 				977B3862122883E900B81FF8 /* CSSPreloadScanner.cpp in Sources */,
 				A80E6D050A1989CA007FB8C5 /* CSSPrimitiveValue.cpp in Sources */,
+				E49BDA0B131FD3E5003C56F0 /* CSSPrimitiveValueCache.cpp in Sources */,
 				A80E6CF70A1989CA007FB8C5 /* CSSProperty.cpp in Sources */,
 				0F6ECD460F252F3700BDE271 /* CSSPropertyLonghand.cpp in Sources */,
 				1ABA76CA11D20E50004C201C /* CSSPropertyNames.cpp in Sources */,
@@ -23056,6 +23273,7 @@
 				371F51A20D262FA000ECE0D5 /* CSSSegmentedFontFace.cpp in Sources */,
 				A80E734F0A199C77007FB8C5 /* CSSSelector.cpp in Sources */,
 				E4C1789A0EE6903800824D69 /* CSSSelectorList.cpp in Sources */,
+				809DD1DF130DE2AD00CAE3ED /* CSSStyleApplyProperty.cpp in Sources */,
 				A80E6E100A19911C007FB8C5 /* CSSStyleDeclaration.cpp in Sources */,
 				A80E6CEF0A1989CA007FB8C5 /* CSSStyleRule.cpp in Sources */,
 				BC772B3F0C4EA91E0083285F /* CSSStyleSelector.cpp in Sources */,
@@ -23076,6 +23294,7 @@
 				BC77D2390FF298080070887B /* DataGridColumn.cpp in Sources */,
 				BC77D1FD0FF28D9B0070887B /* DataGridColumnList.cpp in Sources */,
 				BC64641D11D7F416006455B0 /* DatasetDOMStringMap.cpp in Sources */,
+				815E6167132587AA00B622B0 /* DataTransferItem.cpp in Sources */,
 				2E97CCEA12939CB800C5C8FF /* DataView.cpp in Sources */,
 				F5D3A57C106B83B300545297 /* DateComponents.cpp in Sources */,
 				F55B3DB51251F12D003EF269 /* DateInputType.cpp in Sources */,
@@ -23239,6 +23458,7 @@
 				85C7F5C00AAFB7CD004014DD /* DOMMutationEvent.mm in Sources */,
 				8518DD790A9CF31B0091B7A6 /* DOMNamedNodeMap.mm in Sources */,
 				853BF4DC0ABB6B55008647BB /* DOMNode.mm in Sources */,
+				4F1442281339FD6200E0D6F8 /* DOMNodeHighlighter.cpp in Sources */,
 				85526C380AB0A17E000302EA /* DOMNodeIterator.mm in Sources */,
 				85ACAA8E0A9B759C00671E90 /* DOMNodeList.mm in Sources */,
 				85CA96EB0A9624E900690CCF /* DOMNotation.mm in Sources */,
@@ -23405,7 +23625,9 @@
 				2E37DFDA12DBAFB800A6B233 /* DOMURL.cpp in Sources */,
 				BC1A37BF097C715F0019F3D8 /* DOMUtility.mm in Sources */,
 				15C770A5100D41CD005BA267 /* DOMValidityState.mm in Sources */,
+				3194616B13020B66004BB3F8 /* DOMWebKitAnimation.mm in Sources */,
 				31C0FF4A0E4CEFDD007D6FE5 /* DOMWebKitAnimationEvent.mm in Sources */,
+				3194620513022BF1004BB3F8 /* DOMWebKitAnimationList.mm in Sources */,
 				316FE07E0E6CCC2800BF6088 /* DOMWebKitCSSKeyframeRule.mm in Sources */,
 				316FE0810E6CCC2800BF6088 /* DOMWebKitCSSKeyframesRule.mm in Sources */,
 				498391510F1E76B400C23782 /* DOMWebKitCSSMatrix.mm in Sources */,
@@ -23445,6 +23667,7 @@
 				2ECF7AE110162B5800427DE7 /* ErrorEvent.cpp in Sources */,
 				85031B410A44EFC700F992E0 /* Event.cpp in Sources */,
 				4138D3361244054800323D33 /* EventContext.cpp in Sources */,
+				418A06D1133C04D500CD379C /* EventDispatcher.cpp in Sources */,
 				93C09A810B064F00005ABD4D /* EventHandler.cpp in Sources */,
 				93C09A7F0B064EEF005ABD4D /* EventHandlerMac.mm in Sources */,
 				1CA19E050DC255950065A994 /* EventLoopMac.mm in Sources */,
@@ -23524,6 +23747,7 @@
 				A80E6CEC0A1989CA007FB8C5 /* FontFamilyValue.cpp in Sources */,
 				72626E020EF022FE00A07E20 /* FontFastPath.cpp in Sources */,
 				B2AFFC800D00A5C10030074D /* FontMac.mm in Sources */,
+				84B62685133138F90095A489 /* FontPlatformData.cpp in Sources */,
 				B5320D6C122A24E9002D1440 /* FontPlatformDataCocoa.mm in Sources */,
 				B734B181119B9911006587BD /* FontTranscoder.cpp in Sources */,
 				A80E6CF10A1989CA007FB8C5 /* FontValue.cpp in Sources */,
@@ -23593,6 +23817,7 @@
 				93F19AFD08245E59001E9ABC /* HTMLCanvasElement.cpp in Sources */,
 				A8DF3FD1097FA0FC0052981B /* HTMLCollection.cpp in Sources */,
 				977B3864122883E900B81FF8 /* HTMLConstructionSite.cpp in Sources */,
+				5D4F51DF132725480016F541 /* HTMLConverter.mm in Sources */,
 				BC77CDB80FEFF1210070887B /* HTMLDataGridCellElement.cpp in Sources */,
 				BC77CBAA0FEBF6C90070887B /* HTMLDataGridColElement.cpp in Sources */,
 				BCF524600FEBEE5D0095BF26 /* HTMLDataGridElement.cpp in Sources */,
@@ -23693,7 +23918,7 @@
 				371A67CB11C6C7DB00047B8B /* HyphenationCF.cpp in Sources */,
 				375CD23B119D44EA00A2A859 /* HyphenationMac.mm in Sources */,
 				5126E6BB0A2E3B12005C29FA /* IconDatabase.cpp in Sources */,
-				445C8DB710015FC90031531A /* IconDatabaseNone.cpp in Sources */,
+				516953971329A3C800B92D04 /* IconDatabaseBase.cpp in Sources */,
 				513F14530AB634C400094DDF /* IconLoader.cpp in Sources */,
 				B275358E0B053A66002CE64F /* IconMac.mm in Sources */,
 				51E1ECC00C91C90400DC255B /* IconRecord.cpp in Sources */,
@@ -23730,6 +23955,7 @@
 				DB23C2CB0A508D29002489EB /* IndentOutdentCommand.cpp in Sources */,
 				F3644AFF1119805900E0D537 /* InjectedScript.cpp in Sources */,
 				7A0E76F910BF08ED00A0276E /* InjectedScriptHost.cpp in Sources */,
+				F316396B1329481A00A649CB /* InjectedScriptManager.cpp in Sources */,
 				A8CFF5E60A155A05000A4234 /* InlineBox.cpp in Sources */,
 				A8CFF5E40A155A05000A4234 /* InlineFlowBox.cpp in Sources */,
 				BCEA4859097D93020094C9E4 /* InlineTextBox.cpp in Sources */,
@@ -23759,6 +23985,7 @@
 				F344C75811294FF600F26EEE /* InspectorFrontendClientLocal.cpp in Sources */,
 				7A0E770E10C00A8800A0276E /* InspectorFrontendHost.cpp in Sources */,
 				20D629261253690B00081543 /* InspectorInstrumentation.cpp in Sources */,
+				4F6FDD641341DEDD001F8EE3 /* InspectorPageAgent.cpp in Sources */,
 				9F0D6B2E121BFEBA006C0288 /* InspectorProfilerAgent.cpp in Sources */,
 				82AB1775125C826700C5069D /* InspectorResourceAgent.cpp in Sources */,
 				7AA365EE12E7265400DCA242 /* InspectorRuntimeAgent.cpp in Sources */,
@@ -23777,7 +24004,9 @@
 				B27535620B053814002CE64F /* IntSizeCG.cpp in Sources */,
 				B275357E0B053814002CE64F /* IntSizeMac.mm in Sources */,
 				F55B3DC31251F12D003EF269 /* IsIndexInputType.cpp in Sources */,
+				598D77DD132541EE00761B22 /* JavaArrayJSC.cpp in Sources */,
 				59E560A91105336F00AA1258 /* JavaClassJSC.cpp in Sources */,
+				598D77E11325420400761B22 /* JavaFieldJSC.cpp in Sources */,
 				59A9E7B01104758800DFB4C1 /* JavaInstanceJSC.cpp in Sources */,
 				E1698264113467F300894115 /* JavaRuntimeObject.cpp in Sources */,
 				FD31603512B0267600C1A359 /* JavaScriptAudioNode.cpp in Sources */,
@@ -23786,6 +24015,7 @@
 				1A569D050D7E2B82007C3983 /* jni_objc.mm in Sources */,
 				59EE12301106081F00885116 /* JNIUtility.cpp in Sources */,
 				59EE122C1106080500885116 /* JNIUtilityPrivate.cpp in Sources */,
+				59695084132105A500C3ED18 /* JobjectWrapper.cpp in Sources */,
 				93309DF3099E64920056E581 /* JoinTextNodesCommand.cpp in Sources */,
 				418F88040FF957AE0080F045 /* JSAbstractWorker.cpp in Sources */,
 				49EECF00105070C400099FAB /* JSArrayBuffer.cpp in Sources */,
@@ -24085,6 +24315,7 @@
 				A7D0318E0E93540300E24ACD /* JSImageDataCustom.cpp in Sources */,
 				7A0E76DA10BF059800A0276E /* JSInjectedScriptHost.cpp in Sources */,
 				7A0E76D510BF050700A0276E /* JSInjectedScriptHostCustom.cpp in Sources */,
+				F316396E1329487600A649CB /* JSInjectedScriptManager.cpp in Sources */,
 				7A0E771E10C00DB100A0276E /* JSInspectorFrontendHost.cpp in Sources */,
 				7A74ECBD101839DA00BF939E /* JSInspectorFrontendHostCustom.cpp in Sources */,
 				49EECF06105070C400099FAB /* JSInt16Array.cpp in Sources */,
@@ -24352,7 +24583,11 @@
 				49C7B9A41042D2D30009D447 /* JSWebGLTexture.cpp in Sources */,
 				0C45342710CDBBFA00869157 /* JSWebGLUniformLocation.cpp in Sources */,
 				77EF62F312F9DB7400C77BD2 /* JSWebGLVertexArrayObjectOES.cpp in Sources */,
+				3194616213020B20004BB3F8 /* JSWebKitAnimation.cpp in Sources */,
+				319E68871327C911004AC91A /* JSWebKitAnimationCustom.cpp in Sources */,
 				31C0FF3D0E4CEFAC007D6FE5 /* JSWebKitAnimationEvent.cpp in Sources */,
+				319461FE13022BB8004BB3F8 /* JSWebKitAnimationList.cpp in Sources */,
+				3194623213022F65004BB3F8 /* JSWebKitAnimationListCustom.cpp in Sources */,
 				316FE0710E6CCBEE00BF6088 /* JSWebKitCSSKeyframeRule.cpp in Sources */,
 				E1AD14C51297354900ACA989 /* JSWebKitCSSKeyframeRuleCustom.cpp in Sources */,
 				316FE0730E6CCBEE00BF6088 /* JSWebKitCSSKeyframesRule.cpp in Sources */,
@@ -24442,6 +24677,8 @@
 				4E1959210A39DABA00220FE5 /* MediaFeatureNames.cpp in Sources */,
 				A8EA80090A19516E00A8EF5F /* MediaList.cpp in Sources */,
 				E44613E30CD6819F00FADA75 /* MediaPlayer.cpp in Sources */,
+				072C8B11131C518600A4FCE9 /* MediaPlayerPrivateAVFoundation.cpp in Sources */,
+				072C8B12131C518B00A4FCE9 /* MediaPlayerPrivateAVFoundationObjC.mm in Sources */,
 				E44613E50CD681A600FADA75 /* MediaPlayerPrivateQTKit.mm in Sources */,
 				4E1959290A39DACC00220FE5 /* MediaQuery.cpp in Sources */,
 				4E19592B0A39DACC00220FE5 /* MediaQueryEvaluator.cpp in Sources */,
@@ -24554,6 +24791,7 @@
 				1AF8E1C3125673E000230FF7 /* ProxyServerCFNet.cpp in Sources */,
 				E4D687770ED7AE3D006EA978 /* PurgeableBufferMac.cpp in Sources */,
 				550A0BC9085F6039007353D6 /* QualifiedName.cpp in Sources */,
+				5A574F28131DB96D00471B88 /* QuotesData.cpp in Sources */,
 				F55B3DCB1251F12D003EF269 /* RadioInputType.cpp in Sources */,
 				93F19AB908245E59001E9ABC /* Range.cpp in Sources */,
 				F55B3DCD1251F12D003EF269 /* RangeInputType.cpp in Sources */,
@@ -24620,6 +24858,7 @@
 				BC60EFB70F33A0E700812A93 /* RenderObjectChildList.cpp in Sources */,
 				A871DED00A1530C700B12A68 /* RenderPart.cpp in Sources */,
 				A43BF59C1149292800C643CA /* RenderProgress.cpp in Sources */,
+				5A574F24131DB93900471B88 /* RenderQuote.cpp in Sources */,
 				A871DFE20A15376B00B12A68 /* RenderReplaced.cpp in Sources */,
 				BCA846D60DC67A350026C309 /* RenderReplica.cpp in Sources */,
 				1479FAED109AE37500DED655 /* RenderRuby.cpp in Sources */,
@@ -24633,7 +24872,6 @@
 				BC8C8FAD0DDCD31B00B592F4 /* RenderStyle.cpp in Sources */,
 				D302754D12A5FEAB004BD828 /* RenderSummary.cpp in Sources */,
 				0F4E57171313276200CF85AF /* RenderSVGAllInOne.cpp in Sources */,
-				ADDF1AD61257CD9A0003A759 /* RenderSVGPath.cpp in Sources */,
 				A8DF4AEC0980C42C0052981B /* RenderTable.cpp in Sources */,
 				A8DF4AEA0980C42C0052981B /* RenderTableCell.cpp in Sources */,
 				A8DF4AE80980C42C0052981B /* RenderTableCol.cpp in Sources */,
@@ -24712,6 +24950,7 @@
 				41F066E50F64BCF600A07EAC /* ScriptObject.cpp in Sources */,
 				F33F0282120947F200E5743A /* ScriptProfile.cpp in Sources */,
 				9F72305011184B4100AD0126 /* ScriptProfiler.cpp in Sources */,
+				8A413AE11207BBA50082016E /* ScriptRunner.cpp in Sources */,
 				4127D5370F8AAB1D00E424F5 /* ScriptState.cpp in Sources */,
 				934CC0E10ED39D6F00A658F2 /* ScriptValue.cpp in Sources */,
 				BC8AE34E12EA096A00EB3AE6 /* ScrollableArea.cpp in Sources */,
@@ -24796,7 +25035,7 @@
 				B5C1123B102B6C4600096578 /* SQLTransactionCoordinator.cpp in Sources */,
 				B523CF091182675400EBB29C /* SQLTransactionSync.cpp in Sources */,
 				1A2E6E590CC55213004A2062 /* SQLValue.cpp in Sources */,
-				93F19AE608245E59001E9ABC /* SSLKeyGeneratorMac.mm in Sources */,
+				93F19AE608245E59001E9ABC /* SSLKeyGeneratorMac.cpp in Sources */,
 				CEA3949C11D45CDA003094CF /* StaticHashSetNodeList.cpp in Sources */,
 				BC7FA62E0D1F0EFF00DB22A9 /* StaticNodeList.cpp in Sources */,
 				A5AFB34F115151A700B045CB /* StepRange.cpp in Sources */,
@@ -24809,7 +25048,9 @@
 				C50D0E820FF4272900AC2644 /* StorageNamespace.cpp in Sources */,
 				C55E38C010040D5D00A56BDB /* StorageNamespaceImpl.cpp in Sources */,
 				C5102D950FD9AA2D00FAFF04 /* StorageSyncManager.cpp in Sources */,
+				3AB02D2B12D4F91600FBB694 /* StorageTracker.cpp in Sources */,
 				B2C3DA300D006C1D00EF6F26 /* String.cpp in Sources */,
+				8102C5881325BB1100DDE67A /* StringCallback.cpp in Sources */,
 				B2B2645C0D00A77E000ACC1D /* StringCF.cpp in Sources */,
 				B2B2645D0D00A77E000ACC1D /* StringImplCF.cpp in Sources */,
 				B2AFFC950D00A5DF0030074D /* StringImplMac.mm in Sources */,
@@ -24838,6 +25079,7 @@
 				D000ED2711C1B9CD00C47726 /* SubframeLoader.cpp in Sources */,
 				F55B3DD31251F12D003EF269 /* SubmitInputType.cpp in Sources */,
 				93E227E40AF589AD00D48324 /* SubresourceLoader.cpp in Sources */,
+				7E37EF2E1339208800B29250 /* SubresourceLoaderCF.cpp in Sources */,
 				93B2D8180F9920EE006AE6B2 /* SuddenTermination.mm in Sources */,
 				62C1217C11AB9E77003C462C /* SuspendableTimer.cpp in Sources */,
 				B22279730D00BF220071B782 /* SVGAElement.cpp in Sources */,
@@ -25058,7 +25300,6 @@
 				93309E1D099E64920056E581 /* visible_units.cpp in Sources */,
 				93309E1F099E64920056E581 /* VisiblePosition.cpp in Sources */,
 				A883DF270F3D045D00F19BF6 /* VisibleSelection.cpp in Sources */,
-				93F19AE508245E59001E9ABC /* WebCoreKeyGenerator.m in Sources */,
 				934D9BA50B8C116B007B42A9 /* WebCoreNSStringExtras.mm in Sources */,
 				B50F5B810E96CD9900AD71A6 /* WebCoreObjCExtras.mm in Sources */,
 				93EB169509F880B00091F8FF /* WebCoreSystemInterface.mm in Sources */,
@@ -25081,7 +25322,9 @@
 				49C7B9E51042D32F0009D447 /* WebGLTexture.cpp in Sources */,
 				0C3F1F5A10C8871200D72CE1 /* WebGLUniformLocation.cpp in Sources */,
 				77A17A7712F28642004E02F6 /* WebGLVertexArrayObjectOES.cpp in Sources */,
+				319E69B213299BBD004AC91A /* WebKitAnimation.cpp in Sources */,
 				31C0FF210E4CEB6E007D6FE5 /* WebKitAnimationEvent.cpp in Sources */,
+				319E69B513299BBD004AC91A /* WebKitAnimationList.cpp in Sources */,
 				31288E720E3005D6003619AE /* WebKitCSSKeyframeRule.cpp in Sources */,
 				31288E740E3005D6003619AE /* WebKitCSSKeyframesRule.cpp in Sources */,
 				498391580F1E776900C23782 /* WebKitCSSMatrix.cpp in Sources */,
@@ -25189,13 +25432,12 @@
 				93F19B0508245E59001E9ABC /* XSLTProcessorLibxslt.cpp in Sources */,
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
 				977E2E0E12F0FC9C00C13379 /* XSSFilter.cpp in Sources */,
-				E49BDA0B131FD3E5003C56F0 /* CSSPrimitiveValueCache.cpp in Sources */,
-				5A574F24131DB93900471B88 /* RenderQuote.cpp in Sources */,
-				5A574F28131DB96D00471B88 /* QuotesData.cpp in Sources */,
-				59695084132105A500C3ED18 /* JobjectWrapper.cpp in Sources */,
-				593D3EAD132532840057E7EE /* JavaMethod.cpp in Sources */,
-				598D77DD132541EE00761B22 /* JavaArrayJSC.cpp in Sources */,
-				598D77E11325420400761B22 /* JavaFieldJSC.cpp in Sources */,
+				BCC36EB81342AA3F004BEEF7 /* DefaultLocalizationStrategy.cpp in Sources */,
+				599C671C1343438900C3423C /* JavaMethodJobject.cpp in Sources */,
+				F34742DC134362F000531BC2 /* PageDebuggerAgent.cpp in Sources */,
+				F34742E01343631F00531BC2 /* WorkerDebuggerAgent.cpp in Sources */,
+				F34742E41343633C00531BC2 /* PageScriptDebugServer.cpp in Sources */,
+				F34742E81343635000531BC2 /* WorkerScriptDebugServer.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -25244,6 +25486,11 @@
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = 1CDD45E50BA9C84600F90147 /* WebCore.xcconfig */;
 			buildSettings = {
+				FRAMEWORK_SEARCH_PATHS = (
+					"$(inherited)",
+					"$(FRAMEWORK_SEARCH_PATHS_QUOTED_FOR_TARGET_1)",
+				);
+				FRAMEWORK_SEARCH_PATHS_QUOTED_FOR_TARGET_1 = "\"$(SYSTEM_LIBRARY_DIR)/PrivateFrameworks\"";
 				INSTALL_PATH = "$(BUILT_PRODUCTS_DIR)";
 			};
 			name = Debug;
@@ -25252,6 +25499,11 @@
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = 1CDD45E50BA9C84600F90147 /* WebCore.xcconfig */;
 			buildSettings = {
+				FRAMEWORK_SEARCH_PATHS = (
+					"$(inherited)",
+					"$(FRAMEWORK_SEARCH_PATHS_QUOTED_FOR_TARGET_1)",
+				);
+				FRAMEWORK_SEARCH_PATHS_QUOTED_FOR_TARGET_1 = "\"$(SYSTEM_LIBRARY_DIR)/PrivateFrameworks\"";
 				INSTALL_PATH = "$(BUILT_PRODUCTS_DIR)";
 			};
 			name = Release;
@@ -25261,6 +25513,11 @@
 			baseConfigurationReference = 1CDD45E50BA9C84600F90147 /* WebCore.xcconfig */;
 			buildSettings = {
 				BUILD_VARIANTS = normal;
+				FRAMEWORK_SEARCH_PATHS = (
+					"$(inherited)",
+					"$(FRAMEWORK_SEARCH_PATHS_QUOTED_FOR_TARGET_1)",
+				);
+				FRAMEWORK_SEARCH_PATHS_QUOTED_FOR_TARGET_1 = "\"$(SYSTEM_LIBRARY_DIR)/PrivateFrameworks\"";
 			};
 			name = Production;
 		};
diff --git a/Source/WebCore/accessibility/AXObjectCache.cpp b/Source/WebCore/accessibility/AXObjectCache.cpp
index a01cb59..b471201 100644
--- a/Source/WebCore/accessibility/AXObjectCache.cpp
+++ b/Source/WebCore/accessibility/AXObjectCache.cpp
@@ -616,7 +616,7 @@ void AXObjectCache::textMarkerDataForVisiblePosition(TextMarkerData& textMarkerD
         return;
     
     if (domNode->isHTMLElement()) {
-        InputElement* inputElement = toInputElement(static_cast<Element*>(domNode));
+        InputElement* inputElement = domNode->toInputElement();
         if (inputElement && inputElement->isPasswordField())
             return;
     }
diff --git a/Source/WebCore/accessibility/AXObjectCache.h b/Source/WebCore/accessibility/AXObjectCache.h
index 4c231b5..4805a7f 100644
--- a/Source/WebCore/accessibility/AXObjectCache.h
+++ b/Source/WebCore/accessibility/AXObjectCache.h
@@ -96,7 +96,8 @@ public:
     void handleScrollbarUpdate(ScrollView*);
     
     static void enableAccessibility() { gAccessibilityEnabled = true; }
-    static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
+    // Enhanced user interface accessibility can be toggled by the assistive technology.
+    static void setEnhancedUserInterfaceAccessibility(bool flag) { gAccessibilityEnhancedUserInterfaceEnabled = flag; }
     
     static bool accessibilityEnabled() { return gAccessibilityEnabled; }
     static bool accessibilityEnhancedUserInterfaceEnabled() { return gAccessibilityEnhancedUserInterfaceEnabled; }
diff --git a/Source/WebCore/accessibility/AccessibilityImageMapLink.cpp b/Source/WebCore/accessibility/AccessibilityImageMapLink.cpp
index 0844d02..a41f228 100644
--- a/Source/WebCore/accessibility/AccessibilityImageMapLink.cpp
+++ b/Source/WebCore/accessibility/AccessibilityImageMapLink.cpp
@@ -42,6 +42,7 @@ using namespace HTMLNames;
 AccessibilityImageMapLink::AccessibilityImageMapLink()
     : m_areaElement(0)
     , m_mapElement(0)
+    , m_parent(0)
 {
 }
 
diff --git a/Source/WebCore/accessibility/AccessibilityObject.h b/Source/WebCore/accessibility/AccessibilityObject.h
index 4687cae..2d27e39 100644
--- a/Source/WebCore/accessibility/AccessibilityObject.h
+++ b/Source/WebCore/accessibility/AccessibilityObject.h
@@ -171,6 +171,10 @@ enum AccessibilityRole {
     ListItemRole,
     MenuListPopupRole,
     MenuListOptionRole,
+    ParagraphRole,
+    LabelRole,
+    DivRole,
+    FormRole,
 
     // ARIA Grouping roles
     LandmarkApplicationRole,
diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
index a626950..9b54a69 100644
--- a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -495,7 +495,7 @@ bool AccessibilityRenderObject::isPasswordField() const
     if (ariaRoleAttribute() != UnknownRole)
         return false;
 
-    InputElement* inputElement = toInputElement(static_cast<Element*>(m_renderer->node()));
+    InputElement* inputElement = m_renderer->node()->toInputElement();
     if (!inputElement)
         return false;
 
@@ -585,10 +585,10 @@ bool AccessibilityRenderObject::isPressed() const
 bool AccessibilityRenderObject::isIndeterminate() const
 {
     ASSERT(m_renderer);
-    if (!m_renderer->node() || !m_renderer->node()->isElementNode())
+    if (!m_renderer->node())
         return false;
 
-    InputElement* inputElement = toInputElement(static_cast<Element*>(m_renderer->node()));
+    InputElement* inputElement = m_renderer->node()->toInputElement();
     if (!inputElement)
         return false;
 
@@ -598,8 +598,8 @@ bool AccessibilityRenderObject::isIndeterminate() const
 bool AccessibilityRenderObject::isNativeCheckboxOrRadio() const
 {
     Node* elementNode = node();
-    if (elementNode && elementNode->isElementNode()) {
-        InputElement* input = toInputElement(static_cast<Element*>(elementNode));
+    if (elementNode) {
+        InputElement* input = elementNode->toInputElement();
         if (input)
             return input->isCheckbox() || input->isRadioButton();
     }
@@ -610,11 +610,11 @@ bool AccessibilityRenderObject::isNativeCheckboxOrRadio() const
 bool AccessibilityRenderObject::isChecked() const
 {
     ASSERT(m_renderer);
-    if (!m_renderer->node() || !m_renderer->node()->isElementNode())
+    if (!m_renderer->node())
         return false;
 
     // First test for native checkedness semantics
-    InputElement* inputElement = toInputElement(static_cast<Element*>(m_renderer->node()));
+    InputElement* inputElement = m_renderer->node()->toInputElement();
     if (inputElement)
         return inputElement->isChecked();
 
@@ -661,10 +661,10 @@ bool AccessibilityRenderObject::isReadOnly() const
             return true;
         
         HTMLElement* body = document->body();
-        if (body && body->isContentEditable())
+        if (body && body->rendererIsEditable())
             return false;
 
-        return !document->inDesignMode();
+        return !document->rendererIsEditable();
     }
 
     if (m_renderer->isBoxModelObject()) {
@@ -675,7 +675,7 @@ bool AccessibilityRenderObject::isReadOnly() const
             return static_cast<HTMLTextAreaElement*>(box->node())->readOnly();
     }
 
-    return !m_renderer->node() || !m_renderer->node()->isContentEditable();
+    return !m_renderer->node() || !m_renderer->node()->rendererIsEditable();
 }
 
 bool AccessibilityRenderObject::isOffScreen() const
@@ -1829,7 +1829,7 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
         return false;
     
     // Anything that is content editable should not be ignored.
-    // However, one cannot just call node->isContentEditable() since that will ask if its parents
+    // However, one cannot just call node->rendererIsEditable() since that will ask if its parents
     // are also editable. Only the top level content editable region should be exposed.
     if (node && node->isElementNode()) {
         Element* element = static_cast<Element*>(node);
@@ -1838,6 +1838,10 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
             return false;
     }
     
+    // List items play an important role in defining the structure of lists. They should not be ignored.
+    if (roleValue() == ListItemRole)
+        return false;
+    
     // if this element has aria attributes on it, it should not be ignored.
     if (supportsARIAAttributes())
         return false;
@@ -2401,8 +2405,8 @@ VisiblePositionRange AccessibilityRenderObject::visiblePositionRange() const
     if (!node)
         return VisiblePositionRange();
 
-    VisiblePosition startPos = firstDeepEditingPositionForNode(node);
-    VisiblePosition endPos = lastDeepEditingPositionForNode(node);
+    VisiblePosition startPos = firstPositionInOrBeforeNode(node);
+    VisiblePosition endPos = lastPositionInOrAfterNode(node);
 
     // the VisiblePositions are equal for nodes like buttons, so adjust for that
     // FIXME: Really?  [button, 0] and [button, 1] are distinct (before and after the button)
@@ -3083,9 +3087,24 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
 #if PLATFORM(GTK)
     if (m_renderer->isHR())
         return SplitterRole;
+
+    if (node && node->hasTagName(pTag))
+        return ParagraphRole;
+
+    if (node && node->hasTagName(labelTag))
+        return LabelRole;
+
+    if (node && node->hasTagName(divTag))
+        return DivRole;
+
+    if (node && node->hasTagName(formTag))
+        return FormRole;
+#else
+    if (node && node->hasTagName(labelTag))
+        return GroupRole;
 #endif
 
-    if (m_renderer->isBlockFlow() || (node && node->hasTagName(labelTag)))
+    if (m_renderer->isBlockFlow())
         return GroupRole;
     
     // If the element does not have role, but it has ARIA attributes, accessibility should fallback to exposing it as a group.
diff --git a/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp b/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
index 0701ece..f910ca6 100644
--- a/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
+++ b/Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
@@ -143,6 +143,17 @@ void AXObjectCache::postPlatformNotification(AccessibilityObject* coreObject, AX
             g_signal_emit_by_name(axObject, "state-change", "focused", true);
         }
         notifyChildrenSelectionChange(coreObject);
+    } else if (notification == AXValueChanged) {
+        if (!ATK_IS_VALUE(axObject))
+            return;
+
+        AtkPropertyValues propertyValues;
+        propertyValues.property_name = "accessible-value";
+
+        memset(&propertyValues.new_value,  0, sizeof(GValue));
+        atk_value_get_current_value(ATK_VALUE(axObject), &propertyValues.new_value);
+
+        g_signal_emit_by_name(ATK_OBJECT(axObject), "property-change::accessible-value", &propertyValues, NULL);
     }
 }
 
diff --git a/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp b/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
index c8c1951..850bcbe 100644
--- a/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
+++ b/Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp
@@ -43,17 +43,10 @@ AccessibilityObjectInclusion AccessibilityObject::accessibilityPlatformIncludesO
     if (roleValue() == SplitterRole)
         return IncludeObject;
 
-    if (isGroup()) {
-        // When a list item is made up entirely of children (e.g. paragraphs)
-        // the list item gets ignored. We need it.
-        if (parent->isList())
-            return IncludeObject;
-
-        // We expect the parent of a table cell to be a table.
-        AccessibilityObject* child = firstChild();
-        if (child && child->roleValue() == CellRole)
-            return IgnoreObject;
-    }
+    // When a list item is made up entirely of children (e.g. paragraphs)
+    // the list item gets ignored. We need it.
+    if (isGroup() && parent->isList())
+        return IncludeObject;
 
     // Entries and password fields have extraneous children which we want to ignore.
     if (parent->isPasswordField() || parent->isTextControl())
@@ -105,7 +98,13 @@ void AccessibilityObject::setWrapper(AccessibilityObjectWrapper* wrapper)
 
 bool AccessibilityObject::allowsTextRanges() const
 {
-    return isTextControl() || isWebArea() || isGroup() || isLink() || isHeading() || isListItem();
+    // Check type for the AccessibilityObject.
+    if (isTextControl() || isWebArea() || isGroup() || isLink() || isHeading() || isListItem())
+        return true;
+
+    // Check roles as the last fallback mechanism.
+    AccessibilityRole role = roleValue();
+    return role == ParagraphRole || role == LabelRole || role == DivRole || role == FormRole;
 }
 
 unsigned AccessibilityObject::getLengthForTextRange() const
diff --git a/Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp b/Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
index 1d23612..7dff2e3 100644
--- a/Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
+++ b/Source/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
@@ -158,6 +158,11 @@ static AccessibilityObject* core(AtkDocument* document)
     return core(ATK_OBJECT(document));
 }
 
+static AccessibilityObject* core(AtkValue* value)
+{
+    return core(ATK_OBJECT(value));
+}
+
 static gchar* webkit_accessible_text_get_text(AtkText* text, gint startOffset, gint endOffset);
 
 static const gchar* webkit_accessible_get_name(AtkObject* object)
@@ -471,6 +476,14 @@ static AtkRole atkRole(AccessibilityRole role)
     case ListItemRole:
     case ListBoxOptionRole:
         return ATK_ROLE_LIST_ITEM;
+    case ParagraphRole:
+        return ATK_ROLE_PARAGRAPH;
+    case LabelRole:
+        return ATK_ROLE_LABEL;
+    case DivRole:
+        return ATK_ROLE_SECTION;
+    case FormRole:
+        return ATK_ROLE_FORM;
     default:
         return ATK_ROLE_UNKNOWN;
     }
@@ -478,31 +491,16 @@ static AtkRole atkRole(AccessibilityRole role)
 
 static AtkRole webkit_accessible_get_role(AtkObject* object)
 {
-    AccessibilityObject* axObject = core(object);
+    AccessibilityObject* coreObject = core(object);
 
-    if (!axObject)
+    if (!coreObject)
         return ATK_ROLE_UNKNOWN;
 
-    // WebCore does not know about paragraph role, label role, or section role
-    if (axObject->isAccessibilityRenderObject()) {
-        Node* node = static_cast<AccessibilityRenderObject*>(axObject)->renderer()->node();
-        if (node) {
-            if (node->hasTagName(HTMLNames::pTag))
-                return ATK_ROLE_PARAGRAPH;
-            if (node->hasTagName(HTMLNames::labelTag))
-                return ATK_ROLE_LABEL;
-            if (node->hasTagName(HTMLNames::divTag))
-                return ATK_ROLE_SECTION;
-            if (node->hasTagName(HTMLNames::formTag))
-                return ATK_ROLE_FORM;
-        }
-    }
-
     // Note: Why doesn't WebCore have a password field for this
-    if (axObject->isPasswordField())
+    if (coreObject->isPasswordField())
         return ATK_ROLE_PASSWORD_TEXT;
 
-    return atkRole(axObject->roleValue());
+    return atkRole(coreObject->roleValue());
 }
 
 static bool selectionBelongsToObject(AccessibilityObject* coreObject, VisibleSelection& selection)
@@ -2301,6 +2299,63 @@ static void atk_document_interface_init(AtkDocumentIface* iface)
     iface->get_document_locale = webkit_accessible_document_get_locale;
 }
 
+
+static void webkitAccessibleValueGetCurrentValue(AtkValue* value, GValue* gValue)
+{
+    memset(gValue,  0, sizeof(GValue));
+    g_value_init(gValue, G_TYPE_DOUBLE);
+    g_value_set_double(gValue, core(value)->valueForRange());
+}
+
+static void webkitAccessibleValueGetMaximumValue(AtkValue* value, GValue* gValue)
+{
+    memset(gValue,  0, sizeof(GValue));
+    g_value_init(gValue, G_TYPE_DOUBLE);
+    g_value_set_double(gValue, core(value)->maxValueForRange());
+}
+
+static void webkitAccessibleValueGetMinimumValue(AtkValue* value, GValue* gValue)
+{
+    memset(gValue,  0, sizeof(GValue));
+    g_value_init(gValue, G_TYPE_DOUBLE);
+    g_value_set_double(gValue, core(value)->minValueForRange());
+}
+
+static gboolean webkitAccessibleValueSetCurrentValue(AtkValue* value, const GValue* gValue)
+{
+    if (!G_VALUE_HOLDS_DOUBLE(gValue) && !G_VALUE_HOLDS_INT(gValue))
+        return FALSE;
+
+    AccessibilityObject* coreObject = core(value);
+    if (!coreObject->canSetValueAttribute())
+        return FALSE;
+
+    if (G_VALUE_HOLDS_DOUBLE(gValue))
+        coreObject->setValue(String::number(g_value_get_double(gValue)));
+    else
+        coreObject->setValue(String::number(g_value_get_int(gValue)));
+
+    return TRUE;
+}
+
+static void webkitAccessibleValueGetMinimumIncrement(AtkValue* value, GValue* gValue)
+{
+    memset(gValue,  0, sizeof(GValue));
+    g_value_init(gValue, G_TYPE_DOUBLE);
+
+    // There's not such a thing in the WAI-ARIA specification, thus return zero.
+    g_value_set_double(gValue, 0.0);
+}
+
+static void atkValueInterfaceInit(AtkValueIface* iface)
+{
+    iface->get_current_value = webkitAccessibleValueGetCurrentValue;
+    iface->get_maximum_value = webkitAccessibleValueGetMaximumValue;
+    iface->get_minimum_value = webkitAccessibleValueGetMinimumValue;
+    iface->set_current_value = webkitAccessibleValueSetCurrentValue;
+    iface->get_minimum_increment = webkitAccessibleValueGetMinimumIncrement;
+}
+
 static const GInterfaceInfo AtkInterfacesInitFunctions[] = {
     {(GInterfaceInitFunc)atk_action_interface_init,
      (GInterfaceFinalizeFunc) 0, 0},
@@ -2321,6 +2376,8 @@ static const GInterfaceInfo AtkInterfacesInitFunctions[] = {
     {(GInterfaceInitFunc)atkHyperlinkImplInterfaceInit,
      (GInterfaceFinalizeFunc) 0, 0},
     {(GInterfaceInitFunc)atk_document_interface_init,
+     (GInterfaceFinalizeFunc) 0, 0},
+    {(GInterfaceInitFunc)atkValueInterfaceInit,
      (GInterfaceFinalizeFunc) 0, 0}
 };
 
@@ -2334,7 +2391,8 @@ enum WAIType {
     WAI_TABLE,
     WAI_HYPERTEXT,
     WAI_HYPERLINK,
-    WAI_DOCUMENT
+    WAI_DOCUMENT,
+    WAI_VALUE,
 };
 
 static GType GetAtkInterfaceTypeFromWAIType(WAIType type)
@@ -2360,6 +2418,8 @@ static GType GetAtkInterfaceTypeFromWAIType(WAIType type)
         return ATK_TYPE_HYPERLINK_IMPL;
     case WAI_DOCUMENT:
         return ATK_TYPE_DOCUMENT;
+    case WAI_VALUE:
+        return ATK_TYPE_VALUE;
     }
 
     return G_TYPE_INVALID;
@@ -2431,6 +2491,10 @@ static guint16 getInterfaceMaskFromObject(AccessibilityObject* coreObject)
     if (role == WebAreaRole)
         interfaceMask |= 1 << WAI_DOCUMENT;
 
+    // Value
+    if (role == SliderRole)
+        interfaceMask |= 1 << WAI_VALUE;
+
     return interfaceMask;
 }
 
diff --git a/Source/WebCore/accessibility/gtk/WebKitAccessibleHyperlink.cpp b/Source/WebCore/accessibility/gtk/WebKitAccessibleHyperlink.cpp
index 5927430..b9e483c 100644
--- a/Source/WebCore/accessibility/gtk/WebKitAccessibleHyperlink.cpp
+++ b/Source/WebCore/accessibility/gtk/WebKitAccessibleHyperlink.cpp
@@ -32,6 +32,7 @@
 #include "RenderListMarker.h"
 #include "RenderObject.h"
 #include "TextIterator.h"
+#include "htmlediting.h"
 
 #include <atk/atk.h>
 #include <glib.h>
@@ -230,11 +231,19 @@ static gint webkitAccessibleHyperlinkGetStartIndex(AtkHyperlink* link)
     if (!coreObject)
         return 0;
 
+    AccessibilityObject* parentUnignored = coreObject->parentObjectUnignored();
+    if (!parentUnignored)
+        return 0;
+
     Node* node = coreObject->node();
     if (!node)
         return 0;
 
-    RefPtr<Range> range = Range::create(node->document(), firstPositionInNode(node->parentNode()), firstPositionInNode(node));
+    Node* parentNode = parentUnignored->node();
+    if (!parentNode)
+        return 0;
+
+    RefPtr<Range> range = Range::create(node->document(), firstPositionInOrBeforeNode(parentNode), firstPositionInOrBeforeNode(node));
     return getRangeLengthForObject(coreObject, range.get());
 }
 
@@ -246,11 +255,19 @@ static gint webkitAccessibleHyperlinkGetEndIndex(AtkHyperlink* link)
     if (!coreObject)
         return 0;
 
+    AccessibilityObject* parentUnignored = coreObject->parentObjectUnignored();
+    if (!parentUnignored)
+        return 0;
+
     Node* node = coreObject->node();
     if (!node)
         return 0;
 
-    RefPtr<Range> range = Range::create(node->document(), firstPositionInNode(node->parentNode()), lastPositionInNode(node));
+    Node* parentNode = parentUnignored->node();
+    if (!parentNode)
+        return 0;
+
+    RefPtr<Range> range = Range::create(node->document(), firstPositionInOrBeforeNode(parentNode), lastPositionInOrAfterNode(node));
     return getRangeLengthForObject(coreObject, range.get());
 }
 
diff --git a/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm b/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
index a71ccd4..c0dd795 100644
--- a/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
+++ b/Source/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
@@ -41,6 +41,7 @@
 #import "AccessibilityTableCell.h"
 #import "AccessibilityTableRow.h"
 #import "AccessibilityTableColumn.h"
+#import "Chrome.h"
 #import "ColorMac.h"
 #import "Frame.h"
 #import "FrameLoaderClient.h"
@@ -1286,7 +1287,11 @@ static const AccessibilityRoleMap& createAccessibilityRoleMap()
         { TabPanelRole, NSAccessibilityGroupRole },
         { TreeRole, NSAccessibilityOutlineRole },
         { TreeItemRole, NSAccessibilityRowRole },
-        { ListItemRole, NSAccessibilityGroupRole }
+        { ListItemRole, NSAccessibilityGroupRole },
+        { ParagraphRole, NSAccessibilityGroupRole },
+        { LabelRole, NSAccessibilityGroupRole },
+        { DivRole, NSAccessibilityGroupRole },
+        { FormRole, NSAccessibilityGroupRole }
     };
     AccessibilityRoleMap& roleMap = *new AccessibilityRoleMap;
     
@@ -2330,28 +2335,20 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     FrameView* frameView = m_object->documentFrameView();
     if (!frameView)
         return;
+    Frame* frame = frameView->frame();
+    if (!frame)
+        return;
+    Page* page = frame->page();
+    if (!page)
+        return;
 
-    // simulate a click in the middle of the object
+    // Simulate a click in the middle of the object.
     IntPoint clickPoint = m_object->clickPoint();
-    NSPoint nsClickPoint = NSMakePoint(clickPoint.x(), clickPoint.y());
-    
-    NSView* view = nil;
-    if (m_object->isAttachment())
-        view = [self attachmentView];
-    else
-        view = frameView->documentView();
-    
-    if (!view)
-        return;
-    
-    NSPoint nsScreenPoint = [view convertPoint:nsClickPoint toView:nil];
-    
-    // Show the contextual menu for this event.
-    NSEvent* event = [NSEvent mouseEventWithType:NSRightMouseDown location:nsScreenPoint modifierFlags:0 timestamp:0 windowNumber:[[view window] windowNumber] context:0 eventNumber:0 clickCount:1 pressure:1];
-    NSMenu* menu = [view menuForEvent:event];
     
-    if (menu)
-        [NSMenu popUpContextMenu:menu withEvent:event forView:view];    
+    PlatformMouseEvent mouseEvent(clickPoint, clickPoint, RightButton, MouseEventPressed, 1, false, false, false, false, currentTime());
+    bool handled = frame->eventHandler()->sendContextMenuEvent(mouseEvent);
+    if (handled)
+        page->chrome()->showContextMenu();
 }
 
 - (void)accessibilityPerformAction:(NSString*)action
diff --git a/Source/WebCore/bindings/ScriptControllerBase.cpp b/Source/WebCore/bindings/ScriptControllerBase.cpp
index fbf6d3e..5e87dbf 100644
--- a/Source/WebCore/bindings/ScriptControllerBase.cpp
+++ b/Source/WebCore/bindings/ScriptControllerBase.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "ScriptController.h"
 
+#include "ContentSecurityPolicy.h"
 #include "DocumentLoader.h"
 #include "Frame.h"
 #include "FrameLoaderClient.h"
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
index 14e4ac8..e9591fd 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
@@ -46,16 +46,20 @@ bool RuntimeEnabledFeatures::isLocalStorageEnabled = true;
 bool RuntimeEnabledFeatures::isSessionStorageEnabled = true;
 bool RuntimeEnabledFeatures::isWebkitNotificationsEnabled = false;
 bool RuntimeEnabledFeatures::isApplicationCacheEnabled = true;
+bool RuntimeEnabledFeatures::isDataTransferItemsEnabled = true;
 bool RuntimeEnabledFeatures::isGeolocationEnabled = true;
 bool RuntimeEnabledFeatures::isIndexedDBEnabled = false;
 bool RuntimeEnabledFeatures::isWebAudioEnabled = false;
-bool RuntimeEnabledFeatures::isWebGLEnabled = false;
 bool RuntimeEnabledFeatures::isPushStateEnabled = false;
 bool RuntimeEnabledFeatures::isTouchEnabled = true;
 bool RuntimeEnabledFeatures::isDeviceMotionEnabled = true;
 bool RuntimeEnabledFeatures::isDeviceOrientationEnabled = true;
 bool RuntimeEnabledFeatures::isSpeechInputEnabled = true;
 
+#if ENABLE(MEDIA_STREAM)
+bool RuntimeEnabledFeatures::isMediaStreamEnabled = true;
+#endif
+
 #if ENABLE(XHR_RESPONSE_BLOB)
 bool RuntimeEnabledFeatures::isXHRResponseBlobEnabled = false;
 #endif
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
index 7e21214..1004ea4 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -51,6 +51,9 @@ public:
     static void setApplicationCacheEnabled(bool isEnabled) { isApplicationCacheEnabled = isEnabled; }
     static bool applicationCacheEnabled() { return isApplicationCacheEnabled; }
 
+    static void setDataTransferItemsEnabled(bool isEnabled) { isDataTransferItemsEnabled = isEnabled; }
+    static bool dataTransferItemsEnabled() { return isDataTransferItemsEnabled; }
+
     static void setGeolocationEnabled(bool isEnabled) { isGeolocationEnabled = isEnabled; }
     static bool geolocationEnabled() { return isGeolocationEnabled; }
 
@@ -94,27 +97,6 @@ public:
     static bool webkitAudioContextEnabled() { return isWebAudioEnabled; }
 #endif
 
-#if ENABLE(WEBGL) || ENABLE(BLOB)
-    static void setWebGLEnabled(bool isEnabled) { isWebGLEnabled = isEnabled; }
-    static bool webGLRenderingContextEnabled() { return isWebGLEnabled; }
-    static bool webGLArrayBufferEnabled() { return isWebGLEnabled; }
-    static bool webGLByteArrayEnabled() { return isWebGLEnabled; }
-    static bool webGLUnsignedByteArrayEnabled() { return isWebGLEnabled; }
-    static bool webGLShortArrayEnabled() { return isWebGLEnabled; }
-    static bool webGLUnsignedShortArrayEnabled() { return isWebGLEnabled; }
-    static bool webGLIntArrayEnabled() { return isWebGLEnabled; }
-    static bool webGLUnsignedIntArrayEnabled() { return isWebGLEnabled; }
-    static bool webGLFloatArrayEnabled() { return isWebGLEnabled; }
-    static bool webGLActiveInfoEnabled() { return isWebGLEnabled; }
-    static bool webGLBufferEnabled() { return isWebGLEnabled; }
-    static bool webGLFramebufferEnabled() { return isWebGLEnabled; }
-    static bool webGLProgramEnabled() { return isWebGLEnabled; }
-    static bool webGLRenderbufferEnabled() { return isWebGLEnabled; }
-    static bool webGLShaderEnabled() { return isWebGLEnabled; }
-    static bool webGLTextureEnabled() { return isWebGLEnabled; }
-    static bool webGLUniformLocationEnabled() { return isWebGLEnabled; }
-#endif
-
     static void setPushStateEnabled(bool isEnabled) { isPushStateEnabled = isEnabled; }
     static bool pushStateEnabled() { return isPushStateEnabled; }
     static bool replaceStateEnabled() { return isPushStateEnabled; }
@@ -162,6 +144,12 @@ public:
     static void setJavaScriptI18NAPIEnabled(bool isEnabled) { isJavaScriptI18NAPIEnabled = isEnabled; }
 #endif
 
+#if ENABLE(MEDIA_STREAM)
+    static bool mediaStreamEnabled() { return isMediaStreamEnabled; }
+    static void setMediaStreamEnabled(bool isEnabled) { isMediaStreamEnabled = isEnabled; }
+    static bool webkitGetUserMediaEnabled() { return isMediaStreamEnabled; }
+#endif
+
 private:
     // Never instantiate.
     RuntimeEnabledFeatures() { }
@@ -170,10 +158,10 @@ private:
     static bool isSessionStorageEnabled;
     static bool isWebkitNotificationsEnabled;
     static bool isApplicationCacheEnabled;
+    static bool isDataTransferItemsEnabled;
     static bool isGeolocationEnabled;
     static bool isIndexedDBEnabled;
     static bool isWebAudioEnabled;
-    static bool isWebGLEnabled;
     static bool isPushStateEnabled;
     static bool isTouchEnabled;
     static bool isDeviceMotionEnabled;
@@ -190,6 +178,10 @@ private:
 #if ENABLE(JAVASCRIPT_I18N_API)
     static bool isJavaScriptI18NAPIEnabled;
 #endif
+
+#if ENABLE(MEDIA_STREAM)
+    static bool isMediaStreamEnabled;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/gobject/GNUmakefile.am b/Source/WebCore/bindings/gobject/GNUmakefile.am
index 881f45a..8370b86 100644
--- a/Source/WebCore/bindings/gobject/GNUmakefile.am
+++ b/Source/WebCore/bindings/gobject/GNUmakefile.am
@@ -244,6 +244,8 @@ webkitgtk_gdom_built_sources += \
 	DerivedSources/webkit/WebKitDOMUIEventPrivate.h \
 	DerivedSources/webkit/WebKitDOMValidityState.cpp \
 	DerivedSources/webkit/WebKitDOMValidityStatePrivate.h \
+	DerivedSources/webkit/WebKitDOMWebKitAnimation.cpp \
+	DerivedSources/webkit/WebKitDOMWebKitAnimationList.cpp \
 	DerivedSources/webkit/WebKitDOMWebKitPoint.cpp \
 	DerivedSources/webkit/WebKitDOMWebKitPointPrivate.h \
 	DerivedSources/webkit/WebKitDOMXPathExpression.cpp \
@@ -372,6 +374,8 @@ webkitgtk_built_h_api += \
 	DerivedSources/webkit/WebKitDOMObject.h \
 	DerivedSources/webkit/WebKitDOMNavigator.h \
 	DerivedSources/webkit/WebKitDOMScreen.h \
+	DerivedSources/webkit/WebKitDOMWebKitAnimation.h \
+	DerivedSources/webkit/WebKitDOMWebKitAnimationList.h \
 	DerivedSources/webkit/WebKitDOMWebKitPoint.h \
 	DerivedSources/webkit/WebKitDOMDOMMimeType.h \
 	DerivedSources/webkit/WebKitDOMDOMMimeTypeArray.h \
diff --git a/Source/WebCore/bindings/gobject/GObjectEventListener.cpp b/Source/WebCore/bindings/gobject/GObjectEventListener.cpp
index 27432b9..6211e7d 100644
--- a/Source/WebCore/bindings/gobject/GObjectEventListener.cpp
+++ b/Source/WebCore/bindings/gobject/GObjectEventListener.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2010 Igalia S.L.
+ *  Copyright (C) 2010, 2011 Igalia S.L.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -29,55 +29,51 @@
 
 namespace WebCore {
 
-GObjectEventListener::GObjectEventListener(GObject* object, DOMWindow* window, Node* node, const char* domEventName, const char* signalName)
+typedef void (*GObjectEventListenerCallback)(GObject*, WebKitDOMEvent*, void*);
+
+GObjectEventListener::GObjectEventListener(GObject* object, EventTarget* target, const char* domEventName, GCallback handler, bool capture, void* userData)
     : EventListener(GObjectEventListenerType)
     , m_object(object)
-    , m_coreNode(node)
-    , m_coreWindow(window)
+    , m_coreTarget(target)
     , m_domEventName(domEventName)
-    , m_signalName(signalName)
+    , m_handler(handler)
+    , m_capture(capture)
+    , m_userData(userData)
 {
-    ASSERT(!m_coreWindow || !m_coreNode);
-
+    ASSERT(m_coreTarget);
     g_object_weak_ref(object, reinterpret_cast<GWeakNotify>(GObjectEventListener::gobjectDestroyedCallback), this);
 }
 
 GObjectEventListener::~GObjectEventListener()
 {
-    if (!m_coreWindow && !m_coreNode)
+    if (!m_coreTarget)
         return;
     g_object_weak_unref(m_object, reinterpret_cast<GWeakNotify>(GObjectEventListener::gobjectDestroyedCallback), this);
 }
 
 void GObjectEventListener::gobjectDestroyed()
 {
-    ASSERT(!m_coreWindow || !m_coreNode);
-
-    // We must set m_coreWindow and m_coreNode to null, because removeEventListener may call the
-    // destructor as a side effect and we must be in the proper state to prevent g_object_weak_unref.
-    if (DOMWindow* window = m_coreWindow) {
-        m_coreWindow = 0;
-        window->removeEventListener(m_domEventName.data(), this, false);
-        return;
-    }
+    ASSERT(m_coreTarget);
 
-    Node* node = m_coreNode;
-    m_coreNode = 0; // See above.
-    node->removeEventListener(m_domEventName.data(), this, false);
+    // We must set m_coreTarget to null, because removeEventListener
+    // may call the destructor as a side effect and we must be in the
+    // proper state to prevent g_object_weak_unref.
+    EventTarget* target = m_coreTarget;
+    m_coreTarget = 0;
+    target->removeEventListener(m_domEventName.data(), this, m_capture);
 }
 
 void GObjectEventListener::handleEvent(ScriptExecutionContext*, Event* event)
 {
-    gboolean handled = FALSE;
     WebKitDOMEvent* gobjectEvent = WEBKIT_DOM_EVENT(WebKit::kit(event));
-    g_signal_emit_by_name(m_object, m_signalName.data(), gobjectEvent, &handled);
+    reinterpret_cast<GObjectEventListenerCallback>(m_handler)(m_object, gobjectEvent, m_userData);
     g_object_unref(gobjectEvent);
 }
 
 bool GObjectEventListener::operator==(const EventListener& listener)
 {
     if (const GObjectEventListener* gobjectEventListener = GObjectEventListener::cast(&listener))
-        return m_signalName == gobjectEventListener->m_signalName && m_object == gobjectEventListener->m_object;
+        return m_object == gobjectEventListener->m_object && m_handler == gobjectEventListener->m_handler;
 
     return false;
 }
diff --git a/Source/WebCore/bindings/gobject/GObjectEventListener.h b/Source/WebCore/bindings/gobject/GObjectEventListener.h
index ef1637a..6c85701 100644
--- a/Source/WebCore/bindings/gobject/GObjectEventListener.h
+++ b/Source/WebCore/bindings/gobject/GObjectEventListener.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2010 Igalia S.L.
+ *  Copyright (C) 2010, 2011 Igalia S.L.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -19,30 +19,30 @@
 #ifndef GObjectEventListener_h
 #define GObjectEventListener_h
 
-#include "DOMWindow.h"
 #include "EventListener.h"
-#include "Node.h"
+#include "EventTarget.h"
 
 #include <wtf/RefPtr.h>
 #include <wtf/text/CString.h>
 
 typedef struct _GObject GObject;
+typedef void (*GCallback) (void);
 
 namespace WebCore {
 
 class GObjectEventListener : public EventListener {
 public:
 
-    static void addEventListener(GObject* object, DOMWindow* window, const char* domEventName, const char* signalName)
+    static bool addEventListener(GObject* object, EventTarget* target, const char* domEventName, GCallback handler, bool useCapture, void* userData)
     {
-        RefPtr<GObjectEventListener> listener(adoptRef(new GObjectEventListener(object, window, 0, domEventName, signalName)));
-        window->addEventListener(domEventName, listener.release(), false);
+        RefPtr<GObjectEventListener> listener(adoptRef(new GObjectEventListener(object, target, domEventName, handler, useCapture, userData)));
+        return target->addEventListener(domEventName, listener.release(), useCapture);
     }
 
-    static void addEventListener(GObject* object, Node* node, const char* domEventName, const char* signalName)
+    static bool removeEventListener(GObject* object, EventTarget* target, const char* domEventName, GCallback handler, bool useCapture)
     {
-        RefPtr<GObjectEventListener> listener(adoptRef(new GObjectEventListener(object, 0, node, domEventName, signalName)));
-        node->addEventListener(domEventName, listener.release(), false);
+        GObjectEventListener key(object, target, domEventName, handler, useCapture, 0);
+        return target->removeEventListener(domEventName, &key, useCapture);
     }
 
     static void gobjectDestroyedCallback(GObjectEventListener* listener, GObject*)
@@ -60,7 +60,7 @@ public:
     virtual bool operator==(const EventListener& other);
 
 private:
-    GObjectEventListener(GObject*, DOMWindow*, Node*, const char* domEventName, const char* signalName);
+    GObjectEventListener(GObject*, EventTarget*, const char* domEventName, GCallback handler, bool capture, void* userData);
     ~GObjectEventListener();
     void gobjectDestroyed();
 
@@ -68,12 +68,13 @@ private:
 
     GObject* m_object;
 
-    // We do not need to keep a reference to these WebCore objects, because
-    // we only use them when the GObject and thus the WebCore object is alive.
-    Node* m_coreNode;
-    DOMWindow* m_coreWindow;
+    // We do not need to keep a reference to the m_coreTarget, because
+    // we only use it when the GObject and thus the m_coreTarget object is alive.
+    EventTarget* m_coreTarget;
     CString m_domEventName;
-    CString m_signalName;
+    GCallback m_handler;
+    bool m_capture;
+    void* m_userData;
 };
 } // namespace WebCore
 
diff --git a/Source/WebCore/bindings/gobject/WebKitDOMEventTarget.cpp b/Source/WebCore/bindings/gobject/WebKitDOMEventTarget.cpp
index f2b1a94..f74c340 100644
--- a/Source/WebCore/bindings/gobject/WebKitDOMEventTarget.cpp
+++ b/Source/WebCore/bindings/gobject/WebKitDOMEventTarget.cpp
@@ -66,17 +66,42 @@ static void webkit_dom_event_target_default_init(WebKitDOMEventTargetIface*)
 
 void webkit_dom_event_target_dispatch_event(WebKitDOMEventTarget* target, WebKitDOMEvent* event, GError** error)
 {
-    WebKitDOMEventTargetIface* iface;
-
     g_return_if_fail(WEBKIT_DOM_IS_EVENT_TARGET(target));
     g_return_if_fail(WEBKIT_DOM_IS_EVENT(event));
 
-    iface = WEBKIT_DOM_EVENT_TARGET_GET_IFACE(target);
+    WebKitDOMEventTargetIface* iface = WEBKIT_DOM_EVENT_TARGET_GET_IFACE(target);
 
     if (iface->dispatch_event)
         iface->dispatch_event(target, event, error);
 }
 
+gboolean webkit_dom_event_target_add_event_listener(WebKitDOMEventTarget* target, const char* eventName, GCallback handler, gboolean bubble, gpointer userData)
+{
+
+    g_return_val_if_fail(WEBKIT_DOM_IS_EVENT_TARGET(target), FALSE);
+    g_return_val_if_fail(eventName, FALSE);
+
+    WebKitDOMEventTargetIface* iface = WEBKIT_DOM_EVENT_TARGET_GET_IFACE(target);
+
+    if (iface->add_event_listener)
+        return iface->add_event_listener(target, eventName, handler, bubble, userData);
+
+    return FALSE;
+}
+
+gboolean webkit_dom_event_target_remove_event_listener(WebKitDOMEventTarget* target, const char* eventName, GCallback handler, gboolean bubble)
+{
+    g_return_val_if_fail(WEBKIT_DOM_IS_EVENT_TARGET(target), FALSE);
+    g_return_val_if_fail(eventName, FALSE);
+
+    WebKitDOMEventTargetIface* iface = WEBKIT_DOM_EVENT_TARGET_GET_IFACE(target);
+
+    if (iface->remove_event_listener)
+        return iface->remove_event_listener(target, eventName, handler, bubble);
+
+    return FALSE;
+}
+
 namespace WebKit {
 
 WebCore::EventTarget* core(WebKitDOMEventTarget* request)
diff --git a/Source/WebCore/bindings/gobject/WebKitDOMEventTarget.h b/Source/WebCore/bindings/gobject/WebKitDOMEventTarget.h
index 206abc7..4adbda1 100644
--- a/Source/WebCore/bindings/gobject/WebKitDOMEventTarget.h
+++ b/Source/WebCore/bindings/gobject/WebKitDOMEventTarget.h
@@ -37,9 +37,19 @@ struct _WebKitDOMEventTargetIface {
     GTypeInterface gIface;
 
     /* virtual table */
-    void          (* dispatch_event)(WebKitDOMEventTarget* target,
-                                     WebKitDOMEvent*       event,
-                                     GError**              error);
+    void          (* dispatch_event)(WebKitDOMEventTarget *target,
+                                     WebKitDOMEvent       *event,
+                                     GError              **error);
+
+    gboolean      (* add_event_listener)(WebKitDOMEventTarget *target,
+                                         const char          *eventName,
+                                         GCallback             handler,
+                                         gboolean              bubble,
+                                         gpointer              userData);
+    gboolean      (* remove_event_listener)(WebKitDOMEventTarget *target,
+                                            const char           *eventName,
+                                            GCallback             handler,
+                                            gboolean              bubble);
 };
 
 
@@ -49,6 +59,17 @@ WEBKIT_API void      webkit_dom_event_target_dispatch_event(WebKitDOMEventTarget
                                                             WebKitDOMEvent       *event,
                                                             GError              **error);
 
+WEBKIT_API gboolean  webkit_dom_event_target_add_event_listener(WebKitDOMEventTarget *target,
+                                                                const char           *eventName,
+                                                                GCallback             handler,
+                                                                gboolean              bubble,
+                                                                gpointer              userData);
+
+WEBKIT_API gboolean  webkit_dom_event_target_remove_event_listener(WebKitDOMEventTarget *target,
+                                                                   const char           *eventName,
+                                                                   GCallback             handler,
+                                                                   gboolean              bubble);
+
 G_END_DECLS
 
 #endif /* WebKitDOMEventTarget_h */
diff --git a/Source/WebCore/bindings/js/JSAudioConstructor.cpp b/Source/WebCore/bindings/js/JSAudioConstructor.cpp
index f0040fa..9ac797b 100644
--- a/Source/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/Source/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -40,7 +40,7 @@ namespace WebCore {
 const ClassInfo JSAudioConstructor::s_info = { "AudioConstructor", &DOMConstructorWithDocument::s_info, 0, 0 };
 
 JSAudioConstructor::JSAudioConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorWithDocument(JSAudioConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    : DOMConstructorWithDocument(JSAudioConstructor::createStructure(globalObject->globalData(), globalObject->objectPrototype()), globalObject)
 {
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, globalObject), None);
diff --git a/Source/WebCore/bindings/js/JSAudioConstructor.h b/Source/WebCore/bindings/js/JSAudioConstructor.h
index c90abbf..be0b800 100644
--- a/Source/WebCore/bindings/js/JSAudioConstructor.h
+++ b/Source/WebCore/bindings/js/JSAudioConstructor.h
@@ -38,9 +38,9 @@ namespace WebCore {
     public:
         JSAudioConstructor(JSC::ExecState*, JSDOMGlobalObject*);
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
         static const JSC::ClassInfo s_info;
diff --git a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
index b53d950..d5c9135 100644
--- a/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/Source/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -103,6 +103,7 @@
 #include "JSImageConstructor.cpp"
 #include "JSImageDataCustom.cpp"
 #include "JSInjectedScriptHostCustom.cpp"
+#include "JSInjectedScriptManager.cpp"
 #include "JSInspectorFrontendHostCustom.cpp"
 #include "JSInt16ArrayCustom.cpp"
 #include "JSInt32ArrayCustom.cpp"
@@ -143,6 +144,8 @@
 #include "JSUint16ArrayCustom.cpp"
 #include "JSUint32ArrayCustom.cpp"
 #include "JSUint8ArrayCustom.cpp"
+#include "JSWebKitAnimationCustom.cpp"
+#include "JSWebKitAnimationListCustom.cpp"
 #include "JSWebKitCSSKeyframeRuleCustom.cpp"
 #include "JSWebKitCSSKeyframesRuleCustom.cpp"
 #include "JSWebKitCSSMatrixCustom.cpp"
@@ -156,6 +159,7 @@
 #include "JSXSLTProcessorCustom.cpp"
 #include "JavaScriptCallFrame.cpp"
 #include "MemoryInfo.cpp"
+#include "PageScriptDebugServer.cpp"
 #include "ScheduledAction.cpp"
 #include "ScriptCachedFrameData.cpp"
 #include "ScriptCallStackFactory.cpp"
@@ -169,4 +173,5 @@
 #include "ScriptState.cpp"
 #include "SerializedScriptValue.cpp"
 #include "WorkerScriptController.cpp"
+#include "WorkerScriptDebugServer.cpp"
 
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.cpp b/Source/WebCore/bindings/js/JSDOMBinding.cpp
index 4d18a4e..8501eb9 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/Source/WebCore/bindings/js/JSDOMBinding.cpp
@@ -483,7 +483,7 @@ JSValue jsDateOrNull(ExecState* exec, double value)
 {
     if (!isfinite(value))
         return jsNull();
-    return new (exec) DateInstance(exec, value);
+    return new (exec) DateInstance(exec, exec->lexicalGlobalObject()->dateStructure(), value);
 }
 
 double valueToDate(ExecState* exec, JSValue value)
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.h b/Source/WebCore/bindings/js/JSDOMBinding.h
index 4fe3d16..934d9b3 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.h
+++ b/Source/WebCore/bindings/js/JSDOMBinding.h
@@ -64,9 +64,9 @@ namespace WebCore {
             return globalObject()->scriptExecutionContext();
         }
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
@@ -83,9 +83,9 @@ namespace WebCore {
     // Base class for all constructor objects in the JSC bindings.
     class DOMConstructorObject : public DOMObjectWithGlobalPointer {
     public:
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
@@ -143,7 +143,7 @@ namespace WebCore {
     {
         if (JSC::Structure* structure = getCachedDOMStructure(globalObject, &WrapperClass::s_info))
             return structure;
-        return cacheDOMStructure(globalObject, WrapperClass::createStructure(WrapperClass::createPrototype(exec, globalObject)), &WrapperClass::s_info);
+        return cacheDOMStructure(globalObject, WrapperClass::createStructure(exec->globalData(), WrapperClass::createPrototype(exec, globalObject)), &WrapperClass::s_info);
     }
     template<class WrapperClass> inline JSC::Structure* deprecatedGetDOMStructure(JSC::ExecState* exec)
     {
diff --git a/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp b/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
index efd0ae0..8183b6e 100644
--- a/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -42,8 +42,10 @@ namespace WebCore {
 
 const ClassInfo JSDOMGlobalObject::s_info = { "DOMGlobalObject", &JSGlobalObject::s_info, 0, 0 };
 
-JSDOMGlobalObject::JSDOMGlobalObject(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject::JSDOMGlobalObjectData* data, JSObject* thisValue)
-    : JSGlobalObject(structure, data, thisValue)
+JSDOMGlobalObject::JSDOMGlobalObject(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMWrapperWorld> world, JSObject* thisValue)
+    : JSGlobalObject(structure, thisValue)
+    , m_currentEvent(0)
+    , m_world(world)
 {
     ASSERT(inherits(&s_info));
 }
@@ -60,33 +62,28 @@ void JSDOMGlobalObject::markChildren(MarkStack& markStack)
     for (JSDOMConstructorMap::iterator it2 = constructors().begin(); it2 != end2; ++it2)
         markStack.append(&it2->second);
 
-    if (d()->m_injectedScript)
-        markStack.append(&d()->m_injectedScript);
+    if (m_injectedScript)
+        markStack.append(&m_injectedScript);
 }
 
-void JSDOMGlobalObject::setCurrentEvent(Event* evt)
+void JSDOMGlobalObject::setCurrentEvent(Event* currentEvent)
 {
-    d()->evt = evt;
+    m_currentEvent = currentEvent;
 }
 
 Event* JSDOMGlobalObject::currentEvent() const
 {
-    return d()->evt;
+    return m_currentEvent;
 }
 
 void JSDOMGlobalObject::setInjectedScript(JSObject* injectedScript)
 {
-    d()->m_injectedScript.set(globalData(), this, injectedScript);
+    m_injectedScript.set(globalData(), this, injectedScript);
 }
 
 JSObject* JSDOMGlobalObject::injectedScript() const
 {
-    return d()->m_injectedScript.get();
-}
-
-void JSDOMGlobalObject::destroyJSDOMGlobalObjectData(void* jsDOMGlobalObjectData)
-{
-    delete static_cast<JSDOMGlobalObjectData*>(jsDOMGlobalObjectData);
+    return m_injectedScript.get();
 }
 
 JSDOMGlobalObject* toJSDOMGlobalObject(Document* document, JSC::ExecState* exec)
diff --git a/Source/WebCore/bindings/js/JSDOMGlobalObject.h b/Source/WebCore/bindings/js/JSDOMGlobalObject.h
index ac07969..1e992c5 100644
--- a/Source/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/Source/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -46,11 +46,11 @@ namespace WebCore {
     protected:
         struct JSDOMGlobalObjectData;
 
-        JSDOMGlobalObject(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObjectData*, JSC::JSObject* thisValue);
+        JSDOMGlobalObject(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<DOMWrapperWorld>, JSC::JSObject* thisValue);
 
     public:
-        JSDOMStructureMap& structures() { return d()->structures; }
-        JSDOMConstructorMap& constructors() const { return d()->constructors; }
+        JSDOMStructureMap& structures() { return m_structures; }
+        JSDOMConstructorMap& constructors() { return m_constructors; }
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
@@ -65,47 +65,33 @@ namespace WebCore {
 
         virtual void markChildren(JSC::MarkStack&);
 
-        DOMWrapperWorld* world() { return d()->m_world.get(); }
+        DOMWrapperWorld* world() { return m_world.get(); }
 
         static const JSC::ClassInfo s_info;
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     protected:
-        struct JSDOMGlobalObjectData : public JSC::JSGlobalObject::JSGlobalObjectData {
-            JSDOMGlobalObjectData(DOMWrapperWorld* world, Destructor destructor = destroyJSDOMGlobalObjectData)
-                : JSGlobalObjectData(destructor)
-                , evt(0)
-                , m_world(world)
-            {
-            }
-
-            JSDOMStructureMap structures;
-            JSDOMConstructorMap constructors;
-
-            Event* evt;
-            RefPtr<DOMWrapperWorld> m_world;
-            JSC::WriteBarrier<JSObject> m_injectedScript;
-        };
-
-    private:
-        static void destroyJSDOMGlobalObjectData(void*);
-
-        JSDOMGlobalObjectData* d() const { return static_cast<JSDOMGlobalObjectData*>(JSC::JSVariableObject::d); }
+        JSDOMStructureMap m_structures;
+        JSDOMConstructorMap m_constructors;
+
+        Event* m_currentEvent;
+        RefPtr<DOMWrapperWorld> m_world;
+        JSC::WriteBarrier<JSObject> m_injectedScript;
     };
 
     template<class ConstructorClass>
     inline JSC::JSObject* getDOMConstructor(JSC::ExecState* exec, const JSDOMGlobalObject* globalObject)
     {
-        if (JSC::JSObject* constructor = globalObject->constructors().get(&ConstructorClass::s_info).get())
+        if (JSC::JSObject* constructor = const_cast<JSDOMGlobalObject*>(globalObject)->constructors().get(&ConstructorClass::s_info).get())
             return constructor;
         JSC::JSObject* constructor = new (exec) ConstructorClass(exec, const_cast<JSDOMGlobalObject*>(globalObject));
-        ASSERT(!globalObject->constructors().contains(&ConstructorClass::s_info));
+        ASSERT(!const_cast<JSDOMGlobalObject*>(globalObject)->constructors().contains(&ConstructorClass::s_info));
         JSC::WriteBarrier<JSC::JSObject> temp;
-        globalObject->constructors().add(&ConstructorClass::s_info, temp).first->second.set(exec->globalData(), globalObject, constructor);
+        const_cast<JSDOMGlobalObject*>(globalObject)->constructors().add(&ConstructorClass::s_info, temp).first->second.set(exec->globalData(), globalObject, constructor);
         return constructor;
     }
 
diff --git a/Source/WebCore/bindings/js/JSDOMWindowBase.cpp b/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
index df01f77..584f610 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -45,21 +45,16 @@ namespace WebCore {
 
 const ClassInfo JSDOMWindowBase::s_info = { "Window", &JSDOMGlobalObject::s_info, 0, 0 };
 
-JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
-    : JSDOMGlobalObjectData(shell->world(), destroyJSDOMWindowBaseData)
-    , impl(window)
-    , shell(shell)
-{
-}
-
 JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
-    : JSDOMGlobalObject(structure, new JSDOMWindowBaseData(window, shell), shell)
+    : JSDOMGlobalObject(structure, shell->world(), shell)
+    , m_impl(window)
+    , m_shell(shell)
 {
     ASSERT(inherits(&s_info));
 
     GlobalPropertyInfo staticGlobals[] = {
         GlobalPropertyInfo(Identifier(globalExec(), "document"), jsNull(), DontDelete | ReadOnly),
-        GlobalPropertyInfo(Identifier(globalExec(), "window"), d()->shell, DontDelete | ReadOnly)
+        GlobalPropertyInfo(Identifier(globalExec(), "window"), m_shell, DontDelete | ReadOnly)
     };
     
     addStaticGlobals(staticGlobals, WTF_ARRAY_LENGTH(staticGlobals));
@@ -67,19 +62,19 @@ JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRef
 
 void JSDOMWindowBase::updateDocument()
 {
-    ASSERT(d()->impl->document());
+    ASSERT(m_impl->document());
     ExecState* exec = globalExec();
-    symbolTablePutWithAttributes(exec->globalData(), Identifier(exec, "document"), toJS(exec, this, d()->impl->document()), DontDelete | ReadOnly);
+    symbolTablePutWithAttributes(exec->globalData(), Identifier(exec, "document"), toJS(exec, this, m_impl->document()), DontDelete | ReadOnly);
 }
 
 ScriptExecutionContext* JSDOMWindowBase::scriptExecutionContext() const
 {
-    return d()->impl->document();
+    return m_impl->document();
 }
 
 String JSDOMWindowBase::crossDomainAccessErrorMessage(const JSGlobalObject* other) const
 {
-    return d()->shell->window()->impl()->crossDomainAccessErrorMessage(asJSDOMWindow(other)->impl());
+    return m_shell->window()->impl()->crossDomainAccessErrorMessage(asJSDOMWindow(other)->impl());
 }
 
 void JSDOMWindowBase::printErrorMessage(const String& message) const
@@ -170,7 +165,7 @@ JSValue JSDOMWindowBase::toStrictThisObject(ExecState*) const
 
 JSDOMWindowShell* JSDOMWindowBase::shell() const
 {
-    return d()->shell;
+    return m_shell;
 }
 
 JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
@@ -190,11 +185,6 @@ JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
     return globalData;
 }
 
-void JSDOMWindowBase::destroyJSDOMWindowBaseData(void* jsDOMWindowBaseData)
-{
-    delete static_cast<JSDOMWindowBaseData*>(jsDOMWindowBaseData);
-}
-
 // JSDOMGlobalObject* is ignored, accessing a window in any context will
 // use that DOMWindow's prototype chain.
 JSValue toJS(ExecState* exec, JSDOMGlobalObject*, DOMWindow* domWindow)
diff --git a/Source/WebCore/bindings/js/JSDOMWindowBase.h b/Source/WebCore/bindings/js/JSDOMWindowBase.h
index 91b4f42..bfec31c 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/Source/WebCore/bindings/js/JSDOMWindowBase.h
@@ -49,7 +49,7 @@ namespace WebCore {
     public:
         void updateDocument();
 
-        DOMWindow* impl() const { return d()->impl.get(); }
+        DOMWindow* impl() const { return m_impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
         // Called just before removing this window from the JSDOMWindowShell.
@@ -57,9 +57,9 @@ namespace WebCore {
 
         static const JSC::ClassInfo s_info;
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
         virtual JSC::ExecState* globalExec();
@@ -82,19 +82,11 @@ namespace WebCore {
         static JSC::JSGlobalData* commonJSGlobalData();
 
     private:
-        struct JSDOMWindowBaseData : public JSDOMGlobalObjectData {
-            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell);
-
-            RefPtr<DOMWindow> impl;
-            JSDOMWindowShell* shell;
-        };
+        RefPtr<DOMWindow> m_impl;
+        JSDOMWindowShell* m_shell;
 
         bool allowsAccessFromPrivate(const JSC::JSGlobalObject*) const;
         String crossDomainAccessErrorMessage(const JSC::JSGlobalObject*) const;
-        
-        static void destroyJSDOMWindowBaseData(void*);
-
-        JSDOMWindowBaseData* d() const { return static_cast<JSDOMWindowBaseData*>(JSC::JSVariableObject::d); }
     };
 
     // Returns a JSDOMWindow or jsNull()
diff --git a/Source/WebCore/bindings/js/JSDOMWindowCustom.h b/Source/WebCore/bindings/js/JSDOMWindowCustom.h
index a0e1b8f..a8d5a91 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowCustom.h
+++ b/Source/WebCore/bindings/js/JSDOMWindowCustom.h
@@ -67,7 +67,7 @@ inline bool JSDOMWindowBase::allowsAccessFrom(JSC::ExecState* exec, String& mess
 ALWAYS_INLINE bool JSDOMWindowBase::allowsAccessFromPrivate(const JSGlobalObject* other) const
 {
     const JSDOMWindow* originWindow = asJSDOMWindow(other);
-    const JSDOMWindow* targetWindow = d()->shell->window();
+    const JSDOMWindow* targetWindow = m_shell->window();
 
     if (originWindow == targetWindow)
         return true;
diff --git a/Source/WebCore/bindings/js/JSDOMWindowShell.cpp b/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
index a4cc777..817e9c0 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -44,7 +44,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSDOMWindowShell);
 const ClassInfo JSDOMWindowShell::s_info = { "JSDOMWindowShell", &Base::s_info, 0, 0 };
 
 JSDOMWindowShell::JSDOMWindowShell(PassRefPtr<DOMWindow> window, DOMWrapperWorld* world)
-    : Base(JSDOMWindowShell::createStructure(jsNull()))
+    : Base(JSDOMWindowShell::createStructure(*world->globalData(), jsNull()))
     , m_world(world)
 {
     ASSERT(inherits(&s_info));
@@ -60,10 +60,10 @@ void JSDOMWindowShell::setWindow(PassRefPtr<DOMWindow> domWindow)
     // Explicitly protect the global object's prototype so it isn't collected
     // when we allocate the global object. (Once the global object is fully
     // constructed, it can mark its own prototype.)
-    RefPtr<Structure> prototypeStructure = JSDOMWindowPrototype::createStructure(jsNull());
+    RefPtr<Structure> prototypeStructure = JSDOMWindowPrototype::createStructure(*JSDOMWindow::commonJSGlobalData(), jsNull());
     Global<JSDOMWindowPrototype> prototype(*JSDOMWindow::commonJSGlobalData(), new JSDOMWindowPrototype(0, prototypeStructure.release()));
 
-    RefPtr<Structure> structure = JSDOMWindow::createStructure(prototype.get());
+    RefPtr<Structure> structure = JSDOMWindow::createStructure(*JSDOMWindow::commonJSGlobalData(), prototype.get());
     JSDOMWindow* jsDOMWindow = new (JSDOMWindow::commonJSGlobalData()) JSDOMWindow(structure.release(), domWindow, this);
     prototype->putAnonymousValue(*JSDOMWindow::commonJSGlobalData(), 0, jsDOMWindow);
     setWindow(*JSDOMWindow::commonJSGlobalData(), jsDOMWindow);
diff --git a/Source/WebCore/bindings/js/JSDOMWindowShell.h b/Source/WebCore/bindings/js/JSDOMWindowShell.h
index 06dd1ff..4307c1c 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/Source/WebCore/bindings/js/JSDOMWindowShell.h
@@ -58,9 +58,9 @@ namespace WebCore {
 
         void* operator new(size_t);
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype) 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype) 
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info); 
         }
 
         DOMWrapperWorld* world() { return m_world.get(); }
diff --git a/Source/WebCore/bindings/js/JSDOMWrapper.cpp b/Source/WebCore/bindings/js/JSDOMWrapper.cpp
index 794f039..c91230b 100644
--- a/Source/WebCore/bindings/js/JSDOMWrapper.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWrapper.cpp
@@ -40,10 +40,4 @@ DOMObject::~DOMObject()
 
 #endif
 
-bool DOMObject::defineOwnProperty(ExecState* exec, const Identifier&, PropertyDescriptor&, bool)
-{
-    throwError(exec, createTypeError(exec, "defineProperty is not supported on DOM Objects"));
-    return false;
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSDOMWrapper.h b/Source/WebCore/bindings/js/JSDOMWrapper.h
index 2d09f01..0f8031c 100644
--- a/Source/WebCore/bindings/js/JSDOMWrapper.h
+++ b/Source/WebCore/bindings/js/JSDOMWrapper.h
@@ -34,8 +34,6 @@ protected:
     {
     }
 
-    virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, bool);
-
 #ifndef NDEBUG
     virtual ~DOMObject();
 #endif
diff --git a/Source/WebCore/bindings/js/JSErrorHandler.cpp b/Source/WebCore/bindings/js/JSErrorHandler.cpp
index ae8e363..3d916e6 100644
--- a/Source/WebCore/bindings/js/JSErrorHandler.cpp
+++ b/Source/WebCore/bindings/js/JSErrorHandler.cpp
@@ -88,7 +88,7 @@ void JSErrorHandler::handleEvent(ScriptExecutionContext* scriptExecutionContext,
         args.append(jsNumber(errorEvent->lineno()));
 
         JSGlobalData& globalData = globalObject->globalData();
-        DynamicGlobalObjectScope globalObjectScope(exec, globalData.dynamicGlobalObject ? globalData.dynamicGlobalObject : globalObject);
+        DynamicGlobalObjectScope globalObjectScope(globalData, globalData.dynamicGlobalObject ? globalData.dynamicGlobalObject : globalObject);
 
         JSValue thisValue = globalObject->toThisObject(exec);
 
diff --git a/Source/WebCore/bindings/js/JSEventListener.cpp b/Source/WebCore/bindings/js/JSEventListener.cpp
index 90a164b..e444d88 100644
--- a/Source/WebCore/bindings/js/JSEventListener.cpp
+++ b/Source/WebCore/bindings/js/JSEventListener.cpp
@@ -108,7 +108,7 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
         globalObject->setCurrentEvent(event);
 
         JSGlobalData& globalData = globalObject->globalData();
-        DynamicGlobalObjectScope globalObjectScope(exec, globalData.dynamicGlobalObject ? globalData.dynamicGlobalObject : globalObject);
+        DynamicGlobalObjectScope globalObjectScope(globalData, globalData.dynamicGlobalObject ? globalData.dynamicGlobalObject : globalObject);
 
         globalData.timeoutChecker.start();
         JSValue retval;
diff --git a/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp b/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
index 84dd72e..72aec4b 100644
--- a/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
@@ -76,6 +76,9 @@ JSValue JSHTMLCanvasElement::getContext(ExecState* exec)
             Identifier premultipliedAlpha(exec, "premultipliedAlpha");
             if (jsAttrs->hasProperty(exec, premultipliedAlpha))
                 webGLAttrs->setPremultipliedAlpha(jsAttrs->get(exec, premultipliedAlpha).toBoolean(exec));
+            Identifier preserveDrawingBuffer(exec, "preserveDrawingBuffer");
+            if (jsAttrs->hasProperty(exec, preserveDrawingBuffer))
+                webGLAttrs->setPreserveDrawingBuffer(jsAttrs->get(exec, preserveDrawingBuffer).toBoolean(exec));
         }
     }
 #endif
diff --git a/Source/WebCore/bindings/js/JSImageConstructor.cpp b/Source/WebCore/bindings/js/JSImageConstructor.cpp
index 1ddf136..be75af0 100644
--- a/Source/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/Source/WebCore/bindings/js/JSImageConstructor.cpp
@@ -35,7 +35,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSImageConstructor);
 const ClassInfo JSImageConstructor::s_info = { "ImageConstructor", &DOMConstructorWithDocument::s_info, 0, 0 };
 
 JSImageConstructor::JSImageConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorWithDocument(JSImageConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    : DOMConstructorWithDocument(JSImageConstructor::createStructure(globalObject->globalData(), globalObject->objectPrototype()), globalObject)
 {
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSHTMLImageElementPrototype::self(exec, globalObject), None);
diff --git a/Source/WebCore/bindings/js/JSImageConstructor.h b/Source/WebCore/bindings/js/JSImageConstructor.h
index 73293c7..654e223 100644
--- a/Source/WebCore/bindings/js/JSImageConstructor.h
+++ b/Source/WebCore/bindings/js/JSImageConstructor.h
@@ -29,9 +29,9 @@ namespace WebCore {
     public:
         JSImageConstructor(JSC::ExecState*, JSDOMGlobalObject*);
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
         static const JSC::ClassInfo s_info;
diff --git a/Source/WebCore/bindings/js/JSImageDataCustom.cpp b/Source/WebCore/bindings/js/JSImageDataCustom.cpp
index b5592d8..a92ed47 100644
--- a/Source/WebCore/bindings/js/JSImageDataCustom.cpp
+++ b/Source/WebCore/bindings/js/JSImageDataCustom.cpp
@@ -48,7 +48,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, ImageData* imageD
     wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, ImageData, imageData);
     Identifier dataName(exec, "data");
     static const ClassInfo cpaClassInfo = { "CanvasPixelArray", &JSByteArray::Base::s_info, 0, 0 };
-    DEFINE_STATIC_LOCAL(RefPtr<Structure>, cpaStructure, (JSByteArray::createStructure(jsNull(), &cpaClassInfo)));
+    DEFINE_STATIC_LOCAL(RefPtr<Structure>, cpaStructure, (JSByteArray::createStructure(exec->globalData(), jsNull(), &cpaClassInfo)));
     wrapper->putDirect(exec->globalData(), dataName, new (exec) JSByteArray(exec, cpaStructure, imageData->data()->data()), DontDelete | ReadOnly);
     exec->heap()->reportExtraMemoryCost(imageData->data()->length());
     
diff --git a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
index bc1d877..d56251f 100644
--- a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -35,37 +35,21 @@
 
 #if ENABLE(INSPECTOR)
 
-#include "Console.h"
-#include "JSMainThreadExecState.h"
 #if ENABLE(DATABASE)
 #include "Database.h"
 #include "JSDatabase.h"
 #endif
 #include "ExceptionCode.h"
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "InjectedScript.h"
 #include "InjectedScriptHost.h"
-#include "InspectorAgent.h"
+#include "InspectorDebuggerAgent.h"
 #include "InspectorValues.h"
-#include "JSDOMWindow.h"
-#include "JSDOMWindowCustom.h"
 #include "JSNode.h"
-#include "JSRange.h"
-#include "Node.h"
-#include "Page.h"
 #include "ScriptValue.h"
 #if ENABLE(DOM_STORAGE)
 #include "Storage.h"
 #include "JSStorage.h"
 #endif
-#include "TextIterator.h"
-#include "VisiblePosition.h"
-#include <parser/SourceCode.h>
-#include <runtime/JSArray.h>
 #include <runtime/JSLock.h>
-#include <wtf/RefPtr.h>
-#include <wtf/Vector.h>
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 #include "JavaScriptCallFrame.h"
@@ -89,41 +73,10 @@ ScriptValue InjectedScriptHost::nodeAsScriptValue(ScriptState* state, Node* node
     return ScriptValue(state->globalData(), toJS(state, node));
 }
 
-ScriptObject InjectedScriptHost::createInjectedScript(const String& source, ScriptState* scriptState, long id)
-{
-    SourceCode sourceCode = makeSource(stringToUString(source));
-    JSLock lock(SilenceAssertionsOnly);
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
-    JSValue globalThisValue = scriptState->globalThisValue();
-    Completion comp = JSMainThreadExecState::evaluate(scriptState, globalObject->globalScopeChain(), sourceCode, globalThisValue);
-    if (comp.complType() != JSC::Normal && comp.complType() != JSC::ReturnValue)
-        return ScriptObject();
-    JSValue functionValue = comp.value();
-    CallData callData;
-    CallType callType = getCallData(functionValue, callData);
-    if (callType == CallTypeNone)
-        return ScriptObject();
-
-    MarkedArgumentBuffer args;
-    args.append(toJS(scriptState, globalObject, this));
-    args.append(globalThisValue);
-    args.append(jsNumber(id));
-    JSValue result = JSC::call(scriptState, functionValue, callType, callData, globalThisValue, args);
-    if (result.isObject())
-        return ScriptObject(scriptState, result.getObject());
-    return ScriptObject();
-}
-
-void InjectedScriptHost::discardInjectedScript(ScriptState* scriptState)
-{
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
-    globalObject->setInjectedScript(0);
-}
-
 JSValue JSInjectedScriptHost::currentCallFrame(ExecState* exec)
 {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    JavaScriptCallFrame* callFrame = ScriptDebugServer::shared().currentCallFrame();
+    JavaScriptCallFrame* callFrame = impl()->debuggerAgent()->scriptDebugServer().currentCallFrame();
     if (!callFrame || !callFrame->isValid())
         return jsUndefined();
 
@@ -160,9 +113,9 @@ JSValue JSInjectedScriptHost::internalConstructorName(ExecState* exec)
 JSValue JSInjectedScriptHost::inspect(ExecState* exec)
 {
     if (exec->argumentCount() >= 2) {
-        ScriptValue objectId(exec->globalData(), exec->argument(0));
+        ScriptValue object(exec->globalData(), exec->argument(0));
         ScriptValue hints(exec->globalData(), exec->argument(1));
-        impl()->inspectImpl(objectId.toInspectorValue(exec), hints.toInspectorValue(exec));
+        impl()->inspectImpl(object.toInspectorValue(exec), hints.toInspectorValue(exec));
     }
     return jsUndefined();
 }
@@ -191,33 +144,6 @@ JSValue JSInjectedScriptHost::storageId(ExecState* exec)
     return jsUndefined();
 }
 
-InjectedScript InjectedScriptHost::injectedScriptFor(ScriptState* scriptState)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
-    JSObject* injectedScript = globalObject->injectedScript();
-    if (injectedScript)
-        return InjectedScript(ScriptObject(scriptState, injectedScript));
-
-    if (!canAccessInspectedWindow(scriptState))
-        return InjectedScript();
-
-    pair<long, ScriptObject> injectedScriptObject = injectScript(injectedScriptSource(), scriptState);
-    globalObject->setInjectedScript(injectedScriptObject.second.jsObject());
-    InjectedScript result(injectedScriptObject.second);
-    m_idToInjectedScript.set(injectedScriptObject.first, result);
-    return result;
-}
-
-bool InjectedScriptHost::canAccessInspectedWindow(ScriptState* scriptState)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(scriptState->lexicalGlobalObject());
-    if (!inspectedWindow)
-        return false;
-    return inspectedWindow->allowsAccessFromNoErrorMessage(scriptState);
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp b/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp
new file mode 100644
index 0000000..1843cd2
--- /dev/null
+++ b/Source/WebCore/bindings/js/JSInjectedScriptManager.cpp
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScriptManager.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "ExceptionCode.h"
+#include "InjectedScript.h"
+#include "JSDOMWindow.h"
+#include "JSDOMWindowCustom.h"
+#include "JSInjectedScriptHost.h"
+#include "JSMainThreadExecState.h"
+#include <parser/SourceCode.h>
+#include <runtime/JSLock.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptObject InjectedScriptManager::createInjectedScript(const String& source, ScriptState* scriptState, long id)
+{
+    SourceCode sourceCode = makeSource(stringToUString(source));
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    JSValue globalThisValue = scriptState->globalThisValue();
+    Completion comp = JSMainThreadExecState::evaluate(scriptState, globalObject->globalScopeChain(), sourceCode, globalThisValue);
+    if (comp.complType() != JSC::Normal && comp.complType() != JSC::ReturnValue)
+        return ScriptObject();
+    JSValue functionValue = comp.value();
+    CallData callData;
+    CallType callType = getCallData(functionValue, callData);
+    if (callType == CallTypeNone)
+        return ScriptObject();
+
+    MarkedArgumentBuffer args;
+    args.append(toJS(scriptState, globalObject, m_injectedScriptHost.get()));
+    args.append(globalThisValue);
+    args.append(jsNumber(id));
+    JSValue result = JSC::call(scriptState, functionValue, callType, callData, globalThisValue, args);
+    if (result.isObject())
+        return ScriptObject(scriptState, result.getObject());
+    return ScriptObject();
+}
+
+void InjectedScriptManager::discardInjectedScript(ScriptState* scriptState)
+{
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    globalObject->setInjectedScript(0);
+}
+
+InjectedScript InjectedScriptManager::injectedScriptFor(ScriptState* scriptState)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject());
+    JSObject* injectedScript = globalObject->injectedScript();
+    if (injectedScript)
+        return InjectedScript(ScriptObject(scriptState, injectedScript));
+
+    if (!canAccessInspectedWindow(scriptState))
+        return InjectedScript();
+
+    pair<long, ScriptObject> injectedScriptObject = injectScript(injectedScriptSource(), scriptState);
+    globalObject->setInjectedScript(injectedScriptObject.second.jsObject());
+    InjectedScript result(injectedScriptObject.second);
+    m_idToInjectedScript.set(injectedScriptObject.first, result);
+    return result;
+}
+
+bool InjectedScriptManager::canAccessInspectedWindow(ScriptState* scriptState)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(scriptState->lexicalGlobalObject());
+    if (!inspectedWindow)
+        return false;
+    return inspectedWindow->allowsAccessFromNoErrorMessage(scriptState);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp b/Source/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
index e493508..e477a50 100644
--- a/Source/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
+++ b/Source/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
@@ -49,7 +49,7 @@ JSValue JSJavaScriptCallFrame::evaluate(ExecState* exec)
 
 JSValue JSJavaScriptCallFrame::thisObject(ExecState*) const
 {
-    return impl()->thisObject() ? impl()->thisObject() : jsNull();
+    return impl()->thisObject() ? JSValue(impl()->thisObject()) : jsNull();
 }
 
 JSValue JSJavaScriptCallFrame::type(ExecState* exec) const
diff --git a/Source/WebCore/bindings/js/JSLazyEventListener.cpp b/Source/WebCore/bindings/js/JSLazyEventListener.cpp
index 98db97a..5b17727 100644
--- a/Source/WebCore/bindings/js/JSLazyEventListener.cpp
+++ b/Source/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "JSLazyEventListener.h"
 
+#include "ContentSecurityPolicy.h"
 #include "Frame.h"
 #include "JSNode.h"
 #include <runtime/FunctionConstructor.h>
@@ -74,36 +75,29 @@ JSObject* JSLazyEventListener::initializeJSFunction(ScriptExecutionContext* exec
     if (!executionContext)
         return 0;
 
-    Frame* frame = static_cast<Document*>(executionContext)->frame();
-    if (!frame)
+    Document* document = static_cast<Document*>(executionContext);
+
+    if (!document->frame())
+        return 0;
+
+    if (!document->contentSecurityPolicy()->allowInlineEventHandlers())
         return 0;
 
-    ScriptController* scriptController = frame->script();
-    if (!scriptController->canExecuteScripts(AboutToExecuteScript))
+    ScriptController* script = document->frame()->script();
+    if (!script->canExecuteScripts(AboutToExecuteScript) || script->isPaused())
         return 0;
 
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(executionContext, isolatedWorld());
     if (!globalObject)
         return 0;
 
-    if (executionContext->isDocument()) {
-        JSDOMWindow* window = static_cast<JSDOMWindow*>(globalObject);
-        Frame* frame = window->impl()->frame();
-        if (!frame)
-            return 0;
-        // FIXME: Is this check needed for non-Document contexts?
-        ScriptController* script = frame->script();
-        if (!script->canExecuteScripts(AboutToExecuteScript) || script->isPaused())
-            return 0;
-    }
-
     ExecState* exec = globalObject->globalExec();
 
     MarkedArgumentBuffer args;
     args.append(jsNontrivialString(exec, stringToUString(m_eventParameterName)));
     args.append(jsString(exec, m_code));
 
-    JSObject* jsFunction = constructFunction(exec, args, Identifier(exec, stringToUString(m_functionName)), stringToUString(m_sourceURL), m_lineNumber); // FIXME: is globalExec ok?
+    JSObject* jsFunction = constructFunction(exec, exec->lexicalGlobalObject(), args, Identifier(exec, stringToUString(m_functionName)), stringToUString(m_sourceURL), m_lineNumber); // FIXME: is globalExec ok?
     if (exec->hadException()) {
         exec->clearException();
         return 0;
diff --git a/Source/WebCore/bindings/js/JSMainThreadExecState.h b/Source/WebCore/bindings/js/JSMainThreadExecState.h
index fb01000..436de5e 100644
--- a/Source/WebCore/bindings/js/JSMainThreadExecState.h
+++ b/Source/WebCore/bindings/js/JSMainThreadExecState.h
@@ -26,7 +26,7 @@
 #ifndef JSMainThreadExecState_h
 #define JSMainThreadExecState_h
 
-#include <JSDOMBinding.h>
+#include "JSDOMBinding.h"
 #ifndef NDEBUG
 #include <wtf/MainThread.h>
 #endif
diff --git a/Source/WebCore/bindings/js/JSOptionConstructor.cpp b/Source/WebCore/bindings/js/JSOptionConstructor.cpp
index a3c9aab..59e0b6a 100644
--- a/Source/WebCore/bindings/js/JSOptionConstructor.cpp
+++ b/Source/WebCore/bindings/js/JSOptionConstructor.cpp
@@ -36,7 +36,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSOptionConstructor);
 const ClassInfo JSOptionConstructor::s_info = { "OptionConstructor", &DOMConstructorWithDocument::s_info, 0, 0 };
 
 JSOptionConstructor::JSOptionConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorWithDocument(JSOptionConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    : DOMConstructorWithDocument(JSOptionConstructor::createStructure(globalObject->globalData(), globalObject->objectPrototype()), globalObject)
 {
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSHTMLOptionElementPrototype::self(exec, globalObject), None);
diff --git a/Source/WebCore/bindings/js/JSOptionConstructor.h b/Source/WebCore/bindings/js/JSOptionConstructor.h
index 03633c7..8a18007 100644
--- a/Source/WebCore/bindings/js/JSOptionConstructor.h
+++ b/Source/WebCore/bindings/js/JSOptionConstructor.h
@@ -30,9 +30,9 @@ namespace WebCore {
     public:
         JSOptionConstructor(JSC::ExecState*, JSDOMGlobalObject*);
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
         static const JSC::ClassInfo s_info;
diff --git a/Source/WebCore/bindings/js/JSWebKitAnimationCustom.cpp b/Source/WebCore/bindings/js/JSWebKitAnimationCustom.cpp
new file mode 100644
index 0000000..8425c4c
--- /dev/null
+++ b/Source/WebCore/bindings/js/JSWebKitAnimationCustom.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All right reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSWebKitAnimation.h"
+
+#include "WebKitAnimation.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSWebKitAnimation::iterationCount(ExecState*) const
+{
+    WebKitAnimation* imp = impl();
+    int count = imp->iterationCount();
+    if (count == Animation::IterationCountInfinite)
+        return jsNumber(std::numeric_limits<float>::infinity());
+    return jsNumber(count);
+}
+
+}
diff --git a/Source/WebCore/bindings/js/JSWebKitAnimationListCustom.cpp b/Source/WebCore/bindings/js/JSWebKitAnimationListCustom.cpp
new file mode 100644
index 0000000..eaf77cf
--- /dev/null
+++ b/Source/WebCore/bindings/js/JSWebKitAnimationListCustom.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All right reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSWebKitAnimationList.h"
+
+#include "WebKitAnimationList.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSWebKitAnimationList::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    WebKitAnimationList* list = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = list->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, list->item(i));
+}
+
+}
diff --git a/Source/WebCore/bindings/js/JSWorkerContextBase.cpp b/Source/WebCore/bindings/js/JSWorkerContextBase.cpp
index 88fa43f..c6f86b5 100644
--- a/Source/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/Source/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -45,7 +45,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase);
 const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", &JSDOMGlobalObject::s_info, 0, 0 };
 
 JSWorkerContextBase::JSWorkerContextBase(NonNullPassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
-    : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData(normalWorld(*impl->script()->globalData())), this)
+    : JSDOMGlobalObject(structure, normalWorld(*impl->script()->globalData()), this)
     , m_impl(impl)
 {
     ASSERT(inherits(&s_info));
diff --git a/Source/WebCore/bindings/js/JSWorkerContextBase.h b/Source/WebCore/bindings/js/JSWorkerContextBase.h
index 99948b7..b9c234a 100644
--- a/Source/WebCore/bindings/js/JSWorkerContextBase.h
+++ b/Source/WebCore/bindings/js/JSWorkerContextBase.h
@@ -49,9 +49,9 @@ namespace WebCore {
         WorkerContext* impl() const { return m_impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
         {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+            return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
         }
 
     private:
diff --git a/Source/WebCore/bindings/js/PageScriptDebugServer.cpp b/Source/WebCore/bindings/js/PageScriptDebugServer.cpp
new file mode 100755
index 0000000..3d9cb9d
--- /dev/null
+++ b/Source/WebCore/bindings/js/PageScriptDebugServer.cpp
@@ -0,0 +1,215 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PageScriptDebugServer.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "Frame.h"
+#include "FrameView.h"
+#include "JSDOMWindowCustom.h"
+#include "Page.h"
+#include "PageGroup.h"
+#include "PluginView.h"
+#include "ScriptDebugListener.h"
+#include "Widget.h"
+#include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+static Page* toPage(JSGlobalObject* globalObject)
+{
+    ASSERT_ARG(globalObject, globalObject);
+
+    JSDOMWindow* window = asJSDOMWindow(globalObject);
+    Frame* frame = window->impl()->frame();
+    return frame ? frame->page() : 0;
+}
+
+PageScriptDebugServer& PageScriptDebugServer::shared()
+{
+    DEFINE_STATIC_LOCAL(PageScriptDebugServer, server, ());
+    return server;
+}
+
+PageScriptDebugServer::PageScriptDebugServer()
+    : ScriptDebugServer()
+{
+}
+
+PageScriptDebugServer::~PageScriptDebugServer()
+{
+    deleteAllValues(m_pageListenersMap);
+}
+
+void PageScriptDebugServer::addListener(ScriptDebugListener* listener, Page* page)
+{
+    ASSERT_ARG(listener, listener);
+    ASSERT_ARG(page, page);
+
+    pair<PageListenersMap::iterator, bool> result = m_pageListenersMap.add(page, 0);
+    if (result.second)
+        result.first->second = new ListenerSet;
+
+    ListenerSet* listeners = result.first->second;
+    listeners->add(listener);
+
+    recompileAllJSFunctionsSoon();
+    page->setDebugger(this);
+}
+
+void PageScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page)
+{
+    ASSERT_ARG(listener, listener);
+    ASSERT_ARG(page, page);
+
+    PageListenersMap::iterator it = m_pageListenersMap.find(page);
+    if (it == m_pageListenersMap.end())
+        return;
+
+    ListenerSet* listeners = it->second;
+    listeners->remove(listener);
+    if (listeners->isEmpty()) {
+        m_pageListenersMap.remove(it);
+        delete listeners;
+        didRemoveLastListener(page);
+    }
+}
+
+void PageScriptDebugServer::recompileAllJSFunctions(Timer<ScriptDebugServer>*)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    // If JavaScript stack is not empty postpone recompilation.
+    if (JSDOMWindow::commonJSGlobalData()->dynamicGlobalObject)
+        recompileAllJSFunctionsSoon();
+    else
+        Debugger::recompileAllJSFunctions(JSDOMWindow::commonJSGlobalData());
+}
+
+ScriptDebugServer::ListenerSet* PageScriptDebugServer::getListenersForGlobalObject(JSGlobalObject* globalObject)
+{
+    Page* page = toPage(globalObject);
+    if (!page)
+        return 0;
+    return m_pageListenersMap.get(page);
+}
+
+void PageScriptDebugServer::didPause(JSC::JSGlobalObject* globalObject)
+{
+    Page* page = toPage(globalObject);
+    m_pausedPage = page;
+    setJavaScriptPaused(page->group(), true);
+}
+
+void PageScriptDebugServer::didContinue(JSC::JSGlobalObject* globalObject)
+{
+    Page* page = toPage(globalObject);
+    m_pausedPage = 0;
+    setJavaScriptPaused(page->group(), false);
+}
+
+void PageScriptDebugServer::didRemoveLastListener(Page* page)
+{
+    if (m_pausedPage == page)
+        m_doneProcessingDebuggerEvents = true;
+
+    recompileAllJSFunctionsSoon();
+    page->setDebugger(0);
+}
+
+void PageScriptDebugServer::setJavaScriptPaused(const PageGroup& pageGroup, bool paused)
+{
+    setMainThreadCallbacksPaused(paused);
+
+    const HashSet<Page*>& pages = pageGroup.pages();
+
+    HashSet<Page*>::const_iterator end = pages.end();
+    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it)
+        setJavaScriptPaused(*it, paused);
+}
+
+void PageScriptDebugServer::setJavaScriptPaused(Page* page, bool paused)
+{
+    ASSERT_ARG(page, page);
+
+    page->setDefersLoading(paused);
+
+    for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
+        setJavaScriptPaused(frame, paused);
+}
+
+void PageScriptDebugServer::setJavaScriptPaused(Frame* frame, bool paused)
+{
+    ASSERT_ARG(frame, frame);
+
+    if (!frame->script()->canExecuteScripts(NotAboutToExecuteScript))
+        return;
+
+    frame->script()->setPaused(paused);
+
+    Document* document = frame->document();
+    if (paused) {
+        document->suspendScriptedAnimationControllerCallbacks();
+        document->suspendActiveDOMObjects(ActiveDOMObject::JavaScriptDebuggerPaused);
+    } else {
+        document->resumeActiveDOMObjects();
+        document->resumeScriptedAnimationControllerCallbacks();
+    }
+
+    setJavaScriptPaused(frame->view(), paused);
+}
+
+void PageScriptDebugServer::setJavaScriptPaused(FrameView* view, bool paused)
+{
+    if (!view)
+        return;
+
+    const HashSet<RefPtr<Widget> >* children = view->children();
+    ASSERT(children);
+
+    HashSet<RefPtr<Widget> >::const_iterator end = children->end();
+    for (HashSet<RefPtr<Widget> >::const_iterator it = children->begin(); it != end; ++it) {
+        Widget* widget = (*it).get();
+        if (!widget->isPluginView())
+            continue;
+        static_cast<PluginView*>(widget)->setJavaScriptPaused(paused);
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebCore/bindings/js/PageScriptDebugServer.h b/Source/WebCore/bindings/js/PageScriptDebugServer.h
new file mode 100755
index 0000000..5563e26
--- /dev/null
+++ b/Source/WebCore/bindings/js/PageScriptDebugServer.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PageScriptDebugServer_h
+#define PageScriptDebugServer_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "ScriptDebugServer.h"
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class Frame;
+class FrameView;
+class Page;
+class PageGroup;
+
+class PageScriptDebugServer : public ScriptDebugServer {
+    WTF_MAKE_NONCOPYABLE(PageScriptDebugServer);
+public:
+    static PageScriptDebugServer& shared();
+
+    void addListener(ScriptDebugListener*, Page*);
+    void removeListener(ScriptDebugListener*, Page*);
+
+    virtual void recompileAllJSFunctions(Timer<ScriptDebugServer>*);
+
+private:
+    typedef HashMap<Page*, ListenerSet*> PageListenersMap;
+
+    PageScriptDebugServer();
+    virtual ~PageScriptDebugServer();
+
+    virtual ListenerSet* getListenersForGlobalObject(JSC::JSGlobalObject*);
+    virtual void didPause(JSC::JSGlobalObject*);
+    virtual void didContinue(JSC::JSGlobalObject*);
+
+    void didRemoveLastListener(Page*);
+
+    void setJavaScriptPaused(const PageGroup&, bool paused);
+    void setJavaScriptPaused(Page*, bool paused);
+    void setJavaScriptPaused(Frame*, bool paused);
+    void setJavaScriptPaused(FrameView*, bool paused);
+
+    PageListenersMap m_pageListenersMap;
+    Page* m_pausedPage;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif // PageScriptDebugServer_h
diff --git a/Source/WebCore/bindings/js/ScheduledAction.h b/Source/WebCore/bindings/js/ScheduledAction.h
index c4b3edf..3adc185 100644
--- a/Source/WebCore/bindings/js/ScheduledAction.h
+++ b/Source/WebCore/bindings/js/ScheduledAction.h
@@ -20,8 +20,8 @@
 #ifndef ScheduledAction_h
 #define ScheduledAction_h
 
+#include "JSDOMBinding.h"
 #include "PlatformString.h"
-#include <JSDOMBinding.h>
 #include <collector/handles/Global.h>
 #include <runtime/JSCell.h>
 #include <wtf/PassOwnPtr.h>
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.cpp b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
index 32a3b2d..05c0f2c 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,45 +32,27 @@
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
-#include "DOMWindow.h"
 #include "EventLoop.h"
 #include "Frame.h"
-#include "FrameTree.h"
-#include "FrameView.h"
-#include "JSDOMWindowCustom.h"
 #include "JavaScriptCallFrame.h"
-#include "Page.h"
-#include "PageGroup.h"
-#include "PluginView.h"
 #include "ScriptBreakpoint.h"
 #include "ScriptController.h"
 #include "ScriptDebugListener.h"
-#include "ScrollView.h"
-#include "Widget.h"
 #include <debugger/DebuggerCallFrame.h>
 #include <parser/SourceProvider.h>
 #include <runtime/JSLock.h>
 #include <wtf/text/StringConcatenate.h>
 #include <wtf/MainThread.h>
-#include <wtf/StdLibExtras.h>
-#include <wtf/UnusedParam.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ScriptDebugServer& ScriptDebugServer::shared()
-{
-    DEFINE_STATIC_LOCAL(ScriptDebugServer, server, ());
-    return server;
-}
-
 ScriptDebugServer::ScriptDebugServer()
     : m_callingListeners(false)
     , m_pauseOnExceptionsState(DontPauseOnExceptions)
     , m_pauseOnNextStatement(false)
     , m_paused(false)
-    , m_pausedPage(0)
     , m_doneProcessingDebuggerEvents(true)
     , m_breakpointsActivated(true)
     , m_pauseOnCallFrame(0)
@@ -83,47 +65,6 @@ ScriptDebugServer::~ScriptDebugServer()
     deleteAllValues(m_pageListenersMap);
 }
 
-void ScriptDebugServer::addListener(ScriptDebugListener* listener, Page* page)
-{
-    ASSERT_ARG(listener, listener);
-    ASSERT_ARG(page, page);
-
-    pair<PageListenersMap::iterator, bool> result = m_pageListenersMap.add(page, 0);
-    if (result.second)
-        result.first->second = new ListenerSet;
-
-    ListenerSet* listeners = result.first->second;
-    listeners->add(listener);
-
-    didAddListener(page);
-}
-
-void ScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page)
-{
-    ASSERT_ARG(listener, listener);
-    ASSERT_ARG(page, page);
-
-    PageListenersMap::iterator it = m_pageListenersMap.find(page);
-    if (it == m_pageListenersMap.end())
-        return;
-
-    ListenerSet* listeners = it->second;
-    listeners->remove(listener);
-    if (listeners->isEmpty()) {
-        m_pageListenersMap.remove(it);
-        delete listeners;
-    }
-
-    didRemoveListener(page);
-}
-
-bool ScriptDebugServer::hasListenersInterestedInPage(Page* page)
-{
-    ASSERT_ARG(page, page);
-
-    return m_pageListenersMap.contains(page);
-}
-
 String ScriptDebugServer::setBreakpoint(const String& sourceID, const ScriptBreakpoint& scriptBreakpoint, int* actualLineNumber, int* actualColumnNumber)
 {
     intptr_t sourceIDValue = sourceID.toIntPtr();
@@ -299,15 +240,6 @@ void ScriptDebugServer::dispatchFailedToParseSource(const ListenerSet& listeners
         copy[i]->failedToParseSource(url, data, firstLine, errorLine, errorMessage);
 }
 
-static Page* toPage(JSGlobalObject* globalObject)
-{
-    ASSERT_ARG(globalObject, globalObject);
-
-    JSDOMWindow* window = asJSDOMWindow(globalObject);
-    Frame* frame = window->impl()->frame();
-    return frame ? frame->page() : 0;
-}
-
 static ScriptWorldType currentWorldType(ExecState* exec)
 {
     if (currentWorld(exec) == mainThreadNormalWorld())
@@ -333,22 +265,19 @@ void ScriptDebugServer::sourceParsed(ExecState* exec, SourceProvider* sourceProv
     if (m_callingListeners)
         return;
 
-    Page* page = toPage(exec->lexicalGlobalObject());
-    if (!page)
+    ListenerSet* listeners = getListenersForGlobalObject(exec->lexicalGlobalObject());
+    if (!listeners)
         return;
-
-    ScriptWorldType worldType = currentWorldType(exec);
+    ASSERT(!listeners->isEmpty());
 
     m_callingListeners = true;
 
     bool isError = errorLine != -1;
-
-    if (ListenerSet* pageListeners = m_pageListenersMap.get(page)) {
-        ASSERT(!pageListeners->isEmpty());
-        if (isError)
-            dispatchFailedToParseSource(*pageListeners, sourceProvider, errorLine, ustringToString(errorMessage));
-        else
-            dispatchDidParseSource(*pageListeners, sourceProvider, worldType);
+    if (isError)
+        dispatchFailedToParseSource(*listeners, sourceProvider, errorLine, ustringToString(errorMessage));
+    else {
+        ScriptWorldType worldType = currentWorldType(exec);
+        dispatchDidParseSource(*listeners, sourceProvider, worldType);
     }
 
     m_callingListeners = false;
@@ -362,85 +291,26 @@ void ScriptDebugServer::dispatchFunctionToListeners(const ListenerSet& listeners
         (this->*callback)(copy[i]);
 }
 
-void ScriptDebugServer::dispatchFunctionToListeners(JavaScriptExecutionCallback callback, Page* page)
+void ScriptDebugServer::dispatchFunctionToListeners(JavaScriptExecutionCallback callback, JSGlobalObject* globalObject)
 {
     if (m_callingListeners)
         return;
 
     m_callingListeners = true;
 
-    if (ListenerSet* pageListeners = m_pageListenersMap.get(page)) {
-        ASSERT(!pageListeners->isEmpty());
-        dispatchFunctionToListeners(*pageListeners, callback);
+    if (ListenerSet* listeners = getListenersForGlobalObject(globalObject)) {
+        ASSERT(!listeners->isEmpty());
+        dispatchFunctionToListeners(*listeners, callback);
     }
 
     m_callingListeners = false;
 }
 
-void ScriptDebugServer::setJavaScriptPaused(const PageGroup& pageGroup, bool paused)
-{
-    setMainThreadCallbacksPaused(paused);
-
-    const HashSet<Page*>& pages = pageGroup.pages();
-
-    HashSet<Page*>::const_iterator end = pages.end();
-    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it)
-        setJavaScriptPaused(*it, paused);
-}
-
-void ScriptDebugServer::setJavaScriptPaused(Page* page, bool paused)
-{
-    ASSERT_ARG(page, page);
-
-    page->setDefersLoading(paused);
-
-    for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
-        setJavaScriptPaused(frame, paused);
-}
-
-void ScriptDebugServer::setJavaScriptPaused(Frame* frame, bool paused)
-{
-    ASSERT_ARG(frame, frame);
-
-    if (!frame->script()->canExecuteScripts(NotAboutToExecuteScript))
-        return;
-
-    frame->script()->setPaused(paused);
-
-    Document* document = frame->document();
-    if (paused) {
-        document->suspendScriptedAnimationControllerCallbacks();
-        document->suspendActiveDOMObjects(ActiveDOMObject::JavaScriptDebuggerPaused);
-    } else {
-        document->resumeActiveDOMObjects();
-        document->resumeScriptedAnimationControllerCallbacks();
-    }
-
-    setJavaScriptPaused(frame->view(), paused);
-}
-
-void ScriptDebugServer::setJavaScriptPaused(FrameView* view, bool paused)
-{
-    if (!view)
-        return;
-
-    const HashSet<RefPtr<Widget> >* children = view->children();
-    ASSERT(children);
-
-    HashSet<RefPtr<Widget> >::const_iterator end = children->end();
-    for (HashSet<RefPtr<Widget> >::const_iterator it = children->begin(); it != end; ++it) {
-        Widget* widget = (*it).get();
-        if (!widget->isPluginView())
-            continue;
-        static_cast<PluginView*>(widget)->setJavaScriptPaused(paused);
-    }
-}
-
 void ScriptDebugServer::createCallFrameAndPauseIfNeeded(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
 {
     TextPosition0 textPosition(WTF::OneBasedNumber::fromOneBasedInt(lineNumber).convertToZeroBased(), WTF::ZeroBasedNumber::base());
     m_currentCallFrame = JavaScriptCallFrame::create(debuggerCallFrame, m_currentCallFrame, sourceID, textPosition);
-    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+    pauseIfNeeded(debuggerCallFrame.dynamicGlobalObject());
 }
 
 void ScriptDebugServer::updateCallFrameAndPauseIfNeeded(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
@@ -451,15 +321,15 @@ void ScriptDebugServer::updateCallFrameAndPauseIfNeeded(const DebuggerCallFrame&
 
     TextPosition0 textPosition(WTF::OneBasedNumber::fromOneBasedInt(lineNumber).convertToZeroBased(), WTF::ZeroBasedNumber::base());
     m_currentCallFrame->update(debuggerCallFrame, sourceID, textPosition);
-    pauseIfNeeded(toPage(debuggerCallFrame.dynamicGlobalObject()));
+    pauseIfNeeded(debuggerCallFrame.dynamicGlobalObject());
 }
 
-void ScriptDebugServer::pauseIfNeeded(Page* page)
+void ScriptDebugServer::pauseIfNeeded(JSGlobalObject* dynamicGlobalObject)
 {
     if (m_paused)
         return;
-
-    if (!page || !hasListenersInterestedInPage(page))
+ 
+    if (!getListenersForGlobalObject(dynamicGlobalObject))
         return;
 
     bool pauseNow = m_pauseOnNextStatement;
@@ -471,11 +341,9 @@ void ScriptDebugServer::pauseIfNeeded(Page* page)
     m_pauseOnCallFrame = 0;
     m_pauseOnNextStatement = false;
     m_paused = true;
-    m_pausedPage = page;
 
-    dispatchFunctionToListeners(&ScriptDebugServer::dispatchDidPause, page);
-
-    setJavaScriptPaused(page->group(), true);
+    dispatchFunctionToListeners(&ScriptDebugServer::dispatchDidPause, dynamicGlobalObject);
+    didPause(dynamicGlobalObject);
 
     TimerBase::fireTimersInNestedEventLoop();
 
@@ -484,12 +352,10 @@ void ScriptDebugServer::pauseIfNeeded(Page* page)
     while (!m_doneProcessingDebuggerEvents && !loop.ended())
         loop.cycle();
 
-    setJavaScriptPaused(page->group(), false);
+    didContinue(dynamicGlobalObject);
+    dispatchFunctionToListeners(&ScriptDebugServer::dispatchDidContinue, dynamicGlobalObject);
 
     m_paused = false;
-    m_pausedPage = 0;
-
-    dispatchFunctionToListeners(&ScriptDebugServer::dispatchDidContinue, page);
 }
 
 void ScriptDebugServer::callEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
@@ -565,34 +431,6 @@ void ScriptDebugServer::recompileAllJSFunctionsSoon()
     m_recompileTimer.startOneShot(0);
 }
 
-void ScriptDebugServer::recompileAllJSFunctions(Timer<ScriptDebugServer>*)
-{
-    JSLock lock(SilenceAssertionsOnly);
-    // If JavaScript stack is not empty postpone recompilation.
-    if (JSDOMWindow::commonJSGlobalData()->dynamicGlobalObject)
-        recompileAllJSFunctionsSoon();
-    else
-        Debugger::recompileAllJSFunctions(JSDOMWindow::commonJSGlobalData());
-}
-
-void ScriptDebugServer::didAddListener(Page* page)
-{
-    recompileAllJSFunctionsSoon();
-    page->setDebugger(this);
-}
-
-void ScriptDebugServer::didRemoveListener(Page* page)
-{
-    if (hasListenersInterestedInPage(page))
-        return;
-
-    if (m_pausedPage == page)
-        m_doneProcessingDebuggerEvents = true;
-
-    recompileAllJSFunctionsSoon();
-    page->setDebugger(0);
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebCore/bindings/js/ScriptDebugServer.h b/Source/WebCore/bindings/js/ScriptDebugServer.h
index e7e8502..e53cb4d 100644
--- a/Source/WebCore/bindings/js/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/js/ScriptDebugServer.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -50,21 +50,12 @@ class JSGlobalObject;
 }
 namespace WebCore {
 
-class Frame;
-class FrameView;
-class Page;
-class PageGroup;
 class ScriptDebugListener;
 class JavaScriptCallFrame;
 
-class ScriptDebugServer : JSC::Debugger {
+class ScriptDebugServer : protected JSC::Debugger {
     WTF_MAKE_NONCOPYABLE(ScriptDebugServer); WTF_MAKE_FAST_ALLOCATED;
 public:
-    static ScriptDebugServer& shared();
-
-    void addListener(ScriptDebugListener*, Page*);
-    void removeListener(ScriptDebugListener*, Page*);
-
     String setBreakpoint(const String& sourceID, const ScriptBreakpoint&, int* actualLineNumber, int* actualColumnNumber);
     void removeBreakpoint(const String& breakpointId);
     void clearBreakpoints();
@@ -90,26 +81,24 @@ public:
     bool editScriptSource(const String& sourceID, const String& newContent, String& newSourceOrErrorMessage);
 
     void recompileAllJSFunctionsSoon();
-    void recompileAllJSFunctions(Timer<ScriptDebugServer>* = 0);
+    virtual void recompileAllJSFunctions(Timer<ScriptDebugServer>* = 0) = 0;
 
     JavaScriptCallFrame* currentCallFrame();
 
-private:
+protected:
     typedef HashSet<ScriptDebugListener*> ListenerSet;
     typedef void (ScriptDebugServer::*JavaScriptExecutionCallback)(ScriptDebugListener*);
 
     ScriptDebugServer();
     ~ScriptDebugServer();
 
-    bool hasBreakpoint(intptr_t sourceID, const TextPosition0& position) const;
-    bool hasListenersInterestedInPage(Page*);
+    virtual ListenerSet* getListenersForGlobalObject(JSC::JSGlobalObject*) = 0;
+    virtual void didPause(JSC::JSGlobalObject*) = 0;
+    virtual void didContinue(JSC::JSGlobalObject*) = 0;
 
-    void setJavaScriptPaused(const PageGroup&, bool paused);
-    void setJavaScriptPaused(Page*, bool paused);
-    void setJavaScriptPaused(Frame*, bool paused);
-    void setJavaScriptPaused(FrameView*, bool paused);
+    bool hasBreakpoint(intptr_t sourceID, const TextPosition0&) const;
 
-    void dispatchFunctionToListeners(JavaScriptExecutionCallback, Page*);
+    void dispatchFunctionToListeners(JavaScriptExecutionCallback, JSC::JSGlobalObject*);
     void dispatchFunctionToListeners(const ListenerSet& listeners, JavaScriptExecutionCallback callback);
     void dispatchDidPause(ScriptDebugListener*);
     void dispatchDidContinue(ScriptDebugListener*);
@@ -118,7 +107,7 @@ private:
 
     void createCallFrameAndPauseIfNeeded(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
     void updateCallFrameAndPauseIfNeeded(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineNumber);
-    void pauseIfNeeded(Page*);
+    void pauseIfNeeded(JSC::JSGlobalObject* dynamicGlobalObject);
 
     virtual void detach(JSC::JSGlobalObject*);
 
@@ -131,9 +120,6 @@ private:
     virtual void didExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
     virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
 
-    void didAddListener(Page*);
-    void didRemoveListener(Page*);
-
     typedef HashMap<Page*, ListenerSet*> PageListenersMap;
     typedef HashMap<long, ScriptBreakpoint> LineToBreakpointMap;
     typedef HashMap<intptr_t, LineToBreakpointMap> SourceIdToBreakpointsMap;
@@ -143,7 +129,6 @@ private:
     PauseOnExceptionsState m_pauseOnExceptionsState;
     bool m_pauseOnNextStatement;
     bool m_paused;
-    Page* m_pausedPage;
     bool m_doneProcessingDebuggerEvents;
     bool m_breakpointsActivated;
     JavaScriptCallFrame* m_pauseOnCallFrame;
diff --git a/Source/WebCore/bindings/js/ScriptHeapSnapshot.h b/Source/WebCore/bindings/js/ScriptHeapSnapshot.h
index 6b40e20..a341ddc 100644
--- a/Source/WebCore/bindings/js/ScriptHeapSnapshot.h
+++ b/Source/WebCore/bindings/js/ScriptHeapSnapshot.h
@@ -50,7 +50,6 @@ public:
     unsigned int uid() const { return 0; }
 
     void writeJSON(OutputStream*) { }
-    int exactRetainedSize(uint64_t) { return -1; }
 
 private:
     ScriptHeapSnapshot() { }
diff --git a/Source/WebCore/bindings/js/ScriptProfiler.cpp b/Source/WebCore/bindings/js/ScriptProfiler.cpp
index f372c3c..3468ae3 100644
--- a/Source/WebCore/bindings/js/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/js/ScriptProfiler.cpp
@@ -30,11 +30,17 @@
 
 #include "ScriptProfiler.h"
 
+#include "GCController.h"
 #include "JSDOMBinding.h"
 #include <profiler/Profiler.h>
 
 namespace WebCore {
 
+void ScriptProfiler::collectGarbage()
+{
+    gcController().garbageCollectNow();
+}
+
 void ScriptProfiler::start(ScriptState* state, const String& title)
 {
     JSC::Profiler::profiler()->startProfiling(state, stringToUString(title));
diff --git a/Source/WebCore/bindings/js/ScriptProfiler.h b/Source/WebCore/bindings/js/ScriptProfiler.h
index d8ad482..05d5e92 100644
--- a/Source/WebCore/bindings/js/ScriptProfiler.h
+++ b/Source/WebCore/bindings/js/ScriptProfiler.h
@@ -47,6 +47,7 @@ public:
         virtual bool isCanceled() = 0;
     };
 
+    static void collectGarbage();
     static void start(ScriptState* state, const String& title);
     static PassRefPtr<ScriptProfile> stop(ScriptState* state, const String& title);
     static PassRefPtr<ScriptHeapSnapshot> takeHeapSnapshot(const String&, HeapSnapshotProgress*) { return 0; }
diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.cpp b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
index b3d07ca..a9c1b24 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -206,6 +206,45 @@ protected:
     MarkedArgumentBuffer m_gcBuffer;
 };
 
+#if ASSUME_LITTLE_ENDIAN
+template <typename T> static void writeLittleEndian(Vector<uint8_t>& buffer, T value)
+{
+    buffer.append(reinterpret_cast<uint8_t*>(&value), sizeof(value));
+}
+#else
+template <typename T> static void writeLittleEndian(Vector<uint8_t>& buffer, T value)
+{
+    for (unsigned i = 0; i < sizeof(T); i++) {
+        buffer.append(value & 0xFF);
+        value >>= 8;
+    }
+}
+#endif
+
+template <> void writeLittleEndian<uint8_t>(Vector<uint8_t>& buffer, uint8_t value)
+{
+    buffer.append(value);
+}
+
+template <typename T> static bool writeLittleEndian(Vector<uint8_t>& buffer, const T* values, uint32_t length)
+{
+    if (length > numeric_limits<uint32_t>::max() / sizeof(T))
+        return false;
+
+#if ASSUME_LITTLE_ENDIAN
+    buffer.append(reinterpret_cast<const uint8_t*>(values), length * sizeof(T));
+#else
+    for (unsigned i = 0; i < length; i++) {
+        T value = values[i];
+        for (unsigned j = 0; j < sizeof(T); j++) {
+            buffer.append(static_cast<uint8_t>(value & 0xFF));
+            value >>= 8;
+        }
+    }
+#endif
+    return true;
+}
+
 class CloneSerializer : CloneBase {
 public:
     static bool serialize(ExecState* exec, JSValue value, Vector<uint8_t>& out)
@@ -444,43 +483,6 @@ private:
         writeLittleEndian(m_buffer, c);
     }
 
-#if ASSUME_LITTLE_ENDIAN
-    template <typename T> static void writeLittleEndian(Vector<uint8_t>& buffer, T value)
-    {
-        if (sizeof(T) == 1)
-            buffer.append(value);
-        else
-            buffer.append(reinterpret_cast<uint8_t*>(&value), sizeof(value));
-    }
-#else
-    template <typename T> static void writeLittleEndian(Vector<uint8_t>& buffer, T value)
-    {
-        for (unsigned i = 0; i < sizeof(T); i++) {
-            buffer.append(value & 0xFF);
-            value >>= 8;
-        }
-    }
-#endif
-
-    template <typename T> static bool writeLittleEndian(Vector<uint8_t>& buffer, const T* values, uint32_t length)
-    {
-        if (length > numeric_limits<uint32_t>::max() / sizeof(T))
-            return false;
-
-#if ASSUME_LITTLE_ENDIAN
-        buffer.append(reinterpret_cast<const uint8_t*>(values), length * sizeof(T));
-#else
-        for (unsigned i = 0; i < length; i++) {
-            T value = values[i];
-            for (unsigned j = 0; j < sizeof(T); j++) {
-                buffer.append(static_cast<uint8_t>(value & 0xFF));
-                value >>= 8;
-            }
-        }
-#endif
-        return true;
-    }
-
     void write(uint32_t i)
     {
         writeLittleEndian(m_buffer, i);
@@ -870,12 +872,7 @@ private:
         if (sizeof(T) == 1)
             value = *ptr++;
         else {
-#if CPU(ARMV5_OR_LOWER)
-            // To protect misaligned memory access.
-            memcpy(&value, ptr, sizeof(T));
-#else
             value = *reinterpret_cast<const T*>(ptr);
-#endif
             ptr += sizeof(T);
         }
         return true;
@@ -968,14 +965,7 @@ private:
             return false;
 
 #if ASSUME_LITTLE_ENDIAN
-#if CPU(ARMV5_OR_LOWER)
-        // To protect misaligned memory access.
-        Vector<UChar> alignedBuffer(length);
-        memcpy(alignedBuffer.data(), ptr, length * sizeof(UChar));
-        str = UString::adopt(alignedBuffer);
-#else
         str = UString(reinterpret_cast<const UChar*>(ptr), length);
-#endif
         ptr += length * sizeof(UChar);
 #else
         Vector<UChar> buffer;
@@ -1176,7 +1166,9 @@ private:
             CachedStringRef flags;
             if (!readStringData(flags))
                 return JSValue();
-            RefPtr<RegExp> regExp = RegExp::create(&m_exec->globalData(), pattern->ustring(), flags->ustring());
+            RegExpFlags reFlags = regExpFlags(flags->ustring());
+            ASSERT(reFlags != InvalidFlags);
+            RefPtr<RegExp> regExp = RegExp::create(&m_exec->globalData(), pattern->ustring(), reFlags);
             return new (m_exec) RegExpObject(m_exec->lexicalGlobalObject(), m_globalObject->regExpStructure(), regExp); 
         }
         case ObjectReferenceTag: {
diff --git a/Source/WebCore/bindings/js/WorkerScriptController.cpp b/Source/WebCore/bindings/js/WorkerScriptController.cpp
index d392281..67b0441 100644
--- a/Source/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/js/WorkerScriptController.cpp
@@ -73,13 +73,13 @@ void WorkerScriptController::initScript()
     // Explicitly protect the global object's prototype so it isn't collected
     // when we allocate the global object. (Once the global object is fully
     // constructed, it can mark its own prototype.)
-    RefPtr<Structure> workerContextPrototypeStructure = JSWorkerContextPrototype::createStructure(jsNull());
+    RefPtr<Structure> workerContextPrototypeStructure = JSWorkerContextPrototype::createStructure(*m_globalData, jsNull());
     Global<JSWorkerContextPrototype> workerContextPrototype(*m_globalData, new (m_globalData.get()) JSWorkerContextPrototype(0, workerContextPrototypeStructure.release()));
 
     if (m_workerContext->isDedicatedWorkerContext()) {
-        RefPtr<Structure> dedicatedContextPrototypeStructure = JSDedicatedWorkerContextPrototype::createStructure(workerContextPrototype.get());
+        RefPtr<Structure> dedicatedContextPrototypeStructure = JSDedicatedWorkerContextPrototype::createStructure(*m_globalData, workerContextPrototype.get());
         Global<JSDedicatedWorkerContextPrototype> dedicatedContextPrototype(*m_globalData, new (m_globalData.get()) JSDedicatedWorkerContextPrototype(0, dedicatedContextPrototypeStructure.release()));
-        RefPtr<Structure> structure = JSDedicatedWorkerContext::createStructure(dedicatedContextPrototype.get());
+        RefPtr<Structure> structure = JSDedicatedWorkerContext::createStructure(*m_globalData, dedicatedContextPrototype.get());
 
         m_workerContextWrapper.set(*m_globalData, new (m_globalData.get()) JSDedicatedWorkerContext(structure.release(), m_workerContext->toDedicatedWorkerContext()));
         workerContextPrototype->putAnonymousValue(*m_globalData, 0, m_workerContextWrapper.get());
@@ -87,9 +87,9 @@ void WorkerScriptController::initScript()
 #if ENABLE(SHARED_WORKERS)
     } else {
         ASSERT(m_workerContext->isSharedWorkerContext());
-        RefPtr<Structure> sharedContextPrototypeStructure = JSSharedWorkerContextPrototype::createStructure(workerContextPrototype.get());
+        RefPtr<Structure> sharedContextPrototypeStructure = JSSharedWorkerContextPrototype::createStructure(*m_globalData, workerContextPrototype.get());
         Global<JSSharedWorkerContextPrototype> sharedContextPrototype(*m_globalData, new (m_globalData.get()) JSSharedWorkerContextPrototype(0, sharedContextPrototypeStructure.release()));
-        RefPtr<Structure> structure = JSSharedWorkerContext::createStructure(sharedContextPrototype.get());
+        RefPtr<Structure> structure = JSSharedWorkerContext::createStructure(*m_globalData, sharedContextPrototype.get());
 
         m_workerContextWrapper.set(*m_globalData, new (m_globalData.get()) JSSharedWorkerContext(structure.release(), m_workerContext->toSharedWorkerContext()));
         workerContextPrototype->putAnonymousValue(*m_globalData, 0, m_workerContextWrapper.get());
diff --git a/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp b/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp
new file mode 100755
index 0000000..5e2acd2
--- /dev/null
+++ b/Source/WebCore/bindings/js/WorkerScriptDebugServer.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WorkerScriptDebugServer.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
+
+#include "WorkerContext.h"
+
+namespace WebCore {
+
+WorkerScriptDebugServer::WorkerScriptDebugServer()
+    : ScriptDebugServer()
+{
+}
+
+void WorkerScriptDebugServer::addListener(ScriptDebugListener*, WorkerContext*)
+{
+}
+
+void WorkerScriptDebugServer::removeListener(ScriptDebugListener*, WorkerContext*)
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
diff --git a/Source/WebCore/bindings/js/WorkerScriptDebugServer.h b/Source/WebCore/bindings/js/WorkerScriptDebugServer.h
new file mode 100755
index 0000000..4062435
--- /dev/null
+++ b/Source/WebCore/bindings/js/WorkerScriptDebugServer.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerScriptDebugServer_h
+#define WorkerScriptDebugServer_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
+
+#include "ScriptDebugServer.h"
+
+namespace WebCore {
+
+class WorkerContext;
+
+class WorkerScriptDebugServer : public ScriptDebugServer {
+    WTF_MAKE_NONCOPYABLE(WorkerScriptDebugServer);
+public:
+    WorkerScriptDebugServer();
+    ~WorkerScriptDebugServer() { }
+
+    void addListener(ScriptDebugListener*, WorkerContext*);
+    void removeListener(ScriptDebugListener*, WorkerContext*);
+
+private:
+    virtual void recompileAllJSFunctions(Timer<ScriptDebugServer>*) { }
+    virtual ListenerSet* getListenersForGlobalObject(JSC::JSGlobalObject*) { return 0; }
+    virtual void didPause(JSC::JSGlobalObject*) { }
+    virtual void didContinue(JSC::JSGlobalObject*) { }
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
+
+#endif // WorkerScriptDebugServer_h
diff --git a/Source/WebCore/bindings/objc/DOMHTML.mm b/Source/WebCore/bindings/objc/DOMHTML.mm
index a2277d2..92588e1 100644
--- a/Source/WebCore/bindings/objc/DOMHTML.mm
+++ b/Source/WebCore/bindings/objc/DOMHTML.mm
@@ -182,8 +182,7 @@
 
 - (BOOL)_isEdited
 {
-    WebCore::RenderObject *renderer = core(self)->renderer();
-    return renderer && [self _isTextField] && static_cast<WebCore::RenderTextControl *>(renderer)->lastChangeWasUserEdit();
+    return core(self)->lastChangeWasUserEdit();
 }
 
 @end
@@ -192,8 +191,7 @@
 
 - (BOOL)_isEdited
 {
-    WebCore::RenderObject* renderer = core(self)->renderer();
-    return renderer && static_cast<WebCore::RenderTextControl*>(renderer)->lastChangeWasUserEdit();
+    return core(self)->lastChangeWasUserEdit();
 }
 
 @end
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm b/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
index ed76d08..3806b75 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm
@@ -459,89 +459,6 @@ EOF
     push(@txtInstallProps, "#endif /* ${conditionalString} */\n") if $conditionalString;
 }
 
-my %breakWords = ("before" => 1, "can" => 1, "context" => 1, "dbl" => 1, "drag" => 1,
-                  "drag" => 1, "duration" => 1, "has" => 1, "key" => 1, "loaded" => 1,
-                  "mouse" => 1, "page" => 1, "pop" => 1, "rate" => 1, "select" => 1,
-                  "time" => 1, "touch" => 1, "volume" => 1);
-
-sub SplitEventListenerAttrName {
-    my $attrName = shift;
-
-    my @matches = grep { $attrName =~ /^$_/ } keys (%breakWords);
-
-    if (@matches && (length $matches[0] < length $attrName)) {
-        $attrName = $matches[0] . "-" . substr($attrName, length $matches[0]);
-    }
-
-    return $attrName;
-}
-
-sub EventSignalName {
-    my $attrName = shift;
-    my $name = SplitEventListenerAttrName($attrName) . "-event";
-
-    return $name;
-}
-
-sub GenerateEventListener {
-    my $name = shift;
-    my $object = shift;
-    my $interfaceName = shift;
-
-    my $gobjectSignalName = EventSignalName($name);
-
-    my $txtInstallSignal = << "EOF";
-    g_signal_new("${gobjectSignalName}",
-                 G_TYPE_FROM_CLASS(gobjectClass),
-                 G_SIGNAL_RUN_LAST,
-                 0,
-                 g_signal_accumulator_true_handled, 0,
-                 webkit_marshal_BOOLEAN__OBJECT,
-                 G_TYPE_BOOLEAN, 1,
-                 WEBKIT_TYPE_DOM_EVENT | G_SIGNAL_TYPE_STATIC_SCOPE);
-
-EOF
-    push(@txtInstallSignals, $txtInstallSignal);
-
-    my ${listenerName} = $name . "Listener";
-
-    my $txtInstallEventListener = << "EOF";
-    WebCore::GObjectEventListener::addEventListener(object, coreObject, "${name}", "${gobjectSignalName}");
-EOF
-    push(@txtInstallEventListeners, $txtInstallEventListener);
-
-    $implIncludes{"webkit/WebKitDOMEvent.h"} = 1;
-    $implIncludes{"GObjectEventListener.h"} = 1;
-}
-
-my @eventSignalNames = (
-    # User Interface Event types
-    "focus", "blur",
-    # Basic Event types
-    "load", "unload", "abort", "error", "select", "change", "formchange", "submit", "reset",
-    "resize", "scroll",
-    # Mouse Event types
-    "click", "dblclick", "mousedown", "mouseup",
-    "mousemove", "mouseover", "mouseout",
-    # Mouse Wheel Event types
-    "mousewheel",
-    # Keyboard Event types
-    "keydown", "keypress", "keyup",
-    # -- Events not in the spec but defined in WebKit
-    # Media Event types,
-    "loadstart", "progress", "suspend", "emptied", "stalled", "play",
-    "loadedmetadata", "loadeddata", "waiting", "playing", "canplay",
-    "canplaythrough", "seeking", "seeked", "timeupdate", "ended",
-    "ratechange", "durationchange", "volumechange",
-    # Drag and Drop Event types
-    "drag", "dragend", "dragenter", "dragleave", "dragover", "dragstart", "drop",
-    # Cut and Paste Event types
-    "beforecut", "cut", "beforecopy", "copy", "beforepaste", "paste",
-    # Animations
-    "webkitanimationend", "webkitanimationstart", "webkitanimationiteration",
-    # Other
-    "contextmenu", "input", "forminput", "invalid", "search", "selectstart");
-
 sub GenerateProperties {
     my ($object, $interfaceName, $dataNode) = @_;
 
@@ -610,15 +527,6 @@ EOF
         }
     }
 
-    # We need to define all the events there are in all base classes
-    # that implement EventTarget. For now we only care about these
-    # two.
-    if ($interfaceName eq "Node" || $interfaceName eq "DOMWindow") {
-        foreach my $signalName (@eventSignalNames) {
-            GenerateEventListener($signalName, $object, $interfaceName);
-        }
-    }
-
     push(@cBodyPriv, "};\n\n");
 
     $txtGetProp = << "EOF";
@@ -669,13 +577,6 @@ static void ${lowerCaseIfaceName}_constructed(GObject* object)
 EOF
     push(@cBodyPriv, $implContent);
 
-    if (scalar @txtInstallEventListeners > 0) {
-        $implContent = << "EOF";
-    WebCore::${interfaceName}* coreObject = static_cast<WebCore::${interfaceName}*>(WEBKIT_DOM_OBJECT(object)->coreObject);
-EOF
-    push(@cBodyPriv, $implContent);
-    }
-
     $implContent = << "EOF";
 @txtInstallEventListeners
     if (G_OBJECT_CLASS(${lowerCaseIfaceName}_parent_class)->constructed)
@@ -833,8 +734,7 @@ sub GenerateFunction {
     foreach my $param (@{$function->parameters}) {
         my $paramIDLType = $param->type;
         if ($paramIDLType eq "EventListener" || $paramIDLType eq "MediaQueryListListener") {
-            push(@hBody, "\n/* TODO: event function ${functionName} */\n\n");
-            push(@cBody, "\n/* TODO: event function ${functionName} */\n\n");
+            # EventListeners are handled elsewhere.
             return;
         }
         addIncludeInBody($paramIDLType);
@@ -1283,6 +1183,7 @@ sub GenerateEventTargetIface {
     my $interfaceName = $dataNode->name;
     my $decamelize = FixUpDecamelizedName(decamelize($interfaceName));
 
+    $implIncludes{"GObjectEventListener.h"} = 1;
     $implIncludes{"WebKitDOMEventTarget.h"} = 1;
     $implIncludes{"WebKitDOMEventPrivate.h"} = 1;
 
@@ -1301,9 +1202,23 @@ static void webkit_dom_${decamelize}_dispatch_event(WebKitDOMEventTarget* target
     }
 }
 
+static gboolean webkit_dom_${decamelize}_add_event_listener(WebKitDOMEventTarget* target, const char* eventName, GCallback handler, gboolean bubble, gpointer userData)
+{
+    WebCore::${interfaceName}* coreTarget = static_cast<WebCore::${interfaceName}*>(WEBKIT_DOM_OBJECT(target)->coreObject);
+    return WebCore::GObjectEventListener::addEventListener(G_OBJECT(target), coreTarget, eventName, handler, bubble, userData);
+}
+
+static gboolean webkit_dom_${decamelize}_remove_event_listener(WebKitDOMEventTarget* target, const char* eventName, GCallback handler, gboolean bubble)
+{
+    WebCore::${interfaceName}* coreTarget = static_cast<WebCore::${interfaceName}*>(WEBKIT_DOM_OBJECT(target)->coreObject);
+    return WebCore::GObjectEventListener::removeEventListener(G_OBJECT(target), coreTarget, eventName, handler, bubble);
+}
+
 static void webkit_dom_event_target_init(WebKitDOMEventTargetIface* iface)
 {
     iface->dispatch_event = webkit_dom_${decamelize}_dispatch_event;
+    iface->add_event_listener = webkit_dom_${decamelize}_add_event_listener;
+    iface->remove_event_listener = webkit_dom_${decamelize}_remove_event_listener;
 }
 
 EOF
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index cb51c8a..12b477b 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -746,9 +746,9 @@ sub GenerateHeader
         $structureFlags{"JSC::NeedsThisConversion"} = 1;
     }
     push(@headerContent,
-        "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
+        "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)\n" .
         "    {\n" .
-        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);\n" .
+        "        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);\n" .
         "    }\n\n");
 
     # markChildren function
@@ -958,9 +958,9 @@ sub GenerateHeader
         $structureFlags{"JSC::OverridesMarkChildren"} = 1;
     }
     push(@headerContent,
-        "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
+        "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)\n" .
         "    {\n" .
-        "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);\n" .
+        "        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);\n" .
         "    }\n");
     if ($dataNode->extendedAttributes->{"DelegatingPrototypePutFunction"}) {
         push(@headerContent, "    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
@@ -1442,9 +1442,9 @@ sub GenerateImplementation
         push(@implContent, "JSObject* ${className}::createPrototype(ExecState* exec, JSGlobalObject* globalObject)\n");
         push(@implContent, "{\n");
         if ($hasParent && $parentClassName ne "JSC::DOMNodeFilter") {
-            push(@implContent, "    return new (exec) ${className}Prototype(globalObject, ${className}Prototype::createStructure(${parentClassName}Prototype::self(exec, globalObject)));\n");
+            push(@implContent, "    return new (exec) ${className}Prototype(globalObject, ${className}Prototype::createStructure(exec->globalData(), ${parentClassName}Prototype::self(exec, globalObject)));\n");
         } else {
-            push(@implContent, "    return new (exec) ${className}Prototype(globalObject, ${className}Prototype::createStructure(globalObject->objectPrototype()));\n");
+            push(@implContent, "    return new (exec) ${className}Prototype(globalObject, ${className}Prototype::createStructure(globalObject->globalData(), globalObject->objectPrototype()));\n");
         }
         push(@implContent, "}\n\n");
     }
@@ -2873,9 +2873,9 @@ sub GenerateConstructorDeclaration
     push(@$outputArray, "    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n");
     push(@$outputArray, "    static const JSC::ClassInfo s_info;\n");
 
-    push(@$outputArray, "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n");
+    push(@$outputArray, "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)\n");
     push(@$outputArray, "    {\n");
-    push(@$outputArray, "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);\n");
+    push(@$outputArray, "        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);\n");
     push(@$outputArray, "    }\n");
 
     push(@$outputArray, "protected:\n");
@@ -2907,7 +2907,7 @@ sub GenerateConstructorDefinition
     push(@$outputArray, "const ClassInfo ${constructorClassName}::s_info = { \"${visibleClassName}Constructor\", &DOMConstructorObject::s_info, &${constructorClassName}Table, 0 };\n\n");
 
     push(@$outputArray, "${constructorClassName}::${constructorClassName}(ExecState* exec, JSDOMGlobalObject* globalObject)\n");
-    push(@$outputArray, "    : DOMConstructorObject(${constructorClassName}::createStructure(globalObject->objectPrototype()), globalObject)\n");
+    push(@$outputArray, "    : DOMConstructorObject(${constructorClassName}::createStructure(globalObject->globalData(), globalObject->objectPrototype()), globalObject)\n");
     push(@$outputArray, "{\n");
     push(@$outputArray, "    ASSERT(inherits(&s_info));\n");
     if ($interfaceName eq "DOMWindow") {
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
index df1c04a..6fc0b9a 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -128,7 +128,7 @@ sub AddIncludesForType
 
     # When we're finished with the one-file-per-class
     # reorganization, we won't need these special cases.
-    if (!$codeGenerator->IsPrimitiveType($type) and !$codeGenerator->AvoidInclusionOfType($type) and $type ne "Date") {
+    if (!$codeGenerator->IsPrimitiveType($type) and !$codeGenerator->IsStringType($type) and !$codeGenerator->AvoidInclusionOfType($type) and $type ne "Date") {
         # default, include the same named file
         $implIncludes{GetV8HeaderName(${type})} = 1;
 
@@ -1716,8 +1716,22 @@ sub GenerateImplementation
 
     my $toActive = IsActiveDomType($interfaceName) ? "${className}::toActiveDOMObject" : "0";
 
+    # Find the super descriptor.
+    my $parentClass = "";
+    my $parentClassTemplate = "";
+    foreach (@{$dataNode->parents}) {
+        my $parent = $codeGenerator->StripModule($_);
+        if ($parent eq "EventTarget") {
+            next;
+        }
+        $implIncludes{"V8${parent}.h"} = 1;
+        $parentClass = "V8" . $parent;
+        $parentClassTemplate = $parentClass . "::GetTemplate()";
+        last;
+    }
     push(@implContentDecls, "namespace WebCore {\n\n");
-    push(@implContentDecls, "WrapperTypeInfo ${className}::info = { ${className}::GetTemplate, ${className}::derefObject, ${toActive} };\n\n");   
+    my $parentClassInfo = $parentClass ? "&${parentClass}::info" : "0";
+    push(@implContentDecls, "WrapperTypeInfo ${className}::info = { ${className}::GetTemplate, ${className}::derefObject, ${toActive}, ${parentClassInfo} };\n\n");   
     push(@implContentDecls, "namespace ${interfaceName}Internal {\n\n");
     push(@implContentDecls, "template <typename T> void V8_USE(T) { }\n\n");
 
@@ -1941,15 +1955,6 @@ static v8::Persistent<v8::ObjectTemplate> ConfigureShadowObjectTemplate(v8::Pers
 END
     }
 
-    # find the super descriptor
-    my $parentClassTemplate = "";
-    foreach (@{$dataNode->parents}) {
-        my $parent = $codeGenerator->StripModule($_);
-        if ($parent eq "EventTarget") { next; }
-        $implIncludes{"V8${parent}.h"} = 1;
-        $parentClassTemplate = "V8" . $parent . "::GetTemplate()";
-        last;
-    }
     if (!$parentClassTemplate) {
         $parentClassTemplate = "v8::Persistent<v8::FunctionTemplate>()";
     }
@@ -2506,7 +2511,15 @@ END
     }
 
     push(@implContent, <<END);
-    ${domMapFunction}.set(impl, v8::Persistent<v8::Object>::New(wrapper));
+    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
+END
+    if (IsNodeSubType($dataNode)) {
+        push(@implContent, <<END);
+    wrapperHandle.SetWrapperClassId(v8DOMSubtreeClassId);
+END
+    }    
+    push(@implContent, <<END);
+    ${domMapFunction}.set(impl, wrapperHandle);
 END
 
     push(@implContent, <<END);
@@ -2833,6 +2846,7 @@ sub GetNativeType
 
     return "RefPtr<MediaQueryListListener>" if $type eq "MediaQueryListListener";
 
+    return "PassRefPtr<DOMStringList>" if $type eq "DOMStringList" and $isParameter;
     return "RefPtr<DOMStringList>" if $type eq "DOMStringList";
 
     # Default, assume native type is a pointer with same type name as idl type
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestCallback.cpp b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestCallback.cpp
index 62ebc3c..d12d0c3 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestCallback.cpp
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestCallback.cpp
@@ -27,11 +27,13 @@
 #include "Class1.h"
 #include "Class2.h"
 #include "Class3.h"
+#include "DOMStringList.h"
 #include "KURL.h"
 #include "TestCallback.h"
 #include "WebDOMClass1.h"
 #include "WebDOMClass2.h"
 #include "WebDOMClass3.h"
+#include "WebDOMDOMStringList.h"
 #include "WebDOMString.h"
 #include "WebExceptionHandler.h"
 #include "wtf/text/AtomicString.h"
@@ -115,6 +117,14 @@ int WebDOMTestCallback::callbackWithNonBoolReturnType(const WebDOMClass3& class3
     return impl()->callbackWithNonBoolReturnType(toWebCore(class3Param));
 }
 
+bool WebDOMTestCallback::callbackWithStringList(const WebDOMDOMStringList& listParam)
+{
+    if (!impl())
+        return false;
+
+    return impl()->callbackWithStringList(toWebCore(listParam));
+}
+
 WebCore::TestCallback* toWebCore(const WebDOMTestCallback& wrapper)
 {
     return wrapper.impl();
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestCallback.h b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestCallback.h
index 7a077e2..8d11a4b 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestCallback.h
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestCallback.h
@@ -37,6 +37,7 @@ class WebDOMClass2;
 class WebDOMClass3;
 class WebDOMClass5;
 class WebDOMClass6;
+class WebDOMDOMStringList;
 
 class WebDOMTestCallback : public WebDOMObject {
 public:
@@ -51,6 +52,7 @@ public:
     bool callbackWithClass2Param(const WebDOMClass2& class2Param, const WebDOMString& strArg);
     int callbackWithNonBoolReturnType(const WebDOMClass3& class3Param);
     int customCallback(const WebDOMClass5& class5Param, const WebDOMClass6& class6Param);
+    bool callbackWithStringList(const WebDOMDOMStringList& listParam);
 
     WebCore::TestCallback* impl() const;
 
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp
index 054dc38..b63f50e 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp
@@ -37,6 +37,8 @@
 #include "webkit/WebKitDOMClass2Private.h"
 #include "webkit/WebKitDOMClass3.h"
 #include "webkit/WebKitDOMClass3Private.h"
+#include "webkit/WebKitDOMDOMStringList.h"
+#include "webkit/WebKitDOMDOMStringListPrivate.h"
 #include "webkit/WebKitDOMTestCallback.h"
 #include "webkit/WebKitDOMTestCallbackPrivate.h"
 #include "webkitdefines.h"
@@ -117,6 +119,22 @@ webkit_dom_test_callback_callback_with_non_bool_return_type(WebKitDOMTestCallbac
     return res;
 }
 
+gboolean
+webkit_dom_test_callback_callback_with_string_list(WebKitDOMTestCallback* self, WebKitDOMDOMStringList* list_param)
+{
+    g_return_val_if_fail(self, 0);
+    WebCore::JSMainThreadNullState state;
+    WebCore::TestCallback * item = WebKit::core(self);
+    g_return_val_if_fail(list_param, 0);
+    WebCore::DOMStringList * converted_list_param = NULL;
+    if (list_param != NULL) {
+        converted_list_param = WebKit::core(list_param);
+        g_return_val_if_fail(converted_list_param, 0);
+    }
+    gboolean res = item->callbackWithStringList(converted_list_param);
+    return res;
+}
+
 
 G_DEFINE_TYPE(WebKitDOMTestCallback, webkit_dom_test_callback, WEBKIT_TYPE_DOM_OBJECT)
 
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.h b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.h
index 6049c79..541afb2 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.h
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.h
@@ -58,6 +58,9 @@ webkit_dom_test_callback_callback_with_class2param(WebKitDOMTestCallback* self,
 WEBKIT_API glong
 webkit_dom_test_callback_callback_with_non_bool_return_type(WebKitDOMTestCallback* self, WebKitDOMClass3* class3param);
 
+WEBKIT_API gboolean
+webkit_dom_test_callback_callback_with_string_list(WebKitDOMTestCallback* self, WebKitDOMDOMStringList* list_param);
+
 G_END_DECLS
 
 #endif /* WebKitDOMTestCallback_h */
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
index 44d58d4..1f81c5d 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
@@ -250,12 +250,6 @@ webkit_dom_test_obj_method_with_exception(WebKitDOMTestObj* self, GError **error
     }
 }
 
-
-/* TODO: event function webkit_dom_test_obj_add_event_listener */
-
-
-/* TODO: event function webkit_dom_test_obj_remove_event_listener */
-
 void
 webkit_dom_test_obj_with_dynamic_frame(WebKitDOMTestObj* self)
 {
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
index 0416664..0f0f3c1 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
@@ -82,12 +82,6 @@ webkit_dom_test_obj_options_object(WebKitDOMTestObj* self, WebKitDOMOptionsObjec
 WEBKIT_API void
 webkit_dom_test_obj_method_with_exception(WebKitDOMTestObj* self, GError **error);
 
-
-/* TODO: event function webkit_dom_test_obj_add_event_listener */
-
-
-/* TODO: event function webkit_dom_test_obj_remove_event_listener */
-
 WEBKIT_API void
 webkit_dom_test_obj_with_dynamic_frame(WebKitDOMTestObj* self);
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
index 1f48ee9..a5234d9 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
@@ -26,6 +26,7 @@
 
 #include "JSClass1.h"
 #include "JSClass2.h"
+#include "JSDOMStringList.h"
 #include "ScriptExecutionContext.h"
 #include <runtime/JSLock.h>
 #include <wtf/MainThread.h>
@@ -110,6 +111,24 @@ bool JSTestCallback::callbackWithClass2Param(Class2* class2Param, const String&
     return !raisedException;
 }
 
+bool JSTestCallback::callbackWithStringList(DOMStringList* listParam)
+{
+    if (!canInvokeCallback())
+        return true;
+
+    RefPtr<JSTestCallback> protect(this);
+
+    JSLock lock(SilenceAssertionsOnly);
+
+    ExecState* exec = m_data->globalObject()->globalExec();
+    MarkedArgumentBuffer args;
+    args.append(toJS(exec, listParam));
+
+    bool raisedException = false;
+    m_data->invokeCallback(args, &raisedException);
+    return !raisedException;
+}
+
 }
 
 #endif // ENABLE(DATABASE)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.h b/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.h
index ba3559c..226e874 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestCallback.h
@@ -45,6 +45,7 @@ public:
     virtual bool callbackWithClass2Param(Class2* class2Param, const String& strArg);
     COMPILE_ASSERT(false)    virtual int callbackWithNonBoolReturnType(Class3* class3Param);
     virtual int customCallback(Class5* class5Param, Class6* class6Param);
+    virtual bool callbackWithStringList(DOMStringList* listParam);
 
 private:
     JSTestCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
index 8d519f5..ce0fef6 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
@@ -69,9 +69,9 @@ public:
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::ImplementsHasInstance | DOMConstructorObject::StructureFlags;
@@ -82,7 +82,7 @@ protected:
 const ClassInfo JSTestInterfaceConstructor::s_info = { "TestInterfaceConstructor", &DOMConstructorObject::s_info, &JSTestInterfaceConstructorTable, 0 };
 
 JSTestInterfaceConstructor::JSTestInterfaceConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSTestInterfaceConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    : DOMConstructorObject(JSTestInterfaceConstructor::createStructure(globalObject->globalData(), globalObject->objectPrototype()), globalObject)
 {
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestInterfacePrototype::self(exec, globalObject), DontDelete | ReadOnly);
@@ -144,7 +144,7 @@ JSTestInterface::JSTestInterface(NonNullPassRefPtr<Structure> structure, JSDOMGl
 
 JSObject* JSTestInterface::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTestInterfacePrototype(globalObject, JSTestInterfacePrototype::createStructure(globalObject->objectPrototype()));
+    return new (exec) JSTestInterfacePrototype(globalObject, JSTestInterfacePrototype::createStructure(globalObject->globalData(), globalObject->objectPrototype()));
 }
 
 bool JSTestInterface::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
index 2cabc23..5ee33a0 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
@@ -41,9 +41,9 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -63,9 +63,9 @@ class JSTestInterfacePrototype : public JSC::JSObjectWithGlobalObject {
 public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
     JSTestInterfacePrototype(JSC::JSGlobalObject* globalObject, NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObjectWithGlobalObject(globalObject, structure) { }
 protected:
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
index 0e5edeb..efaee3b 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
@@ -70,9 +70,9 @@ public:
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::ImplementsHasInstance | DOMConstructorObject::StructureFlags;
@@ -81,7 +81,7 @@ protected:
 const ClassInfo JSTestMediaQueryListListenerConstructor::s_info = { "TestMediaQueryListListenerConstructor", &DOMConstructorObject::s_info, &JSTestMediaQueryListListenerConstructorTable, 0 };
 
 JSTestMediaQueryListListenerConstructor::JSTestMediaQueryListListenerConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSTestMediaQueryListListenerConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    : DOMConstructorObject(JSTestMediaQueryListListenerConstructor::createStructure(globalObject->globalData(), globalObject->objectPrototype()), globalObject)
 {
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestMediaQueryListListenerPrototype::self(exec, globalObject), DontDelete | ReadOnly);
@@ -140,7 +140,7 @@ JSTestMediaQueryListListener::JSTestMediaQueryListListener(NonNullPassRefPtr<Str
 
 JSObject* JSTestMediaQueryListListener::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTestMediaQueryListListenerPrototype(globalObject, JSTestMediaQueryListListenerPrototype::createStructure(globalObject->objectPrototype()));
+    return new (exec) JSTestMediaQueryListListenerPrototype(globalObject, JSTestMediaQueryListListenerPrototype::createStructure(globalObject->globalData(), globalObject->objectPrototype()));
 }
 
 bool JSTestMediaQueryListListener::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
index a9f8606..fdb8a02 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
@@ -39,9 +39,9 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -63,9 +63,9 @@ public:
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
     JSTestMediaQueryListListenerPrototype(JSC::JSGlobalObject* globalObject, NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObjectWithGlobalObject(globalObject, structure) { }
 protected:
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
index fd2f4d9..a98cafa 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
@@ -149,9 +149,9 @@ public:
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::ImplementsHasInstance | DOMConstructorObject::StructureFlags;
@@ -160,7 +160,7 @@ protected:
 const ClassInfo JSTestObjConstructor::s_info = { "TestObjConstructor", &DOMConstructorObject::s_info, &JSTestObjConstructorTable, 0 };
 
 JSTestObjConstructor::JSTestObjConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSTestObjConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    : DOMConstructorObject(JSTestObjConstructor::createStructure(globalObject->globalData(), globalObject->objectPrototype()), globalObject)
 {
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestObjPrototype::self(exec, globalObject), DontDelete | ReadOnly);
@@ -265,7 +265,7 @@ JSTestObj::JSTestObj(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject*
 
 JSObject* JSTestObj::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTestObjPrototype(globalObject, JSTestObjPrototype::createStructure(globalObject->objectPrototype()));
+    return new (exec) JSTestObjPrototype(globalObject, JSTestObjPrototype::createStructure(globalObject->globalData(), globalObject->objectPrototype()));
 }
 
 bool JSTestObj::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
index 7e21168..751239b 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
@@ -40,9 +40,9 @@ public:
     virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -72,9 +72,9 @@ public:
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
     JSTestObjPrototype(JSC::JSGlobalObject* globalObject, NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObjectWithGlobalObject(globalObject, structure) { }
 protected:
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
index 5dd6c44..535f99b 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
@@ -71,9 +71,9 @@ public:
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 protected:
     static const unsigned StructureFlags = JSC::OverridesGetOwnPropertySlot | JSC::ImplementsHasInstance | DOMConstructorObject::StructureFlags;
@@ -82,7 +82,7 @@ protected:
 const ClassInfo JSTestSerializedScriptValueInterfaceConstructor::s_info = { "TestSerializedScriptValueInterfaceConstructor", &DOMConstructorObject::s_info, &JSTestSerializedScriptValueInterfaceConstructorTable, 0 };
 
 JSTestSerializedScriptValueInterfaceConstructor::JSTestSerializedScriptValueInterfaceConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
-    : DOMConstructorObject(JSTestSerializedScriptValueInterfaceConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+    : DOMConstructorObject(JSTestSerializedScriptValueInterfaceConstructor::createStructure(globalObject->globalData(), globalObject->objectPrototype()), globalObject)
 {
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSTestSerializedScriptValueInterfacePrototype::self(exec, globalObject), DontDelete | ReadOnly);
@@ -130,7 +130,7 @@ JSTestSerializedScriptValueInterface::JSTestSerializedScriptValueInterface(NonNu
 
 JSObject* JSTestSerializedScriptValueInterface::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTestSerializedScriptValueInterfacePrototype(globalObject, JSTestSerializedScriptValueInterfacePrototype::createStructure(globalObject->objectPrototype()));
+    return new (exec) JSTestSerializedScriptValueInterfacePrototype(globalObject, JSTestSerializedScriptValueInterfacePrototype::createStructure(globalObject->globalData(), globalObject->objectPrototype()));
 }
 
 bool JSTestSerializedScriptValueInterface::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
index 175fb12..d5f8879 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
@@ -41,9 +41,9 @@ public:
     virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
@@ -63,9 +63,9 @@ class JSTestSerializedScriptValueInterfacePrototype : public JSC::JSObjectWithGl
 public:
     static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     static const JSC::ClassInfo s_info;
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSGlobalData& globalData, JSC::JSValue prototype)
     {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return JSC::Structure::create(globalData, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
     JSTestSerializedScriptValueInterfacePrototype(JSC::JSGlobalObject* globalObject, NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObjectWithGlobalObject(globalObject, structure) { }
 protected:
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestCallback.h b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestCallback.h
index 08c30b7..3d6f7bd 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestCallback.h
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestCallback.h
@@ -33,6 +33,7 @@
 @class DOMClass3;
 @class DOMClass5;
 @class DOMClass6;
+@class DOMDOMStringList;
 @class NSString;
 
 @interface DOMTestCallback : DOMObject
@@ -41,6 +42,7 @@
 - (BOOL)callbackWithClass2Param:(DOMClass2 *)class2Param strArg:(NSString *)strArg;
 - (int)callbackWithNonBoolReturnType:(DOMClass3 *)class3Param;
 - (int)customCallback:(DOMClass5 *)class5Param class6Param:(DOMClass6 *)class6Param;
+- (BOOL)callbackWithStringList:(DOMDOMStringList *)listParam;
 @end
 
 #endif
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestCallback.mm b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestCallback.mm
index c4be39d..e070de5 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestCallback.mm
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestCallback.mm
@@ -45,8 +45,10 @@
 #import "DOMClass3Internal.h"
 #import "DOMClass5Internal.h"
 #import "DOMClass6Internal.h"
+#import "DOMDOMStringListInternal.h"
 #import "DOMEventInternal.h"
 #import "DOMNodeInternal.h"
+#import "DOMStringList.h"
 #import "DOMStyleSheetInternal.h"
 #import "DOMTestCallbackInternal.h"
 #import "ExceptionHandlers.h"
@@ -109,6 +111,12 @@
     return IMPL->customCallback(core(class5Param), core(class6Param));
 }
 
+- (BOOL)callbackWithStringList:(DOMDOMStringList *)listParam
+{
+    WebCore::JSMainThreadNullState state;
+    return IMPL->callbackWithStringList(core(listParam));
+}
+
 @end
 
 WebCore::TestCallback* core(DOMTestCallback *wrapper)
diff --git a/Source/WebCore/bindings/scripts/test/TestCallback.idl b/Source/WebCore/bindings/scripts/test/TestCallback.idl
index 9679a5a..2475251 100644
--- a/Source/WebCore/bindings/scripts/test/TestCallback.idl
+++ b/Source/WebCore/bindings/scripts/test/TestCallback.idl
@@ -38,5 +38,6 @@ module test {
       boolean callbackWithClass2Param(in Class2 class2Param, in DOMString strArg);
       long callbackWithNonBoolReturnType(in Class3 class3Param);
       [Custom] long customCallback(in Class5 class5Param, in Class6 class6Param);
+      boolean callbackWithStringList(in DOMStringList listParam);
     };
 }
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
index 057302d..c17f73d 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
@@ -27,7 +27,7 @@
 #include "V8Class1.h"
 #include "V8Class2.h"
 #include "V8CustomVoidCallback.h"
-#include "V8DOMString.h"
+#include "V8DOMStringList.h"
 #include "V8Proxy.h"
 #include <wtf/GetPtr.h>
 #include <wtf/RefCounted.h>
@@ -131,6 +131,33 @@ bool V8TestCallback::callbackWithClass2Param(Class2* class2Param, const String&
     return !invokeCallback(m_callback, 2, argv, callbackReturnValue, scriptExecutionContext());
 }
 
+bool V8TestCallback::callbackWithStringList(PassRefPtr<DOMStringList> listParam)
+{
+    if (!canInvokeCallback())
+        return true;
+
+    v8::HandleScope handleScope;
+
+    v8::Handle<v8::Context> v8Context = toV8Context(scriptExecutionContext(), m_worldContext);
+    if (v8Context.IsEmpty())
+        return true;
+
+    v8::Context::Scope scope(v8Context);
+
+    v8::Handle<v8::Value> listParamHandle = toV8(listParam);
+    if (listParamHandle.IsEmpty()) {
+        CRASH();
+        return true;
+    }
+
+    v8::Handle<v8::Value> argv[] = {
+        listParamHandle
+    };
+
+    bool callbackReturnValue = false;
+    return !invokeCallback(m_callback, 1, argv, callbackReturnValue, scriptExecutionContext());
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(DATABASE)
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.h b/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.h
index 8ff8c26..194f13c 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.h
@@ -50,6 +50,7 @@ public:
     virtual bool callbackWithClass2Param(Class2* class2Param, const String& strArg);
     COMPILE_ASSERT(false)    virtual int callbackWithNonBoolReturnType(Class3* class3Param);
     virtual int customCallback(Class5* class5Param, Class6* class6Param);
+    virtual bool callbackWithStringList(PassRefPtr<DOMStringList> listParam);
 
 private:
     V8TestCallback(v8::Local<v8::Object>, ScriptExecutionContext*);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
index 4c40d98..21c8804 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestInterface::info = { V8TestInterface::GetTemplate, V8TestInterface::derefObject, 0 };
+WrapperTypeInfo V8TestInterface::info = { V8TestInterface::GetTemplate, V8TestInterface::derefObject, 0, 0 };
 
 namespace TestInterfaceInternal {
 
@@ -87,7 +87,8 @@ v8::Handle<v8::Object> V8TestInterface::wrapSlow(TestInterface* impl)
         return wrapper;
 
     impl->ref();
-    getDOMObjectMap().set(impl, v8::Persistent<v8::Object>::New(wrapper));
+    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
+    getDOMObjectMap().set(impl, wrapperHandle);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
index ab9e6db..6d71ea7 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestMediaQueryListListener::info = { V8TestMediaQueryListListener::GetTemplate, V8TestMediaQueryListListener::derefObject, 0 };
+WrapperTypeInfo V8TestMediaQueryListListener::info = { V8TestMediaQueryListListener::GetTemplate, V8TestMediaQueryListListener::derefObject, 0, 0 };
 
 namespace TestMediaQueryListListenerInternal {
 
@@ -94,7 +94,8 @@ v8::Handle<v8::Object> V8TestMediaQueryListListener::wrapSlow(TestMediaQueryList
         return wrapper;
 
     impl->ref();
-    getDOMObjectMap().set(impl, v8::Persistent<v8::Object>::New(wrapper));
+    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
+    getDOMObjectMap().set(impl, wrapperHandle);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index 4298756..5884e89 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -46,7 +46,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestObj::info = { V8TestObj::GetTemplate, V8TestObj::derefObject, 0 };
+WrapperTypeInfo V8TestObj::info = { V8TestObj::GetTemplate, V8TestObj::derefObject, 0, 0 };
 
 namespace TestObjInternal {
 
@@ -1380,7 +1380,8 @@ v8::Handle<v8::Object> V8TestObj::wrapSlow(TestObj* impl)
         return wrapper;
 
     impl->ref();
-    getDOMObjectMap().set(impl, v8::Persistent<v8::Object>::New(wrapper));
+    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
+    getDOMObjectMap().set(impl, wrapperHandle);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
index fef8dbd..c6cc4d6 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
@@ -34,7 +34,7 @@
 
 namespace WebCore {
 
-WrapperTypeInfo V8TestSerializedScriptValueInterface::info = { V8TestSerializedScriptValueInterface::GetTemplate, V8TestSerializedScriptValueInterface::derefObject, 0 };
+WrapperTypeInfo V8TestSerializedScriptValueInterface::info = { V8TestSerializedScriptValueInterface::GetTemplate, V8TestSerializedScriptValueInterface::derefObject, 0, 0 };
 
 namespace TestSerializedScriptValueInterfaceInternal {
 
@@ -83,7 +83,8 @@ v8::Handle<v8::Object> V8TestSerializedScriptValueInterface::wrapSlow(TestSerial
 
     impl->ref();
     SerializedScriptValue::deserializeAndSetProperty(wrapper, "value", static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly), impl->value());
-    getDOMObjectMap().set(impl, v8::Persistent<v8::Object>::New(wrapper));
+    v8::Persistent<v8::Object> wrapperHandle = v8::Persistent<v8::Object>::New(wrapper);
+    getDOMObjectMap().set(impl, wrapperHandle);
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/v8/DebuggerScript.js b/Source/WebCore/bindings/v8/DebuggerScript.js
index 0bed33d..fe6e8ab 100644
--- a/Source/WebCore/bindings/v8/DebuggerScript.js
+++ b/Source/WebCore/bindings/v8/DebuggerScript.js
@@ -262,5 +262,4 @@ DebuggerScript._frameMirrorToJSCallFrame = function(frameMirror, callerFrame)
 }
 
 return DebuggerScript;
-
 })();
diff --git a/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp b/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
new file mode 100755
index 0000000..f149d8f
--- /dev/null
+++ b/Source/WebCore/bindings/v8/PageScriptDebugServer.cpp
@@ -0,0 +1,165 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PageScriptDebugServer.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "Frame.h"
+#include "Page.h"
+#include "ScriptDebugListener.h"
+#include "V8Binding.h"
+#include "V8DOMWindow.h"
+#include "V8Proxy.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+static Frame* retrieveFrame(v8::Handle<v8::Context> context)
+{
+    if (context.IsEmpty())
+        return 0;
+
+    // Test that context has associated global dom window object.
+    v8::Handle<v8::Object> global = context->Global();
+    if (global.IsEmpty())
+        return 0;
+
+    global = V8DOMWrapper::lookupDOMWrapper(V8DOMWindow::GetTemplate(), global);
+    if (global.IsEmpty())
+        return 0;
+
+    return V8Proxy::retrieveFrame(context);
+}
+
+PageScriptDebugServer& PageScriptDebugServer::shared()
+{
+    DEFINE_STATIC_LOCAL(PageScriptDebugServer, server, ());
+    return server;
+}
+
+PageScriptDebugServer::PageScriptDebugServer()
+    : ScriptDebugServer()
+    , m_pausedPage(0)
+    , m_enabled(true)
+{
+}
+
+void PageScriptDebugServer::addListener(ScriptDebugListener* listener, Page* page)
+{
+    if (!m_enabled)
+        return;
+
+    V8Proxy* proxy = V8Proxy::retrieve(page->mainFrame());
+    if (!proxy)
+        return;
+
+    v8::HandleScope scope;
+    v8::Local<v8::Context> debuggerContext = v8::Debug::GetDebugContext();
+    v8::Context::Scope contextScope(debuggerContext);
+
+    if (!m_listenersMap.size()) {
+        ensureDebuggerScriptCompiled();
+        ASSERT(!m_debuggerScript.get()->IsUndefined());
+        v8::Debug::SetDebugEventListener2(&PageScriptDebugServer::v8DebugEventCallback, v8::External::New(this));
+    }
+    m_listenersMap.set(page, listener);
+
+    V8DOMWindowShell* shell = proxy->windowShell();
+    if (!shell->isContextInitialized())
+        return;
+    v8::Handle<v8::Context> context = shell->context();
+    v8::Handle<v8::Function> getScriptsFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("getScripts")));
+    v8::Handle<v8::Value> argv[] = { context->GetData() };
+    v8::Handle<v8::Value> value = getScriptsFunction->Call(m_debuggerScript.get(), 1, argv);
+    if (value.IsEmpty())
+        return;
+    ASSERT(!value->IsUndefined() && value->IsArray());
+    v8::Handle<v8::Array> scriptsArray = v8::Handle<v8::Array>::Cast(value);
+    for (unsigned i = 0; i < scriptsArray->Length(); ++i)
+        dispatchDidParseSource(listener, v8::Handle<v8::Object>::Cast(scriptsArray->Get(v8::Integer::New(i))));
+}
+
+void PageScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page)
+{
+    if (!m_listenersMap.contains(page))
+        return;
+
+    if (m_pausedPage == page)
+        continueProgram();
+
+    m_listenersMap.remove(page);
+
+    if (m_listenersMap.isEmpty())
+        v8::Debug::SetDebugEventListener(0);
+    // FIXME: Remove all breakpoints set by the agent.
+}
+
+void PageScriptDebugServer::setClientMessageLoop(PassOwnPtr<ClientMessageLoop> clientMessageLoop)
+{
+    m_clientMessageLoop = clientMessageLoop;
+}
+
+ScriptDebugListener* PageScriptDebugServer::getDebugListenerForContext(v8::Handle<v8::Context> context)
+{
+    v8::HandleScope scope;
+    Frame* frame = retrieveFrame(context);
+    if (!frame)
+        return 0;
+    return m_listenersMap.get(frame->page());
+}
+
+void PageScriptDebugServer::runMessageLoopOnPause(v8::Handle<v8::Context> context)
+{
+    v8::HandleScope scope;
+    Frame* frame = retrieveFrame(context);
+    m_pausedPage = frame->page();
+
+    // Wait for continue or step command.
+    m_clientMessageLoop->run(m_pausedPage);
+
+    // The listener may have been removed in the nested loop.
+    if (ScriptDebugListener* listener = m_listenersMap.get(m_pausedPage))
+        listener->didContinue();
+     
+    m_pausedPage = 0;
+}
+
+void PageScriptDebugServer::quitMessageLoopOnPause()
+{
+    m_clientMessageLoop->quitNow();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebCore/bindings/v8/PageScriptDebugServer.h b/Source/WebCore/bindings/v8/PageScriptDebugServer.h
new file mode 100755
index 0000000..4b134c1
--- /dev/null
+++ b/Source/WebCore/bindings/v8/PageScriptDebugServer.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PageScriptDebugServer_h
+#define PageScriptDebugServer_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "ScriptDebugServer.h"
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class Page;
+
+class PageScriptDebugServer : public ScriptDebugServer {
+    WTF_MAKE_NONCOPYABLE(PageScriptDebugServer);
+public:
+    static PageScriptDebugServer& shared();
+
+    void addListener(ScriptDebugListener*, Page*);
+    void removeListener(ScriptDebugListener*, Page*);
+
+    // v8-specific methods.
+    void setEnabled(bool value) { m_enabled = value; }
+    
+    class ClientMessageLoop {
+    public:
+        virtual ~ClientMessageLoop() { }
+        virtual void run(Page*) = 0;
+        virtual void quitNow() = 0;
+    };
+    void setClientMessageLoop(PassOwnPtr<ClientMessageLoop>);
+
+private:
+    PageScriptDebugServer();
+    virtual ~PageScriptDebugServer() { }
+    
+    virtual ScriptDebugListener* getDebugListenerForContext(v8::Handle<v8::Context>);
+    virtual void runMessageLoopOnPause(v8::Handle<v8::Context>);
+    virtual void quitMessageLoopOnPause();
+
+    typedef HashMap<Page*, ScriptDebugListener*> ListenersMap;
+    ListenersMap m_listenersMap;
+    OwnPtr<ClientMessageLoop> m_clientMessageLoop;
+    Page* m_pausedPage;
+    bool m_enabled;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
+#endif // PageScriptDebugServer_h
diff --git a/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp b/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp
new file mode 100644
index 0000000..ba64263
--- /dev/null
+++ b/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RetainedDOMInfo.h"
+
+#include "Node.h"
+
+namespace WebCore {
+
+RetainedDOMInfo::RetainedDOMInfo(Node* root)
+    : m_root(root)
+{
+    ASSERT(m_root);
+}
+
+RetainedDOMInfo::~RetainedDOMInfo()
+{
+}
+
+void RetainedDOMInfo::Dispose()
+{
+    delete this;
+}
+
+bool RetainedDOMInfo::IsEquivalent(v8::RetainedObjectInfo* other)
+{
+    ASSERT(other);
+    return other == this || static_cast<WebCore::RetainedObjectInfo*>(other)->GetEquivalenceClass() == this->GetEquivalenceClass();
+}
+
+intptr_t RetainedDOMInfo::GetHash()
+{
+    return reinterpret_cast<intptr_t>(m_root);
+}
+    
+const char* RetainedDOMInfo::GetLabel()
+{
+    return m_root->inDocument() ? "Document DOM tree" : "Detached DOM tree";
+}
+
+intptr_t RetainedDOMInfo::GetElementCount()
+{
+    intptr_t count = 1;
+    Node* current = m_root;
+    while (current) {
+        current = current->traverseNextNode(m_root);
+        ++count;
+    }
+    return count;
+}
+
+intptr_t RetainedDOMInfo::GetEquivalenceClass()
+{
+    return reinterpret_cast<intptr_t>(m_root);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/RetainedDOMInfo.h b/Source/WebCore/bindings/v8/RetainedDOMInfo.h
new file mode 100644
index 0000000..6767f75
--- /dev/null
+++ b/Source/WebCore/bindings/v8/RetainedDOMInfo.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RetainedDOMInfo_h
+#define RetainedDOMInfo_h
+
+#include "RetainedObjectInfo.h"
+
+namespace WebCore {
+
+class Node;
+
+// Implements v8::RetainedObjectInfo.
+class RetainedDOMInfo : public RetainedObjectInfo {
+public:
+    explicit RetainedDOMInfo(Node* root);
+    virtual ~RetainedDOMInfo();
+    virtual void Dispose();
+    virtual bool IsEquivalent(v8::RetainedObjectInfo* other);
+    virtual intptr_t GetHash();
+    virtual const char* GetLabel();
+    virtual intptr_t GetElementCount();
+    virtual intptr_t GetEquivalenceClass();
+    
+private:
+    // V8 guarantees to keep RetainedObjectInfos alive only during a GC or heap snapshotting round, when renderer
+    // doesn't get control. This allows us to use raw pointers.
+    Node* m_root;
+};
+
+} // namespace WebCore
+
+#endif // RetainedDOMInfo_h
diff --git a/Source/WebCore/bindings/v8/RetainedObjectInfo.h b/Source/WebCore/bindings/v8/RetainedObjectInfo.h
new file mode 100644
index 0000000..0368fb1
--- /dev/null
+++ b/Source/WebCore/bindings/v8/RetainedObjectInfo.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RetainedObjectInfo_h
+#define RetainedObjectInfo_h
+
+#include <v8-profiler.h>
+
+namespace WebCore {
+
+class RetainedObjectInfo : public v8::RetainedObjectInfo {
+public:
+    virtual intptr_t GetEquivalenceClass() = 0;
+};
+
+} // namespace WebCore
+
+#endif // RetainedObjectInfo_h
diff --git a/Source/WebCore/bindings/v8/ScriptCachedFrameData.cpp b/Source/WebCore/bindings/v8/ScriptCachedFrameData.cpp
index dc28f32..9e15d1c 100644
--- a/Source/WebCore/bindings/v8/ScriptCachedFrameData.cpp
+++ b/Source/WebCore/bindings/v8/ScriptCachedFrameData.cpp
@@ -26,6 +26,10 @@
 #include "config.h"
 #include "ScriptCachedFrameData.h"
 
+#if PLATFORM(ANDROID) || PLATFORM(QT)
+// FIXME: the right guard should be ENABLE(PAGE_CACHE). Replace with the right guard, once
+// https://bugs.webkit.org/show_bug.cgi?id=35061 is fixed.
+
 #include "Frame.h"
 #include "ScriptController.h"
 #include "V8DOMWindow.h"
@@ -72,3 +76,5 @@ void ScriptCachedFrameData::clear()
 }
 
 } // namespace WebCore
+
+#endif // PLATFORM(ANDROID) || PLATFORM(QT)
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
index cc7fba8..5758639 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010, Google Inc. All rights reserved.
+ * Copyright (c) 2010-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -33,13 +33,10 @@
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 
-#include "Frame.h"
+#include "DebuggerScriptSource.h"
 #include "JavaScriptCallFrame.h"
-#include "Page.h"
 #include "ScriptDebugListener.h"
 #include "V8Binding.h"
-#include "V8DOMWindow.h"
-#include "V8Proxy.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -57,92 +54,12 @@ private:
 
 }
 
-static Frame* retrieveFrame(v8::Handle<v8::Context> context)
-{
-    if (context.IsEmpty())
-        return 0;
-
-    // Test that context has associated global dom window object.
-    v8::Handle<v8::Object> global = context->Global();
-    if (global.IsEmpty())
-        return 0;
-
-    global = V8DOMWrapper::lookupDOMWrapper(V8DOMWindow::GetTemplate(), global);
-    if (global.IsEmpty())
-        return 0;
-
-    return V8Proxy::retrieveFrame(context);
-}
-
-ScriptDebugServer& ScriptDebugServer::shared()
-{
-    DEFINE_STATIC_LOCAL(ScriptDebugServer, server, ());
-    return server;
-}
-
 ScriptDebugServer::ScriptDebugServer()
     : m_pauseOnExceptionsState(DontPauseOnExceptions)
-    , m_pausedPage(0)
-    , m_enabled(true)
     , m_breakpointsActivated(true)
 {
 }
 
-void ScriptDebugServer::setDebuggerScriptSource(const String& scriptSource)
-{
-    m_debuggerScriptSource = scriptSource;
-}
-
-void ScriptDebugServer::addListener(ScriptDebugListener* listener, Page* page)
-{
-    if (!m_enabled)
-        return;
-
-    V8Proxy* proxy = V8Proxy::retrieve(page->mainFrame());
-    if (!proxy)
-        return;
-
-    v8::HandleScope scope;
-    v8::Local<v8::Context> debuggerContext = v8::Debug::GetDebugContext();
-    v8::Context::Scope contextScope(debuggerContext);
-
-    if (!m_listenersMap.size()) {
-        ensureDebuggerScriptCompiled();
-        ASSERT(!m_debuggerScript.get()->IsUndefined());
-        v8::Debug::SetDebugEventListener2(&ScriptDebugServer::v8DebugEventCallback);
-    }
-    m_listenersMap.set(page, listener);
-
-    V8DOMWindowShell* shell = proxy->windowShell();
-    if (!shell->isContextInitialized())
-        return;
-    v8::Handle<v8::Context> context = shell->context();
-    v8::Handle<v8::Function> getScriptsFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("getScripts")));
-    v8::Handle<v8::Value> argv[] = { context->GetData() };
-    v8::Handle<v8::Value> value = getScriptsFunction->Call(m_debuggerScript.get(), 1, argv);
-    if (value.IsEmpty())
-        return;
-    ASSERT(!value->IsUndefined() && value->IsArray());
-    v8::Handle<v8::Array> scriptsArray = v8::Handle<v8::Array>::Cast(value);
-    for (unsigned i = 0; i < scriptsArray->Length(); ++i)
-        dispatchDidParseSource(listener, v8::Handle<v8::Object>::Cast(scriptsArray->Get(v8::Integer::New(i))));
-}
-
-void ScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page)
-{
-    if (!m_listenersMap.contains(page))
-        return;
-
-    if (m_pausedPage == page)
-        continueProgram();
-
-    m_listenersMap.remove(page);
-
-    if (m_listenersMap.isEmpty())
-        v8::Debug::SetDebugEventListener(0);
-    // FIXME: Remove all breakpoints set by the agent.
-}
-
 String ScriptDebugServer::setBreakpoint(const String& sourceID, const ScriptBreakpoint& scriptBreakpoint, int* actualLineNumber, int* actualColumnNumber)
 {
     v8::HandleScope scope;
@@ -229,7 +146,7 @@ void ScriptDebugServer::setPauseOnExceptionsState(PauseOnExceptionsState pauseOn
 
 void ScriptDebugServer::setPauseOnNextStatement(bool pause)
 {
-    if (m_pausedPage)
+    if (isPaused())
         return;
     if (pause)
         v8::Debug::DebugBreak();
@@ -239,17 +156,15 @@ void ScriptDebugServer::setPauseOnNextStatement(bool pause)
 
 void ScriptDebugServer::breakProgram()
 {
-    DEFINE_STATIC_LOCAL(v8::Persistent<v8::FunctionTemplate>, callbackTemplate, ());
-
     if (!m_breakpointsActivated)
         return;
 
     if (!v8::Context::InContext())
         return;
 
-    if (callbackTemplate.IsEmpty()) {
-        callbackTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New());
-        callbackTemplate->SetCallHandler(&ScriptDebugServer::breakProgramCallback);
+    if (m_breakProgramCallbackTemplate.get().IsEmpty()) {
+        m_breakProgramCallbackTemplate.set(v8::FunctionTemplate::New());
+        m_breakProgramCallbackTemplate.get()->SetCallHandler(&ScriptDebugServer::breakProgramCallback, v8::External::New(this));
     }
 
     v8::Handle<v8::Context> context = v8::Context::GetCurrent();
@@ -257,21 +172,22 @@ void ScriptDebugServer::breakProgram()
         return;
 
     m_pausedPageContext = *context;
-    v8::Handle<v8::Function> breakProgramFunction = callbackTemplate->GetFunction();
+    v8::Handle<v8::Function> breakProgramFunction = m_breakProgramCallbackTemplate.get()->GetFunction();
     v8::Debug::Call(breakProgramFunction);
     m_pausedPageContext.Clear();
 }
 
 void ScriptDebugServer::continueProgram()
 {
-    if (m_pausedPage)
-        m_clientMessageLoop->quitNow();
-    didResume();
+    if (isPaused())
+        quitMessageLoopOnPause();
+    m_currentCallFrame.clear();
+    m_executionState.clear();
 }
 
 void ScriptDebugServer::stepIntoStatement()
 {
-    ASSERT(m_pausedPage);
+    ASSERT(isPaused());
     v8::Handle<v8::Function> function = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("stepIntoStatement")));
     v8::Handle<v8::Value> argv[] = { m_executionState.get() };
     function->Call(m_debuggerScript.get(), 1, argv);
@@ -280,7 +196,7 @@ void ScriptDebugServer::stepIntoStatement()
 
 void ScriptDebugServer::stepOverStatement()
 {
-    ASSERT(m_pausedPage);
+    ASSERT(isPaused());
     v8::Handle<v8::Function> function = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("stepOverStatement")));
     v8::Handle<v8::Value> argv[] = { m_executionState.get() };
     function->Call(m_debuggerScript.get(), 1, argv);
@@ -289,7 +205,7 @@ void ScriptDebugServer::stepOverStatement()
 
 void ScriptDebugServer::stepOutOfFunction()
 {
-    ASSERT(m_pausedPage);
+    ASSERT(isPaused());
     v8::Handle<v8::Function> function = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("stepOutOfFunction")));
     v8::Handle<v8::Value> argv[] = { m_executionState.get() };
     function->Call(m_debuggerScript.get(), 1, argv);
@@ -302,7 +218,7 @@ bool ScriptDebugServer::editScriptSource(const String& sourceID, const String& n
     v8::HandleScope scope;
 
     OwnPtr<v8::Context::Scope> contextScope;
-    if (!m_pausedPage)
+    if (!isPaused())
         contextScope.set(new v8::Context::Scope(v8::Debug::GetDebugContext()));
 
     v8::Handle<v8::Function> function = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("editScriptSource")));
@@ -337,11 +253,6 @@ PassRefPtr<JavaScriptCallFrame> ScriptDebugServer::currentCallFrame()
     return m_currentCallFrame;
 }
 
-void ScriptDebugServer::setEnabled(bool value)
-{
-     m_enabled = value;
-}
-
 void ScriptDebugServer::interruptAndRun(PassOwnPtr<Task> task)
 {
     v8::Debug::DebugBreakForCommand(new ClientDataImpl(task));
@@ -352,44 +263,42 @@ void ScriptDebugServer::runPendingTasks()
     v8::Debug::ProcessDebugMessages();
 }
 
+static ScriptDebugServer* toScriptDebugServer(v8::Handle<v8::Value> data)
+{
+    void* p = v8::Handle<v8::External>::Cast(data)->Value();
+    return static_cast<ScriptDebugServer*>(p);
+}
+
 v8::Handle<v8::Value> ScriptDebugServer::breakProgramCallback(const v8::Arguments& args)
 {
     ASSERT(2 == args.Length());
-    ScriptDebugServer::shared().breakProgram(v8::Handle<v8::Object>::Cast(args[0]));
+    
+    ScriptDebugServer* thisPtr = toScriptDebugServer(args.Data());
+    thisPtr->breakProgram(v8::Handle<v8::Object>::Cast(args[0]));
     return v8::Undefined();
 }
 
 void ScriptDebugServer::breakProgram(v8::Handle<v8::Object> executionState)
 {
     // Don't allow nested breaks.
-    if (m_pausedPage)
-        return;
-
-    Frame* frame = retrieveFrame(m_pausedPageContext);
-    if (!frame)
+    if (isPaused())
         return;
 
-    ScriptDebugListener* listener = m_listenersMap.get(frame->page());
+    ScriptDebugListener* listener = getDebugListenerForContext(m_pausedPageContext);
     if (!listener)
         return;
 
     m_executionState.set(executionState);
-    m_pausedPage = frame->page();
     ScriptState* currentCallFrameState = ScriptState::forContext(m_pausedPageContext);
     listener->didPause(currentCallFrameState);
 
-    // Wait for continue or step command.
-    m_clientMessageLoop->run(m_pausedPage);
-    ASSERT(!m_pausedPage);
-
-    // The listener may have been removed in the nested loop.
-    if (ScriptDebugListener* listener = m_listenersMap.get(frame->page()))
-        listener->didContinue();
+    runMessageLoopOnPause(m_pausedPageContext);
 }
 
 void ScriptDebugServer::v8DebugEventCallback(const v8::Debug::EventDetails& eventDetails)
 {
-    ScriptDebugServer::shared().handleV8DebugEvent(eventDetails);
+    ScriptDebugServer* thisPtr = toScriptDebugServer(eventDetails.GetCallbackData());
+    thisPtr->handleV8DebugEvent(eventDetails);
 }
 
 void ScriptDebugServer::handleV8DebugEvent(const v8::Debug::EventDetails& eventDetails)
@@ -408,31 +317,28 @@ void ScriptDebugServer::handleV8DebugEvent(const v8::Debug::EventDetails& eventD
     v8::Handle<v8::Context> eventContext = eventDetails.GetEventContext();
     ASSERT(!eventContext.IsEmpty());
 
-    Frame* frame = retrieveFrame(eventContext);
-    if (frame) {
-        ScriptDebugListener* listener = m_listenersMap.get(frame->page());
-        if (listener) {
-            v8::HandleScope scope;
-            if (event == v8::AfterCompile) {
-                v8::Context::Scope contextScope(v8::Debug::GetDebugContext());
-                v8::Handle<v8::Function> onAfterCompileFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("getAfterCompileScript")));
-                v8::Handle<v8::Value> argv[] = { eventDetails.GetEventData() };
-                v8::Handle<v8::Value> value = onAfterCompileFunction->Call(m_debuggerScript.get(), 1, argv);
-                ASSERT(value->IsObject());
-                v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(value);
-                dispatchDidParseSource(listener, object);
-            } else if (event == v8::Break || event == v8::Exception) {
-                if (event == v8::Exception) {
-                    v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(1);
-                    // Stack trace is empty in case of syntax error. Silently continue execution in such cases.
-                    if (!stackTrace->GetFrameCount())
-                        return;
-                }
-
-                m_pausedPageContext = *eventContext;
-                breakProgram(eventDetails.GetExecutionState());
-                m_pausedPageContext.Clear();
+    ScriptDebugListener* listener = getDebugListenerForContext(eventContext);
+    if (listener) {
+        v8::HandleScope scope;
+        if (event == v8::AfterCompile) {
+            v8::Context::Scope contextScope(v8::Debug::GetDebugContext());
+            v8::Handle<v8::Function> onAfterCompileFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("getAfterCompileScript")));
+            v8::Handle<v8::Value> argv[] = { eventDetails.GetEventData() };
+            v8::Handle<v8::Value> value = onAfterCompileFunction->Call(m_debuggerScript.get(), 1, argv);
+            ASSERT(value->IsObject());
+            v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(value);
+            dispatchDidParseSource(listener, object);
+        } else if (event == v8::Break || event == v8::Exception) {
+            if (event == v8::Exception) {
+                v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(1);
+                // Stack trace is empty in case of syntax error. Silently continue execution in such cases.
+                if (!stackTrace->GetFrameCount())
+                    return;
             }
+
+            m_pausedPageContext = *eventContext;
+            breakProgram(eventDetails.GetExecutionState());
+            m_pausedPageContext.Clear();
         }
     }
 }
@@ -454,15 +360,14 @@ void ScriptDebugServer::ensureDebuggerScriptCompiled()
         v8::HandleScope scope;
         v8::Local<v8::Context> debuggerContext = v8::Debug::GetDebugContext();
         v8::Context::Scope contextScope(debuggerContext);
-        m_debuggerScript.set(v8::Handle<v8::Object>::Cast(v8::Script::Compile(v8String(m_debuggerScriptSource))->Run()));
+        String debuggerScriptSource(reinterpret_cast<const char*>(DebuggerScriptSource_js), sizeof(DebuggerScriptSource_js));
+        m_debuggerScript.set(v8::Handle<v8::Object>::Cast(v8::Script::Compile(v8String(debuggerScriptSource))->Run()));
     }
 }
 
-void ScriptDebugServer::didResume()
+bool ScriptDebugServer::isPaused()
 {
-    m_currentCallFrame.clear();
-    m_executionState.clear();
-    m_pausedPage = 0;
+    return !m_executionState.get().IsEmpty();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptDebugServer.h b/Source/WebCore/bindings/v8/ScriptDebugServer.h
index af3d2ab..15004ea 100644
--- a/Source/WebCore/bindings/v8/ScriptDebugServer.h
+++ b/Source/WebCore/bindings/v8/ScriptDebugServer.h
@@ -45,17 +45,11 @@
 
 namespace WebCore {
 
-class Page;
 class ScriptDebugListener;
 
 class ScriptDebugServer {
     WTF_MAKE_NONCOPYABLE(ScriptDebugServer);
 public:
-    static ScriptDebugServer& shared();
-
-    void addListener(ScriptDebugListener*, Page*);
-    void removeListener(ScriptDebugListener*, Page*);
-
     String setBreakpoint(const String& sourceID, const ScriptBreakpoint&, int* actualLineNumber, int* actualColumnNumber);
     void removeBreakpoint(const String& breakpointId);
     void clearBreakpoints();
@@ -83,23 +77,8 @@ public:
     void recompileAllJSFunctionsSoon() { }
     void recompileAllJSFunctions(Timer<ScriptDebugServer>* = 0) { }
 
-    void pageCreated(Page*) { }
-
-    // v8-specific methods.
-    void setDebuggerScriptSource(const String& scriptSource);
-
-    class ClientMessageLoop {
-    public:
-        virtual ~ClientMessageLoop() { }
-        virtual void run(Page*) = 0;
-        virtual void quitNow() = 0;
-    };
-    void setClientMessageLoop(PassOwnPtr<ClientMessageLoop> clientMessageLoop) { m_clientMessageLoop = clientMessageLoop; }
-
     PassRefPtr<JavaScriptCallFrame> currentCallFrame();
 
-    void setEnabled(bool);
-
     class Task {
     public:
         virtual ~Task() { }
@@ -108,9 +87,13 @@ public:
     static void interruptAndRun(PassOwnPtr<Task>);
     void runPendingTasks();
 
-private:
+protected:
     ScriptDebugServer();
     ~ScriptDebugServer() { }
+    
+    virtual ScriptDebugListener* getDebugListenerForContext(v8::Handle<v8::Context>) = 0;
+    virtual void runMessageLoopOnPause(v8::Handle<v8::Context>) = 0;
+    virtual void quitMessageLoopOnPause() = 0;
 
     static v8::Handle<v8::Value> breakProgramCallback(const v8::Arguments& args);
     void breakProgram(v8::Handle<v8::Object> executionState);
@@ -121,21 +104,17 @@ private:
     void dispatchDidParseSource(ScriptDebugListener* listener, v8::Handle<v8::Object> sourceObject);
 
     void ensureDebuggerScriptCompiled();
-    void didResume();
+    
+    bool isPaused();
 
-    typedef HashMap<Page*, ScriptDebugListener*> ListenersMap;
-    ListenersMap m_listenersMap;
-    String m_debuggerScriptSource;
     PauseOnExceptionsState m_pauseOnExceptionsState;
     OwnHandle<v8::Object> m_debuggerScript;
     RefPtr<JavaScriptCallFrame> m_currentCallFrame;
     OwnHandle<v8::Object> m_executionState;
-    OwnPtr<ClientMessageLoop> m_clientMessageLoop;
-    Page* m_pausedPage;
     v8::Local<v8::Context> m_pausedPageContext;
-    bool m_enabled;
 
     bool m_breakpointsActivated;
+    OwnHandle<v8::FunctionTemplate> m_breakProgramCallbackTemplate;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptHeapSnapshot.cpp b/Source/WebCore/bindings/v8/ScriptHeapSnapshot.cpp
index 09e1e54..68ed8da 100644
--- a/Source/WebCore/bindings/v8/ScriptHeapSnapshot.cpp
+++ b/Source/WebCore/bindings/v8/ScriptHeapSnapshot.cpp
@@ -40,6 +40,11 @@
 
 namespace WebCore {
 
+ScriptHeapSnapshot::~ScriptHeapSnapshot()
+{
+    const_cast<v8::HeapSnapshot*>(m_snapshot)->Delete();
+}
+
 String ScriptHeapSnapshot::title() const
 {
     v8::HandleScope scope;
@@ -76,10 +81,4 @@ void ScriptHeapSnapshot::writeJSON(ScriptHeapSnapshot::OutputStream* stream)
     m_snapshot->Serialize(&outputStream, v8::HeapSnapshot::kJSON);
 }
 
-int ScriptHeapSnapshot::exactRetainedSize(uint64_t nodeId)
-{
-    const v8::HeapGraphNode* node = m_snapshot->GetNodeById(nodeId);
-    return node ? node->GetRetainedSize(true) : -1;
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptHeapSnapshot.h b/Source/WebCore/bindings/v8/ScriptHeapSnapshot.h
index 6cfd76d..4093fa7 100644
--- a/Source/WebCore/bindings/v8/ScriptHeapSnapshot.h
+++ b/Source/WebCore/bindings/v8/ScriptHeapSnapshot.h
@@ -54,12 +54,11 @@ public:
     {
         return adoptRef(new ScriptHeapSnapshot(snapshot));
     }
-    virtual ~ScriptHeapSnapshot() {}
+    virtual ~ScriptHeapSnapshot();
 
     String title() const;
     unsigned int uid() const;
     void writeJSON(OutputStream* stream);
-    int exactRetainedSize(uint64_t nodeId);
 
 private:
     ScriptHeapSnapshot(const v8::HeapSnapshot* snapshot)
diff --git a/Source/WebCore/bindings/v8/ScriptProfile.cpp b/Source/WebCore/bindings/v8/ScriptProfile.cpp
index c5a6dbf..2c9f0f5 100644
--- a/Source/WebCore/bindings/v8/ScriptProfile.cpp
+++ b/Source/WebCore/bindings/v8/ScriptProfile.cpp
@@ -39,6 +39,11 @@
 
 namespace WebCore {
 
+ScriptProfile::~ScriptProfile()
+{
+    const_cast<v8::CpuProfile*>(m_profile)->Delete();
+}
+
 String ScriptProfile::title() const
 {
     v8::HandleScope scope;
diff --git a/Source/WebCore/bindings/v8/ScriptProfile.h b/Source/WebCore/bindings/v8/ScriptProfile.h
index 0182669..d8196a4 100644
--- a/Source/WebCore/bindings/v8/ScriptProfile.h
+++ b/Source/WebCore/bindings/v8/ScriptProfile.h
@@ -48,7 +48,7 @@ public:
     {
         return adoptRef(new ScriptProfile(profile));
     }
-    virtual ~ScriptProfile() {}
+    virtual ~ScriptProfile();
 
     String title() const;
     unsigned int uid() const;
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.cpp b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
index 615dcfc..3fe45a8 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
@@ -32,9 +32,11 @@
 #include "ScriptProfiler.h"
 
 #include "InspectorValues.h"
+#include "RetainedDOMInfo.h"
+#include "V8Binding.h"
+#include "V8Node.h"
 
 #include <v8-profiler.h>
-#include <V8Binding.h>
 
 namespace WebCore {
 
@@ -53,6 +55,14 @@ PassRefPtr<ScriptProfile> ScriptProfiler::stop(ScriptState* state, const String&
     return profile ? ScriptProfile::create(profile) : 0;
 }
 
+void ScriptProfiler::collectGarbage()
+{
+    // NOTE : There is currently no direct way to collect memory from the v8 C++ API
+    // but notifying low-memory forces a mark-compact, which is exactly what we want
+    // in this case.
+    v8::V8::LowMemoryNotification();
+}
+
 namespace {
 
 class ActivityControlAdapter : public v8::ActivityControl {
@@ -90,4 +100,19 @@ PassRefPtr<ScriptHeapSnapshot> ScriptProfiler::takeHeapSnapshot(const String& ti
     return snapshot ? ScriptHeapSnapshot::create(snapshot) : 0;
 }
 
+static v8::RetainedObjectInfo* retainedDOMInfo(uint16_t classId, v8::Handle<v8::Value> wrapper)
+{
+    ASSERT(classId == v8DOMSubtreeClassId);
+    if (!wrapper->IsObject())
+        return 0;
+    Node* node = V8Node::toNative(wrapper.As<v8::Object>());
+    return node ? new RetainedDOMInfo(node) : 0;
+}
+
+void ScriptProfiler::initialize()
+{
+    v8::HeapProfiler::DefineWrapperClass(v8DOMSubtreeClassId, &retainedDOMInfo);
+}
+
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.h b/Source/WebCore/bindings/v8/ScriptProfiler.h
index 9016668..92a980b 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.h
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.h
@@ -53,9 +53,11 @@ public:
         virtual bool isCanceled() = 0;
     };
 
+    static void collectGarbage();
     static void start(ScriptState* state, const String& title);
     static PassRefPtr<ScriptProfile> stop(ScriptState* state, const String& title);
     static PassRefPtr<ScriptHeapSnapshot> takeHeapSnapshot(const String& title, HeapSnapshotProgress*);
+    static void initialize();
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/SerializedScriptValue.h b/Source/WebCore/bindings/v8/SerializedScriptValue.h
index c0e9109..212be66 100644
--- a/Source/WebCore/bindings/v8/SerializedScriptValue.h
+++ b/Source/WebCore/bindings/v8/SerializedScriptValue.h
@@ -37,7 +37,7 @@
 
 namespace WebCore {
 
-class SerializedScriptValue : public ThreadSafeShared<SerializedScriptValue> {
+class SerializedScriptValue : public ThreadSafeRefCounted<SerializedScriptValue> {
 public:
     static void deserializeAndSetProperty(v8::Handle<v8::Object>, const char* propertyName,
                                           v8::PropertyAttribute, SerializedScriptValue*);
diff --git a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
index d88d8a6..e025008 100644
--- a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
@@ -43,6 +43,7 @@
 #include "ScriptCallStack.h"
 #include "ScriptCallStackFactory.h"
 #include "ScriptController.h"
+#include "ScriptProfiler.h"
 #include "StorageNamespace.h"
 #include "V8Binding.h"
 #include "V8BindingState.h"
@@ -305,6 +306,8 @@ bool V8DOMWindowShell::initContextIfNeeded()
 
         v8::V8::SetFailedAccessCheckCallbackFunction(reportUnsafeJavaScriptAccess);
 
+        ScriptProfiler::initialize();
+        
         isV8Initialized = true;
     }
 
diff --git a/Source/WebCore/bindings/v8/V8GCController.cpp b/Source/WebCore/bindings/v8/V8GCController.cpp
index cda9f3d..82c9ca4 100644
--- a/Source/WebCore/bindings/v8/V8GCController.cpp
+++ b/Source/WebCore/bindings/v8/V8GCController.cpp
@@ -34,27 +34,20 @@
 #include "ActiveDOMObject.h"
 #include "Attr.h"
 #include "DOMDataStore.h"
-#include "Frame.h"
+#include "DOMImplementation.h"
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
 #include "MessagePort.h"
 #include "PlatformBridge.h"
-#include "SVGElement.h"
+#include "RetainedDOMInfo.h"
+#include "RetainedObjectInfo.h"
 #include "V8Binding.h"
-#include "V8CSSCharsetRule.h"
-#include "V8CSSFontFaceRule.h"
-#include "V8CSSImportRule.h"
-#include "V8CSSMediaRule.h"
+#include "V8CSSRule.h"
 #include "V8CSSRuleList.h"
 #include "V8CSSStyleDeclaration.h"
-#include "V8CSSStyleRule.h"
-#include "V8CSSStyleSheet.h"
-#include "V8DOMMap.h"
-#include "V8HTMLLinkElement.h"
-#include "V8HTMLStyleElement.h"
+#include "V8DOMImplementation.h"
 #include "V8MessagePort.h"
-#include "V8ProcessingInstruction.h"
-#include "V8Proxy.h"
+#include "V8StyleSheet.h"
 #include "V8StyleSheetList.h"
 #include "WrapperTypeInfo.h"
 
@@ -175,19 +168,86 @@ public:
     }
 };
 
-class GrouperItem {
+// Implements v8::RetainedObjectInfo.
+class UnspecifiedGroup : public RetainedObjectInfo {
 public:
-    GrouperItem(uintptr_t groupId, v8::Persistent<v8::Object> wrapper) 
-        : m_groupId(groupId)
-        , m_wrapper(wrapper) 
-        {
-        }
+    explicit UnspecifiedGroup(void* object)
+        : m_object(object)
+    {
+        ASSERT(m_object);
+    }
+    
+    virtual void Dispose() { delete this; }
+  
+    virtual bool IsEquivalent(v8::RetainedObjectInfo* other)
+    {
+        ASSERT(other);
+        return other == this || static_cast<WebCore::RetainedObjectInfo*>(other)->GetEquivalenceClass() == this->GetEquivalenceClass();
+    }
 
+    virtual intptr_t GetHash()
+    {
+        return reinterpret_cast<intptr_t>(m_object);
+    }
+    
+    virtual const char* GetLabel()
+    {
+        return "Object group";
+    }
+
+    virtual intptr_t GetEquivalenceClass()
+    {
+        return reinterpret_cast<intptr_t>(m_object);
+    }
+
+private:
+    void* m_object;
+};
+
+class GroupId {
+public:
+    GroupId() : m_type(NullType), m_groupId(0) {}
+    GroupId(Node* node) : m_type(NodeType), m_node(node) {}
+    GroupId(void* other) : m_type(OtherType), m_other(other) {}
+    bool operator!() const { return m_type == NullType; }
     uintptr_t groupId() const { return m_groupId; }
+    RetainedObjectInfo* createRetainedObjectInfo() const
+    {
+        switch (m_type) {
+        case NullType:
+            return 0;
+        case NodeType:
+            return new RetainedDOMInfo(m_node);
+        case OtherType:
+            return new UnspecifiedGroup(m_other);
+        default:
+            return 0;
+        }
+    }
+    
+private:
+    enum Type {
+        NullType,
+        NodeType,
+        OtherType
+    };
+    Type m_type;
+    union {
+        uintptr_t m_groupId;
+        Node* m_node;
+        void* m_other;
+    };
+};
+
+class GrouperItem {
+public:
+    GrouperItem(GroupId groupId, v8::Persistent<v8::Object> wrapper) : m_groupId(groupId), m_wrapper(wrapper) {}
+    uintptr_t groupId() const { return m_groupId.groupId(); }
+    RetainedObjectInfo* createRetainedObjectInfo() const { return m_groupId.createRetainedObjectInfo(); }
     v8::Persistent<v8::Object> wrapper() const { return m_wrapper; }
 
 private:
-    uintptr_t m_groupId;
+    GroupId m_groupId;
     v8::Persistent<v8::Object> m_wrapper;
 };
 
@@ -198,215 +258,160 @@ bool operator<(const GrouperItem& a, const GrouperItem& b)
 
 typedef Vector<GrouperItem> GrouperList;
 
-void makeV8ObjectGroups(GrouperList& grouper)
+// If the node is in document, put it in the ownerDocument's object group.
+//
+// If an image element was created by JavaScript "new Image",
+// it is not in a document. However, if the load event has not
+// been fired (still onloading), it is treated as in the document.
+//
+// Otherwise, the node is put in an object group identified by the root
+// element of the tree to which it belongs.
+static GroupId calculateGroupId(Node* node)
 {
-    // Group by sorting by the group id.
-    std::sort(grouper.begin(), grouper.end());
-
-    // FIXME Should probably work in iterators here, but indexes were easier for my simple mind.
-    for (size_t i = 0; i < grouper.size(); ) {
-        // Seek to the next key (or the end of the list).
-        size_t nextKeyIndex = grouper.size();
-        for (size_t j = i; j < grouper.size(); ++j) {
-            if (grouper[i].groupId() != grouper[j].groupId()) {
-                nextKeyIndex = j;
-                break;
-            }
-        }
+    if (node->inDocument() || (node->hasTagName(HTMLNames::imgTag) && !static_cast<HTMLImageElement*>(node)->haveFiredLoadEvent()))
+        return GroupId(node->document());
+
+    Node* root = node;
+    if (node->isAttributeNode()) {
+        root = static_cast<Attr*>(node)->ownerElement();
+        // If the attribute has no element, no need to put it in the group,
+        // because it'll always be a group of 1.
+        if (!root)
+            return GroupId();
+    } else {
+        while (Node* parent = root->parentNode())
+            root = parent;
+    }
 
-        ASSERT(nextKeyIndex > i);
+    return GroupId(root);
+}
 
-        // We only care about a group if it has more than one object. If it only
-        // has one object, it has nothing else that needs to be kept alive.
-        if (nextKeyIndex - i <= 1) {
-            i = nextKeyIndex;
-            continue;
+static GroupId calculateGroupId(StyleBase* styleBase)
+{
+    ASSERT(styleBase);
+    StyleBase* current = styleBase;
+    StyleSheet* styleSheet = 0;
+    while (true) {
+        // Special case: CSSStyleDeclarations might be either inline and in this case
+        // we need to group them with their node or regular ones.
+        if (current->isMutableStyleDeclaration()) {
+            CSSMutableStyleDeclaration* cssMutableStyleDeclaration = static_cast<CSSMutableStyleDeclaration*>(current);
+            if (cssMutableStyleDeclaration->isInlineStyleDeclaration()) {
+                ASSERT(cssMutableStyleDeclaration->parent()->isStyleSheet());
+                return calculateGroupId(cssMutableStyleDeclaration->node());
+            }
+            // Either we have no parent, or this parent is a CSSRule.
+            ASSERT(cssMutableStyleDeclaration->parent() == cssMutableStyleDeclaration->parentRule());
         }
 
-        Vector<v8::Persistent<v8::Value> > group;
-        group.reserveCapacity(nextKeyIndex - i);
-        for (; i < nextKeyIndex; ++i) {
-            v8::Persistent<v8::Value> wrapper = grouper[i].wrapper();
-            if (!wrapper.IsEmpty())
-                group.append(wrapper);
-        }
+        if (current->isStyleSheet())
+            styleSheet = static_cast<StyleSheet*>(current);
 
-        if (group.size() > 1)
-            v8::V8::AddObjectGroup(&group[0], group.size());
+        StyleBase* parent = current->parent();
+        if (!parent)
+            break;
+        current = parent;
+    }
 
-        ASSERT(i == nextKeyIndex);
+    if (styleSheet) {
+        if (Node* ownerNode = styleSheet->ownerNode())
+            return calculateGroupId(ownerNode);
+        return GroupId(styleSheet);
     }
+
+    return GroupId(current);
 }
 
-class NodeGrouperVisitor : public DOMWrapperMap<Node>::Visitor {
+class GrouperVisitor : public DOMWrapperMap<Node>::Visitor, public DOMWrapperMap<void>::Visitor {
 public:
-    NodeGrouperVisitor()
-    {
-        // FIXME: grouper_.reserveCapacity(node_map.size());  ?
-    }
-
     void visitDOMWrapper(DOMDataStore* store, Node* node, v8::Persistent<v8::Object> wrapper)
     {
-        // If the node is in document, put it in the ownerDocument's object group.
-        //
-        // If an image element was created by JavaScript "new Image",
-        // it is not in a document. However, if the load event has not
-        // been fired (still onloading), it is treated as in the document.
-        //
-        // Otherwise, the node is put in an object group identified by the root
-        // element of the tree to which it belongs.
-        uintptr_t groupId;
-        if (node->inDocument() || (node->hasTagName(HTMLNames::imgTag) && !static_cast<HTMLImageElement*>(node)->haveFiredLoadEvent()))
-            groupId = reinterpret_cast<uintptr_t>(node->document());
-        else {
-            Node* root = node;
-            if (node->isAttributeNode()) {
-                root = static_cast<Attr*>(node)->ownerElement();
-                // If the attribute has no element, no need to put it in the group,
-                // because it'll always be a group of 1.
-                if (!root)
-                    return;
-            } else {
-                while (root->parentNode())
-                    root = root->parentNode();
-
-                // If the node is alone in its DOM tree (doesn't have a parent or any
-                // children) then the group will be filtered out later anyway.
-                if (root == node && !node->hasChildNodes() && !node->hasAttributes())
-                    return;
-            }
-            groupId = reinterpret_cast<uintptr_t>(root);
-        }
+        GroupId groupId = calculateGroupId(node);
+        if (!groupId)
+            return;
         m_grouper.append(GrouperItem(groupId, wrapper));
+    }
 
-        // If the node is styled and there is a wrapper for the inline
-        // style declaration, we need to keep that style declaration
-        // wrapper alive as well, so we add it to the object group.
-        if (node->isStyledElement()) {
-            StyledElement* element = reinterpret_cast<StyledElement*>(node);
-            addDOMObjectToGroup(store, groupId, element->inlineStyleDecl());
-        }
-
-        if (node->isDocumentNode()) {
-            Document* document = reinterpret_cast<Document*>(node);
-            addDOMObjectToGroup(store, groupId, document->styleSheets());
-            addDOMObjectToGroup(store, groupId, document->implementation());
-        }
-
+    void visitDOMWrapper(DOMDataStore* store, void* object, v8::Persistent<v8::Object> wrapper)
+    {
         WrapperTypeInfo* typeInfo = V8DOMWrapper::domWrapperType(wrapper);
 
-        if (V8HTMLLinkElement::info.equals(typeInfo)) {
-            HTMLLinkElement* htmlLinkElement = static_cast<HTMLLinkElement*>(node);
-            addDOMObjectToGroup(store, groupId, htmlLinkElement->sheet());
-        }
+        if (typeInfo->isSubclass(&V8StyleSheetList::info)) {
+            StyleSheetList* styleSheetList = static_cast<StyleSheetList*>(object);
+            GroupId groupId(styleSheetList);
+            if (Document* document = styleSheetList->document())
+                groupId = GroupId(document);
+            m_grouper.append(GrouperItem(groupId, wrapper));
 
-        if (V8HTMLStyleElement::info.equals(typeInfo)) {
-            HTMLStyleElement* htmlStyleElement = static_cast<HTMLStyleElement*>(node);
-            addDOMObjectToGroup(store, groupId, htmlStyleElement->sheet());
-        }
+        } else if (typeInfo->isSubclass(&V8DOMImplementation::info)) {
+            DOMImplementation* domImplementation = static_cast<DOMImplementation*>(object);
+            GroupId groupId(domImplementation);
+            if (Document* document = domImplementation->ownerDocument())
+                groupId = GroupId(document);
+            m_grouper.append(GrouperItem(groupId, wrapper));
 
-        if (V8ProcessingInstruction::info.equals(typeInfo)) {
-            ProcessingInstruction* processingInstruction = static_cast<ProcessingInstruction*>(node);
-            addDOMObjectToGroup(store, groupId, processingInstruction->sheet());
-        }
-    }
+        } else if (typeInfo->isSubclass(&V8StyleSheet::info) || typeInfo->isSubclass(&V8CSSRule::info)) {
+            m_grouper.append(GrouperItem(calculateGroupId(static_cast<StyleBase*>(object)), wrapper));
 
-    void applyGrouping()
-    {
-        makeV8ObjectGroups(m_grouper);
-    }
-
-private:
-    GrouperList m_grouper;
+        } else if (typeInfo->isSubclass(&V8CSSStyleDeclaration::info)) {
+            CSSStyleDeclaration* cssStyleDeclaration = static_cast<CSSStyleDeclaration*>(object);
 
-    void addDOMObjectToGroup(DOMDataStore* store, uintptr_t groupId, void* object)
-    {
-        if (!object)
-            return;
-        v8::Persistent<v8::Object> wrapper = store->domObjectMap().get(object);
-        if (!wrapper.IsEmpty())
+            GroupId groupId = calculateGroupId(cssStyleDeclaration);
             m_grouper.append(GrouperItem(groupId, wrapper));
-    }
-};
 
-class DOMObjectGrouperVisitor : public DOMWrapperMap<void>::Visitor {
-public:
-    DOMObjectGrouperVisitor()
-    {
+        } else if (typeInfo->isSubclass(&V8CSSRuleList::info)) {
+            CSSRuleList* cssRuleList = static_cast<CSSRuleList*>(object);
+            GroupId groupId(cssRuleList);
+            StyleList* styleList = cssRuleList->styleList();
+            if (styleList)
+                groupId = calculateGroupId(styleList);
+            m_grouper.append(GrouperItem(groupId, wrapper));
+        }
     }
 
-    void startMap()
+    void applyGrouping()
     {
-        m_grouper.shrink(0);
-    }
+        // Group by sorting by the group id.
+        std::sort(m_grouper.begin(), m_grouper.end());
+
+        for (size_t i = 0; i < m_grouper.size(); ) {
+            // Seek to the next key (or the end of the list).
+            size_t nextKeyIndex = m_grouper.size();
+            for (size_t j = i; j < m_grouper.size(); ++j) {
+                if (m_grouper[i].groupId() != m_grouper[j].groupId()) {
+                    nextKeyIndex = j;
+                    break;
+                }
+            }
 
-    void endMap()
-    {
-        makeV8ObjectGroups(m_grouper);
-    }
+            ASSERT(nextKeyIndex > i);
 
-    void visitDOMWrapper(DOMDataStore* store, void* object, v8::Persistent<v8::Object> wrapper)
-    {
-        WrapperTypeInfo* typeInfo = V8DOMWrapper::domWrapperType(wrapper);
-        // FIXME: extend WrapperTypeInfo with isStyle to simplify the check below or consider
-        // adding a virtual method to WrapperTypeInfo which would know how to group objects.
-        // FIXME: check if there are other StyleBase wrappers we should care of.
-        if (V8CSSStyleSheet::info.equals(typeInfo)
-            || V8CSSStyleDeclaration::info.equals(typeInfo)
-            || V8CSSCharsetRule::info.equals(typeInfo)
-            || V8CSSFontFaceRule::info.equals(typeInfo)
-            || V8CSSStyleRule::info.equals(typeInfo)
-            || V8CSSImportRule::info.equals(typeInfo)
-            || V8CSSMediaRule::info.equals(typeInfo)) {
-            StyleBase* styleBase = static_cast<StyleBase*>(object);
-
-            // We put the whole tree of style elements into a single object group.
-            // To achieve that we group elements by the roots of their trees.
-            StyleBase* root = styleBase;
-            ASSERT(root);
-            while (true) {
-                StyleBase* parent = root->parent();
-                if (!parent)
-                    break;
-                root = parent;
+            // We only care about a group if it has more than one object. If it only
+            // has one object, it has nothing else that needs to be kept alive.
+            if (nextKeyIndex - i <= 1) {
+                i = nextKeyIndex;
+                continue;
             }
-            // Group id is an address of the root.
-            uintptr_t groupId = reinterpret_cast<uintptr_t>(root);
-            m_grouper.append(GrouperItem(groupId, wrapper));
 
-            if (V8CSSStyleDeclaration::info.equals(typeInfo)) {
-                CSSStyleDeclaration* cssStyleDeclaration = static_cast<CSSStyleDeclaration*>(styleBase);
-                if (cssStyleDeclaration->isMutableStyleDeclaration()) {
-                    CSSMutableStyleDeclaration* cssMutableStyleDeclaration = static_cast<CSSMutableStyleDeclaration*>(cssStyleDeclaration);
-                    CSSMutableStyleDeclaration::const_iterator end = cssMutableStyleDeclaration->end();
-                    for (CSSMutableStyleDeclaration::const_iterator it = cssMutableStyleDeclaration->begin(); it != end; ++it) {
-                        wrapper = store->domObjectMap().get(it->value());
-                        if (!wrapper.IsEmpty())
-                            m_grouper.append(GrouperItem(groupId, wrapper));
-                    }
-                }
+            size_t rootIndex = i;
+            
+            Vector<v8::Persistent<v8::Value> > group;
+            group.reserveCapacity(nextKeyIndex - i);
+            for (; i < nextKeyIndex; ++i) {
+                v8::Persistent<v8::Value> wrapper = m_grouper[i].wrapper();
+                if (!wrapper.IsEmpty())
+                    group.append(wrapper);
             }
-        } else if (V8StyleSheetList::info.equals(typeInfo)) {
-            addAllItems(store, static_cast<StyleSheetList*>(object), wrapper);
-        } else if (V8CSSRuleList::info.equals(typeInfo)) {
-            addAllItems(store, static_cast<CSSRuleList*>(object), wrapper);
+
+            if (group.size() > 1)
+                v8::V8::AddObjectGroup(&group[0], group.size(), m_grouper[rootIndex].createRetainedObjectInfo());
+
+            ASSERT(i == nextKeyIndex);
         }
     }
 
 private:
     GrouperList m_grouper;
-
-    template <class C>
-    void addAllItems(DOMDataStore* store, C* collection, v8::Persistent<v8::Object> wrapper)
-    {
-        uintptr_t groupId = reinterpret_cast<uintptr_t>(collection);
-        m_grouper.append(GrouperItem(groupId, wrapper));
-        for (unsigned i = 0; i < collection->length(); i++) {
-            wrapper = store->domObjectMap().get(collection->item(i));
-            if (!wrapper.IsEmpty())
-                m_grouper.append(GrouperItem(groupId, wrapper));
-        }
-    }
 };
 
 // Create object groups for DOM tree nodes.
@@ -425,12 +430,10 @@ void V8GCController::gcPrologue()
     visitActiveDOMObjectsInCurrentThread(&prologueVisitor);
 
     // Create object groups.
-    NodeGrouperVisitor nodeGrouperVisitor;
-    visitDOMNodesInCurrentThread(&nodeGrouperVisitor);
-    nodeGrouperVisitor.applyGrouping();
-
-    DOMObjectGrouperVisitor domObjectGrouperVisitor;
-    visitDOMObjectsInCurrentThread(&domObjectGrouperVisitor);
+    GrouperVisitor grouperVisitor;
+    visitDOMNodesInCurrentThread(&grouperVisitor);
+    visitDOMObjectsInCurrentThread(&grouperVisitor);
+    grouperVisitor.applyGrouping();
 
     // Clean single element cache for string conversions.
     lastStringImpl = 0;
diff --git a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp b/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
index 7f46333..0e2c368 100644
--- a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "V8LazyEventListener.h"
 
+#include "ContentSecurityPolicy.h"
 #include "Frame.h"
 #include "V8Binding.h"
 #include "V8HiddenPropertyName.h"
@@ -80,6 +81,9 @@ void V8LazyEventListener::prepareListenerObject(ScriptExecutionContext* context)
     if (hasExistingListenerObject())
         return;
 
+    if (context->isDocument() && !static_cast<Document*>(context)->contentSecurityPolicy()->allowInlineEventHandlers())
+        return;
+
     v8::HandleScope handleScope;
 
     V8Proxy* proxy = V8Proxy::retrieve(context);
diff --git a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
new file mode 100755
index 0000000..5e2acd2
--- /dev/null
+++ b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WorkerScriptDebugServer.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
+
+#include "WorkerContext.h"
+
+namespace WebCore {
+
+WorkerScriptDebugServer::WorkerScriptDebugServer()
+    : ScriptDebugServer()
+{
+}
+
+void WorkerScriptDebugServer::addListener(ScriptDebugListener*, WorkerContext*)
+{
+}
+
+void WorkerScriptDebugServer::removeListener(ScriptDebugListener*, WorkerContext*)
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
diff --git a/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h
new file mode 100755
index 0000000..fdc47ac
--- /dev/null
+++ b/Source/WebCore/bindings/v8/WorkerScriptDebugServer.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerScriptDebugServer_h
+#define WorkerScriptDebugServer_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
+
+#include "ScriptDebugServer.h"
+
+namespace WebCore {
+
+class WorkerContext;
+
+class WorkerScriptDebugServer : public ScriptDebugServer {
+    WTF_MAKE_NONCOPYABLE(WorkerScriptDebugServer);
+public:
+    WorkerScriptDebugServer();
+    ~WorkerScriptDebugServer() { }
+
+    void addListener(ScriptDebugListener*, WorkerContext*);
+    void removeListener(ScriptDebugListener*, WorkerContext*);
+
+private:
+    virtual ScriptDebugListener* getDebugListenerForContext(v8::Handle<v8::Context>) { return 0; }
+    virtual void runMessageLoopOnPause(v8::Handle<v8::Context>) { }
+    virtual void quitMessageLoopOnPause() { }
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
+
+#endif // WorkerScriptDebugServer_h
diff --git a/Source/WebCore/bindings/v8/WrapperTypeInfo.h b/Source/WebCore/bindings/v8/WrapperTypeInfo.h
index 1d1cbfd..166d642 100644
--- a/Source/WebCore/bindings/v8/WrapperTypeInfo.h
+++ b/Source/WebCore/bindings/v8/WrapperTypeInfo.h
@@ -41,7 +41,9 @@ namespace WebCore {
     static const int v8DOMWrapperObjectIndex = 1;
     static const int v8DOMHiddenReferenceArrayIndex = 2;
     static const int v8DefaultWrapperInternalFieldCount = 3;
-    
+
+    static const uint16_t v8DOMSubtreeClassId = 1;
+
     typedef v8::Persistent<v8::FunctionTemplate> (*GetTemplateFunction)();
     typedef void (*DerefObjectFunction)(void*);
     typedef ActiveDOMObject* (*ToActiveDOMObjectFunction)(v8::Handle<v8::Object>);
@@ -61,6 +63,16 @@ namespace WebCore {
         {
             return this == that;
         }
+
+        bool isSubclass(const WrapperTypeInfo* that) const
+        {
+            for (const WrapperTypeInfo* current = this; current; current = current->parentClass) {
+                if (current == that)
+                    return true;
+            }
+
+            return false;
+        }
         
         v8::Persistent<v8::FunctionTemplate> getTemplate() { return getTemplateFunction(); }
         
@@ -80,6 +92,7 @@ namespace WebCore {
         const GetTemplateFunction getTemplateFunction;
         const DerefObjectFunction derefObjectFunction;
         const ToActiveDOMObjectFunction toActiveDOMObjectFunction;
+        const WrapperTypeInfo* parentClass;
     };
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp b/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
index 8fd2d62..52465b6 100644
--- a/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
@@ -76,6 +76,9 @@ v8::Handle<v8::Value> V8HTMLCanvasElement::getContextCallback(const v8::Argument
             v8::Handle<v8::String> premultipliedAlpha = v8::String::New("premultipliedAlpha");
             if (jsAttrs->Has(premultipliedAlpha))
                 webGLAttrs->setPremultipliedAlpha(jsAttrs->Get(premultipliedAlpha)->BooleanValue());
+            v8::Handle<v8::String> preserveDrawingBuffer = v8::String::New("preserveDrawingBuffer");
+            if (jsAttrs->Has(preserveDrawingBuffer))
+                webGLAttrs->setPreserveDrawingBuffer(jsAttrs->Get(preserveDrawingBuffer)->BooleanValue());
         }
     }
 #endif
diff --git a/Source/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp b/Source/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
index ccd6fb2..a1a8636 100644
--- a/Source/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
@@ -77,6 +77,6 @@ v8::Handle<v8::Value> toV8(IDBAny* impl)
     return v8::Undefined();
 }
 
-#endif // ENABLE(INDEXED_DATABASE)
-
 } // namespace WebCore
+
+#endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/bindings/v8/custom/V8IDBKeyCustom.cpp b/Source/WebCore/bindings/v8/custom/V8IDBKeyCustom.cpp
index 3805dca..b8fa6bb 100644
--- a/Source/WebCore/bindings/v8/custom/V8IDBKeyCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8IDBKeyCustom.cpp
@@ -56,6 +56,6 @@ v8::Handle<v8::Value> toV8(IDBKey* key)
     return v8::Undefined();
 }
 
-#endif // ENABLE(INDEXED_DATABASE)
-
 } // namespace WebCore
+
+#endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
index 7a33ed0..3dbacb2 100644
--- a/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2009 Google Inc. All rights reserved.
+ * Copyright (C) 2007-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -31,27 +31,21 @@
 #include "config.h"
 #include "V8InjectedScriptHost.h"
 
-#include "DOMWindow.h"
 #include "Database.h"
-#include "Frame.h"
 #include "InjectedScript.h"
 #include "InjectedScriptHost.h"
+#include "InspectorDebuggerAgent.h"
 #include "InspectorValues.h"
-#include "Node.h"
-#include "Page.h"
 #include "ScriptDebugServer.h"
 #include "ScriptValue.h"
-
 #include "V8Binding.h"
 #include "V8BindingState.h"
-#include "V8DOMWindow.h"
 #include "V8Database.h"
 #include "V8HiddenPropertyName.h"
 #include "V8JavaScriptCallFrame.h"
 #include "V8Node.h"
 #include "V8Proxy.h"
 #include "V8Storage.h"
-#include <wtf/RefPtr.h>
 
 namespace WebCore {
 
@@ -71,86 +65,6 @@ ScriptValue InjectedScriptHost::nodeAsScriptValue(ScriptState* state, Node* node
     return ScriptValue(toV8(node));
 }
 
-static void WeakReferenceCallback(v8::Persistent<v8::Value> object, void* parameter)
-{
-    InjectedScriptHost* nativeObject = static_cast<InjectedScriptHost*>(parameter);
-    nativeObject->deref();
-    object.Dispose();
-}
-
-static v8::Local<v8::Object> createInjectedScriptHostV8Wrapper(InjectedScriptHost* host)
-{
-    v8::Local<v8::Function> function = V8InjectedScriptHost::GetTemplate()->GetFunction();
-    if (function.IsEmpty()) {
-        // Return if allocation failed.
-        return v8::Local<v8::Object>();
-    }
-    v8::Local<v8::Object> instance = SafeAllocation::newInstance(function);
-    if (instance.IsEmpty()) {
-        // Avoid setting the wrapper if allocation failed.
-        return v8::Local<v8::Object>();
-    }
-    V8DOMWrapper::setDOMWrapper(instance, &V8InjectedScriptHost::info, host);
-    // Create a weak reference to the v8 wrapper of InspectorBackend to deref
-    // InspectorBackend when the wrapper is garbage collected.
-    host->ref();
-    v8::Persistent<v8::Object> weakHandle = v8::Persistent<v8::Object>::New(instance);
-    weakHandle.MakeWeak(host, &WeakReferenceCallback);
-    return instance;
-}
-
-ScriptObject InjectedScriptHost::createInjectedScript(const String& scriptSource, ScriptState* inspectedScriptState, long id)
-{
-    v8::HandleScope scope;
-
-    v8::Local<v8::Context> inspectedContext = inspectedScriptState->context();
-    v8::Context::Scope contextScope(inspectedContext);
-
-    // Call custom code to create InjectedScripHost wrapper specific for the context
-    // instead of calling toV8() that would create the
-    // wrapper in the current context.
-    // FIXME: make it possible to use generic bindings factory for InjectedScriptHost.
-    v8::Local<v8::Object> scriptHostWrapper = createInjectedScriptHostV8Wrapper(this);
-    if (scriptHostWrapper.IsEmpty())
-        return ScriptObject();
-
-    v8::Local<v8::Object> windowGlobal = inspectedContext->Global();
-
-    // Inject javascript into the context. The compiled script is supposed to evaluate into
-    // a single anonymous function(it's anonymous to avoid cluttering the global object with
-    // inspector's stuff) the function is called a few lines below with InjectedScriptHost wrapper,
-    // injected script id and explicit reference to the inspected global object. The function is expected
-    // to create and configure InjectedScript instance that is going to be used by the inspector.
-    v8::Local<v8::Script> script = v8::Script::Compile(v8String(scriptSource));
-    v8::Local<v8::Value> v = script->Run();
-    ASSERT(!v.IsEmpty());
-    ASSERT(v->IsFunction());
-
-    v8::Handle<v8::Value> args[] = {
-      scriptHostWrapper,
-      windowGlobal,
-      v8::Number::New(id),
-    };
-    v8::Local<v8::Value> injectedScriptValue = v8::Function::Cast(*v)->Call(windowGlobal, 3, args);
-    v8::Local<v8::Object> injectedScript(v8::Object::Cast(*injectedScriptValue));
-    return ScriptObject(inspectedScriptState, injectedScript);
-}
-
-void InjectedScriptHost::discardInjectedScript(ScriptState* inspectedScriptState)
-{
-    v8::HandleScope handleScope;
-    v8::Local<v8::Context> context = inspectedScriptState->context();
-    v8::Context::Scope contextScope(context);
-
-    v8::Local<v8::Object> global = context->Global();
-    // Skip proxy object. The proxy object will survive page navigation while we need
-    // an object whose lifetime consides with that of the inspected context.
-    global = v8::Local<v8::Object>::Cast(global->GetPrototype());
-
-    v8::Handle<v8::String> key = V8HiddenPropertyName::devtoolsInjectedScript();
-    global->DeleteHiddenValue(key);
-}
-
 v8::Handle<v8::Value> V8InjectedScriptHost::inspectedNodeCallback(const v8::Arguments& args)
 {
     INC_STATS("InjectedScriptHost.inspectedNode()");
@@ -185,9 +99,9 @@ v8::Handle<v8::Value> V8InjectedScriptHost::inspectCallback(const v8::Arguments&
         return v8::Undefined();
 
     InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
-    ScriptValue objectId(args[0]);
+    ScriptValue object(args[0]);
     ScriptValue hints(args[1]);
-    host->inspectImpl(objectId.toInspectorValue(ScriptState::current()), hints.toInspectorValue(ScriptState::current()));
+    host->inspectImpl(object.toInspectorValue(ScriptState::current()), hints.toInspectorValue(ScriptState::current()));
 
     return v8::Undefined();
 }
@@ -196,7 +110,8 @@ v8::Handle<v8::Value> V8InjectedScriptHost::currentCallFrameCallback(const v8::A
 {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     INC_STATS("InjectedScriptHost.currentCallFrame()");
-    return toV8(ScriptDebugServer::shared().currentCallFrame());
+    InjectedScriptHost* host = V8InjectedScriptHost::toNative(args.Holder());
+    return toV8(host->debuggerAgent()->scriptDebugServer().currentCallFrame());
 #else
     UNUSED_PARAM(args);
     return v8::Undefined();
@@ -231,46 +146,4 @@ v8::Handle<v8::Value> V8InjectedScriptHost::storageIdCallback(const v8::Argument
     return v8::Undefined();
 }
 
-InjectedScript InjectedScriptHost::injectedScriptFor(ScriptState* inspectedScriptState)
-{
-    v8::HandleScope handleScope;
-    v8::Local<v8::Context> context = inspectedScriptState->context();
-    v8::Context::Scope contextScope(context);
-
-    v8::Local<v8::Object> global = context->Global();
-    // Skip proxy object. The proxy object will survive page navigation while we need
-    // an object whose lifetime consides with that of the inspected context.
-    global = v8::Local<v8::Object>::Cast(global->GetPrototype());
-
-    v8::Handle<v8::String> key = V8HiddenPropertyName::devtoolsInjectedScript();
-    v8::Local<v8::Value> val = global->GetHiddenValue(key);
-    if (!val.IsEmpty() && val->IsObject())
-        return InjectedScript(ScriptObject(inspectedScriptState, v8::Local<v8::Object>::Cast(val)));
-
-    if (!canAccessInspectedWindow(inspectedScriptState))
-        return InjectedScript();
-
-    pair<long, ScriptObject> injectedScript = injectScript(injectedScriptSource(), inspectedScriptState);
-    InjectedScript result(injectedScript.second);
-    m_idToInjectedScript.set(injectedScript.first, result);
-    global->SetHiddenValue(key, injectedScript.second.v8Object());
-    return result;
-}
-
-bool InjectedScriptHost::canAccessInspectedWindow(ScriptState* scriptState)
-{
-    v8::HandleScope handleScope;
-    v8::Local<v8::Context> context = scriptState->context();
-    v8::Local<v8::Object> global = context->Global();
-    if (global.IsEmpty())
-        return false;
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8DOMWindow::GetTemplate(), global);
-    if (holder.IsEmpty())
-        return false;
-    Frame* frame = V8DOMWindow::toNative(holder)->frame();
-
-    v8::Context::Scope contextScope(context);
-    return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), frame, false);
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp b/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp
new file mode 100644
index 0000000..f4006b8
--- /dev/null
+++ b/Source/WebCore/bindings/v8/custom/V8InjectedScriptManager.cpp
@@ -0,0 +1,170 @@
+/*
+ * Copyright (C) 2007-2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScriptManager.h"
+
+#include "DOMWindow.h"
+#include "InjectedScript.h"
+#include "InjectedScriptHost.h"
+#include "ScriptValue.h"
+#include "V8Binding.h"
+#include "V8BindingState.h"
+#include "V8DOMWindow.h"
+#include "V8HiddenPropertyName.h"
+#include "V8InjectedScriptHost.h"
+#include "V8Proxy.h"
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+static void WeakReferenceCallback(v8::Persistent<v8::Value> object, void* parameter)
+{
+    InjectedScriptHost* nativeObject = static_cast<InjectedScriptHost*>(parameter);
+    nativeObject->deref();
+    object.Dispose();
+}
+
+static v8::Local<v8::Object> createInjectedScriptHostV8Wrapper(InjectedScriptHost* host)
+{
+    v8::Local<v8::Function> function = V8InjectedScriptHost::GetTemplate()->GetFunction();
+    if (function.IsEmpty()) {
+        // Return if allocation failed.
+        return v8::Local<v8::Object>();
+    }
+    v8::Local<v8::Object> instance = SafeAllocation::newInstance(function);
+    if (instance.IsEmpty()) {
+        // Avoid setting the wrapper if allocation failed.
+        return v8::Local<v8::Object>();
+    }
+    V8DOMWrapper::setDOMWrapper(instance, &V8InjectedScriptHost::info, host);
+    // Create a weak reference to the v8 wrapper of InspectorBackend to deref
+    // InspectorBackend when the wrapper is garbage collected.
+    host->ref();
+    v8::Persistent<v8::Object> weakHandle = v8::Persistent<v8::Object>::New(instance);
+    weakHandle.MakeWeak(host, &WeakReferenceCallback);
+    return instance;
+}
+
+ScriptObject InjectedScriptManager::createInjectedScript(const String& scriptSource, ScriptState* inspectedScriptState, long id)
+{
+    v8::HandleScope scope;
+
+    v8::Local<v8::Context> inspectedContext = inspectedScriptState->context();
+    v8::Context::Scope contextScope(inspectedContext);
+
+    // Call custom code to create InjectedScripHost wrapper specific for the context
+    // instead of calling toV8() that would create the
+    // wrapper in the current context.
+    // FIXME: make it possible to use generic bindings factory for InjectedScriptHost.
+    v8::Local<v8::Object> scriptHostWrapper = createInjectedScriptHostV8Wrapper(m_injectedScriptHost.get());
+    if (scriptHostWrapper.IsEmpty())
+        return ScriptObject();
+
+    v8::Local<v8::Object> windowGlobal = inspectedContext->Global();
+
+    // Inject javascript into the context. The compiled script is supposed to evaluate into
+    // a single anonymous function(it's anonymous to avoid cluttering the global object with
+    // inspector's stuff) the function is called a few lines below with InjectedScriptHost wrapper,
+    // injected script id and explicit reference to the inspected global object. The function is expected
+    // to create and configure InjectedScript instance that is going to be used by the inspector.
+    v8::Local<v8::Script> script = v8::Script::Compile(v8String(scriptSource));
+    v8::Local<v8::Value> v = script->Run();
+    ASSERT(!v.IsEmpty());
+    ASSERT(v->IsFunction());
+
+    v8::Handle<v8::Value> args[] = {
+      scriptHostWrapper,
+      windowGlobal,
+      v8::Number::New(id),
+    };
+    v8::Local<v8::Value> injectedScriptValue = v8::Function::Cast(*v)->Call(windowGlobal, 3, args);
+    v8::Local<v8::Object> injectedScript(v8::Object::Cast(*injectedScriptValue));
+    return ScriptObject(inspectedScriptState, injectedScript);
+}
+
+void InjectedScriptManager::discardInjectedScript(ScriptState* inspectedScriptState)
+{
+    v8::HandleScope handleScope;
+    v8::Local<v8::Context> context = inspectedScriptState->context();
+    v8::Context::Scope contextScope(context);
+
+    v8::Local<v8::Object> global = context->Global();
+    // Skip proxy object. The proxy object will survive page navigation while we need
+    // an object whose lifetime consides with that of the inspected context.
+    global = v8::Local<v8::Object>::Cast(global->GetPrototype());
+
+    v8::Handle<v8::String> key = V8HiddenPropertyName::devtoolsInjectedScript();
+    global->DeleteHiddenValue(key);
+}
+
+InjectedScript InjectedScriptManager::injectedScriptFor(ScriptState* inspectedScriptState)
+{
+    v8::HandleScope handleScope;
+    v8::Local<v8::Context> context = inspectedScriptState->context();
+    v8::Context::Scope contextScope(context);
+
+    v8::Local<v8::Object> global = context->Global();
+    // Skip proxy object. The proxy object will survive page navigation while we need
+    // an object whose lifetime consides with that of the inspected context.
+    global = v8::Local<v8::Object>::Cast(global->GetPrototype());
+
+    v8::Handle<v8::String> key = V8HiddenPropertyName::devtoolsInjectedScript();
+    v8::Local<v8::Value> val = global->GetHiddenValue(key);
+    if (!val.IsEmpty() && val->IsObject())
+        return InjectedScript(ScriptObject(inspectedScriptState, v8::Local<v8::Object>::Cast(val)));
+
+    if (!canAccessInspectedWindow(inspectedScriptState))
+        return InjectedScript();
+
+    pair<long, ScriptObject> injectedScript = injectScript(injectedScriptSource(), inspectedScriptState);
+    InjectedScript result(injectedScript.second);
+    m_idToInjectedScript.set(injectedScript.first, result);
+    global->SetHiddenValue(key, injectedScript.second.v8Object());
+    return result;
+}
+
+bool InjectedScriptManager::canAccessInspectedWindow(ScriptState* scriptState)
+{
+    v8::HandleScope handleScope;
+    v8::Local<v8::Context> context = scriptState->context();
+    v8::Local<v8::Object> global = context->Global();
+    if (global.IsEmpty())
+        return false;
+    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8DOMWindow::GetTemplate(), global);
+    if (holder.IsEmpty())
+        return false;
+    Frame* frame = V8DOMWindow::toNative(holder)->frame();
+
+    v8::Context::Scope contextScope(context);
+    return V8BindingSecurity::canAccessFrame(V8BindingState::Only(), frame, false);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8WebKitAnimationCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebKitAnimationCustom.cpp
new file mode 100644
index 0000000..c0949ae
--- /dev/null
+++ b/Source/WebCore/bindings/v8/custom/V8WebKitAnimationCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "V8WebKitAnimation.h"
+
+#include "V8Binding.h"
+#include "V8BindingMacros.h"
+#include "V8Proxy.h"
+#include "WebKitAnimation.h"
+
+#include <v8.h>
+
+namespace WebCore {
+
+v8::Handle<v8::Value> V8WebKitAnimation::iterationCountAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.WebKitAnimation.iterationCount._get");
+    v8::Handle<v8::Object> holder = info.Holder();
+    WebKitAnimation* imp = V8WebKitAnimation::toNative(holder);
+    int count = imp->iterationCount();
+    if (count == Animation::IterationCountInfinite)
+        return v8::Number::New(std::numeric_limits<float>::infinity());
+    return v8::Number::New(count);
+}
+
+} // namespace WebCore
+
diff --git a/Source/WebCore/bridge/c/CRuntimeObject.h b/Source/WebCore/bridge/c/CRuntimeObject.h
index 267d71e..85815fb 100644
--- a/Source/WebCore/bridge/c/CRuntimeObject.h
+++ b/Source/WebCore/bridge/c/CRuntimeObject.h
@@ -44,9 +44,9 @@ public:
 
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 };
 
diff --git a/Source/WebCore/bridge/c/c_class.cpp b/Source/WebCore/bridge/c/c_class.cpp
index a808946..4f9cdd9 100644
--- a/Source/WebCore/bridge/c/c_class.cpp
+++ b/Source/WebCore/bridge/c/c_class.cpp
@@ -35,6 +35,7 @@
 #include <runtime/ScopeChain.h>
 #include <runtime/Identifier.h>
 #include <runtime/JSLock.h>
+#include <runtime/JSObject.h>
 #include <wtf/text/StringHash.h>
 
 namespace JSC { namespace Bindings {
diff --git a/Source/WebCore/bridge/c/c_instance.cpp b/Source/WebCore/bridge/c/c_instance.cpp
index 27affeb..21fae4f 100644
--- a/Source/WebCore/bridge/c/c_instance.cpp
+++ b/Source/WebCore/bridge/c/c_instance.cpp
@@ -120,9 +120,9 @@ public:
         ASSERT(inherits(&s_info));
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     static const ClassInfo s_info;
diff --git a/Source/WebCore/bridge/c/c_runtime.cpp b/Source/WebCore/bridge/c/c_runtime.cpp
index f8c0dba..a84acbb 100644
--- a/Source/WebCore/bridge/c/c_runtime.cpp
+++ b/Source/WebCore/bridge/c/c_runtime.cpp
@@ -34,6 +34,7 @@
 #include "npruntime_impl.h"
 #include <runtime/ScopeChain.h>
 #include <runtime/JSLock.h>
+#include <runtime/JSObject.h>
 
 namespace JSC {
 namespace Bindings {
diff --git a/Source/WebCore/bridge/jni/JNIUtility.cpp b/Source/WebCore/bridge/jni/JNIUtility.cpp
index 17cc038..cfd4e83 100644
--- a/Source/WebCore/bridge/jni/JNIUtility.cpp
+++ b/Source/WebCore/bridge/jni/JNIUtility.cpp
@@ -166,122 +166,129 @@ void releaseUCharactersForJStringInEnv(JNIEnv* env, jstring aJString, const jcha
     env->ReleaseStringChars(aJString, s);
 }
 
-JNIType JNITypeFromClassName(const char* name)
+JavaType javaTypeFromClassName(const char* name)
 {
-    JNIType type;
+    JavaType type;
 
     if (!strcmp("byte", name))
-        type = byte_type;
+        type = JavaTypeByte;
     else if (!strcmp("short", name))
-        type = short_type;
+        type = JavaTypeShort;
     else if (!strcmp("int", name))
-        type = int_type;
+        type = JavaTypeInt;
     else if (!strcmp("long", name))
-        type = long_type;
+        type = JavaTypeLong;
     else if (!strcmp("float", name))
-        type = float_type;
+        type = JavaTypeFloat;
     else if (!strcmp("double", name))
-        type = double_type;
+        type = JavaTypeDouble;
     else if (!strcmp("char", name))
-        type = char_type;
+        type = JavaTypeChar;
     else if (!strcmp("boolean", name))
-        type = boolean_type;
+        type = JavaTypeBoolean;
     else if (!strcmp("void", name))
-        type = void_type;
+        type = JavaTypeVoid;
     else if ('[' == name[0])
-        type = array_type;
+        type = JavaTypeArray;
+#if USE(V8)
+    else if (!strcmp("java.lang.String", name))
+        type = JavaTypeString;
+#endif
     else
-        type = object_type;
+        type = JavaTypeObject;
 
     return type;
 }
 
-const char* signatureFromPrimitiveType(JNIType type)
+const char* signatureFromJavaType(JavaType type)
 {
     switch (type) {
-    case void_type:
+    case JavaTypeVoid:
         return "V";
 
-    case array_type:
+    case JavaTypeArray:
         return "[";
 
-    case object_type:
+    case JavaTypeObject:
+#if USE(V8)
+    case JavaTypeString:
+#endif
         return "L";
 
-    case boolean_type:
+    case JavaTypeBoolean:
         return "Z";
 
-    case byte_type:
+    case JavaTypeByte:
         return "B";
 
-    case char_type:
+    case JavaTypeChar:
         return "C";
 
-    case short_type:
+    case JavaTypeShort:
         return "S";
 
-    case int_type:
+    case JavaTypeInt:
         return "I";
 
-    case long_type:
+    case JavaTypeLong:
         return "J";
 
-    case float_type:
+    case JavaTypeFloat:
         return "F";
 
-    case double_type:
+    case JavaTypeDouble:
         return "D";
 
-    case invalid_type:
+    case JavaTypeInvalid:
     default:
         break;
     }
     return "";
 }
 
-JNIType JNITypeFromPrimitiveType(char type)
+JavaType javaTypeFromPrimitiveType(char type)
 {
     switch (type) {
     case 'V':
-        return void_type;
+        return JavaTypeVoid;
 
     case 'L':
-        return object_type;
+        return JavaTypeObject;
 
     case '[':
-        return array_type;
+        return JavaTypeArray;
 
     case 'Z':
-        return boolean_type;
+        return JavaTypeBoolean;
 
     case 'B':
-        return byte_type;
+        return JavaTypeByte;
 
     case 'C':
-        return char_type;
+        return JavaTypeChar;
 
     case 'S':
-        return short_type;
+        return JavaTypeShort;
 
     case 'I':
-        return int_type;
+        return JavaTypeInt;
 
     case 'J':
-        return long_type;
+        return JavaTypeLong;
 
     case 'F':
-        return float_type;
+        return JavaTypeFloat;
 
     case 'D':
-        return double_type;
+        return JavaTypeDouble;
 
     default:
         break;
     }
-    return invalid_type;
+    return JavaTypeInvalid;
 }
 
-jvalue getJNIField(jobject obj, JNIType type, const char* name, const char* signature)
+jvalue getJNIField(jobject obj, JavaType type, const char* name, const char* signature)
 {
     JavaVM* jvm = getJavaVM();
     JNIEnv* env = getJNIEnv();
@@ -294,32 +301,35 @@ jvalue getJNIField(jobject obj, JNIType type, const char* name, const char* sign
             jfieldID field = env->GetFieldID(cls, name, signature);
             if (field) {
                 switch (type) {
-                case array_type:
-                case object_type:
+                case JavaTypeArray:
+                case JavaTypeObject:
+#if USE(V8)
+                case JavaTypeString:
+#endif
                     result.l = env->functions->GetObjectField(env, obj, field);
                     break;
-                case boolean_type:
+                case JavaTypeBoolean:
                     result.z = env->functions->GetBooleanField(env, obj, field);
                     break;
-                case byte_type:
+                case JavaTypeByte:
                     result.b = env->functions->GetByteField(env, obj, field);
                     break;
-                case char_type:
+                case JavaTypeChar:
                     result.c = env->functions->GetCharField(env, obj, field);
                     break;
-                case short_type:
+                case JavaTypeShort:
                     result.s = env->functions->GetShortField(env, obj, field);
                     break;
-                case int_type:
+                case JavaTypeInt:
                     result.i = env->functions->GetIntField(env, obj, field);
                     break;
-                case long_type:
+                case JavaTypeLong:
                     result.j = env->functions->GetLongField(env, obj, field);
                     break;
-                case float_type:
+                case JavaTypeFloat:
                     result.f = env->functions->GetFloatField(env, obj, field);
                     break;
-                case double_type:
+                case JavaTypeDouble:
                     result.d = env->functions->GetDoubleField(env, obj, field);
                     break;
                 default:
@@ -340,6 +350,50 @@ jvalue getJNIField(jobject obj, JNIType type, const char* name, const char* sign
     return result;
 }
 
+jvalue callJNIMethod(jobject object, JavaType returnType, const char* name, const char* signature, jvalue* args)
+{
+    jmethodID methodId = getMethodID(object, name, signature);
+    jvalue result;
+    switch (returnType) {
+    case JavaTypeVoid:
+        callJNIMethodIDA<void>(object, methodId, args);
+        break;
+    case JavaTypeObject:
+#if USE(V8)
+    case JavaTypeString:
+#endif
+        result.l = callJNIMethodIDA<jobject>(object, methodId, args);
+        break;
+    case JavaTypeBoolean:
+        result.z = callJNIMethodIDA<jboolean>(object, methodId, args);
+        break;
+    case JavaTypeByte:
+        result.b = callJNIMethodIDA<jbyte>(object, methodId, args);
+        break;
+    case JavaTypeChar:
+        result.c = callJNIMethodIDA<jchar>(object, methodId, args);
+        break;
+    case JavaTypeShort:
+        result.s = callJNIMethodIDA<jshort>(object, methodId, args);
+        break;
+    case JavaTypeInt:
+        result.i = callJNIMethodIDA<jint>(object, methodId, args);
+        break;
+    case JavaTypeLong:
+        result.j = callJNIMethodIDA<jlong>(object, methodId, args);
+        break;
+    case JavaTypeFloat:
+        result.f = callJNIMethodIDA<jfloat>(object, methodId, args);
+        break;
+    case JavaTypeDouble:
+        result.d = callJNIMethodIDA<jdouble>(object, methodId, args);
+        break;
+    default:
+        break;
+    }
+    return result;
+}
+
 } // namespace Bindings
 
 } // namespace JSC
diff --git a/Source/WebCore/bridge/jni/JNIUtility.h b/Source/WebCore/bridge/jni/JNIUtility.h
index 7b5d37c..508a2e5 100644
--- a/Source/WebCore/bridge/jni/JNIUtility.h
+++ b/Source/WebCore/bridge/jni/JNIUtility.h
@@ -28,36 +28,14 @@
 
 #if ENABLE(JAVA_BRIDGE)
 
+#include "JavaType.h"
+
 #if OS(MAC_OS_X)
 #include <JavaVM/jni.h>
 #else
 #include <jni.h>
 #endif
 
-// The order of these items can not be modified as they are tightly
-// bound with the JVM on Mac OSX. If new types need to be added, they
-// should be added to the end. It is used in jni_obc.mm when calling
-// through to the JVM. Newly added items need to be made compatible
-// in that file.
-//
-// TODO: Strictly, these are not JNI types but simply Java types. The type
-// conversion logic used here needs improving and this enum will likely be
-// changed at that time. See https://bugs.webkit.org/show_bug.cgi?id=38745
-typedef enum {
-    invalid_type = 0,
-    void_type,
-    object_type,
-    boolean_type,
-    byte_type,
-    char_type,
-    short_type,
-    int_type,
-    long_type,
-    float_type,
-    double_type,
-    array_type
-} JNIType;
-
 namespace JSC {
 
 namespace Bindings {
@@ -70,11 +48,12 @@ void releaseCharactersForJStringInEnv(JNIEnv*, jstring, const char*);
 const jchar* getUCharactersFromJStringInEnv(JNIEnv*, jstring);
 void releaseUCharactersForJStringInEnv(JNIEnv*, jstring, const jchar*);
 
-JNIType JNITypeFromClassName(const char* name);
-JNIType JNITypeFromPrimitiveType(char type);
-const char* signatureFromPrimitiveType(JNIType);
+JavaType javaTypeFromClassName(const char* name);
+JavaType javaTypeFromPrimitiveType(char type);
+const char* signatureFromJavaType(JavaType);
 
-jvalue getJNIField(jobject, JNIType, const char* name, const char* signature);
+jvalue getJNIField(jobject, JavaType, const char* name, const char* signature);
+jvalue callJNIMethod(jobject, JavaType returnType, const char* name, const char* signature, jvalue* args);
 
 jmethodID getMethodID(jobject, const char* name, const char* sig);
 JNIEnv* getJNIEnv();
diff --git a/Source/WebCore/bridge/jni/JavaMethod.h b/Source/WebCore/bridge/jni/JavaMethod.h
index 39d04c9..f15b653 100644
--- a/Source/WebCore/bridge/jni/JavaMethod.h
+++ b/Source/WebCore/bridge/jni/JavaMethod.h
@@ -30,9 +30,9 @@
 #if ENABLE(JAVA_BRIDGE)
 
 #include "Bridge.h"
-#include "JNIUtility.h"
+#include "JavaType.h"
 
-#include "JavaString.h"
+#include <wtf/text/WTFString.h>
 
 namespace JSC {
 
@@ -42,29 +42,12 @@ typedef const char* RuntimeType;
 
 class JavaMethod : public Method {
 public:
-    JavaMethod(JNIEnv*, jobject aMethod);
-    ~JavaMethod();
-
-    const JavaString& name() const { return m_name; }
-    RuntimeType returnType() const { return m_returnType.utf8(); }
-    const WTF::String& parameterAt(int i) const { return m_parameters[i]; }
-    int numParameters() const { return m_parameters.size(); }
-
-    const char* signature() const;
-    JNIType JNIReturnType() const;
-
-    jmethodID methodID(jobject obj) const;
-
-    bool isStatic() const { return m_isStatic; }
-
-private:
-    Vector<WTF::String> m_parameters;
-    JavaString m_name;
-    mutable char* m_signature;
-    JavaString m_returnType;
-    JNIType m_JNIReturnType;
-    mutable jmethodID m_methodID;
-    bool m_isStatic;
+    virtual String name() const = 0;
+    virtual RuntimeType returnTypeClassName() const = 0;
+    virtual String parameterAt(int) const = 0;
+    virtual const char* signature() const = 0;
+    virtual JavaType returnType() const = 0;
+    virtual bool isStatic() const = 0;
 };
 
 } // namespace Bindings
diff --git a/Source/WebCore/bridge/jni/JavaMethod.cpp b/Source/WebCore/bridge/jni/JavaMethodJobject.cpp
index 60620a0..2f2802c 100644
--- a/Source/WebCore/bridge/jni/JavaMethod.cpp
+++ b/Source/WebCore/bridge/jni/JavaMethodJobject.cpp
@@ -25,7 +25,7 @@
  */
 
 #include "config.h"
-#include "JavaMethod.h"
+#include "JavaMethodJobject.h"
 
 #if ENABLE(JAVA_BRIDGE)
 
@@ -40,7 +40,7 @@
 using namespace JSC;
 using namespace JSC::Bindings;
 
-JavaMethod::JavaMethod(JNIEnv* env, jobject aMethod)
+JavaMethodJobject::JavaMethodJobject(JNIEnv* env, jobject aMethod)
 {
     // Get return type name
     jstring returnTypeName = 0;
@@ -50,14 +50,14 @@ JavaMethod::JavaMethod(JNIEnv* env, jobject aMethod)
             returnTypeName = env->NewStringUTF("<Unknown>");
         env->DeleteLocalRef(returnType);
     }
-    m_returnType = JavaString(env, returnTypeName);
-    m_JNIReturnType = JNITypeFromClassName(m_returnType.utf8());
+    m_returnTypeClassName = JavaString(env, returnTypeName);
+    m_returnType = javaTypeFromClassName(m_returnTypeClassName.utf8());
     env->DeleteLocalRef(returnTypeName);
 
     // Get method name
     jstring methodName = static_cast<jstring>(callJNIMethod<jobject>(aMethod, "getName", "()Ljava/lang/String;"));
-    if (!returnTypeName)
-        returnTypeName = env->NewStringUTF("<Unknown>");
+    if (!methodName)
+        methodName = env->NewStringUTF("<Unknown>");
     m_name = JavaString(env, methodName);
     env->DeleteLocalRef(methodName);
 
@@ -79,7 +79,6 @@ JavaMethod::JavaMethod(JNIEnv* env, jobject aMethod)
 
     // Created lazily.
     m_signature = 0;
-    m_methodID = 0;
 
     jclass modifierClass = env->FindClass("java/lang/reflect/Modifier");
     int modifiers = callJNIMethod<jint>(aMethod, "getModifiers", "()I");
@@ -87,7 +86,7 @@ JavaMethod::JavaMethod(JNIEnv* env, jobject aMethod)
     env->DeleteLocalRef(modifierClass);
 }
 
-JavaMethod::~JavaMethod()
+JavaMethodJobject::~JavaMethodJobject()
 {
     if (m_signature)
         fastFree(m_signature);
@@ -115,7 +114,7 @@ static void appendClassName(StringBuilder& builder, const char* className)
     fastFree(result);
 }
 
-const char* JavaMethod::signature() const
+const char* JavaMethodJobject::signature() const
 {
     if (!m_signature) {
 #if USE(JSC)
@@ -126,12 +125,12 @@ const char* JavaMethod::signature() const
         signatureBuilder.append('(');
         for (unsigned int i = 0; i < m_parameters.size(); i++) {
             CString javaClassName = parameterAt(i).utf8();
-            JNIType type = JNITypeFromClassName(javaClassName.data());
-            if (type == array_type)
+            JavaType type = javaTypeFromClassName(javaClassName.data());
+            if (type == JavaTypeArray)
                 appendClassName(signatureBuilder, javaClassName.data());
             else {
-                signatureBuilder.append(signatureFromPrimitiveType(type));
-                if (type == object_type) {
+                signatureBuilder.append(signatureFromJavaType(type));
+                if (type == JavaTypeObject) {
                     appendClassName(signatureBuilder, javaClassName.data());
                     signatureBuilder.append(';');
                 }
@@ -139,12 +138,12 @@ const char* JavaMethod::signature() const
         }
         signatureBuilder.append(')');
 
-        const char* returnType = m_returnType.utf8();
-        if (m_JNIReturnType == array_type)
+        const char* returnType = m_returnTypeClassName.utf8();
+        if (m_returnType == JavaTypeArray)
             appendClassName(signatureBuilder, returnType);
         else {
-            signatureBuilder.append(signatureFromPrimitiveType(m_JNIReturnType));
-            if (m_JNIReturnType == object_type) {
+            signatureBuilder.append(signatureFromJavaType(m_returnType));
+            if (m_returnType == JavaTypeObject) {
                 appendClassName(signatureBuilder, returnType);
                 signatureBuilder.append(';');
             }
@@ -157,16 +156,4 @@ const char* JavaMethod::signature() const
     return m_signature;
 }
 
-JNIType JavaMethod::JNIReturnType() const
-{
-    return m_JNIReturnType;
-}
-
-jmethodID JavaMethod::methodID(jobject obj) const
-{
-    if (!m_methodID)
-        m_methodID = getMethodID(obj, m_name.utf8(), signature());
-    return m_methodID;
-}
-
 #endif // ENABLE(JAVA_BRIDGE)
diff --git a/Source/WebCore/bridge/jni/JavaMethodJobject.h b/Source/WebCore/bridge/jni/JavaMethodJobject.h
new file mode 100644
index 0000000..d9482ba
--- /dev/null
+++ b/Source/WebCore/bridge/jni/JavaMethodJobject.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2007, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright 2010, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaMethodJobject_h
+#define JavaMethodJobject_h
+
+#if ENABLE(JAVA_BRIDGE)
+
+#include "JavaMethod.h"
+#include "JavaString.h"
+
+#include <wtf/text/CString.h>
+
+namespace JSC {
+
+namespace Bindings {
+
+class JavaMethodJobject : public JavaMethod {
+public:
+    JavaMethodJobject(JNIEnv*, jobject);
+    virtual ~JavaMethodJobject();
+
+    // JavaMethod implementation
+    virtual String name() const { return m_name.impl(); }
+    virtual RuntimeType returnTypeClassName() const { return m_returnTypeClassName.utf8(); }
+    virtual String parameterAt(int i) const { return m_parameters[i]; }
+    virtual const char* signature() const;
+    virtual JavaType returnType() const { return m_returnType; }
+    virtual bool isStatic() const { return m_isStatic; }
+
+    // Method implementation
+    virtual int numParameters() const { return m_parameters.size(); }
+
+private:
+    Vector<String> m_parameters;
+    JavaString m_name;
+    mutable char* m_signature;
+    JavaString m_returnTypeClassName;
+    JavaType m_returnType;
+    bool m_isStatic;
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(JAVA_BRIDGE)
+
+#endif // JavaMethodJobject_h
diff --git a/Source/WebCore/bridge/jni/JavaType.h b/Source/WebCore/bridge/jni/JavaType.h
new file mode 100644
index 0000000..17053fb
--- /dev/null
+++ b/Source/WebCore/bridge/jni/JavaType.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaType_h
+#define JavaType_h
+
+#if ENABLE(JAVA_BRIDGE)
+
+namespace JSC {
+
+namespace Bindings {
+
+// The order of these items can not be modified as they are tightly
+// bound with the JVM on Mac OSX. If new types need to be added, they
+// should be added to the end. It is used in jni_obc.mm when calling
+// through to the JVM. Newly added items need to be made compatible
+// in that file.
+//
+// The type conversion logic used here needs improving and this enum will likely
+// be changed at that time. See https://bugs.webkit.org/show_bug.cgi?id=38745
+enum JavaType {
+    JavaTypeInvalid = 0,
+    JavaTypeVoid,
+    JavaTypeObject,
+    JavaTypeBoolean,
+    JavaTypeByte,
+    JavaTypeChar,
+    JavaTypeShort,
+    JavaTypeInt,
+    JavaTypeLong,
+    JavaTypeFloat,
+    JavaTypeDouble,
+    JavaTypeArray,
+#if USE(V8)
+    // JavaTypeString is distinct from JavaTypeObject because strings receive
+    // special handling when we convert to and from JavaScript. When calling
+    // Java methods, we must create Java String objects for string arguments.
+    // However, at conversion time we cannot assume that the mechanism used to
+    // interact with Java is JNI. Instead we use a special JavaTypeString.
+    // Implementations of JavaInstance which use JNI will create a Java String
+    // object when converting the JavaValue to a jvalue.
+    //
+    // Note that this type is independent of the JavaScript engine, but is
+    // currently used only with V8.
+    // See https://bugs.webkit.org/show_bug.cgi?id=57023.
+    JavaTypeString,
+#endif
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(JAVA_BRIDGE)
+
+#endif // JavaType_h
diff --git a/Source/WebCore/bridge/jni/jni_jsobject.mm b/Source/WebCore/bridge/jni/jni_jsobject.mm
index 172559e..03b8fc2 100644
--- a/Source/WebCore/bridge/jni/jni_jsobject.mm
+++ b/Source/WebCore/bridge/jni/jni_jsobject.mm
@@ -419,7 +419,7 @@ jstring JavaJSObject::toString() const
     JSObject *thisObj = const_cast<JSObject*>(_imp);
     ExecState* exec = rootObject->globalObject()->globalExec();
     
-    return static_cast<jstring>(convertValueToJValue(exec, rootObject, thisObj, object_type, "java.lang.String").l);
+    return static_cast<jstring>(convertValueToJValue(exec, rootObject, thisObj, JavaTypeObject, "java.lang.String").l);
 }
 
 void JavaJSObject::finalize() const
diff --git a/Source/WebCore/bridge/jni/jni_objc.mm b/Source/WebCore/bridge/jni/jni_objc.mm
index 8fa2c3f..9c943e8 100644
--- a/Source/WebCore/bridge/jni/jni_objc.mm
+++ b/Source/WebCore/bridge/jni/jni_objc.mm
@@ -28,31 +28,31 @@
 #if ENABLE(JAVA_BRIDGE)
 
 #import <Foundation/Foundation.h>
-#import "JNIUtility.h"
 #import "JNIUtilityPrivate.h"
+#import "JavaType.h"
 #import "objc_utility.h"
 #include <runtime/JSLock.h>
 
 using namespace JSC::Bindings;
 
 @interface NSObject (WebScriptingPrivate)
-- (jvalue)webPlugInCallJava:(jobject)object method:(jmethodID)method returnType:(JNIType)returnType arguments:(jvalue*)args;
+- (jvalue)webPlugInCallJava:(jobject)object method:(jmethodID)method returnType:(JavaType)returnType arguments:(jvalue*)args;
 - (jvalue)webPlugInCallJava:(jobject)object
                    isStatic:(BOOL)isStatic
-                 returnType:(JNIType)returnType
+                 returnType:(JavaType)returnType
                      method:(jmethodID)method
                   arguments:(jvalue*)args
                  callingURL:(NSURL *)url
        exceptionDescription:(NSString **)exceptionString;
 @end
 
-bool JSC::Bindings::dispatchJNICall(ExecState* exec, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue &result, const char*, JSValue& exceptionDescription)
+bool JSC::Bindings::dispatchJNICall(ExecState* exec, const void* targetAppletView, jobject obj, bool isStatic, JavaType returnType, jmethodID methodID, jvalue* args, jvalue &result, const char*, JSValue& exceptionDescription)
 {
     id view = (id)targetAppletView;
     
-    // As array_type is not known by the Mac JVM, change it to a compatible type.
-    if (returnType == array_type)
-        returnType = object_type;
+    // As JavaTypeArray is not known by the Mac JVM, change it to a compatible type.
+    if (returnType == JavaTypeArray)
+        returnType = JavaTypeObject;
     
     if ([view respondsToSelector:@selector(webPlugInCallJava:isStatic:returnType:method:arguments:callingURL:exceptionDescription:)]) {
         NSString *_exceptionDescription = 0;
diff --git a/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp b/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp
index a8be0bd..2356fe1 100644
--- a/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.cpp
@@ -53,8 +53,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
     jobjectArray jarray = 0;
 
     // Build the correct array type
-    switch (JNITypeFromPrimitiveType(javaClassName[1])) {
-    case object_type:
+    switch (javaTypeFromPrimitiveType(javaClassName[1])) {
+    case JavaTypeObject:
             {
             // Only support string object types
             if (!strcmp("[Ljava.lang.String;", javaClassName)) {
@@ -71,7 +71,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case boolean_type:
+    case JavaTypeBoolean:
         {
             jarray = (jobjectArray)env->NewBooleanArray(length);
             for (unsigned i = 0; i < length; i++) {
@@ -82,7 +82,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case byte_type:
+    case JavaTypeByte:
         {
             jarray = (jobjectArray)env->NewByteArray(length);
             for (unsigned i = 0; i < length; i++) {
@@ -93,7 +93,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case char_type:
+    case JavaTypeChar:
         {
             jarray = (jobjectArray)env->NewCharArray(length);
             for (unsigned i = 0; i < length; i++) {
@@ -107,7 +107,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case short_type:
+    case JavaTypeShort:
         {
             jarray = (jobjectArray)env->NewShortArray(length);
             for (unsigned i = 0; i < length; i++) {
@@ -118,7 +118,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case int_type:
+    case JavaTypeInt:
         {
             jarray = (jobjectArray)env->NewIntArray(length);
             for (unsigned i = 0; i < length; i++) {
@@ -129,7 +129,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case long_type:
+    case JavaTypeLong:
         {
             jarray = (jobjectArray)env->NewLongArray(length);
             for (unsigned i = 0; i < length; i++) {
@@ -140,7 +140,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case float_type:
+    case JavaTypeFloat:
         {
             jarray = (jobjectArray)env->NewFloatArray(length);
             for (unsigned i = 0; i < length; i++) {
@@ -151,7 +151,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case double_type:
+    case JavaTypeDouble:
         {
             jarray = (jobjectArray)env->NewDoubleArray(length);
             for (unsigned i = 0; i < length; i++) {
@@ -162,9 +162,9 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
             break;
         }
 
-    case array_type: // don't handle embedded arrays
-    case void_type: // Don't expect arrays of void objects
-    case invalid_type: // Array of unknown objects
+    case JavaTypeArray: // don't handle embedded arrays
+    case JavaTypeVoid: // Don't expect arrays of void objects
+    case JavaTypeInvalid: // Array of unknown objects
         break;
     }
 
@@ -172,16 +172,16 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
     return jarray;
 }
 
-jvalue convertValueToJValue(ExecState* exec, RootObject* rootObject, JSValue value, JNIType jniType, const char* javaClassName)
+jvalue convertValueToJValue(ExecState* exec, RootObject* rootObject, JSValue value, JavaType javaType, const char* javaClassName)
 {
     JSLock lock(SilenceAssertionsOnly);
 
     jvalue result;
     memset(&result, 0, sizeof(jvalue));
 
-    switch (jniType) {
-    case array_type:
-    case object_type:
+    switch (javaType) {
+    case JavaTypeArray:
+    case JavaTypeObject:
         {
             // FIXME: JavaJSObject::convertValueToJObject functionality is almost exactly the same,
             // these functions should use common code.
@@ -258,56 +258,56 @@ jvalue convertValueToJValue(ExecState* exec, RootObject* rootObject, JSValue val
         }
         break;
 
-    case boolean_type:
+    case JavaTypeBoolean:
         {
             result.z = (jboolean)value.toNumber(exec);
         }
         break;
 
-    case byte_type:
+    case JavaTypeByte:
         {
             result.b = (jbyte)value.toNumber(exec);
         }
         break;
 
-    case char_type:
+    case JavaTypeChar:
         {
             result.c = (jchar)value.toNumber(exec);
         }
         break;
 
-    case short_type:
+    case JavaTypeShort:
         {
             result.s = (jshort)value.toNumber(exec);
         }
         break;
 
-    case int_type:
+    case JavaTypeInt:
         {
             result.i = (jint)value.toNumber(exec);
         }
         break;
 
-    case long_type:
+    case JavaTypeLong:
         {
             result.j = (jlong)value.toNumber(exec);
         }
         break;
 
-    case float_type:
+    case JavaTypeFloat:
         {
             result.f = (jfloat)value.toNumber(exec);
         }
         break;
 
-    case double_type:
+    case JavaTypeDouble:
         {
             result.d = (jdouble)value.toNumber(exec);
         }
         break;
 
-    case invalid_type:
-    case void_type:
+    case JavaTypeInvalid:
+    case JavaTypeVoid:
         break;
     }
     return result;
diff --git a/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.h b/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.h
index 1266acd..ed09fd6 100644
--- a/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.h
+++ b/Source/WebCore/bridge/jni/jsc/JNIUtilityPrivate.h
@@ -41,8 +41,8 @@ namespace Bindings {
 
 class RootObject;
 
-jvalue convertValueToJValue(ExecState*, RootObject*, JSValue, JNIType, const char* javaClassName);
-bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValue& exceptionDescription);
+jvalue convertValueToJValue(ExecState*, RootObject*, JSValue, JavaType, const char* javaClassName);
+bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject, bool isStatic, JavaType returnType, jmethodID, jvalue* args, jvalue& result, const char* callingURL, JSValue& exceptionDescription);
 
 } // namespace Bindings
 
diff --git a/Source/WebCore/bridge/jni/jsc/JavaArrayJSC.cpp b/Source/WebCore/bridge/jni/jsc/JavaArrayJSC.cpp
index db87baa..caa8579 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaArrayJSC.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JavaArrayJSC.cpp
@@ -75,7 +75,7 @@ void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValue aValue) cons
     JNIEnv* env = getJNIEnv();
     char* javaClassName = 0;
 
-    JNIType arrayType = JNITypeFromPrimitiveType(m_type[1]);
+    JavaType arrayType = javaTypeFromPrimitiveType(m_type[1]);
     if (m_type[1] == 'L') {
         // The type of the array will be something like:
         // "[Ljava.lang.string;". This is guaranteed, so no need
@@ -86,54 +86,54 @@ void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValue aValue) cons
     jvalue aJValue = convertValueToJValue(exec, m_rootObject.get(), aValue, arrayType, javaClassName);
 
     switch (arrayType) {
-    case object_type:
+    case JavaTypeObject:
         {
             env->SetObjectArrayElement(static_cast<jobjectArray>(javaArray()), index, aJValue.l);
             break;
         }
 
-    case boolean_type:
+    case JavaTypeBoolean:
         {
             env->SetBooleanArrayRegion(static_cast<jbooleanArray>(javaArray()), index, 1, &aJValue.z);
             break;
         }
 
-    case byte_type:
+    case JavaTypeByte:
         {
             env->SetByteArrayRegion(static_cast<jbyteArray>(javaArray()), index, 1, &aJValue.b);
             break;
         }
 
-    case char_type:
+    case JavaTypeChar:
         {
             env->SetCharArrayRegion(static_cast<jcharArray>(javaArray()), index, 1, &aJValue.c);
             break;
         }
 
-    case short_type:
+    case JavaTypeShort:
         {
             env->SetShortArrayRegion(static_cast<jshortArray>(javaArray()), index, 1, &aJValue.s);
             break;
         }
 
-    case int_type:
+    case JavaTypeInt:
         {
             env->SetIntArrayRegion(static_cast<jintArray>(javaArray()), index, 1, &aJValue.i);
             break;
         }
 
-    case long_type:
+    case JavaTypeLong:
         {
             env->SetLongArrayRegion(static_cast<jlongArray>(javaArray()), index, 1, &aJValue.j);
         }
 
-    case float_type:
+    case JavaTypeFloat:
         {
             env->SetFloatArrayRegion(static_cast<jfloatArray>(javaArray()), index, 1, &aJValue.f);
             break;
         }
 
-    case double_type:
+    case JavaTypeDouble:
         {
             env->SetDoubleArrayRegion(static_cast<jdoubleArray>(javaArray()), index, 1, &aJValue.d);
             break;
@@ -149,9 +149,9 @@ void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValue aValue) cons
 JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
 {
     JNIEnv* env = getJNIEnv();
-    JNIType arrayType = JNITypeFromPrimitiveType(m_type[1]);
+    JavaType arrayType = javaTypeFromPrimitiveType(m_type[1]);
     switch (arrayType) {
-    case object_type:
+    case JavaTypeObject:
         {
             jobjectArray objectArray = static_cast<jobjectArray>(javaArray());
             jobject anObject;
@@ -168,7 +168,7 @@ JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
             return JavaInstance::create(anObject, rootObject())->createRuntimeObject(exec);
         }
 
-    case boolean_type:
+    case JavaTypeBoolean:
         {
             jbooleanArray booleanArray = static_cast<jbooleanArray>(javaArray());
             jboolean aBoolean;
@@ -176,7 +176,7 @@ JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
             return jsBoolean(aBoolean);
         }
 
-    case byte_type:
+    case JavaTypeByte:
         {
             jbyteArray byteArray = static_cast<jbyteArray>(javaArray());
             jbyte aByte;
@@ -184,7 +184,7 @@ JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
             return jsNumber(aByte);
         }
 
-    case char_type:
+    case JavaTypeChar:
         {
             jcharArray charArray = static_cast<jcharArray>(javaArray());
             jchar aChar;
@@ -193,7 +193,7 @@ JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
             break;
         }
 
-    case short_type:
+    case JavaTypeShort:
         {
             jshortArray shortArray = static_cast<jshortArray>(javaArray());
             jshort aShort;
@@ -201,7 +201,7 @@ JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
             return jsNumber(aShort);
         }
 
-    case int_type:
+    case JavaTypeInt:
         {
             jintArray intArray = static_cast<jintArray>(javaArray());
             jint anInt;
@@ -209,7 +209,7 @@ JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
             return jsNumber(anInt);
         }
 
-    case long_type:
+    case JavaTypeLong:
         {
             jlongArray longArray = static_cast<jlongArray>(javaArray());
             jlong aLong;
@@ -217,7 +217,7 @@ JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
             return jsNumber(aLong);
         }
 
-    case float_type:
+    case JavaTypeFloat:
         {
             jfloatArray floatArray = static_cast<jfloatArray>(javaArray());
             jfloat aFloat;
@@ -225,7 +225,7 @@ JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
             return jsNumber(aFloat);
         }
 
-    case double_type:
+    case JavaTypeDouble:
         {
             jdoubleArray doubleArray = static_cast<jdoubleArray>(javaArray());
             jdouble aDouble;
diff --git a/Source/WebCore/bridge/jni/jsc/JavaClassJSC.cpp b/Source/WebCore/bridge/jni/jsc/JavaClassJSC.cpp
index 18cd1af..44ea2b4 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaClassJSC.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JavaClassJSC.cpp
@@ -28,10 +28,9 @@
 
 #if ENABLE(JAVA_BRIDGE)
 
-#include "JNIUtility.h"
 #include "JSDOMWindow.h"
 #include "JavaFieldJSC.h"
-#include "JavaMethod.h"
+#include "JavaMethodJobject.h"
 #include <runtime/Identifier.h>
 #include <runtime/JSLock.h>
 
@@ -77,7 +76,7 @@ JavaClass::JavaClass(jobject anInstance)
         int numMethods = env->GetArrayLength(methods);
         for (i = 0; i < numMethods; i++) {
             jobject aJMethod = env->GetObjectArrayElement((jobjectArray)methods, i);
-            JavaMethod* aMethod = new JavaMethod(env, aJMethod); // deleted in the JavaClass destructor
+            JavaMethod* aMethod = new JavaMethodJobject(env, aJMethod); // deleted in the JavaClass destructor
             MethodList* methodList;
             {
                 JSLock lock(SilenceAssertionsOnly);
diff --git a/Source/WebCore/bridge/jni/jsc/JavaFieldJSC.cpp b/Source/WebCore/bridge/jni/jsc/JavaFieldJSC.cpp
index d3ba06a..b7c664e 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaFieldJSC.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JavaFieldJSC.cpp
@@ -48,9 +48,9 @@ JavaField::JavaField(JNIEnv* env, jobject aField)
         fieldTypeName = static_cast<jstring>(callJNIMethod<jobject>(fieldType, "getName", "()Ljava/lang/String;"));
     if (!fieldTypeName)
         fieldTypeName = env->NewStringUTF("<Unknown>");
-    m_type = JavaString(env, fieldTypeName);
+    m_typeClassName = JavaString(env, fieldTypeName);
 
-    m_JNIType = JNITypeFromClassName(m_type.utf8());
+    m_type = javaTypeFromClassName(m_typeClassName.utf8());
 
     // Get field name
     jstring fieldName = static_cast<jstring>(callJNIMethod<jobject>(aField, "getName", "()Ljava/lang/String;"));
@@ -61,7 +61,7 @@ JavaField::JavaField(JNIEnv* env, jobject aField)
     m_field = new JobjectWrapper(aField);
 }
 
-jvalue JavaField::dispatchValueFromInstance(ExecState* exec, const JavaInstance* instance, const char* name, const char* sig, JNIType returnType) const
+jvalue JavaField::dispatchValueFromInstance(ExecState* exec, const JavaInstance* instance, const char* name, const char* sig, JavaType returnType) const
 {
     jobject jinstance = instance->javaInstance();
     jobject fieldJInstance = m_field->m_instance;
@@ -94,17 +94,17 @@ JSValue JavaField::valueFromInstance(ExecState* exec, const Instance* i) const
 
     JSValue jsresult = jsUndefined();
 
-    switch (m_JNIType) {
-    case array_type:
-    case object_type:
+    switch (m_type) {
+    case JavaTypeArray:
+    case JavaTypeObject:
         {
-            jvalue result = dispatchValueFromInstance(exec, instance, "get", "(Ljava/lang/Object;)Ljava/lang/Object;", object_type);
+            jvalue result = dispatchValueFromInstance(exec, instance, "get", "(Ljava/lang/Object;)Ljava/lang/Object;", JavaTypeObject);
             jobject anObject = result.l;
 
             if (!anObject)
                 return jsNull();
 
-            const char* arrayType = type();
+            const char* arrayType = typeClassName();
             if (arrayType[0] == '[')
                 jsresult = JavaArray::convertJObjectToArray(exec, anObject, arrayType, instance->rootObject());
             else if (anObject)
@@ -112,29 +112,29 @@ JSValue JavaField::valueFromInstance(ExecState* exec, const Instance* i) const
         }
         break;
 
-    case boolean_type:
-        jsresult = jsBoolean(dispatchValueFromInstance(exec, instance, "getBoolean", "(Ljava/lang/Object;)Z", boolean_type).z);
+    case JavaTypeBoolean:
+        jsresult = jsBoolean(dispatchValueFromInstance(exec, instance, "getBoolean", "(Ljava/lang/Object;)Z", JavaTypeBoolean).z);
         break;
 
-    case byte_type:
-    case char_type:
-    case short_type:
+    case JavaTypeByte:
+    case JavaTypeChar:
+    case JavaTypeShort:
 
-    case int_type:
+    case JavaTypeInt:
         {
             jint value;
-            jvalue result = dispatchValueFromInstance(exec, instance, "getInt", "(Ljava/lang/Object;)I", int_type);
+            jvalue result = dispatchValueFromInstance(exec, instance, "getInt", "(Ljava/lang/Object;)I", JavaTypeInt);
             value = result.i;
             jsresult = jsNumber(static_cast<int>(value));
         }
         break;
 
-    case long_type:
-    case float_type:
-    case double_type:
+    case JavaTypeLong:
+    case JavaTypeFloat:
+    case JavaTypeDouble:
         {
             jdouble value;
-            jvalue result = dispatchValueFromInstance(exec, instance, "getDouble", "(Ljava/lang/Object;)D", double_type);
+            jvalue result = dispatchValueFromInstance(exec, instance, "getDouble", "(Ljava/lang/Object;)D", JavaTypeDouble);
             value = result.i;
             jsresult = jsNumber(static_cast<double>(value));
         }
@@ -166,7 +166,7 @@ void JavaField::dispatchSetValueToInstance(ExecState* exec, const JavaInstance*
 
                 args[0].l = jinstance;
                 args[1] = javaValue;
-                dispatchJNICall(exec, rootObject->nativeHandle(), fieldJInstance, false, void_type, mid, args, result, 0, exceptionDescription);
+                dispatchJNICall(exec, rootObject->nativeHandle(), fieldJInstance, false, JavaTypeVoid, mid, args, result, 0, exceptionDescription);
                 if (exceptionDescription)
                     throwError(exec, createError(exec, exceptionDescription.toString(exec)));
             }
@@ -177,61 +177,61 @@ void JavaField::dispatchSetValueToInstance(ExecState* exec, const JavaInstance*
 void JavaField::setValueToInstance(ExecState* exec, const Instance* i, JSValue aValue) const
 {
     const JavaInstance* instance = static_cast<const JavaInstance*>(i);
-    jvalue javaValue = convertValueToJValue(exec, i->rootObject(), aValue, m_JNIType, type());
+    jvalue javaValue = convertValueToJValue(exec, i->rootObject(), aValue, m_type, typeClassName());
 
     LOG(LiveConnect, "JavaField::setValueToInstance setting value %s to %s", UString(name().impl()).utf8().data(), aValue.toString(exec).ascii().data());
 
-    switch (m_JNIType) {
-    case array_type:
-    case object_type:
+    switch (m_type) {
+    case JavaTypeArray:
+    case JavaTypeObject:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "set", "(Ljava/lang/Object;Ljava/lang/Object;)V");
         }
         break;
 
-    case boolean_type:
+    case JavaTypeBoolean:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "setBoolean", "(Ljava/lang/Object;Z)V");
         }
         break;
 
-    case byte_type:
+    case JavaTypeByte:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "setByte", "(Ljava/lang/Object;B)V");
         }
         break;
 
-    case char_type:
+    case JavaTypeChar:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "setChar", "(Ljava/lang/Object;C)V");
         }
         break;
 
-    case short_type:
+    case JavaTypeShort:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "setShort", "(Ljava/lang/Object;S)V");
         }
         break;
 
-    case int_type:
+    case JavaTypeInt:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "setInt", "(Ljava/lang/Object;I)V");
         }
         break;
 
-    case long_type:
+    case JavaTypeLong:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "setLong", "(Ljava/lang/Object;J)V");
         }
         break;
 
-    case float_type:
+    case JavaTypeFloat:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "setFloat", "(Ljava/lang/Object;F)V");
         }
         break;
 
-    case double_type:
+    case JavaTypeDouble:
         {
             dispatchSetValueToInstance(exec, instance, javaValue, "setDouble", "(Ljava/lang/Object;D)V");
         }
diff --git a/Source/WebCore/bridge/jni/jsc/JavaFieldJSC.h b/Source/WebCore/bridge/jni/jsc/JavaFieldJSC.h
index a67264a..9b95132 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaFieldJSC.h
+++ b/Source/WebCore/bridge/jni/jsc/JavaFieldJSC.h
@@ -47,17 +47,16 @@ public:
     virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const;
 
     const JavaString& name() const { return m_name; }
-    virtual RuntimeType type() const { return m_type.utf8(); }
-
-    JNIType getJNIType() const { return m_JNIType; }
+    virtual RuntimeType typeClassName() const { return m_typeClassName.utf8(); }
+    JavaType type() const { return m_type; }
 
 private:
     void dispatchSetValueToInstance(ExecState*, const JavaInstance*, jvalue, const char* name, const char* sig) const;
-    jvalue dispatchValueFromInstance(ExecState*, const JavaInstance*, const char* name, const char* sig, JNIType returnType) const;
+    jvalue dispatchValueFromInstance(ExecState*, const JavaInstance*, const char* name, const char* sig, JavaType returnType) const;
 
     JavaString m_name;
-    JavaString m_type;
-    JNIType m_JNIType;
+    JavaString m_typeClassName;
+    JavaType m_type;
     RefPtr<JobjectWrapper> m_field;
 };
 
diff --git a/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp b/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
index 9d9a450..806efa6 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
+++ b/Source/WebCore/bridge/jni/jsc/JavaInstanceJSC.cpp
@@ -29,7 +29,6 @@
 #if ENABLE(JAVA_BRIDGE)
 
 #include "JavaRuntimeObject.h"
-#include "JNIUtility.h"
 #include "JNIUtilityPrivate.h"
 #include "JSDOMBinding.h"
 #include "JavaArrayJSC.h"
@@ -125,9 +124,9 @@ public:
         ASSERT(inherits(&s_info));
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     static const ClassInfo s_info;
@@ -178,7 +177,7 @@ JSValue JavaInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod
 
     for (i = 0; i < count; i++) {
         CString javaClassName = jMethod->parameterAt(i).utf8();
-        jArgs[i] = convertValueToJValue(exec, m_rootObject.get(), exec->argument(i), JNITypeFromClassName(javaClassName.data()), javaClassName.data());
+        jArgs[i] = convertValueToJValue(exec, m_rootObject.get(), exec->argument(i), javaTypeFromClassName(javaClassName.data()), javaClassName.data());
         LOG(LiveConnect, "JavaInstance::invokeMethod arg[%d] = %s", i, exec->argument(i).toString(exec).ascii().data());
     }
 
@@ -196,7 +195,8 @@ JSValue JavaInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod
         jobject obj = m_instance->m_instance;
         JSValue exceptionDescription;
         const char *callingURL = 0; // FIXME, need to propagate calling URL to Java
-        handled = dispatchJNICall(exec, rootObject->nativeHandle(), obj, jMethod->isStatic(), jMethod->JNIReturnType(), jMethod->methodID(obj), jArgs.data(), result, callingURL, exceptionDescription);
+        jmethodID methodId = getMethodID(obj, jMethod->name().utf8().data(), jMethod->signature());
+        handled = dispatchJNICall(exec, rootObject->nativeHandle(), obj, jMethod->isStatic(), jMethod->returnType(), methodId, jArgs.data(), result, callingURL, exceptionDescription);
         if (exceptionDescription) {
             throwError(exec, createError(exec, exceptionDescription.toString(exec)));
             return jsUndefined();
@@ -206,58 +206,22 @@ JSValue JavaInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod
 // This is a deprecated code path which should not be required on Android.
 // Remove this guard once Bug 39476 is fixed.
 #if PLATFORM(ANDROID) || defined(BUILDING_ON_TIGER)
-    if (!handled) {
-        jobject obj = m_instance->m_instance;
-        switch (jMethod->JNIReturnType()) {
-        case void_type:
-            callJNIMethodIDA<void>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case object_type:
-            result.l = callJNIMethodIDA<jobject>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case boolean_type:
-            result.z = callJNIMethodIDA<jboolean>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case byte_type:
-            result.b = callJNIMethodIDA<jbyte>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case char_type:
-            result.c = callJNIMethodIDA<jchar>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case short_type:
-            result.s = callJNIMethodIDA<jshort>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case int_type:
-            result.i = callJNIMethodIDA<jint>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case long_type:
-            result.j = callJNIMethodIDA<jlong>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case float_type:
-            result.f = callJNIMethodIDA<jfloat>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case double_type:
-            result.d = callJNIMethodIDA<jdouble>(obj, jMethod->methodID(obj), jArgs.data());
-            break;
-        case array_type:
-        case invalid_type:
-            break;
-        }
-    }
+    if (!handled)
+        result = callJNIMethod(m_instance->m_instance, jMethod->returnType(), jMethod->name().utf8().data(), jMethod->signature(), jArgs.data());
 #endif
 
-    switch (jMethod->JNIReturnType()) {
-    case void_type:
+    switch (jMethod->returnType()) {
+    case JavaTypeVoid:
         {
             resultValue = jsUndefined();
         }
         break;
 
-    case object_type:
+    case JavaTypeObject:
         {
             if (result.l) {
-                // FIXME: array_type return type is handled below, can we actually get an array here?
-                const char* arrayType = jMethod->returnType();
+                // FIXME: JavaTypeArray return type is handled below, can we actually get an array here?
+                const char* arrayType = jMethod->returnTypeClassName();
                 if (arrayType[0] == '[')
                     resultValue = JavaArray::convertJObjectToArray(exec, result.l, arrayType, rootObject);
                 else {
@@ -281,63 +245,63 @@ JSValue JavaInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod
         }
         break;
 
-    case boolean_type:
+    case JavaTypeBoolean:
         {
             resultValue = jsBoolean(result.z);
         }
         break;
 
-    case byte_type:
+    case JavaTypeByte:
         {
             resultValue = jsNumber(result.b);
         }
         break;
 
-    case char_type:
+    case JavaTypeChar:
         {
             resultValue = jsNumber(result.c);
         }
         break;
 
-    case short_type:
+    case JavaTypeShort:
         {
             resultValue = jsNumber(result.s);
         }
         break;
 
-    case int_type:
+    case JavaTypeInt:
         {
             resultValue = jsNumber(result.i);
         }
         break;
 
-    case long_type:
+    case JavaTypeLong:
         {
             resultValue = jsNumber(result.j);
         }
         break;
 
-    case float_type:
+    case JavaTypeFloat:
         {
             resultValue = jsNumber(result.f);
         }
         break;
 
-    case double_type:
+    case JavaTypeDouble:
         {
             resultValue = jsNumber(result.d);
         }
         break;
 
-    case array_type:
+    case JavaTypeArray:
         {
-            const char* arrayType = jMethod->returnType();
+            const char* arrayType = jMethod->returnTypeClassName();
             ASSERT(arrayType[0] == '[');
             resultValue = JavaArray::convertJObjectToArray(exec, result.l, arrayType, rootObject);
         }
         break;
 
-    case invalid_type:
+    case JavaTypeInvalid:
         {
             resultValue = jsUndefined();
         }
diff --git a/Source/WebCore/bridge/jni/jsc/JavaRuntimeObject.h b/Source/WebCore/bridge/jni/jsc/JavaRuntimeObject.h
index 12a85ae..03f116f 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaRuntimeObject.h
+++ b/Source/WebCore/bridge/jni/jsc/JavaRuntimeObject.h
@@ -42,9 +42,9 @@ public:
 
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 };
 
diff --git a/Source/WebCore/bridge/jni/jsc/JavaStringJSC.h b/Source/WebCore/bridge/jni/jsc/JavaStringJSC.h
index 3ce7a16..7c19d4e 100644
--- a/Source/WebCore/bridge/jni/jsc/JavaStringJSC.h
+++ b/Source/WebCore/bridge/jni/jsc/JavaStringJSC.h
@@ -28,7 +28,9 @@
 
 #include "JNIUtility.h"
 #include "JavaInstanceJSC.h"
+
 #include <runtime/JSLock.h>
+#include <runtime/ScopeChain.h>
 
 
 namespace JSC {
diff --git a/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.cpp b/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.cpp
index 30e344d..7ac1a93 100644
--- a/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.cpp
+++ b/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.cpp
@@ -30,22 +30,28 @@
 
 #include "JavaInstanceV8.h"
 #include "JavaNPObjectV8.h"
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
 #include "npruntime_impl.h"
 #endif // PLATFORM(ANDROID)
+=======
+#include "JavaValueV8.h"
+>>>>>>> webkit.org at r82507
 #include <wtf/text/CString.h>
 
 namespace JSC {
 
 namespace Bindings {
 
-jvalue convertNPVariantToJValue(NPVariant value, const WTF::String& javaType)
+JavaValue convertNPVariantToJavaValue(NPVariant value, const String& javaClass)
 {
-    CString javaClassName = javaType.utf8();
-    JNIType jniType = JNITypeFromClassName(javaClassName.data());
-    jvalue result;
+    CString javaClassName = javaClass.utf8();
+    JavaType javaType = javaTypeFromClassName(javaClassName.data());
+    JavaValue result;
+    result.m_type = javaType;
     NPVariantType type = value.type;
 
+<<<<<<< HEAD
     switch (jniType) {
     case array_type:
 #if PLATFORM(ANDROID)
@@ -208,29 +214,31 @@ jvalue convertNPVariantToJValue(NPVariant value, const WTF::String& javaType)
 #endif // PLATFORM(ANDROID)
 
     case object_type:
+=======
+    switch (javaType) {
+    case JavaTypeArray:
+    case JavaTypeObject:
+>>>>>>> webkit.org at r82507
         {
-            result.l = static_cast<jobject>(0);
-
-            // First see if we have a Java instance.
+            // See if we have a Java instance.
             if (type == NPVariantType_Object) {
                 NPObject* objectImp = NPVARIANT_TO_OBJECT(value);
-                if (JavaInstance* instance = ExtractJavaInstance(objectImp))
-                    result.l = instance->javaInstance();
+                result.m_objectValue = ExtractJavaInstance(objectImp);
             }
+        }
+        break;
 
-            // Now convert value to a string if the target type is a java.lang.string, and we're not
-            // converting from a Null.
-            if (!result.l && !strcmp(javaClassName.data(), "java.lang.String")) {
+    case JavaTypeString:
+        {
 #ifdef CONVERT_NULL_TO_EMPTY_STRING
-                if (type == NPVariantType_Null) {
-                    JNIEnv* env = getJNIEnv();
-                    jchar buf[2];
-                    jobject javaString = env->functions->NewString(env, buf, 0);
-                    result.l = javaString;
-                } else
+            if (type == NPVariantType_Null) {
+                result.m_type = JavaTypeString;
+                result.m_stringValue = String::fromUTF8("");
+            } else
 #else
-                if (type == NPVariantType_String)
+            if (type == NPVariantType_String)
 #endif
+<<<<<<< HEAD
                 {
                     NPString src = NPVARIANT_TO_STRING(value);
                     JNIEnv* env = getJNIEnv();
@@ -261,182 +269,167 @@ jvalue convertNPVariantToJValue(NPVariant value, const WTF::String& javaType)
 #endif // PLATFORM(ANDROID)
             } else if (!result.l)
                 memset(&result, 0, sizeof(jvalue)); // Handle it the same as a void case
+=======
+            {
+                NPString src = NPVARIANT_TO_STRING(value);
+                result.m_type = JavaTypeString;
+                result.m_stringValue = String::fromUTF8(src.UTF8Characters);
+            }
+>>>>>>> webkit.org at r82507
         }
         break;
 
-    case boolean_type:
+    case JavaTypeBoolean:
         {
             if (type == NPVariantType_Bool)
-                result.z = NPVARIANT_TO_BOOLEAN(value);
-            else
-                memset(&result, 0, sizeof(jvalue)); // as void case
+                result.m_booleanValue = NPVARIANT_TO_BOOLEAN(value);
         }
         break;
 
-    case byte_type:
+    case JavaTypeByte:
         {
             if (type == NPVariantType_Int32)
-                result.b = static_cast<jbyte>(NPVARIANT_TO_INT32(value));
+                result.m_byteValue = static_cast<signed char>(NPVARIANT_TO_INT32(value));
             else if (type == NPVariantType_Double)
-                result.b = static_cast<jbyte>(NPVARIANT_TO_DOUBLE(value));
-            else
-                memset(&result, 0, sizeof(jvalue));
+                result.m_byteValue = static_cast<signed char>(NPVARIANT_TO_DOUBLE(value));
         }
         break;
 
-    case char_type:
+    case JavaTypeChar:
         {
             if (type == NPVariantType_Int32)
-                result.c = static_cast<char>(NPVARIANT_TO_INT32(value));
-            else
-                memset(&result, 0, sizeof(jvalue));
+                result.m_charValue = static_cast<unsigned short>(NPVARIANT_TO_INT32(value));
         }
         break;
 
-    case short_type:
+    case JavaTypeShort:
         {
             if (type == NPVariantType_Int32)
-                result.s = static_cast<jshort>(NPVARIANT_TO_INT32(value));
+                result.m_shortValue = static_cast<short>(NPVARIANT_TO_INT32(value));
             else if (type == NPVariantType_Double)
-                result.s = static_cast<jshort>(NPVARIANT_TO_DOUBLE(value));
-            else
-                memset(&result, 0, sizeof(jvalue));
+                result.m_shortValue = static_cast<short>(NPVARIANT_TO_DOUBLE(value));
         }
         break;
 
-    case int_type:
+    case JavaTypeInt:
         {
             if (type == NPVariantType_Int32)
-                result.i = static_cast<jint>(NPVARIANT_TO_INT32(value));
+                result.m_intValue = static_cast<int>(NPVARIANT_TO_INT32(value));
             else if (type == NPVariantType_Double)
-                result.i = static_cast<jint>(NPVARIANT_TO_DOUBLE(value));
-            else
-                memset(&result, 0, sizeof(jvalue));
+                result.m_intValue = static_cast<int>(NPVARIANT_TO_DOUBLE(value));
         }
         break;
 
-    case long_type:
+    case JavaTypeLong:
         {
             if (type == NPVariantType_Int32)
-                result.j = static_cast<jlong>(NPVARIANT_TO_INT32(value));
+                result.m_longValue = static_cast<long long>(NPVARIANT_TO_INT32(value));
             else if (type == NPVariantType_Double)
-                result.j = static_cast<jlong>(NPVARIANT_TO_DOUBLE(value));
-            else
-                memset(&result, 0, sizeof(jvalue));
+                result.m_longValue = static_cast<long long>(NPVARIANT_TO_DOUBLE(value));
         }
         break;
 
-    case float_type:
+    case JavaTypeFloat:
         {
             if (type == NPVariantType_Int32)
-                result.f = static_cast<jfloat>(NPVARIANT_TO_INT32(value));
+                result.m_floatValue = static_cast<float>(NPVARIANT_TO_INT32(value));
             else if (type == NPVariantType_Double)
-                result.f = static_cast<jfloat>(NPVARIANT_TO_DOUBLE(value));
-            else
-                memset(&result, 0, sizeof(jvalue));
+                result.m_floatValue = static_cast<float>(NPVARIANT_TO_DOUBLE(value));
         }
         break;
 
-    case double_type:
+    case JavaTypeDouble:
         {
             if (type == NPVariantType_Int32)
-                result.d = static_cast<jdouble>(NPVARIANT_TO_INT32(value));
+                result.m_doubleValue = static_cast<double>(NPVARIANT_TO_INT32(value));
             else if (type == NPVariantType_Double)
-                result.d = static_cast<jdouble>(NPVARIANT_TO_DOUBLE(value));
-            else
-                memset(&result, 0, sizeof(jvalue));
+                result.m_doubleValue = static_cast<double>(NPVARIANT_TO_DOUBLE(value));
         }
         break;
-
-        break;
-
-    case invalid_type:
     default:
-    case void_type:
-        {
-            memset(&result, 0, sizeof(jvalue));
-        }
         break;
     }
     return result;
 }
 
 
-void convertJValueToNPVariant(jvalue value, JNIType jniType, const char* javaTypeName, NPVariant* result)
+void convertJavaValueToNPVariant(JavaValue value, NPVariant* result)
 {
-    switch (jniType) {
-    case void_type:
+    switch (value.m_type) {
+    case JavaTypeVoid:
         {
             VOID_TO_NPVARIANT(*result);
         }
         break;
 
-    case object_type:
+    case JavaTypeObject:
         {
-            if (value.l) {
-                if (!strcmp(javaTypeName, "java.lang.String")) {
-                    const char* v = getCharactersFromJString(static_cast<jstring>(value.l));
-                    // s is freed in NPN_ReleaseVariantValue (see npruntime.cpp)
-                    const char* s = strdup(v);
-                    releaseCharactersForJString(static_cast<jstring>(value.l), v);
-                    STRINGZ_TO_NPVARIANT(s, *result);
-                } else
-                    OBJECT_TO_NPVARIANT(JavaInstanceToNPObject(new JavaInstance(value.l)), *result);
-            } else
+            // If the JavaValue is a String object, it should have type JavaTypeString.
+            if (value.m_objectValue)
+                OBJECT_TO_NPVARIANT(JavaInstanceToNPObject(value.m_objectValue.get()), *result);
+            else
                 VOID_TO_NPVARIANT(*result);
         }
         break;
 
-    case boolean_type:
+    case JavaTypeString:
+        {
+            const char* utf8String = strdup(value.m_stringValue.utf8().data());
+            // The copied string is freed in NPN_ReleaseVariantValue (see npruntime.cpp)
+            STRINGZ_TO_NPVARIANT(utf8String, *result);
+        }
+        break;
+
+    case JavaTypeBoolean:
         {
-            BOOLEAN_TO_NPVARIANT(value.z, *result);
+            BOOLEAN_TO_NPVARIANT(value.m_booleanValue, *result);
         }
         break;
 
-    case byte_type:
+    case JavaTypeByte:
         {
-            INT32_TO_NPVARIANT(value.b, *result);
+            INT32_TO_NPVARIANT(value.m_byteValue, *result);
         }
         break;
 
-    case char_type:
+    case JavaTypeChar:
         {
-            INT32_TO_NPVARIANT(value.c, *result);
+            INT32_TO_NPVARIANT(value.m_charValue, *result);
         }
         break;
 
-    case short_type:
+    case JavaTypeShort:
         {
-            INT32_TO_NPVARIANT(value.s, *result);
+            INT32_TO_NPVARIANT(value.m_shortValue, *result);
         }
         break;
 
-    case int_type:
+    case JavaTypeInt:
         {
-            INT32_TO_NPVARIANT(value.i, *result);
+            INT32_TO_NPVARIANT(value.m_intValue, *result);
         }
         break;
 
         // TODO: Check if cast to double is needed.
-    case long_type:
+    case JavaTypeLong:
         {
-            DOUBLE_TO_NPVARIANT(value.j, *result);
+            DOUBLE_TO_NPVARIANT(value.m_longValue, *result);
         }
         break;
 
-    case float_type:
+    case JavaTypeFloat:
         {
-            DOUBLE_TO_NPVARIANT(value.f, *result);
+            DOUBLE_TO_NPVARIANT(value.m_floatValue, *result);
         }
         break;
 
-    case double_type:
+    case JavaTypeDouble:
         {
-            DOUBLE_TO_NPVARIANT(value.d, *result);
+            DOUBLE_TO_NPVARIANT(value.m_doubleValue, *result);
         }
         break;
 
-    case invalid_type:
+    case JavaTypeInvalid:
     default:
         {
             VOID_TO_NPVARIANT(*result);
@@ -445,6 +438,103 @@ void convertJValueToNPVariant(jvalue value, JNIType jniType, const char* javaTyp
     }
 }
 
+JavaValue jvalueToJavaValue(const jvalue& value, const JavaType& type)
+{
+    JavaValue result;
+    result.m_type = type;
+    switch (result.m_type) {
+    case JavaTypeVoid:
+        break;
+    case JavaTypeObject:
+        result.m_objectValue = new JavaInstance(value.l);
+        break;
+    case JavaTypeString:
+        {
+            jstring javaString = static_cast<jstring>(value.l);
+            const UChar* a = getUCharactersFromJStringInEnv(getJNIEnv(), javaString);
+            // We take a copy to allow the Java String to be released.
+            result.m_stringValue = String(a).threadsafeCopy();
+            releaseUCharactersForJStringInEnv(getJNIEnv(), javaString, a);
+        }
+        break;
+    case JavaTypeBoolean:
+        result.m_booleanValue = value.z == JNI_FALSE ? false : true;
+        break;
+    case JavaTypeByte:
+        result.m_byteValue = value.b;
+        break;
+    case JavaTypeChar:
+        result.m_charValue = value.c;
+        break;
+    case JavaTypeShort:
+        result.m_shortValue = value.s;
+        break;
+    case JavaTypeInt:
+        result.m_intValue = value.i;
+        break;
+    case JavaTypeLong:
+        result.m_longValue = value.j;
+        break;
+    case JavaTypeFloat:
+        result.m_floatValue = value.f;
+        break;
+    case JavaTypeDouble:
+        result.m_doubleValue = value.d;
+        break;
+    default:
+        ASSERT(false);
+    }
+    return result;
+}
+
+jvalue javaValueToJvalue(const JavaValue& value)
+{
+    jvalue result;
+    memset(&result, 0, sizeof(jvalue));
+    switch (value.m_type) {
+    case JavaTypeVoid:
+        break;
+    case JavaTypeObject:
+        if (value.m_objectValue)
+            result.l = value.m_objectValue->javaInstance();
+        break;
+    case JavaTypeString:
+        // This creates a local reference to a new String object, which will
+        // be released when the call stack returns to Java. Note that this
+        // may cause leaks if invoked from a native message loop, as is the
+        // case in workers.
+        result.l = getJNIEnv()->NewString(value.m_stringValue.characters(), value.m_stringValue.length());
+        break;
+    case JavaTypeBoolean:
+        result.z = value.m_booleanValue ? JNI_TRUE : JNI_FALSE;
+        break;
+    case JavaTypeByte:
+        result.b = value.m_byteValue;
+        break;
+    case JavaTypeChar:
+        result.c = value.m_charValue;
+        break;
+    case JavaTypeShort:
+        result.s = value.m_shortValue;
+        break;
+    case JavaTypeInt:
+        result.i = value.m_intValue;
+        break;
+    case JavaTypeLong:
+        result.j = value.m_longValue;
+        break;
+    case JavaTypeFloat:
+        result.f = value.m_floatValue;
+        break;
+    case JavaTypeDouble:
+        result.d = value.m_doubleValue;
+        break;
+    default:
+        ASSERT(false);
+    }
+    return result;
+}
+
 } // namespace Bindings
 
 } // namespace JSC
diff --git a/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.h b/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.h
index df73a9e..0282904 100644
--- a/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.h
+++ b/Source/WebCore/bridge/jni/v8/JNIUtilityPrivate.h
@@ -36,8 +36,13 @@ namespace JSC {
 
 namespace Bindings {
 
-jvalue convertNPVariantToJValue(NPVariant, const WTF::String& javaType);
-void convertJValueToNPVariant(jvalue, JNIType, const char* javaClassName, NPVariant*);
+class JavaValue;
+
+JavaValue convertNPVariantToJavaValue(NPVariant, const String& javaClass);
+void convertJavaValueToNPVariant(JavaValue, NPVariant*);
+
+JavaValue jvalueToJavaValue(const jvalue&, const JavaType&);
+jvalue javaValueToJvalue(const JavaValue&);
 
 } // namespace Bindings
 
diff --git a/Source/WebCore/bridge/jni/v8/JavaClassV8.cpp b/Source/WebCore/bridge/jni/v8/JavaClassV8.cpp
index 18377bd..24d05f3 100644
--- a/Source/WebCore/bridge/jni/v8/JavaClassV8.cpp
+++ b/Source/WebCore/bridge/jni/v8/JavaClassV8.cpp
@@ -29,7 +29,7 @@
 #if ENABLE(JAVA_BRIDGE)
 
 #include "JavaFieldV8.h"
-#include "JavaMethod.h"
+#include "JavaMethodJobject.h"
 
 using namespace JSC::Bindings;
 
@@ -38,7 +38,7 @@ JavaClass::JavaClass(jobject anInstance)
     jobject aClass = callJNIMethod<jobject>(anInstance, "getClass", "()Ljava/lang/Class;");
 
     if (!aClass) {
-        fprintf(stderr, "%s:  unable to call getClass on instance %p\n", __PRETTY_FUNCTION__, anInstance);
+        LOG_ERROR("unable to call getClass on instance %p", anInstance);
         return;
     }
 
@@ -62,13 +62,13 @@ JavaClass::JavaClass(jobject anInstance)
     int numMethods = env->GetArrayLength(methods);
     for (i = 0; i < numMethods; i++) {
         jobject aJMethod = env->GetObjectArrayElement(static_cast<jobjectArray>(methods), i);
-        JavaMethod* aMethod = new JavaMethod(env, aJMethod); // deleted in the JavaClass destructor
+        JavaMethod* aMethod = new JavaMethodJobject(env, aJMethod); // deleted in the JavaClass destructor
         MethodList* methodList;
         {
-            methodList = m_methods.get(aMethod->name().utf8());
+            methodList = m_methods.get(aMethod->name());
             if (!methodList) {
                 methodList = new MethodList();
-                m_methods.set(aMethod->name().utf8(), methodList);
+                m_methods.set(aMethod->name(), methodList);
             }
         }
         methodList->append(aMethod);
diff --git a/Source/WebCore/bridge/jni/v8/JavaFieldV8.cpp b/Source/WebCore/bridge/jni/v8/JavaFieldV8.cpp
index 62081eb..2a6dd0b 100644
--- a/Source/WebCore/bridge/jni/v8/JavaFieldV8.cpp
+++ b/Source/WebCore/bridge/jni/v8/JavaFieldV8.cpp
@@ -35,8 +35,8 @@ JavaField::JavaField(JNIEnv* env, jobject aField)
     // Get field type
     jobject fieldType = callJNIMethod<jobject>(aField, "getType", "()Ljava/lang/Class;");
     jstring fieldTypeName = static_cast<jstring>(callJNIMethod<jobject>(fieldType, "getName", "()Ljava/lang/String;"));
-    m_type = JavaString(env, fieldTypeName);
-    m_JNIType = JNITypeFromClassName(m_type.utf8());
+    m_typeClassName = JavaString(env, fieldTypeName);
+    m_type = javaTypeFromClassName(m_typeClassName.utf8());
 
     // Get field name
     jstring fieldName = static_cast<jstring>(callJNIMethod<jobject>(aField, "getName", "()Ljava/lang/String;"));
diff --git a/Source/WebCore/bridge/jni/v8/JavaFieldV8.h b/Source/WebCore/bridge/jni/v8/JavaFieldV8.h
index caf28bf..defed60 100644
--- a/Source/WebCore/bridge/jni/v8/JavaFieldV8.h
+++ b/Source/WebCore/bridge/jni/v8/JavaFieldV8.h
@@ -40,14 +40,13 @@ public:
     JavaField(JNIEnv*, jobject aField);
 
     const JavaString& name() const { return m_name; }
-    const char* type() const { return m_type.utf8(); }
-
-    JNIType getJNIType() const { return m_JNIType; }
+    const char* typeClassName() const { return m_typeClassName.utf8(); }
+    JavaType type() const { return m_type; }
 
 private:
     JavaString m_name;
-    JavaString m_type;
-    JNIType m_JNIType;
+    JavaString m_typeClassName;
+    JavaType m_type;
     RefPtr<JobjectWrapper> m_field;
 };
 
diff --git a/Source/WebCore/bridge/jni/v8/JavaInstanceV8.cpp b/Source/WebCore/bridge/jni/v8/JavaInstanceV8.cpp
index dbf53f0..d1075ae 100644
--- a/Source/WebCore/bridge/jni/v8/JavaInstanceV8.cpp
+++ b/Source/WebCore/bridge/jni/v8/JavaInstanceV8.cpp
@@ -29,10 +29,12 @@
 
 #if ENABLE(JAVA_BRIDGE)
 
-#include "JavaMethod.h"
 #include "JNIUtilityPrivate.h"
 #include "JavaClassV8.h"
+#include "JavaFieldV8.h"
+#include "JavaMethod.h"
 
+#include <wtf/OwnArrayPtr.h>
 #include <wtf/text/CString.h>
 
 using namespace JSC::Bindings;
@@ -68,88 +70,21 @@ JavaClass* JavaInstance::getClass() const
     return m_class;
 }
 
-bool JavaInstance::invokeMethod(const char* methodName, const NPVariant* args, int count, NPVariant* resultValue)
+JavaValue JavaInstance::invokeMethod(const JavaMethod* method, JavaValue* args)
 {
-    VOID_TO_NPVARIANT(*resultValue);
-
-    MethodList methodList = getClass()->methodsNamed(methodName);
-
-    size_t numMethods = methodList.size();
-
-    // Try to find a good match for the overloaded method.  The
-    // fundamental problem is that JavaScript doesn't have the
-    // notion of method overloading and Java does.  We could
-    // get a bit more sophisticated and attempt to does some
-    // type checking as we as checking the number of parameters.
-    JavaMethod* aMethod;
-    JavaMethod* method = 0;
-    for (size_t methodIndex = 0; methodIndex < numMethods; methodIndex++) {
-        aMethod = methodList[methodIndex];
-        if (aMethod->numParameters() == count) {
-            method = aMethod;
-            break;
-        }
-    }
-    if (!method)
-        return false;
-
-    const JavaMethod* jMethod = static_cast<const JavaMethod*>(method);
-
-    jvalue* jArgs = 0;
-    if (count > 0)
-        jArgs = static_cast<jvalue*>(malloc(count * sizeof(jvalue)));
-
-    for (int i = 0; i < count; i++)
-        jArgs[i] = convertNPVariantToJValue(args[i], jMethod->parameterAt(i));
-
-    jvalue result;
-
-    // The following code can be conditionally removed once we have a Tiger update that
-    // contains the new Java plugin.  It is needed for builds prior to Tiger.
-    {
-        jobject obj = javaInstance();
-        switch (jMethod->JNIReturnType()) {
-        case void_type:
-            callJNIMethodIDA<void>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case object_type:
-            result.l = callJNIMethodIDA<jobject>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case boolean_type:
-            result.z = callJNIMethodIDA<jboolean>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case byte_type:
-            result.b = callJNIMethodIDA<jbyte>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case char_type:
-            result.c = callJNIMethodIDA<jchar>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case short_type:
-            result.s = callJNIMethodIDA<jshort>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case int_type:
-            result.i = callJNIMethodIDA<jint>(obj, jMethod->methodID(obj), jArgs);
-            break;
-
-        case long_type:
-            result.j = callJNIMethodIDA<jlong>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case float_type:
-            result.f = callJNIMethodIDA<jfloat>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case double_type:
-            result.d = callJNIMethodIDA<jdouble>(obj, jMethod->methodID(obj), jArgs);
-            break;
-        case invalid_type:
-        default:
-            break;
-        }
-    }
-
-    convertJValueToNPVariant(result, jMethod->JNIReturnType(), jMethod->returnType(), resultValue);
-    free(jArgs);
+    ASSERT(getClass()->methodsNamed(method->name().utf8().data()).find(method) != notFound);
+    unsigned int numParams = method->numParameters();
+    OwnArrayPtr<jvalue> jvalueArgs = adoptArrayPtr(new jvalue[numParams]);
+    for (unsigned int i = 0; i < numParams; ++i)
+        jvalueArgs[i] = javaValueToJvalue(args[i]);
+    jvalue result = callJNIMethod(javaInstance(), method->returnType(), method->name().utf8().data(), method->signature(), jvalueArgs.get());
+    return jvalueToJavaValue(result, method->returnType());
+}
 
-    return true;
+JavaValue JavaInstance::getField(const JavaField* field)
+{
+    ASSERT(getClass()->fieldNamed(field->name().utf8()) == field);
+    return jvalueToJavaValue(getJNIField(javaInstance(), field->type(), field->name().utf8(), field->typeClassName()), field->type());
 }
 
 #endif // ENABLE(JAVA_BRIDGE)
diff --git a/Source/WebCore/bridge/jni/v8/JavaInstanceV8.h b/Source/WebCore/bridge/jni/v8/JavaInstanceV8.h
index 8ee3195..b1150f8 100644
--- a/Source/WebCore/bridge/jni/v8/JavaInstanceV8.h
+++ b/Source/WebCore/bridge/jni/v8/JavaInstanceV8.h
@@ -30,6 +30,7 @@
 #if ENABLE(JAVA_BRIDGE)
 
 #include "JNIUtility.h"
+#include "JavaValueV8.h"
 #include "JobjectWrapper.h"
 #include "npruntime.h"
 
@@ -43,6 +44,8 @@ namespace JSC {
 namespace Bindings {
 
 class JavaClass;
+class JavaField;
+class JavaMethod;
 
 class JavaInstance : public RefCounted<JavaInstance> {
 public:
@@ -50,9 +53,10 @@ public:
     virtual ~JavaInstance();
 
     JavaClass* getClass() const;
-
-    bool invokeMethod(const char* name, const NPVariant* args, int argsCount, NPVariant* result);
-
+    // args must be an array of length greater than or equal to the number of
+    // arguments expected by the method.
+    JavaValue invokeMethod(const JavaMethod*, JavaValue* args);
+    JavaValue getField(const JavaField*);
     jobject javaInstance() const { return m_instance->m_instance; }
 
     // These functions are called before and after the main entry points into
diff --git a/Source/WebCore/bridge/jni/v8/JavaNPObjectV8.cpp b/Source/WebCore/bridge/jni/v8/JavaNPObjectV8.cpp
index 7a7adc5..b02d059 100644
--- a/Source/WebCore/bridge/jni/v8/JavaNPObjectV8.cpp
+++ b/Source/WebCore/bridge/jni/v8/JavaNPObjectV8.cpp
@@ -33,6 +33,8 @@
 #include "JavaClassV8.h"
 #include "JavaFieldV8.h"
 #include "JavaInstanceV8.h"
+#include "JavaMethod.h"
+#include "JavaValueV8.h"
 #include "npruntime_impl.h"
 
 namespace JSC {
@@ -115,12 +117,40 @@ bool JavaNPObjectInvoke(NPObject* obj, NPIdentifier identifier, const NPVariant*
         return false;
 
     instance->begin();
-    bool r = instance->invokeMethod(name, args, argCount, result);
-    instance->end();
 
+    MethodList methodList = instance->getClass()->methodsNamed(name);
     // TODO: use NPN_MemFree
     free(name);
-    return r;
+
+    // Try to find a good match for the overloaded method. The
+    // fundamental problem is that JavaScript doesn't have the
+    // notion of method overloading and Java does. We could
+    // get a bit more sophisticated and attempt to do some
+    // type checking as well as checking the number of parameters.
+    size_t numMethods = methodList.size();
+    JavaMethod* aMethod;
+    JavaMethod* jMethod = 0;
+    for (size_t methodIndex = 0; methodIndex < numMethods; methodIndex++) {
+        aMethod = methodList[methodIndex];
+        if (aMethod->numParameters() == static_cast<int>(argCount)) {
+            jMethod = aMethod;
+            break;
+        }
+    }
+    if (!jMethod)
+        return false;
+
+    JavaValue* jArgs = new JavaValue[argCount];
+    for (unsigned int i = 0; i < argCount; i++)
+        jArgs[i] = convertNPVariantToJavaValue(args[i], jMethod->parameterAt(i));
+
+    JavaValue jResult = instance->invokeMethod(jMethod, jArgs);
+    instance->end();
+    delete[] jArgs;
+
+    VOID_TO_NPVARIANT(*result);
+    convertJavaValueToNPVariant(jResult, result);
+    return true;
 }
 
 bool JavaNPObjectHasProperty(NPObject* obj, NPIdentifier identifier)
@@ -150,12 +180,11 @@ bool JavaNPObjectGetProperty(NPObject* obj, NPIdentifier identifier, NPVariant*
 
     instance->begin();
     JavaField* field = instance->getClass()->fieldNamed(name);
-    instance->end();
     free(name); // TODO: use NPN_MemFree
-
     if (!field)
         return false;
 
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
     // JSC does not seem to support returning object properties so we emulate that
     // behaviour here.
@@ -167,6 +196,12 @@ bool JavaNPObjectGetProperty(NPObject* obj, NPIdentifier identifier, NPVariant*
                                field->type());
 #endif // PLATFORM(ANDROID)
     convertJValueToNPVariant(value, field->getJNIType(), field->type(), result);
+=======
+    JavaValue value = instance->getField(field);
+    instance->end();
+
+    convertJavaValueToNPVariant(value, result);
+>>>>>>> webkit.org at r82507
 
     return true;
 }
diff --git a/Source/WebCore/bridge/jni/v8/JavaValueV8.h b/Source/WebCore/bridge/jni/v8/JavaValueV8.h
new file mode 100644
index 0000000..3e1c623
--- /dev/null
+++ b/Source/WebCore/bridge/jni/v8/JavaValueV8.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright 2011, The Android Open Source Project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JavaValueV8_h
+#define JavaValueV8_h
+
+#if ENABLE(JAVA_BRIDGE)
+
+#include "JavaType.h"
+
+#include <wtf/text/WTFString.h>
+
+namespace JSC {
+
+namespace Bindings {
+
+class JavaInstance;
+
+// A variant used to represent a Java value, almost identical to the JNI
+// jvalue type. It exists because the logic to convert between JavaScript
+// objects (as JavaNPObject or JSValue) and Java objects should not depend upon
+// JNI, to allow ports to provide a JavaInstance object etc which does not use
+// JNI. This means that the 'object' field of this variant uses JavaInstance,
+// not jobject.
+//
+// Note that this class is independent of the JavaScript engine, but is
+// currently used only with V8.
+// See https://bugs.webkit.org/show_bug.cgi?id=57023.
+struct JavaValue {
+    JavaValue() : m_type(JavaTypeInvalid) {}
+
+    JavaType m_type;
+    // We don't use a union because we want to be able to ref-count some of the
+    // values. This requires types with non-trivial constructors.
+    RefPtr<JavaInstance> m_objectValue;
+    bool m_booleanValue;
+    signed char m_byteValue;
+    unsigned short m_charValue;
+    short m_shortValue;
+    int m_intValue;
+    long long m_longValue;
+    float m_floatValue;
+    double m_doubleValue;
+    String m_stringValue;
+};
+
+} // namespace Bindings
+
+} // namespace JSC
+
+#endif // ENABLE(JAVA_BRIDGE)
+
+#endif // JavaValueV8_h
diff --git a/Source/WebCore/bridge/objc/ObjCRuntimeObject.h b/Source/WebCore/bridge/objc/ObjCRuntimeObject.h
index e9fa10d..b29a333 100644
--- a/Source/WebCore/bridge/objc/ObjCRuntimeObject.h
+++ b/Source/WebCore/bridge/objc/ObjCRuntimeObject.h
@@ -42,9 +42,9 @@ public:
 
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 };
 
diff --git a/Source/WebCore/bridge/objc/objc_instance.mm b/Source/WebCore/bridge/objc/objc_instance.mm
index e0b18f1..4f93cfa 100644
--- a/Source/WebCore/bridge/objc/objc_instance.mm
+++ b/Source/WebCore/bridge/objc/objc_instance.mm
@@ -184,9 +184,9 @@ public:
         ASSERT(inherits(&s_info));
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
     static const ClassInfo s_info;
diff --git a/Source/WebCore/bridge/objc/objc_runtime.h b/Source/WebCore/bridge/objc/objc_runtime.h
index 1cee85b..4ef0afd 100644
--- a/Source/WebCore/bridge/objc/objc_runtime.h
+++ b/Source/WebCore/bridge/objc/objc_runtime.h
@@ -103,9 +103,9 @@ public:
         return globalObject->objectPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
 private:
diff --git a/Source/WebCore/bridge/qt/qt_instance.cpp b/Source/WebCore/bridge/qt/qt_instance.cpp
index 7af752d..91ae40f 100644
--- a/Source/WebCore/bridge/qt/qt_instance.cpp
+++ b/Source/WebCore/bridge/qt/qt_instance.cpp
@@ -59,9 +59,9 @@ public:
             instance->markAggregate(markStack);
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount, &s_info);
     }
 
 protected:
diff --git a/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp b/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
index 534e28e..da3e383 100644
--- a/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
+++ b/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
@@ -119,7 +119,7 @@ public:
         QByteArray byteArray;
         QBuffer buffer(&byteArray);
         instance->toImage().save(&buffer, "PNG");
-        const QString encodedString = QString("data:image/png;base64,") + byteArray.toBase64();
+        const QString encodedString = QLatin1String("data:image/png;base64,") + QLatin1String(byteArray.toBase64());
         const UString ustring((UChar*)encodedString.utf16(), encodedString.length());
         return jsString(exec, ustring);
     }
@@ -150,9 +150,9 @@ public:
 
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount, &s_info);
     }
 
 protected:
@@ -239,7 +239,7 @@ JSValue QtPixmapInstance::defaultValue(ExecState* exec, PreferredPrimitiveType p
 
 JSValue QtPixmapInstance::valueOf(ExecState* exec) const
 {
-    const QString stringValue = QString("[Qt Native Pixmap %1,%2]").arg(width()).arg(height());
+    const QString stringValue = QString::fromLatin1("[Qt Native Pixmap %1,%2]").arg(width()).arg(height());
     UString ustring((UChar*)stringValue.utf16(), stringValue.length());
     return jsString(exec, ustring);
 }
diff --git a/Source/WebCore/bridge/qt/qt_runtime.cpp b/Source/WebCore/bridge/qt/qt_runtime.cpp
index 78821b9..87ee522 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.cpp
+++ b/Source/WebCore/bridge/qt/qt_runtime.cpp
@@ -845,17 +845,13 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         QRegExp re = variant.value<QRegExp>();
 
         if (re.isValid()) {
-            UString uflags;
-            if (re.caseSensitivity() == Qt::CaseInsensitive)
-                uflags = "i"; // ### Can't do g or m
-
             UString pattern((UChar*)re.pattern().utf16(), re.pattern().length());
+            RegExpFlags flags = (re.caseSensitivity() == Qt::CaseInsensitive) ? FlagIgnoreCase : NoFlags;
 
-            RefPtr<JSC::RegExp> regExp = JSC::RegExp::create(&exec->globalData(), pattern, uflags);
+            RefPtr<JSC::RegExp> regExp = JSC::RegExp::create(&exec->globalData(), pattern, flags);
             if (regExp->isValid())
                 return new (exec) RegExpObject(exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->regExpStructure(), regExp.release());
-            else
-                return jsNull();
+            return jsNull();
         }
     }
 
@@ -887,14 +883,14 @@ JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, con
         dt.isDST = -1;
         double ms = gregorianDateTimeToMS(exec, dt, time.msec(), /*inputIsUTC*/ false);
 
-        return new (exec) DateInstance(exec, trunc(ms));
+        return new (exec) DateInstance(exec, exec->lexicalGlobalObject()->dateStructure(), trunc(ms));
     }
 
     if (type == QMetaType::QByteArray) {
         QByteArray qtByteArray = variant.value<QByteArray>();
         WTF::RefPtr<WTF::ByteArray> wtfByteArray = WTF::ByteArray::create(qtByteArray.length());
         memcpy(wtfByteArray->data(), qtByteArray.constData(), qtByteArray.length());
-        return new (exec) JSC::JSByteArray(exec, JSC::JSByteArray::createStructure(jsNull()), wtfByteArray.get());
+        return new (exec) JSC::JSByteArray(exec, JSC::JSByteArray::createStructure(exec->globalData(), jsNull()), wtfByteArray.get());
     }
 
     if (type == QMetaType::QObjectStar || type == QMetaType::QWidgetStar) {
@@ -1832,7 +1828,7 @@ void QtConnectionObject::execute(void **argv)
                         fimp = static_cast<JSFunction*>(m_funcObject.get());
 
                         JSObject* qt_sender = QtInstance::getQtInstance(sender(), ro, QScriptEngine::QtOwnership)->createRuntimeObject(exec);
-                        JSObject* wrapper = constructEmptyObject(exec, createEmptyObjectStructure(jsNull()));
+                        JSObject* wrapper = constructEmptyObject(exec, createEmptyObjectStructure(exec->globalData(), jsNull()));
                         PutPropertySlot slot;
                         wrapper->put(exec, Identifier(exec, "__qt_sender__"), qt_sender, slot);
                         oldsc = fimp->scope();
diff --git a/Source/WebCore/bridge/qt/qt_runtime.h b/Source/WebCore/bridge/qt/qt_runtime.h
index b86ccbe..85b34b8 100644
--- a/Source/WebCore/bridge/qt/qt_runtime.h
+++ b/Source/WebCore/bridge/qt/qt_runtime.h
@@ -153,9 +153,9 @@ public:
         return globalObject->functionPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType,  StructureFlags), AnonymousSlotCount, &s_info);
     }
 
 protected:
diff --git a/Source/WebCore/bridge/runtime_array.h b/Source/WebCore/bridge/runtime_array.h
index f4c74e2..9555545 100644
--- a/Source/WebCore/bridge/runtime_array.h
+++ b/Source/WebCore/bridge/runtime_array.h
@@ -33,6 +33,7 @@ namespace JSC {
     
 class RuntimeArray : public JSArray {
 public:
+    typedef Bindings::Array BindingsArray;
     RuntimeArray(ExecState*, Bindings::Array*);
     virtual ~RuntimeArray();
 
@@ -48,7 +49,7 @@ public:
     
     unsigned getLength() const { return getConcreteArray()->getLength(); }
     
-    Bindings::Array* getConcreteArray() const { return static_cast<Bindings::Array*>(subclassData()); }
+    Bindings::Array* getConcreteArray() const { return static_cast<BindingsArray*>(subclassData()); }
 
     static const ClassInfo s_info;
 
@@ -57,9 +58,9 @@ public:
         return globalObject->arrayPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
 protected:
diff --git a/Source/WebCore/bridge/runtime_method.h b/Source/WebCore/bridge/runtime_method.h
index c0c9f16..9df796e 100644
--- a/Source/WebCore/bridge/runtime_method.h
+++ b/Source/WebCore/bridge/runtime_method.h
@@ -45,9 +45,9 @@ public:
         return globalObject->functionPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
 protected:
diff --git a/Source/WebCore/bridge/runtime_object.h b/Source/WebCore/bridge/runtime_object.h
index 0decd17..bb6d051 100644
--- a/Source/WebCore/bridge/runtime_object.h
+++ b/Source/WebCore/bridge/runtime_object.h
@@ -61,9 +61,9 @@ public:
         return globalObject->objectPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValue prototype)
+    static PassRefPtr<Structure> createStructure(JSGlobalData& globalData, JSValue prototype)
     {
-        return Structure::create(prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
+        return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
     }
 
 protected:
diff --git a/Source/WebCore/config.h b/Source/WebCore/config.h
index 176cd5b..13cf56d 100644
--- a/Source/WebCore/config.h
+++ b/Source/WebCore/config.h
@@ -29,6 +29,30 @@
 
 #include <wtf/Platform.h>
 
+/* See note in wtf/Platform.h for more info on EXPORT_MACROS. */
+#if USE(EXPORT_MACROS)
+
+#include <wtf/ExportMacros.h>
+
+#if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
+#define WTF_EXPORT_PRIVATE WTF_EXPORT
+#define JS_EXPORT_PRIVATE WTF_EXPORT
+#else
+#define WTF_EXPORT_PRIVATE WTF_IMPORT
+#define JS_EXPORT_PRIVATE WTF_IMPORT
+#endif
+
+#define JS_EXPORTDATA JS_EXPORT_PRIVATE
+#define JS_EXPORTCLASS JS_EXPORT_PRIVATE
+
+#if defined(BUILDING_WebCore) || defined(BUILDING_WebKit)
+#define WEBKIT_EXPORTDATA WTF_EXPORT
+#else
+#define WEBKIT_EXPORTDATA WTF_IMPORT
+#endif
+
+#else /* !USE(EXPORT_MACROS) */
+
 #if !PLATFORM(CHROMIUM) && OS(WINDOWS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
 #if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
 #define JS_EXPORTDATA __declspec(dllexport)
@@ -40,13 +64,19 @@
 #else
 #define WEBKIT_EXPORTDATA __declspec(dllimport)
 #endif
+#define WTF_EXPORT_PRIVATE JS_EXPORTDATA
+#define JS_EXPORT_PRIVATE JS_EXPORTDATA
 #define JS_EXPORTCLASS JS_EXPORTDATA
 #else
 #define JS_EXPORTDATA
 #define JS_EXPORTCLASS
 #define WEBKIT_EXPORTDATA
+#define WTF_EXPORT_PRIVATE
+#define JS_EXPORT_PRIVATE
 #endif
 
+#endif /* USE(EXPORT_MACROS) */
+
 #ifdef __APPLE__
 #define HAVE_FUNC_USLEEP 1
 #endif /* __APPLE__ */
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
index a023fbd..4c0571d 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -29,6 +29,7 @@
 #include "CounterContent.h"
 #include "CursorList.h"
 #include "CSSBorderImageValue.h"
+#include "CSSLineBoxContainValue.h"
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSPrimitiveValueCache.h"
@@ -204,6 +205,7 @@ static const int computedProperties[] = {
     CSSPropertyWebkitHyphenateLimitAfter,
     CSSPropertyWebkitHyphenateLimitBefore,
     CSSPropertyWebkitHyphens,
+    CSSPropertyWebkitLineBoxContain,
     CSSPropertyWebkitLineBreak,
     CSSPropertyWebkitLineClamp,
     CSSPropertyWebkitLocale,
@@ -232,6 +234,7 @@ static const int computedProperties[] = {
     CSSPropertyWebkitTextEmphasisPosition,
     CSSPropertyWebkitTextEmphasisStyle,
     CSSPropertyWebkitTextFillColor,
+    CSSPropertyWebkitTextOrientation,
     CSSPropertyWebkitTextSecurity,
     CSSPropertyWebkitTextStrokeColor,
     CSSPropertyWebkitTextStrokeWidth,
@@ -586,6 +589,13 @@ static PassRefPtr<CSSValue> getTimingFunctionValue(const AnimationList* animList
     return list.release();
 }
 
+static PassRefPtr<CSSValue> createLineBoxContainValue(CSSPrimitiveValueCache* primitiveValueCache, unsigned lineBoxContain)
+{
+    if (!lineBoxContain)
+        return primitiveValueCache->createIdentifierValue(CSSValueNone);
+    return CSSLineBoxContainValue::create(lineBoxContain);
+}
+
 CSSComputedStyleDeclaration::CSSComputedStyleDeclaration(PassRefPtr<Node> n, bool allowVisitedStyle, const String& pseudoElementName)
     : m_node(n)
     , m_allowVisitedStyle(allowVisitedStyle)
@@ -672,8 +682,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::valueForShadow(const ShadowDat
         RefPtr<CSSPrimitiveValue> x = zoomAdjustedPixelValue(s->x(), style, primitiveValueCache);
         RefPtr<CSSPrimitiveValue> y = zoomAdjustedPixelValue(s->y(), style, primitiveValueCache);
         RefPtr<CSSPrimitiveValue> blur = zoomAdjustedPixelValue(s->blur(), style, primitiveValueCache);
-        RefPtr<CSSPrimitiveValue> spread = propertyID == CSSPropertyTextShadow ? 0 : zoomAdjustedPixelValue(s->spread(), style, primitiveValueCache);
-        RefPtr<CSSPrimitiveValue> style = propertyID == CSSPropertyTextShadow || s->style() == Normal ? 0 : primitiveValueCache->createIdentifierValue(CSSValueInset);
+        RefPtr<CSSPrimitiveValue> spread = propertyID == CSSPropertyTextShadow ? PassRefPtr<CSSPrimitiveValue>() : zoomAdjustedPixelValue(s->spread(), style, primitiveValueCache);
+        RefPtr<CSSPrimitiveValue> style = propertyID == CSSPropertyTextShadow || s->style() == Normal ? PassRefPtr<CSSPrimitiveValue>() : primitiveValueCache->createIdentifierValue(CSSValueInset);
         RefPtr<CSSPrimitiveValue> color = primitiveValueCache->createColorValue(s->color().rgb());
         list->prepend(ShadowValue::create(x.release(), y.release(), blur.release(), spread.release(), style.release(), color.release()));
     }
@@ -780,8 +790,11 @@ static PassRefPtr<CSSValue> contentToCSSValue(const RenderStyle* style, CSSPrimi
 
 static PassRefPtr<CSSValue> counterToCSSValue(const RenderStyle* style, int propertyID, CSSPrimitiveValueCache* primitiveValueCache)
 {
-    RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
     const CounterDirectiveMap* map = style->counterDirectives();
+    if (!map)
+        return 0;
+
+    RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
     for (CounterDirectiveMap::const_iterator it = map->begin(); it != map->end(); ++it) {
         list->append(primitiveValueCache->createValue(it->first.get(), CSSPrimitiveValue::CSS_STRING));
         short number = propertyID == CSSPropertyCounterIncrement ? it->second.m_incrementValue : it->second.m_resetValue;
@@ -1687,7 +1700,10 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return primitiveValueCache->createValue(style->writingMode());
         case CSSPropertyWebkitTextCombine:
             return primitiveValueCache->createValue(style->textCombine());
-
+        case CSSPropertyWebkitTextOrientation:
+            return CSSPrimitiveValue::create(style->fontDescription().textOrientation());
+        case CSSPropertyWebkitLineBoxContain:
+            return createLineBoxContainValue(primitiveValueCache, style->lineBoxContain());
         case CSSPropertyContent:
             return contentToCSSValue(style.get(), primitiveValueCache);
         case CSSPropertyCounterIncrement:
diff --git a/Source/WebCore/css/CSSFontFaceSource.cpp b/Source/WebCore/css/CSSFontFaceSource.cpp
index 681a94b..d32684e 100644
--- a/Source/WebCore/css/CSSFontFaceSource.cpp
+++ b/Source/WebCore/css/CSSFontFaceSource.cpp
@@ -115,7 +115,8 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
     }
 
     // See if we have a mapping in our FontData cache.
-    unsigned hashKey = (fontDescription.computedPixelSize() + 1) << 5 | fontDescription.widthVariant() << 3 | (fontDescription.orientation() == Vertical ? 4 : 0) | (syntheticBold ? 2 : 0) | (syntheticItalic ? 1 : 0);
+    unsigned hashKey = (fontDescription.computedPixelSize() + 1) << 6 | fontDescription.widthVariant() << 4
+                       | (fontDescription.textOrientation() == TextOrientationUpright ? 8 : 0) | (fontDescription.orientation() == Vertical ? 4 : 0) | (syntheticBold ? 2 : 0) | (syntheticItalic ? 1 : 0);
     if (SimpleFontData* cachedData = m_fontDataTable.get(hashKey))
         return cachedData;
 
@@ -162,7 +163,8 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
                 if (!m_font->ensureCustomFontData())
                     return 0;
 
-                fontData.set(new SimpleFontData(m_font->platformDataFromCustomData(fontDescription.computedPixelSize(), syntheticBold, syntheticItalic, fontDescription.orientation(), fontDescription.widthVariant(), fontDescription.renderingMode()), true, false));
+                fontData.set(new SimpleFontData(m_font->platformDataFromCustomData(fontDescription.computedPixelSize(), syntheticBold, syntheticItalic, fontDescription.orientation(),
+                                                                                   fontDescription.textOrientation(), fontDescription.widthVariant(), fontDescription.renderingMode()), true, false));
             }
         } else {
 #if ENABLE(SVG_FONTS)
diff --git a/Source/WebCore/css/CSSGrammar.y b/Source/WebCore/css/CSSGrammar.y
index 8658674..246a449 100644
--- a/Source/WebCore/css/CSSGrammar.y
+++ b/Source/WebCore/css/CSSGrammar.y
@@ -99,7 +99,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %}
 
-%expect 51
+%expect 55
 
 %nonassoc LOWEST_PREC
 
@@ -183,13 +183,18 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 %token <number> HERTZ
 %token <number> KHERTZ
 %token <string> DIMEN
+%token <string> INVALIDDIMEN
 %token <number> PERCENTAGE
 %token <number> FLOATTOKEN
 %token <number> INTEGER
 
 %token <string> URI
 %token <string> FUNCTION
+%token <string> ANYFUNCTION
 %token <string> NOTFUNCTION
+%token <string> CALCFUNCTION
+%token <string> MINFUNCTION
+%token <string> MAXFUNCTION
 
 %token <string> UNICODERANGE
 
@@ -247,6 +252,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 %type <selector> simple_selector
 %type <selector> selector
 %type <selectorList> selector_list
+%type <selectorList> simple_selector_list
 %type <selector> selector_with_trailing_whitespace
 %type <selector> class
 %type <selector> attrib
@@ -270,6 +276,14 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 %type <value> term
 %type <value> unary_term
 %type <value> function
+%type <value> calc_func_term
+%type <character> calc_func_operator
+%type <valueList> calc_func_expr
+%type <valueList> calc_func_expr_list
+%type <valueList> calc_func_paren_expr
+%type <value> calc_function
+%type <string> min_or_max
+%type <value> min_or_max_function
 
 %type <string> element_name
 %type <string> attr_name
@@ -921,6 +935,28 @@ simple_selector:
     }
   ;
 
+simple_selector_list:
+    simple_selector %prec UNIMPORTANT_TOK {
+        if ($1) {
+            CSSParser* p = static_cast<CSSParser*>(parser);
+            $$ = p->createFloatingSelectorVector();
+            $$->append(p->sinkFloatingSelector($1));
+        } else
+            $$ = 0
+    }
+    | simple_selector_list maybe_space ',' maybe_space simple_selector %prec UNIMPORTANT_TOK {
+        if ($1 && $5) {
+            CSSParser* p = static_cast<CSSParser*>(parser);
+            $$ = $1;
+            $$->append(p->sinkFloatingSelector($5));
+        } else
+            $$ = 0;
+    }
+    | simple_selector_list error {
+        $$ = 0;
+    }
+  ;
+
 element_name:
     IDENT {
         CSSParserString& str = $1;
@@ -1102,6 +1138,25 @@ pseudo:
         // FIXME: This call is needed to force selector to compute the pseudoType early enough.
         $$->pseudoType();
     }
+    // use by :-webkit-any.
+    // FIXME: should we support generic selectors here or just simple_selectors?
+    // Use simple_selector_list for now to match -moz-any.
+    // See http://lists.w3.org/Archives/Public/www-style/2010Sep/0566.html for some
+    // related discussion with respect to :not.
+    | ':' ANYFUNCTION maybe_space simple_selector_list maybe_space ')' {
+        if ($4) {
+            CSSParser *p = static_cast<CSSParser*>(parser);
+            $$ = p->createFloatingSelector();
+            $$->setMatch(CSSSelector::PseudoClass);
+            $$->adoptSelectorVector(*p->sinkFloatingSelectorVector($4));
+            $2.lower();
+            $$->setValue($2);
+            CSSSelector::PseudoType type = $$->pseudoType();
+            if (type != CSSSelector::PseudoAny)
+                $$ = 0;
+        } else
+            $$ = 0;
+    }
     // used by :nth-*(ax+b)
     | ':' FUNCTION maybe_space NTH maybe_space ')' {
         CSSParser *p = static_cast<CSSParser*>(parser);
@@ -1151,7 +1206,11 @@ pseudo:
             CSSParser* p = static_cast<CSSParser*>(parser);
             $$ = p->createFloatingSelector();
             $$->setMatch(CSSSelector::PseudoClass);
-            $$->setSimpleSelector(p->sinkFloatingSelector($4)->releaseSelector());
+
+            Vector<OwnPtr<CSSParserSelector> > selectorVector;
+            selectorVector.append(p->sinkFloatingSelector($4));
+            $$->adoptSelectorVector(selectorVector);
+
             $2.lower();
             $$->setValue($2);
         }
@@ -1361,6 +1420,12 @@ term:
   | function {
       $$ = $1;
   }
+  | calc_function {
+      $$ = $1;
+  }
+  | min_or_max_function {
+      $$ = $1;
+  }
   | '%' maybe_space { /* Handle width: %; */
       $$.id = 0; $$.unit = 0;
   }
@@ -1417,6 +1482,143 @@ function:
         $$.function = f;
   }
   ;
+ 
+calc_func_term:
+  unary_term { $$ = $1; }
+  | unary_operator unary_term { $$ = $2; $$.fValue *= $1; }
+  ;
+
+calc_func_operator:
+    '+' WHITESPACE {
+        $$ = '+';
+    }
+    | '-' WHITESPACE {
+        $$ = '-';
+    }
+    | '*' maybe_space {
+        $$ = '*';
+    }
+    | '/' maybe_space {
+        $$ = '/';
+    }
+    | IDENT maybe_space {
+        if (equalIgnoringCase("mod", $1.characters, $1.length))
+            $$ = '%';
+        else
+            $$ = 0;
+    }
+  ;
+
+calc_func_paren_expr:
+    '(' maybe_space calc_func_expr maybe_space ')' maybe_space {
+        if ($3) {
+            $$ = $3;
+            CSSParserValue v;
+            v.id = 0;
+            v.unit = CSSParserValue::Operator;
+            v.iValue = '(';
+            $$->insertValueAt(0, v);
+            v.iValue = ')';
+            $$->addValue(v);
+        }
+    }
+
+calc_func_expr:
+    calc_func_term maybe_space {
+        CSSParser* p = static_cast<CSSParser*>(parser);
+        $$ = p->createFloatingValueList();
+        $$->addValue(p->sinkFloatingValue($1));
+    }
+    | calc_func_expr calc_func_operator calc_func_term {
+        CSSParser* p = static_cast<CSSParser*>(parser);
+        if ($1 && $2) {
+            $$ = $1;
+            CSSParserValue v;
+            v.id = 0;
+            v.unit = CSSParserValue::Operator;
+            v.iValue = $2;
+            $$->addValue(v);
+            $$->addValue(p->sinkFloatingValue($3));
+        } else
+            $$ = 0;
+
+    }
+    | calc_func_expr calc_func_operator calc_func_paren_expr {
+        if ($1 && $2 && $3) {
+            $$ = $1;
+            CSSParserValue v;
+            v.id = 0;
+            v.unit = CSSParserValue::Operator;
+            v.iValue = $2;
+            $$->addValue(v);
+            $$->extend(*($3));
+        } else 
+            $$ = 0;
+    }
+    | calc_func_paren_expr
+    | calc_func_expr error {
+        $$ = 0;
+    }
+  ;
+
+calc_func_expr_list:
+    calc_func_expr  {
+        $$ = $1;
+    }    
+    | calc_func_expr_list ',' maybe_space calc_func_expr {
+        if ($1 && $4) {
+            $$ = $1;
+            CSSParserValue v;
+            v.id = 0;
+            v.unit = CSSParserValue::Operator;
+            v.iValue = ',';
+            $$->addValue(v);
+            $$->extend(*($4));
+        } else
+            $$ = 0;
+    }
+    
+
+calc_function:
+    CALCFUNCTION maybe_space calc_func_expr ')' maybe_space {
+        CSSParser* p = static_cast<CSSParser*>(parser);
+        CSSParserFunction* f = p->createFloatingFunction();
+        f->name = $1;
+        f->args = p->sinkFloatingValueList($3);
+        $$.id = 0;
+        $$.unit = CSSParserValue::Function;
+        $$.function = f;
+    }
+    | CALCFUNCTION maybe_space error {
+        YYERROR;
+    }
+    ;
+
+
+min_or_max:
+    MINFUNCTION {
+        $$ = $1;
+    }
+    | MAXFUNCTION {
+        $$ = $1;
+    }
+    ;
+
+min_or_max_function:
+    min_or_max maybe_space calc_func_expr_list ')' maybe_space {
+        CSSParser* p = static_cast<CSSParser*>(parser);
+        CSSParserFunction* f = p->createFloatingFunction();
+        f->name = $1;
+        f->args = p->sinkFloatingValueList($3);
+        $$.id = 0;
+        $$.unit = CSSParserValue::Function;
+        $$.function = f;
+    } 
+    | min_or_max maybe_space error {
+        YYERROR;
+    }
+    ;
+
 /*
  * There is a constraint on the color that it must
  * have either 3 or 6 hex-digits (i.e., [0-9a-fA-F])
diff --git a/Source/WebCore/css/CSSImageValue.cpp b/Source/WebCore/css/CSSImageValue.cpp
index 6896596..a9038b9 100644
--- a/Source/WebCore/css/CSSImageValue.cpp
+++ b/Source/WebCore/css/CSSImageValue.cpp
@@ -67,10 +67,6 @@ StyleCachedImage* CSSImageValue::cachedImage(CachedResourceLoader* loader)
 StyleCachedImage* CSSImageValue::cachedImage(CachedResourceLoader* loader, const String& url)
 {
     ASSERT(loader);
-    if (!loader) {
-        // FIXME: Remove when http://webkit.org/b/53045 is fixed.
-        CRASH();
-    }
 
     if (!m_accessedImage) {
         m_accessedImage = true;
diff --git a/Source/WebCore/css/CSSLineBoxContainValue.cpp b/Source/WebCore/css/CSSLineBoxContainValue.cpp
new file mode 100644
index 0000000..b029285
--- /dev/null
+++ b/Source/WebCore/css/CSSLineBoxContainValue.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CSSLineBoxContainValue.h"
+
+#include "CSSPrimitiveValue.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+CSSLineBoxContainValue::CSSLineBoxContainValue(unsigned value)
+    : m_value(value)
+{
+}
+
+String CSSLineBoxContainValue::cssText() const
+{
+    String text("");
+
+    if (m_value & LineBoxContainBlock)
+        text += "block";
+    if (m_value & LineBoxContainInline) {
+        if (!text.isEmpty())
+            text += " ";
+        text += "inline";
+    }
+    if (m_value & LineBoxContainFont) {
+        if (!text.isEmpty())
+            text += " ";
+        text += "font";
+    }
+    if (m_value & LineBoxContainGlyphs) {
+        if (!text.isEmpty())
+            text += " ";
+        text += "glyphs";
+    }
+    if (m_value & LineBoxContainReplaced) {
+        if (!text.isEmpty())
+            text += " ";
+        text += "replaced";
+    }
+    if (m_value & LineBoxContainInlineBox) {
+        if (!text.isEmpty())
+            text += " ";
+        text += "inline-box";
+    }
+
+    return text;
+}
+
+}
diff --git a/Source/WebCore/css/CSSLineBoxContainValue.h b/Source/WebCore/css/CSSLineBoxContainValue.h
new file mode 100644
index 0000000..8d62b11
--- /dev/null
+++ b/Source/WebCore/css/CSSLineBoxContainValue.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CSSLineBoxContainValue_h
+#define CSSLineBoxContainValue_h
+
+#include "CSSValue.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class CSSPrimitiveValue;
+
+enum LineBoxContainFlags { LineBoxContainNone = 0x0, LineBoxContainBlock = 0x1, LineBoxContainInline = 0x2, LineBoxContainFont = 0x4, LineBoxContainGlyphs = 0x8,
+                           LineBoxContainReplaced = 0x10, LineBoxContainInlineBox = 0x20 };
+typedef unsigned LineBoxContain;
+
+// Used for text-CSSLineBoxContain and box-CSSLineBoxContain
+class CSSLineBoxContainValue : public CSSValue {
+public:
+    static PassRefPtr<CSSLineBoxContainValue> create(LineBoxContain value)
+    {
+        return adoptRef(new CSSLineBoxContainValue(value));
+    }
+
+    virtual String cssText() const;
+
+    LineBoxContain value() const { return m_value; }
+
+private:
+    LineBoxContain m_value;
+
+private:
+    CSSLineBoxContainValue(LineBoxContain);
+    virtual bool isCSSLineBoxContainValue() const { return true; }
+};
+
+} // namespace
+
+#endif
diff --git a/Source/WebCore/css/CSSMutableStyleDeclaration.cpp b/Source/WebCore/css/CSSMutableStyleDeclaration.cpp
index e6a49d3..6485e5b 100644
--- a/Source/WebCore/css/CSSMutableStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSMutableStyleDeclaration.cpp
@@ -82,15 +82,18 @@ CSSMutableStyleDeclaration::CSSMutableStyleDeclaration(CSSRule* parent, const CS
 #endif
 {
     m_properties.reserveInitialCapacity(numProperties);
-    HashSet<int> candidates;
+    HashMap<int, bool> candidates;
     for (int i = 0; i < numProperties; ++i) {
         const CSSProperty *property = properties[i];
         ASSERT(property);
-        if (candidates.contains(property->id()))
-            removeProperty(properties[i]->id(), false);
+        bool important = property->isImportant();
+        if (candidates.contains(property->id())) {
+            if (!important && candidates.get(property->id()))
+                continue;
+            removeProperty(property->id(), false);
+        }
         m_properties.append(*property);
-        if (!getPropertyPriority(property->id()) && !property->isImportant())
-            candidates.add(property->id());
+        candidates.set(property->id(), important);
     }
 }
 
@@ -129,11 +132,11 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
         case CSSPropertyBackgroundPosition: {
             // FIXME: Is this correct? The code in cssparser.cpp is confusing
             const int properties[2] = { CSSPropertyBackgroundPositionX, CSSPropertyBackgroundPositionY };
-            return getLayeredShorthandValue(properties, 2);
+            return getLayeredShorthandValue(properties);
         }
         case CSSPropertyBackgroundRepeat: {
             const int properties[2] = { CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY };
-            return getLayeredShorthandValue(properties, 2);
+            return getLayeredShorthandValue(properties);
         }
         case CSSPropertyBackground: {
             const int properties[9] = { CSSPropertyBackgroundColor,
@@ -145,7 +148,7 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
                                         CSSPropertyBackgroundPositionY, 
                                         CSSPropertyBackgroundClip,
                                         CSSPropertyBackgroundOrigin }; 
-            return getLayeredShorthandValue(properties, 9);
+            return getLayeredShorthandValue(properties);
         }
         case CSSPropertyBorder: {
             const int properties[3][4] = {{ CSSPropertyBorderTopWidth,
@@ -162,7 +165,7 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
                                             CSSPropertyBorderLeftColor }};
             String res;
             for (size_t i = 0; i < WTF_ARRAY_LENGTH(properties); ++i) {
-                String value = getCommonValue(properties[i], 4);
+                String value = getCommonValue(properties[i]);
                 if (!value.isNull()) {
                     if (!res.isNull())
                         res += " ";
@@ -174,27 +177,27 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
         case CSSPropertyBorderTop: {
             const int properties[3] = { CSSPropertyBorderTopWidth, CSSPropertyBorderTopStyle,
                                         CSSPropertyBorderTopColor};
-            return getShorthandValue(properties, 3);
+            return getShorthandValue(properties);
         }
         case CSSPropertyBorderRight: {
             const int properties[3] = { CSSPropertyBorderRightWidth, CSSPropertyBorderRightStyle,
                                         CSSPropertyBorderRightColor};
-            return getShorthandValue(properties, 3);
+            return getShorthandValue(properties);
         }
         case CSSPropertyBorderBottom: {
             const int properties[3] = { CSSPropertyBorderBottomWidth, CSSPropertyBorderBottomStyle,
                                         CSSPropertyBorderBottomColor};
-            return getShorthandValue(properties, 3);
+            return getShorthandValue(properties);
         }
         case CSSPropertyBorderLeft: {
             const int properties[3] = { CSSPropertyBorderLeftWidth, CSSPropertyBorderLeftStyle,
                                         CSSPropertyBorderLeftColor};
-            return getShorthandValue(properties, 3);
+            return getShorthandValue(properties);
         }
         case CSSPropertyOutline: {
             const int properties[3] = { CSSPropertyOutlineWidth, CSSPropertyOutlineStyle,
                                         CSSPropertyOutlineColor };
-            return getShorthandValue(properties, 3);
+            return getShorthandValue(properties);
         }
         case CSSPropertyBorderColor: {
             const int properties[4] = { CSSPropertyBorderTopColor, CSSPropertyBorderRightColor,
@@ -218,7 +221,7 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
         }
         case CSSPropertyOverflow: {
             const int properties[2] = { CSSPropertyOverflowX, CSSPropertyOverflowY };
-            return getCommonValue(properties, 2);
+            return getCommonValue(properties);
         }
         case CSSPropertyPadding: {
             const int properties[4] = { CSSPropertyPaddingTop, CSSPropertyPaddingRight,
@@ -228,40 +231,40 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
         case CSSPropertyListStyle: {
             const int properties[3] = { CSSPropertyListStyleType, CSSPropertyListStylePosition,
                                         CSSPropertyListStyleImage };
-            return getShorthandValue(properties, 3);
+            return getShorthandValue(properties);
         }
         case CSSPropertyWebkitMaskPosition: {
             // FIXME: Is this correct? The code in cssparser.cpp is confusing
             const int properties[2] = { CSSPropertyWebkitMaskPositionX, CSSPropertyWebkitMaskPositionY };
-            return getLayeredShorthandValue(properties, 2);
+            return getLayeredShorthandValue(properties);
         }
         case CSSPropertyWebkitMaskRepeat: {
             const int properties[2] = { CSSPropertyWebkitMaskRepeatX, CSSPropertyWebkitMaskRepeatY };
-            return getLayeredShorthandValue(properties, 2);
+            return getLayeredShorthandValue(properties);
         }
         case CSSPropertyWebkitMask: {
             const int properties[] = { CSSPropertyWebkitMaskImage, CSSPropertyWebkitMaskRepeat, 
                                        CSSPropertyWebkitMaskAttachment, CSSPropertyWebkitMaskPosition, CSSPropertyWebkitMaskClip,
                                        CSSPropertyWebkitMaskOrigin };
-            return getLayeredShorthandValue(properties, 6);
+            return getLayeredShorthandValue(properties);
         }
         case CSSPropertyWebkitTransformOrigin: {
             const int properties[3] = { CSSPropertyWebkitTransformOriginX,
                                         CSSPropertyWebkitTransformOriginY,
                                         CSSPropertyWebkitTransformOriginZ };
-            return getShorthandValue(properties, 3);
+            return getShorthandValue(properties);
         }
         case CSSPropertyWebkitTransition: {
             const int properties[4] = { CSSPropertyWebkitTransitionProperty, CSSPropertyWebkitTransitionDuration,
                                         CSSPropertyWebkitTransitionTimingFunction, CSSPropertyWebkitTransitionDelay };
-            return getLayeredShorthandValue(properties, 4);
+            return getLayeredShorthandValue(properties);
         }
         case CSSPropertyWebkitAnimation: {
             const int properties[7] = { CSSPropertyWebkitAnimationName, CSSPropertyWebkitAnimationDuration,
                                         CSSPropertyWebkitAnimationTimingFunction, CSSPropertyWebkitAnimationDelay,
                                         CSSPropertyWebkitAnimationIterationCount, CSSPropertyWebkitAnimationDirection,
                                         CSSPropertyWebkitAnimationFillMode };
-            return getLayeredShorthandValue(properties, 7);
+            return getLayeredShorthandValue(properties);
         }
 #if ENABLE(SVG)
         case CSSPropertyMarker: {
@@ -331,15 +334,15 @@ String CSSMutableStyleDeclaration::get4Values(const int* properties) const
     return res;
 }
 
-String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* properties, unsigned number) const
+String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* properties, size_t size) const
 {
     String res;
 
     // Begin by collecting the properties into an array.
-    Vector< RefPtr<CSSValue> > values(number);
+    Vector< RefPtr<CSSValue> > values(size);
     size_t numLayers = 0;
     
-    for (size_t i = 0; i < number; ++i) {
+    for (size_t i = 0; i < size; ++i) {
         values[i] = getPropertyCSSValue(properties[i]);
         if (values[i]) {
             if (values[i]->isValueList()) {
@@ -357,7 +360,7 @@ String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* propertie
         bool useRepeatXShorthand = false;
         bool useRepeatYShorthand = false;
         bool useSingleWordShorthand = false;
-        for (size_t j = 0; j < number; j++) {
+        for (size_t j = 0; j < size; j++) {
             RefPtr<CSSValue> value;
             if (values[j]) {
                 if (values[j]->isValueList())
@@ -380,7 +383,7 @@ String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* propertie
             if (properties[j] == CSSPropertyBackgroundRepeatX && isPropertyImplicit(properties[j])) {
 
                 // BUG 49055: make sure the value was not reset in the layer check just above.
-                if (j < number - 1 && properties[j + 1] == CSSPropertyBackgroundRepeatY && value) {
+                if (j < size - 1 && properties[j + 1] == CSSPropertyBackgroundRepeatY && value) {
                     RefPtr<CSSValue> yValue;
                     RefPtr<CSSValue> nextValue = values[j + 1];
                     if (nextValue->isValueList())
@@ -432,10 +435,10 @@ String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* propertie
     return res;
 }
 
-String CSSMutableStyleDeclaration::getShorthandValue(const int* properties, int number) const
+String CSSMutableStyleDeclaration::getShorthandValue(const int* properties, size_t size) const
 {
     String res;
-    for (int i = 0; i < number; ++i) {
+    for (size_t i = 0; i < size; ++i) {
         if (!isPropertyImplicit(properties[i])) {
             RefPtr<CSSValue> value = getPropertyCSSValue(properties[i]);
             // FIXME: provide default value if !value
@@ -450,10 +453,10 @@ String CSSMutableStyleDeclaration::getShorthandValue(const int* properties, int
 }
 
 // only returns a non-null value if all properties have the same, non-null value
-String CSSMutableStyleDeclaration::getCommonValue(const int* properties, int number) const
+String CSSMutableStyleDeclaration::getCommonValue(const int* properties, size_t size) const
 {
     String res;
-    for (int i = 0; i < number; ++i) {
+    for (size_t i = 0; i < size; ++i) {
         RefPtr<CSSValue> value = getPropertyCSSValue(properties[i]);
         if (!value)
             return String();
@@ -509,14 +512,18 @@ String CSSMutableStyleDeclaration::removeProperty(int propertyID, bool notifyCha
     return value;
 }
 
+bool CSSMutableStyleDeclaration::isInlineStyleDeclaration()
+{
+    // FIXME: Ideally, this should be factored better and there
+    // should be a subclass of CSSMutableStyleDeclaration just
+    // for inline style declarations that handles this
+    return m_node && m_node->isStyledElement() && static_cast<StyledElement*>(m_node)->inlineStyleDecl() == this;
+}
+
 void CSSMutableStyleDeclaration::setNeedsStyleRecalc()
 {
     if (m_node) {
-        // FIXME: Ideally, this should be factored better and there
-        // should be a subclass of CSSMutableStyleDeclaration just
-        // for inline style declarations that handles this
-        bool isInlineStyleDeclaration = m_node->isStyledElement() && this == static_cast<StyledElement*>(m_node)->inlineStyleDecl();
-        if (isInlineStyleDeclaration) {
+        if (isInlineStyleDeclaration()) {
             m_node->setNeedsStyleRecalc(InlineStyleChange);
             static_cast<StyledElement*>(m_node)->invalidateStyleAttribute();
             if (m_node->document())
@@ -717,7 +724,7 @@ String CSSMutableStyleDeclaration::cssText() const
         String positionValue;
         const int properties[2] = { CSSPropertyBackgroundPositionX, CSSPropertyBackgroundPositionY };
         if (positionXProp->value()->isValueList() || positionYProp->value()->isValueList()) 
-            positionValue = getLayeredShorthandValue(properties, 2);
+            positionValue = getLayeredShorthandValue(properties);
         else
             positionValue = positionXProp->value()->cssText() + " " + positionYProp->value()->cssText();
         result += "background-position: " + positionValue + (positionXProp->isImportant() ? " !important" : "") + "; ";
@@ -733,7 +740,7 @@ String CSSMutableStyleDeclaration::cssText() const
         String repeatValue;
         const int repeatProperties[2] = { CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY };
         if (repeatXProp->value()->isValueList() || repeatYProp->value()->isValueList()) 
-            repeatValue = getLayeredShorthandValue(repeatProperties, 2);
+            repeatValue = getLayeredShorthandValue(repeatProperties);
         else
             repeatValue = repeatXProp->value()->cssText() + " " + repeatYProp->value()->cssText();
         result += "background-repeat: " + repeatValue + (repeatXProp->isImportant() ? " !important" : "") + "; ";
diff --git a/Source/WebCore/css/CSSMutableStyleDeclaration.h b/Source/WebCore/css/CSSMutableStyleDeclaration.h
index 0eab1b6..ca17f11 100644
--- a/Source/WebCore/css/CSSMutableStyleDeclaration.h
+++ b/Source/WebCore/css/CSSMutableStyleDeclaration.h
@@ -140,6 +140,8 @@ public:
     
     bool propertiesEqual(const CSSMutableStyleDeclaration* o) const { return m_properties == o->m_properties; }
 
+    bool isInlineStyleDeclaration();
+
 protected:
     CSSMutableStyleDeclaration(CSSRule* parentRule);
 
@@ -152,12 +154,16 @@ private:
 
     void setNeedsStyleRecalc();
 
-    String getShorthandValue(const int* properties, int number) const;
-    String getCommonValue(const int* properties, int number) const;
-    String getLayeredShorthandValue(const int* properties, unsigned number) const;
+    String getShorthandValue(const int* properties, size_t) const;
+    String getCommonValue(const int* properties, size_t) const;
+    String getLayeredShorthandValue(const int* properties, size_t) const;
     String get4Values(const int* properties) const;
     String borderSpacingValue(const int properties[2]) const;
-    
+
+    template<size_t size> String getShorthandValue(const int (&properties)[size]) const { return getShorthandValue(properties, size); }
+    template<size_t size> String getCommonValue(const int (&properties)[size]) const { return getCommonValue(properties, size); }
+    template<size_t size> String getLayeredShorthandValue(const int (&properties)[size]) const { return getLayeredShorthandValue(properties, size); }
+
     void setPropertyInternal(const CSSProperty&, CSSProperty* slot = 0);
     bool removeShorthandProperty(int propertyID, bool notifyChanged);
 
diff --git a/Source/WebCore/css/CSSOMUtils.cpp b/Source/WebCore/css/CSSOMUtils.cpp
index d1e9638..7ecd938 100644
--- a/Source/WebCore/css/CSSOMUtils.cpp
+++ b/Source/WebCore/css/CSSOMUtils.cpp
@@ -31,7 +31,7 @@
 #include "config.h"
 #include "CSSOMUtils.h"
 
-#include "PlatformString.h"
+#include <wtf/HexNumber.h>
 
 namespace WebCore {
 
@@ -53,7 +53,9 @@ void serializeCharacter(UChar32 c, Vector<UChar>& appendTo)
 
 void serializeCharacterAsCodePoint(UChar32 c, Vector<UChar>& appendTo)
 {
-    append(appendTo, String::format("\\%x ", c));
+    appendTo.append('\\');
+    appendUnsignedAsHex(c, appendTo, Lowercase);
+    appendTo.append(' ');
 }
 
 void serializeIdentifier(const String& identifier, String& appendTo)
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index df8816c..02733ae 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -36,6 +36,7 @@
 #include "CSSImportRule.h"
 #include "CSSInheritedValue.h"
 #include "CSSInitialValue.h"
+#include "CSSLineBoxContainValue.h"
 #include "CSSMediaRule.h"
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSPageRule.h"
@@ -72,6 +73,7 @@
 #include "WebKitCSSKeyframesRule.h"
 #include "WebKitCSSTransformValue.h"
 #include <limits.h>
+#include <wtf/HexNumber.h>
 #include <wtf/dtoa.h>
 #include <wtf/text/StringBuffer.h>
 
@@ -97,6 +99,7 @@ using namespace WTF;
 namespace WebCore {
 
 static const unsigned INVALID_NUM_PARSED_PROPERTIES = UINT_MAX;
+static const double MAX_SCALE = 1000000;
 
 static bool equal(const CSSParserString& a, const char* b)
 {
@@ -177,6 +180,7 @@ CSSParser::~CSSParser()
     fastFree(m_data);
 
     fastDeleteAllValues(m_floatingSelectors);
+    deleteAllValues(m_floatingSelectorVectors);
     deleteAllValues(m_floatingValueLists);
     deleteAllValues(m_floatingFunctions);
 }
@@ -698,10 +702,11 @@ bool CSSParser::parseValue(int propId, bool important)
         else
             return parseQuotes(propId, important);
         break;
-    case CSSPropertyUnicodeBidi:         // normal | embed | bidi-override | inherit
-        if (id == CSSValueNormal ||
-             id == CSSValueEmbed ||
-             id == CSSValueBidiOverride)
+    case CSSPropertyUnicodeBidi: // normal | embed | bidi-override | isolate | inherit
+        if (id == CSSValueNormal
+            || id == CSSValueEmbed
+            || id == CSSValueBidiOverride
+            || id == CSSValueWebkitIsolate)
             validPrimitive = true;
         break;
 
@@ -838,9 +843,10 @@ bool CSSParser::parseValue(int propId, bool important)
         break;
 
     case CSSPropertyTextAlign:
-        // left | right | center | justify | webkit_left | webkit_right | webkit_center | start | end | <string> | inherit
-        if ((id >= CSSValueWebkitAuto && id <= CSSValueWebkitCenter) || id == CSSValueStart || id == CSSValueEnd ||
-             value->unit == CSSPrimitiveValue::CSS_STRING)
+        // left | right | center | justify | webkit_left | webkit_right | webkit_center | webkit_match_parent |
+        // start | end | <string> | inherit
+        if ((id >= CSSValueWebkitAuto && id <= CSSValueWebkitMatchParent) || id == CSSValueStart || id == CSSValueEnd
+             || value->unit == CSSPrimitiveValue::CSS_STRING)
             validPrimitive = true;
         break;
 
@@ -1887,6 +1893,7 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitTextEmphasisStyle:
         return parseTextEmphasisStyle(important);
 
+<<<<<<< HEAD
 #ifdef ANDROID_CSS_RING
     case CSSPropertyWebkitRing:
     {
@@ -1924,6 +1931,20 @@ bool CSSParser::parseValue(int propId, bool important)
             m_valueList->next();
         break;
 #endif
+=======
+    case CSSPropertyWebkitTextOrientation:
+        // FIXME: For now just support upright and vertical-right.
+        if (id == CSSValueVerticalRight || id == CSSValueUpright)
+            validPrimitive = true;
+        break;
+
+    case CSSPropertyWebkitLineBoxContain:
+        if (id == CSSValueNone)
+            validPrimitive = true;
+        else
+            return parseLineBoxContain(important);
+        break;
+>>>>>>> webkit.org at r82507
 
 #if ENABLE(SVG)
     default:
@@ -2608,34 +2629,80 @@ bool CSSParser::parseFillImage(RefPtr<CSSValue>& value)
     return false;
 }
 
-PassRefPtr<CSSValue> CSSParser::parseFillPositionXY(CSSParserValueList* valueList, bool& xFound, bool& yFound)
+PassRefPtr<CSSValue> CSSParser::parseFillPositionX(CSSParserValueList* valueList)
+{
+    int id = valueList->current()->id;
+    if (id == CSSValueLeft || id == CSSValueRight || id == CSSValueCenter) {
+        int percent = 0;
+        if (id == CSSValueRight)
+            percent = 100;
+        else if (id == CSSValueCenter)
+            percent = 50;
+        return primitiveValueCache()->createValue(percent, CSSPrimitiveValue::CSS_PERCENTAGE);
+    }
+    if (validUnit(valueList->current(), FPercent | FLength, m_strict))
+        return primitiveValueCache()->createValue(valueList->current()->fValue,
+                                                  (CSSPrimitiveValue::UnitTypes)valueList->current()->unit);
+    return 0;
+}
+
+PassRefPtr<CSSValue> CSSParser::parseFillPositionY(CSSParserValueList* valueList)
+{
+    int id = valueList->current()->id;
+    if (id == CSSValueTop || id == CSSValueBottom || id == CSSValueCenter) {
+        int percent = 0;
+        if (id == CSSValueBottom)
+            percent = 100;
+        else if (id == CSSValueCenter)
+            percent = 50;
+        return primitiveValueCache()->createValue(percent, CSSPrimitiveValue::CSS_PERCENTAGE);
+    }
+    if (validUnit(valueList->current(), FPercent | FLength, m_strict))
+        return primitiveValueCache()->createValue(valueList->current()->fValue,
+                                                  (CSSPrimitiveValue::UnitTypes)valueList->current()->unit);
+    return 0;
+}
+
+PassRefPtr<CSSValue> CSSParser::parseFillPositionComponent(CSSParserValueList* valueList, unsigned& cumulativeFlags, FillPositionFlag& individualFlag)
 {
     int id = valueList->current()->id;
     if (id == CSSValueLeft || id == CSSValueTop || id == CSSValueRight || id == CSSValueBottom || id == CSSValueCenter) {
         int percent = 0;
         if (id == CSSValueLeft || id == CSSValueRight) {
-            if (xFound)
+            if (cumulativeFlags & XFillPosition)
                 return 0;
-            xFound = true;
+            cumulativeFlags |= XFillPosition;
+            individualFlag = XFillPosition;
             if (id == CSSValueRight)
                 percent = 100;
         }
         else if (id == CSSValueTop || id == CSSValueBottom) {
-            if (yFound)
+            if (cumulativeFlags & YFillPosition)
                 return 0;
-            yFound = true;
+            cumulativeFlags |= YFillPosition;
+            individualFlag = YFillPosition;
             if (id == CSSValueBottom)
                 percent = 100;
-        }
-        else if (id == CSSValueCenter)
+        } else if (id == CSSValueCenter) {
             // Center is ambiguous, so we're not sure which position we've found yet, an x or a y.
             percent = 50;
+            cumulativeFlags |= AmbiguousFillPosition;
+            individualFlag = AmbiguousFillPosition;
+        }
         return primitiveValueCache()->createValue(percent, CSSPrimitiveValue::CSS_PERCENTAGE);
     }
-    if (validUnit(valueList->current(), FPercent | FLength, m_strict))
+    if (validUnit(valueList->current(), FPercent | FLength, m_strict)) {
+        if (!cumulativeFlags) {
+            cumulativeFlags |= XFillPosition;
+            individualFlag = XFillPosition;
+        } else if (cumulativeFlags & (XFillPosition | AmbiguousFillPosition)) {
+            cumulativeFlags |= YFillPosition;
+            individualFlag = YFillPosition;
+        } else
+            return 0;
         return primitiveValueCache()->createValue(valueList->current()->fValue,
-                                         (CSSPrimitiveValue::UnitTypes)valueList->current()->unit);
-
+                                                  (CSSPrimitiveValue::UnitTypes)valueList->current()->unit);
+    }
     return 0;
 }
 
@@ -2644,8 +2711,10 @@ void CSSParser::parseFillPosition(CSSParserValueList* valueList, RefPtr<CSSValue
     CSSParserValue* value = valueList->current();
 
     // Parse the first value.  We're just making sure that it is one of the valid keywords or a percentage/length.
-    bool value1IsX = false, value1IsY = false;
-    value1 = parseFillPositionXY(valueList, value1IsX, value1IsY);
+    unsigned cumulativeFlags = 0;
+    FillPositionFlag value1Flag = InvalidFillPosition;
+    FillPositionFlag value2Flag = InvalidFillPosition;
+    value1 = parseFillPositionComponent(valueList, cumulativeFlags, value1Flag);
     if (!value1)
         return;
 
@@ -2658,9 +2727,8 @@ void CSSParser::parseFillPosition(CSSParserValueList* valueList, RefPtr<CSSValue
     if (value && value->unit == CSSParserValue::Operator && value->iValue == ',')
         value = 0;
 
-    bool value2IsX = false, value2IsY = false;
     if (value) {
-        value2 = parseFillPositionXY(valueList, value2IsX, value2IsY);
+        value2 = parseFillPositionComponent(valueList, cumulativeFlags, value2Flag);
         if (value2)
             valueList->next();
         else {
@@ -2678,7 +2746,7 @@ void CSSParser::parseFillPosition(CSSParserValueList* valueList, RefPtr<CSSValue
         // For left/right/center, the default of 50% in the y is still correct.
         value2 = primitiveValueCache()->createValue(50, CSSPrimitiveValue::CSS_PERCENTAGE);
 
-    if (value1IsY || value2IsX)
+    if (value1Flag == YFillPosition || value2Flag == XFillPosition)
         value1.swap(value2);
 }
 
@@ -2856,16 +2924,14 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
                     break;
                 case CSSPropertyBackgroundPositionX:
                 case CSSPropertyWebkitMaskPositionX: {
-                    bool xFound = false, yFound = true;
-                    currValue = parseFillPositionXY(m_valueList, xFound, yFound);
+                    currValue = parseFillPositionX(m_valueList);
                     if (currValue)
                         m_valueList->next();
                     break;
                 }
                 case CSSPropertyBackgroundPositionY:
                 case CSSPropertyWebkitMaskPositionY: {
-                    bool xFound = true, yFound = false;
-                    currValue = parseFillPositionXY(m_valueList, xFound, yFound);
+                    currValue = parseFillPositionY(m_valueList);
                     if (currValue)
                         m_valueList->next();
                     break;
@@ -3940,10 +4006,76 @@ bool CSSParser::parseFontFaceUnicodeRange()
     return true;
 }
 
-static inline bool parseColorInt(const UChar*& string, const UChar* end, UChar terminator, int& value)
+// Returns the number of characters which form a valid double
+// and are terminated by the given terminator character
+static int checkForValidDouble(const UChar* string, const UChar* end, const char terminator)
+{
+    int length = end - string;
+    if (length < 1)
+        return 0;
+
+    bool decimalMarkSeen = false;
+    int processedLength = 0;
+
+    for (int i = 0; i < length; ++i) {
+        if (string[i] == terminator) {
+            processedLength = i;
+            break;
+        }
+        if (!isASCIIDigit(string[i])) {
+            if (!decimalMarkSeen && string[i] == '.')
+                decimalMarkSeen = true;
+            else
+                return 0;
+        }
+    }
+
+    if (decimalMarkSeen && processedLength == 1)
+        return 0;
+
+    return processedLength;
+}
+
+// Returns the number of characters consumed for parsing a valid double
+// terminated by the given terminator character
+static int parseDouble(const UChar* string, const UChar* end, const char terminator, double& value)
+{
+    int length = checkForValidDouble(string, end, terminator);
+    if (!length)
+        return 0;
+
+    int position = 0;
+    double localValue = 0;
+
+    // The consumed characters here are guaranteed to be
+    // ASCII digits with or without a decimal mark
+    for (; position < length; ++position) {
+        if (string[position] == '.')
+            break;
+        localValue = localValue * 10 + string[position] - '0';
+    }
+
+    if (++position == length) {
+        value = localValue;
+        return length;
+    }
+
+    double fraction = 0;
+    double scale = 1;
+
+    while (position < length && scale < MAX_SCALE) {
+        fraction = fraction * 10 + string[position++] - '0';
+        scale *= 10;
+    }
+
+    value = localValue + fraction / scale;
+    return length;
+}
+
+static bool parseColorIntOrPercentage(const UChar*& string, const UChar* end, const char terminator, CSSPrimitiveValue::UnitTypes& expect, int& value)
 {
     const UChar* current = string;
-    int localValue = 0;
+    double localValue = 0;
     bool negative = false;
     while (current != end && isHTMLSpace(*current))
         current++;
@@ -3954,7 +4086,7 @@ static inline bool parseColorInt(const UChar*& string, const UChar* end, UChar t
     if (current == end || !isASCIIDigit(*current))
         return false;
     while (current != end && isASCIIDigit(*current)) {
-        int newValue = localValue * 10 + *current++ - '0';
+        double newValue = localValue * 10 + *current++ - '0';
         if (newValue >= 255) {
             // Clamp values at 255.
             localValue = 255;
@@ -3964,12 +4096,42 @@ static inline bool parseColorInt(const UChar*& string, const UChar* end, UChar t
         }
         localValue = newValue;
     }
+
+    if (expect == CSSPrimitiveValue::CSS_NUMBER && (*current == '.' || *current == '%'))
+        return false;
+
+    if (*current == '.') {
+        // We already parsed the integral part, try to parse
+        // the fraction part of the percentage value.
+        double percentage = 0;
+        int numCharactersParsed = parseDouble(current, end, '%', percentage);
+        if (!numCharactersParsed)
+            return false;
+        current += numCharactersParsed;
+        if (*current != '%')
+            return false;
+        localValue += percentage;
+    }
+
+    if (expect == CSSPrimitiveValue::CSS_PERCENTAGE && *current != '%')
+        return false;
+
+    if (*current == '%') {
+        expect = CSSPrimitiveValue::CSS_PERCENTAGE;
+        localValue = localValue / 100.0 * 256.0;
+        // Clamp values at 255 for percentages over 100%
+        if (localValue > 255)
+            localValue = 255;
+        current++;
+    } else
+        expect = CSSPrimitiveValue::CSS_NUMBER;
+
     while (current != end && isHTMLSpace(*current))
         current++;
     if (current == end || *current++ != terminator)
         return false;
     // Clamp negative values at zero.
-    value = negative ? 0 : localValue;
+    value = negative ? 0 : static_cast<int>(localValue);
     string = current;
     return true;
 }
@@ -3987,21 +4149,7 @@ static inline bool isTenthAlpha(const UChar* string, const int length)
     return false;
 }
 
-static inline bool isValidDouble(const UChar* string, const int length)
-{
-    bool decimalMarkSeen = false;
-    for (int i = 0; i < length; ++i) {
-        if (!isASCIIDigit(string[i])) {
-            if (!decimalMarkSeen && string[i] == '.')
-                decimalMarkSeen = true;
-            else
-                return false;
-        }
-    }
-    return true;
-}
-
-static inline bool parseAlphaValue(const UChar*& string, const UChar* end, UChar terminator, int& value)
+static inline bool parseAlphaValue(const UChar*& string, const UChar* end, const char terminator, int& value)
 {
     while (string != end && isHTMLSpace(*string))
         string++;
@@ -4023,7 +4171,7 @@ static inline bool parseAlphaValue(const UChar*& string, const UChar* end, UChar
         return false;
 
     if (string[0] != '0' && string[0] != '1' && string[0] != '.') {
-        if (isValidDouble(string, length - 1)) {
+        if (checkForValidDouble(string, end, terminator)) {
             value = negative ? 0 : 255;
             string = end;
             return true;
@@ -4044,20 +4192,12 @@ static inline bool parseAlphaValue(const UChar*& string, const UChar* end, UChar
         return true;
     }
 
-    if (!isValidDouble(string, length - 1))
-       return false;
-
-    Vector<char, 8> bytes(length + 1);
-
-    for (int i = 0; i < length; ++i)
-        bytes[i] = string[i];
-
-    bytes[length] = '\0';
-    char* foundTerminator;
-    double d = WTF::strtod(bytes.data(), &foundTerminator);
-    value = negative ? 0 : static_cast<int>(d * nextafter(256.0, 0.0));
-    string += (foundTerminator - bytes.data()) + 1;
-    return *foundTerminator == terminator;
+    double alpha = 0;
+    if (!parseDouble(string, end, terminator, alpha))
+        return false;
+    value = negative ? 0 : static_cast<int>(alpha * nextafter(256.0, 0.0));
+    string = end;
+    return true;
 }
 
 static inline bool mightBeRGBA(const UChar* characters, unsigned length)
@@ -4085,6 +4225,7 @@ bool CSSParser::parseColor(const String &name, RGBA32& rgb, bool strict)
 {
     const UChar* characters = name.characters();
     unsigned length = name.length();
+    CSSPrimitiveValue::UnitTypes expect = CSSPrimitiveValue::CSS_UNKNOWN;
 
     if (!strict && length >= 3) {
         if (name[0] == '#') {
@@ -4104,11 +4245,12 @@ bool CSSParser::parseColor(const String &name, RGBA32& rgb, bool strict)
         int green;
         int blue;
         int alpha;
-        if (!parseColorInt(current, end, ',', red))
+
+        if (!parseColorIntOrPercentage(current, end, ',', expect, red))
             return false;
-        if (!parseColorInt(current, end, ',', green))
+        if (!parseColorIntOrPercentage(current, end, ',', expect, green))
             return false;
-        if (!parseColorInt(current, end, ',', blue))
+        if (!parseColorIntOrPercentage(current, end, ',', expect, blue))
             return false;
         if (!parseAlphaValue(current, end, ')', alpha))
             return false;
@@ -4125,11 +4267,11 @@ bool CSSParser::parseColor(const String &name, RGBA32& rgb, bool strict)
         int red;
         int green;
         int blue;
-        if (!parseColorInt(current, end, ',', red))
+        if (!parseColorIntOrPercentage(current, end, ',', expect, red))
             return false;
-        if (!parseColorInt(current, end, ',', green))
+        if (!parseColorIntOrPercentage(current, end, ',', expect, green))
             return false;
-        if (!parseColorInt(current, end, ')', blue))
+        if (!parseColorIntOrPercentage(current, end, ')', expect, blue))
             return false;
         if (current != end)
             return false;
@@ -5544,15 +5686,13 @@ bool CSSParser::parseTransformOrigin(int propId, int& propId1, int& propId2, int
             // parseTransformOriginShorthand advances the m_valueList pointer
             break;
         case CSSPropertyWebkitTransformOriginX: {
-            bool xFound = false, yFound = true;
-            value = parseFillPositionXY(m_valueList, xFound, yFound);
+            value = parseFillPositionX(m_valueList);
             if (value)
                 m_valueList->next();
             break;
         }
         case CSSPropertyWebkitTransformOriginY: {
-            bool xFound = true, yFound = false;
-            value = parseFillPositionXY(m_valueList, xFound, yFound);
+            value = parseFillPositionY(m_valueList);
             if (value)
                 m_valueList->next();
             break;
@@ -5583,15 +5723,13 @@ bool CSSParser::parsePerspectiveOrigin(int propId, int& propId1, int& propId2, R
             parseFillPosition(m_valueList, value, value2);
             break;
         case CSSPropertyWebkitPerspectiveOriginX: {
-            bool xFound = false, yFound = true;
-            value = parseFillPositionXY(m_valueList, xFound, yFound);
+            value = parseFillPositionX(m_valueList);
             if (value)
                 m_valueList->next();
             break;
         }
         case CSSPropertyWebkitPerspectiveOriginY: {
-            bool xFound = true, yFound = false;
-            value = parseFillPositionXY(m_valueList, xFound, yFound);
+            value = parseFillPositionY(m_valueList);
             if (value)
                 m_valueList->next();
             break;
@@ -5658,6 +5796,46 @@ bool CSSParser::parseTextEmphasisStyle(bool important)
     return false;
 }
 
+bool CSSParser::parseLineBoxContain(bool important)
+{
+    LineBoxContain lineBoxContain = LineBoxContainNone;
+
+    for (CSSParserValue* value = m_valueList->current(); value; value = m_valueList->next()) {
+        if (value->id == CSSValueBlock) {
+            if (lineBoxContain & LineBoxContainBlock)
+                return false;
+            lineBoxContain |= LineBoxContainBlock;
+        } else if (value->id == CSSValueInline) {
+            if (lineBoxContain & LineBoxContainInline)
+                return false;
+            lineBoxContain |= LineBoxContainInline;
+        } else if (value->id == CSSValueFont) {
+            if (lineBoxContain & LineBoxContainFont)
+                return false;
+            lineBoxContain |= LineBoxContainFont;
+        } else if (value->id == CSSValueGlyphs) {
+            if (lineBoxContain & LineBoxContainGlyphs)
+                return false;
+            lineBoxContain |= LineBoxContainGlyphs;
+        } else if (value->id == CSSValueReplaced) {
+            if (lineBoxContain & LineBoxContainReplaced)
+                return false;
+            lineBoxContain |= LineBoxContainReplaced;
+        } else if (value->id == CSSValueInlineBox) {
+            if (lineBoxContain & LineBoxContainInlineBox)
+                return false;
+            lineBoxContain |= LineBoxContainInlineBox;
+        } else
+            return false;
+    }
+    
+    if (!lineBoxContain)
+        return false;
+
+    addProperty(CSSPropertyWebkitLineBoxContain, CSSLineBoxContainValue::create(lineBoxContain), important);
+    return true;
+}
+
 static inline int yyerror(const char*) { return 1; }
 
 #define END_TOKEN 0
@@ -5689,6 +5867,7 @@ int CSSParser::lex(void* yylvalWithoutType)
     case DIMEN:
     case UNICODERANGE:
     case FUNCTION:
+    case ANYFUNCTION:
     case NOTFUNCTION:
         yylval->string.characters = t;
         yylval->string.length = length;
@@ -5902,6 +6081,22 @@ PassOwnPtr<CSSParserSelector> CSSParser::sinkFloatingSelector(CSSParserSelector*
     return adoptPtr(selector);
 }
 
+Vector<OwnPtr<CSSParserSelector> >* CSSParser::createFloatingSelectorVector()
+{
+    Vector<OwnPtr<CSSParserSelector> >* selectorVector = new Vector<OwnPtr<CSSParserSelector> >;
+    m_floatingSelectorVectors.add(selectorVector);
+    return selectorVector;
+}
+
+Vector<OwnPtr<CSSParserSelector> >* CSSParser::sinkFloatingSelectorVector(Vector<OwnPtr<CSSParserSelector> >* selectorVector)
+{
+    if (selectorVector) {
+        ASSERT(m_floatingSelectorVectors.contains(selectorVector));
+        m_floatingSelectorVectors.remove(selectorVector);
+    }
+    return selectorVector;
+}
+
 CSSParserValueList* CSSParser::createFloatingValueList()
 {
     CSSParserValueList* list = new CSSParserValueList;
@@ -6485,11 +6680,8 @@ String quoteCSSString(const String& string)
             buffer[index++] = ch;
             afterEscape = false;
         } else if (ch < 0x20 || ch == 0x7F) { // Control characters.
-            static const char hexDigits[17] = "0123456789abcdef";
             buffer[index++] = '\\';
-            if (ch >= 0x10)
-                buffer[index++] = hexDigits[ch >> 4];
-            buffer[index++] = hexDigits[ch & 0xF];
+            placeByteAsHexCompressIfPossible(ch, buffer, index, Lowercase);
             afterEscape = true;
         } else {
             // Space character may be required to separate backslash-escape sequence and normal characters.
diff --git a/Source/WebCore/css/CSSParser.h b/Source/WebCore/css/CSSParser.h
index 230e699..c03afd9 100644
--- a/Source/WebCore/css/CSSParser.h
+++ b/Source/WebCore/css/CSSParser.h
@@ -89,8 +89,13 @@ namespace WebCore {
         PassRefPtr<CSSValue> parseBackgroundColor();
 
         bool parseFillImage(RefPtr<CSSValue>&);
-        PassRefPtr<CSSValue> parseFillPositionXY(CSSParserValueList*, bool& xFound, bool& yFound);
+
+        enum FillPositionFlag { InvalidFillPosition = 0, AmbiguousFillPosition = 1, XFillPosition = 2, YFillPosition = 4 };
+        PassRefPtr<CSSValue> parseFillPositionComponent(CSSParserValueList*, unsigned& cumulativeFlags, FillPositionFlag& individualFlag);
+        PassRefPtr<CSSValue> parseFillPositionX(CSSParserValueList*);
+        PassRefPtr<CSSValue> parseFillPositionY(CSSParserValueList*);
         void parseFillPosition(CSSParserValueList*, RefPtr<CSSValue>&, RefPtr<CSSValue>&);
+        
         void parseFillRepeat(RefPtr<CSSValue>&, RefPtr<CSSValue>&);
         PassRefPtr<CSSValue> parseFillSize(int propId, bool &allowComma);
 
@@ -173,11 +178,16 @@ namespace WebCore {
 
         bool parseTextEmphasisStyle(bool important);
 
+        bool parseLineBoxContain(bool important);
+
         int yyparse();
 
         CSSParserSelector* createFloatingSelector();
         PassOwnPtr<CSSParserSelector> sinkFloatingSelector(CSSParserSelector*);
 
+        Vector<OwnPtr<CSSParserSelector> >* createFloatingSelectorVector();
+        Vector<OwnPtr<CSSParserSelector> >* sinkFloatingSelectorVector(Vector<OwnPtr<CSSParserSelector> >*);
+
         CSSParserValueList* createFloatingValueList();
         CSSParserValueList* sinkFloatingValueList(CSSParserValueList*);
 
@@ -311,6 +321,7 @@ namespace WebCore {
         Vector<RefPtr<StyleBase> > m_parsedStyleObjects;
         Vector<RefPtr<CSSRuleList> > m_parsedRuleLists;
         HashSet<CSSParserSelector*> m_floatingSelectors;
+        HashSet<Vector<OwnPtr<CSSParserSelector> >*> m_floatingSelectorVectors;
         HashSet<CSSParserValueList*> m_floatingValueLists;
         HashSet<CSSParserFunction*> m_floatingFunctions;
 
diff --git a/Source/WebCore/css/CSSParserValues.cpp b/Source/WebCore/css/CSSParserValues.cpp
index dc0e82b..94dcd3c 100644
--- a/Source/WebCore/css/CSSParserValues.cpp
+++ b/Source/WebCore/css/CSSParserValues.cpp
@@ -25,6 +25,7 @@
 #include "CSSFunctionValue.h"
 #include "CSSQuirkPrimitiveValue.h"
 #include "CSSSelector.h"
+#include "CSSSelectorList.h"
 
 namespace WebCore {
         
@@ -43,12 +44,23 @@ void CSSParserValueList::addValue(const CSSParserValue& v)
 {
     m_values.append(v);
 }
-    
+
+void CSSParserValueList::insertValueAt(unsigned i, const CSSParserValue& v)
+{
+    m_values.insert(i, v);
+}
+
 void CSSParserValueList::deleteValueAt(unsigned i)
 { 
     m_values.remove(i);
 }
 
+void CSSParserValueList::extend(CSSParserValueList& valueList)
+{
+    for (unsigned int i = 0; i < valueList.size(); ++i)
+        m_values.append(*(valueList.valueAt(i)));
+}
+
 PassRefPtr<CSSValue> CSSParserValue::createCSSValue()
 {
     RefPtr<CSSValue> parsedValue;
@@ -96,5 +108,11 @@ CSSParserSelector::~CSSParserSelector()
     deleteAllValues(toDelete);
 }
 
+void CSSParserSelector::adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectorVector)
+{
+    CSSSelectorList* selectorList = fastNew<CSSSelectorList>();
+    selectorList->adoptSelectorVector(selectorVector);
+    m_selector->setSelectorList(adoptPtr(selectorList));
+}
 }
 
diff --git a/Source/WebCore/css/CSSParserValues.h b/Source/WebCore/css/CSSParserValues.h
index d084091..81ecbc3 100644
--- a/Source/WebCore/css/CSSParserValues.h
+++ b/Source/WebCore/css/CSSParserValues.h
@@ -71,7 +71,9 @@ public:
     ~CSSParserValueList();
     
     void addValue(const CSSParserValue&);
+    void insertValueAt(unsigned, const CSSParserValue&);
     void deleteValueAt(unsigned);
+    void extend(CSSParserValueList&);
 
     unsigned size() const { return m_values.size(); }
     CSSParserValue* current() { return m_current < m_values.size() ? &m_values[m_current] : 0; }
@@ -105,11 +107,12 @@ public:
     void setValue(const AtomicString& value) { m_selector->setValue(value); }
     void setAttribute(const QualifiedName& value) { m_selector->setAttribute(value); }
     void setArgument(const AtomicString& value) { m_selector->setArgument(value); }
-    void setSimpleSelector(PassOwnPtr<CSSSelector> value) { m_selector->setSimpleSelector(value); }
     void setMatch(CSSSelector::Match value) { m_selector->m_match = value; }
     void setRelation(CSSSelector::Relation value) { m_selector->m_relation = value; }
     void setForPage() { m_selector->setForPage(); }
-    
+
+    void adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectorVector);
+
     CSSSelector::PseudoType pseudoType() const { return m_selector->pseudoType(); }
     bool isUnknownPseudoElement() const { return m_selector->isUnknownPseudoElement(); }
     bool isSimple() const { return !m_tagHistory && m_selector->isSimple(); }
diff --git a/Source/WebCore/css/CSSPrimitiveValueCache.cpp b/Source/WebCore/css/CSSPrimitiveValueCache.cpp
index 6b3eebe..5c7a4c0 100644
--- a/Source/WebCore/css/CSSPrimitiveValueCache.cpp
+++ b/Source/WebCore/css/CSSPrimitiveValueCache.cpp
@@ -23,7 +23,7 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <config.h>
+#include "config.h"
 #include "CSSPrimitiveValueCache.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/css/CSSPrimitiveValueMappings.h b/Source/WebCore/css/CSSPrimitiveValueMappings.h
index fb4aff3..16412ad 100644
--- a/Source/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/Source/WebCore/css/CSSPrimitiveValueMappings.h
@@ -39,6 +39,7 @@
 #include "RenderStyleConstants.h"
 #include "SVGRenderStyleDefs.h"
 #include "TextDirection.h"
+#include "TextOrientation.h"
 #include "TextRenderingMode.h"
 #include "ThemeTypes.h"
 
@@ -1616,30 +1617,36 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ETextAlign e)
     , m_hasCachedCSSText(false)
 {
     switch (e) {
-        case TAAUTO:
-            m_value.ident = CSSValueWebkitAuto;
-            break;
-        case LEFT:
-            m_value.ident = CSSValueLeft;
-            break;
-        case RIGHT:
-            m_value.ident = CSSValueRight;
-            break;
-        case CENTER:
-            m_value.ident = CSSValueCenter;
-            break;
-        case JUSTIFY:
-            m_value.ident = CSSValueJustify;
-            break;
-        case WEBKIT_LEFT:
-            m_value.ident = CSSValueWebkitLeft;
-            break;
-        case WEBKIT_RIGHT:
-            m_value.ident = CSSValueWebkitRight;
-            break;
-        case WEBKIT_CENTER:
-            m_value.ident = CSSValueWebkitCenter;
-            break;
+    case TAAUTO:
+        m_value.ident = CSSValueWebkitAuto;
+        break;
+    case TASTART:
+        m_value.ident = CSSValueStart;
+        break;
+    case TAEND:
+        m_value.ident = CSSValueEnd;
+        break;
+    case LEFT:
+        m_value.ident = CSSValueLeft;
+        break;
+    case RIGHT:
+        m_value.ident = CSSValueRight;
+        break;
+    case CENTER:
+        m_value.ident = CSSValueCenter;
+        break;
+    case JUSTIFY:
+        m_value.ident = CSSValueJustify;
+        break;
+    case WEBKIT_LEFT:
+        m_value.ident = CSSValueWebkitLeft;
+        break;
+    case WEBKIT_RIGHT:
+        m_value.ident = CSSValueWebkitRight;
+        break;
+    case WEBKIT_CENTER:
+        m_value.ident = CSSValueWebkitCenter;
+        break;
     }
 }
 
@@ -1647,9 +1654,9 @@ template<> inline CSSPrimitiveValue::operator ETextAlign() const
 {
     switch (m_value.ident) {
         case CSSValueStart:
+            return TASTART;
         case CSSValueEnd:
-            ASSERT_NOT_REACHED(); // Depends on direction, thus should be handled by the caller.
-            return LEFT;
+            return TAEND;
         default:
             return static_cast<ETextAlign>(m_value.ident - CSSValueWebkitAuto);
     }
@@ -1734,30 +1741,34 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EUnicodeBidi e)
     , m_hasCachedCSSText(false)
 {
     switch (e) {
-        case UBNormal:
-            m_value.ident = CSSValueNormal;
-            break;
-        case Embed:
-            m_value.ident = CSSValueEmbed;
-            break;
-        case Override:
-            m_value.ident = CSSValueBidiOverride;
-            break;
+    case UBNormal:
+        m_value.ident = CSSValueNormal;
+        break;
+    case Embed:
+        m_value.ident = CSSValueEmbed;
+        break;
+    case Override:
+        m_value.ident = CSSValueBidiOverride;
+        break;
+    case Isolate:
+        m_value.ident = CSSValueWebkitIsolate;
     }
 }
 
 template<> inline CSSPrimitiveValue::operator EUnicodeBidi() const
 {
     switch (m_value.ident) {
-        case CSSValueNormal:
-            return UBNormal; 
-        case CSSValueEmbed:
-            return Embed; 
-        case CSSValueBidiOverride:
-            return Override;
-        default:
-            ASSERT_NOT_REACHED();
-            return UBNormal;
+    case CSSValueNormal:
+        return UBNormal;
+    case CSSValueEmbed:
+        return Embed;
+    case CSSValueBidiOverride:
+        return Override;
+    case CSSValueWebkitIsolate:
+        return Isolate;
+    default:
+        ASSERT_NOT_REACHED();
+        return UBNormal;
     }
 }
 
@@ -2177,6 +2188,33 @@ template<> inline CSSPrimitiveValue::operator TextEmphasisMark() const
     }
 }
 
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(TextOrientation e)
+    : m_type(CSS_IDENT)
+    , m_hasCachedCSSText(false)
+{
+    switch (e) {
+    case TextOrientationVerticalRight:
+        m_value.ident = CSSValueVerticalRight;
+        break;
+    case TextOrientationUpright:
+        m_value.ident = CSSValueUpright;
+        break;
+    }
+}
+
+template<> inline CSSPrimitiveValue::operator TextOrientation() const
+{
+    switch (m_value.ident) {
+    case CSSValueVerticalRight:
+        return TextOrientationVerticalRight;
+    case CSSValueUpright:
+        return TextOrientationUpright;
+    default:
+        ASSERT_NOT_REACHED();
+        return TextOrientationVerticalRight;
+    }
+}
+
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EPointerEvents e)
     : m_type(CSS_IDENT)
     , m_hasCachedCSSText(false)
diff --git a/Source/WebCore/css/CSSPropertyNames.in b/Source/WebCore/css/CSSPropertyNames.in
index d1fdcd3..a62d2f3 100644
--- a/Source/WebCore/css/CSSPropertyNames.in
+++ b/Source/WebCore/css/CSSPropertyNames.in
@@ -21,6 +21,7 @@ font-variant
 font-weight
 text-rendering
 -webkit-font-smoothing
+-webkit-text-orientation
 -webkit-text-size-adjust
 -webkit-writing-mode
 zoom
@@ -230,6 +231,7 @@ z-index
 -webkit-hyphenate-limit-after
 -webkit-hyphenate-limit-before
 -webkit-hyphens
+-webkit-line-box-contain
 -webkit-line-break
 -webkit-line-clamp
 -webkit-locale
diff --git a/Source/WebCore/css/CSSRuleList.h b/Source/WebCore/css/CSSRuleList.h
index a355c4a..87996a9 100644
--- a/Source/WebCore/css/CSSRuleList.h
+++ b/Source/WebCore/css/CSSRuleList.h
@@ -53,6 +53,11 @@ public:
     void deleteRule(unsigned index);
     void append(CSSRule*);
 
+    StyleList* styleList()
+    {
+        return m_list.get();
+    }
+
 private:
     CSSRuleList();
     CSSRuleList(StyleList*, bool omitCharsetRules);
diff --git a/Source/WebCore/css/CSSSelector.cpp b/Source/WebCore/css/CSSSelector.cpp
index c804697..a87d4f3 100644
--- a/Source/WebCore/css/CSSSelector.cpp
+++ b/Source/WebCore/css/CSSSelector.cpp
@@ -27,6 +27,7 @@
 #include "CSSSelector.h"
 
 #include "CSSOMUtils.h"
+#include "CSSSelectorList.h"
 #include "HTMLNames.h"
 #include <wtf/Assertions.h>
 #include <wtf/HashMap.h>
@@ -78,9 +79,12 @@ inline unsigned CSSSelector::specificityForOneSelector() const
     case Contain:
     case Begin:
     case End:
-        if (pseudoType() == PseudoNot && simpleSelector())
-            s += simpleSelector()->specificityForOneSelector();
-        else
+        // FIXME: PsuedoAny should base the specificity on the sub-selectors.
+        // See http://lists.w3.org/Archives/Public/www-style/2010Sep/0530.html
+        if (pseudoType() == PseudoNot) {
+            ASSERT(selectorList());
+            s += selectorList()->first()->specificityForOneSelector();
+        } else
             s += 0x100;
     case None:
         break;
@@ -211,6 +215,7 @@ PseudoId CSSSelector::pseudoId(PseudoType type)
     case PseudoNthLastOfType:
     case PseudoLink:
     case PseudoVisited:
+    case PseudoAny:
     case PseudoAnyLink:
     case PseudoAutofill:
     case PseudoHover:
@@ -265,6 +270,7 @@ static HashMap<AtomicStringImpl*, CSSSelector::PseudoType>* nameToPseudoTypeMap(
 {
     DEFINE_STATIC_LOCAL(AtomicString, active, ("active"));
     DEFINE_STATIC_LOCAL(AtomicString, after, ("after"));
+    DEFINE_STATIC_LOCAL(AtomicString, any, ("-webkit-any("));
     DEFINE_STATIC_LOCAL(AtomicString, anyLink, ("-webkit-any-link"));
     DEFINE_STATIC_LOCAL(AtomicString, autofill, ("-webkit-autofill"));
     DEFINE_STATIC_LOCAL(AtomicString, before, ("before"));
@@ -364,6 +370,7 @@ static HashMap<AtomicStringImpl*, CSSSelector::PseudoType>* nameToPseudoTypeMap(
         nameToPseudoType->set(active.impl(), CSSSelector::PseudoActive);
         nameToPseudoType->set(after.impl(), CSSSelector::PseudoAfter);
         nameToPseudoType->set(anyLink.impl(), CSSSelector::PseudoAnyLink);
+        nameToPseudoType->set(any.impl(), CSSSelector::PseudoAny);
         nameToPseudoType->set(autofill.impl(), CSSSelector::PseudoAutofill);
         nameToPseudoType->set(before.impl(), CSSSelector::PseudoBefore);
         nameToPseudoType->set(checked.impl(), CSSSelector::PseudoChecked);
@@ -527,6 +534,7 @@ void CSSSelector::extractPseudoType() const
     case PseudoNthLastOfType:
     case PseudoLink:
     case PseudoVisited:
+    case PseudoAny:
     case PseudoAnyLink:
     case PseudoAutofill:
     case PseudoHover:
@@ -638,17 +646,33 @@ String CSSSelector::selectorText() const
         } else if (cs->m_match == CSSSelector::PseudoClass || cs->m_match == CSSSelector::PagePseudoClass) {
             str += ":";
             str += cs->value();
-            if (cs->pseudoType() == PseudoNot) {
-                if (CSSSelector* subSel = cs->simpleSelector())
-                    str += subSel->selectorText();
+
+            switch (cs->pseudoType()) {
+            case PseudoNot:
+                ASSERT(cs->selectorList());
+                str += cs->selectorList()->first()->selectorText();
                 str += ")";
-            } else if (cs->pseudoType() == PseudoLang
-                    || cs->pseudoType() == PseudoNthChild
-                    || cs->pseudoType() == PseudoNthLastChild
-                    || cs->pseudoType() == PseudoNthOfType
-                    || cs->pseudoType() == PseudoNthLastOfType) {
+                break;
+            case PseudoLang:
+            case PseudoNthChild:
+            case PseudoNthLastChild:
+            case PseudoNthOfType:
+            case PseudoNthLastOfType:
                 str += cs->argument();
                 str += ")";
+                break;
+            case PseudoAny: {
+                CSSSelector* firstSubSelector = cs->selectorList()->first();
+                for (CSSSelector* subSelector = firstSubSelector; subSelector; subSelector = CSSSelectorList::next(subSelector)) {
+                    if (subSelector != firstSubSelector)
+                        str += ",";
+                    str += subSelector->selectorText();
+                }
+                str += ")";
+                break;
+            }
+            default:
+                break;
             }
         } else if (cs->m_match == CSSSelector::PseudoElement) {
             str += "::";
@@ -736,11 +760,11 @@ void CSSSelector::setArgument(const AtomicString& value)
     createRareData(); 
     m_data.m_rareData->m_argument = value; 
 }
-
-void CSSSelector::setSimpleSelector(PassOwnPtr<CSSSelector> value)
+    
+void CSSSelector::setSelectorList(PassOwnPtr<CSSSelectorList> selectorList)
 {
     createRareData(); 
-    m_data.m_rareData->m_simpleSelector = value; 
+    m_data.m_rareData->m_selectorList = selectorList;
 }
 
 bool CSSSelector::parseNth()
@@ -761,7 +785,7 @@ bool CSSSelector::matchNth(int count)
 
 bool CSSSelector::isSimple() const
 {
-    if (simpleSelector() || tagHistory() || matchesPseudoElement())
+    if (selectorList() || tagHistory() || matchesPseudoElement())
         return false;
 
     int numConditions = 0;
@@ -784,6 +808,21 @@ bool CSSSelector::isSimple() const
     return numConditions <= 1;
 }
 
+CSSSelector::RareData::RareData(PassRefPtr<AtomicStringImpl> value)
+    : m_value(value.leakRef())
+    , m_a(0)
+    , m_b(0)
+    , m_attribute(anyQName())
+    , m_argument(nullAtom)
+{
+}
+
+CSSSelector::RareData::~RareData()
+{
+    if (m_value)
+        m_value->deref();
+}
+    
 // a helper function for parsing nth-arguments
 bool CSSSelector::RareData::parseNth()
 {
diff --git a/Source/WebCore/css/CSSSelector.h b/Source/WebCore/css/CSSSelector.h
index c04c27b..fdadafa 100644
--- a/Source/WebCore/css/CSSSelector.h
+++ b/Source/WebCore/css/CSSSelector.h
@@ -29,6 +29,7 @@
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
+    class CSSSelectorList;
 
     // this class represents a selector for a StyleRule
     class CSSSelector {
@@ -129,6 +130,7 @@ namespace WebCore {
             PseudoNthLastOfType,
             PseudoLink,
             PseudoVisited,
+            PseudoAny,
             PseudoAnyLink,
             PseudoAutofill,
             PseudoHover,
@@ -247,13 +249,13 @@ namespace WebCore {
         const AtomicString& value() const { return *reinterpret_cast<const AtomicString*>(m_hasRareData ? &m_data.m_rareData->m_value : &m_data.m_value); }
         const QualifiedName& attribute() const;
         const AtomicString& argument() const { return m_hasRareData ? m_data.m_rareData->m_argument : nullAtom; }
-        CSSSelector* simpleSelector() const { return m_hasRareData ? m_data.m_rareData->m_simpleSelector.get() : 0; }
+        CSSSelectorList* selectorList() const { return m_hasRareData ? m_data.m_rareData->m_selectorList.get() : 0; }
         
         void setTag(const QualifiedName& value) { m_tag = value; }
         void setValue(const AtomicString&);
         void setAttribute(const QualifiedName&);
         void setArgument(const AtomicString&);
-        void setSimpleSelector(PassOwnPtr<CSSSelector>);
+        void setSelectorList(PassOwnPtr<CSSSelectorList>);
         
         bool parseNth();
         bool matchNth(int count);
@@ -284,7 +286,7 @@ namespace WebCore {
         bool m_isLastInTagHistory     : 1;
         bool m_hasRareData            : 1;
         bool m_isForPage              : 1;
-        // FIXME: Remove once http://webkit.org/b/53045 is fixed.
+        // FIXME: Remove once http://webkit.org/b/56124 is fixed.
         bool m_deleted                : 1;
 
         unsigned specificityForOneSelector() const;
@@ -294,19 +296,8 @@ namespace WebCore {
         struct RareData {
             WTF_MAKE_NONCOPYABLE(RareData); WTF_MAKE_FAST_ALLOCATED;
         public:
-            RareData(PassRefPtr<AtomicStringImpl> value)
-                : m_value(value.leakRef())
-                , m_a(0)
-                , m_b(0)
-                , m_attribute(anyQName())
-                , m_argument(nullAtom)
-            {
-            }
-            ~RareData()
-            {
-                if (m_value)
-                    m_value->deref();
-            }
+            RareData(PassRefPtr<AtomicStringImpl> value);
+            ~RareData();
 
             bool parseNth();
             bool matchNth(int count);
@@ -314,9 +305,9 @@ namespace WebCore {
             AtomicStringImpl* m_value; // Plain pointer to keep things uniform with the union.
             int m_a; // Used for :nth-*
             int m_b; // Used for :nth-*
-            OwnPtr<CSSSelector> m_simpleSelector; // Used for :not.
             QualifiedName m_attribute; // used for attribute selector
             AtomicString m_argument; // Used for :contains, :lang and :nth-*
+            OwnPtr<CSSSelectorList> m_selectorList; // Used for :-webkit-any and :not
         };
         void createRareData();
         
diff --git a/Source/WebCore/css/CSSSelectorList.cpp b/Source/WebCore/css/CSSSelectorList.cpp
index 6f307ee..c0ffdd5 100644
--- a/Source/WebCore/css/CSSSelectorList.cpp
+++ b/Source/WebCore/css/CSSSelectorList.cpp
@@ -87,7 +87,7 @@ void CSSSelectorList::deleteSelectors()
     if (!m_selectorArray)
         return;
 
-    // FIXME: Remove once http://webkit.org/b/53045 is fixed.
+    // FIXME: Remove once http://webkit.org/b/56124 is fixed.
     if (m_selectorArray == freedSelectorArrayMarker)
         CRASH();
 
@@ -122,9 +122,11 @@ static bool forEachTagSelector(Functor& functor, CSSSelector* selector)
     do {
         if (functor(selector))
             return true;
-        if (CSSSelector* simpleSelector = selector->simpleSelector()) {
-            if (forEachTagSelector(functor, simpleSelector))
-                return true;
+        if (CSSSelectorList* selectorList = selector->selectorList()) {
+            for (CSSSelector* subSelector = selectorList->first(); subSelector; subSelector = CSSSelectorList::next(subSelector)) {
+                if (forEachTagSelector(functor, subSelector))
+                    return true;
+            }
         }
     } while ((selector = selector->tagHistory()));
 
diff --git a/Source/WebCore/css/CSSStyleApplyProperty.cpp b/Source/WebCore/css/CSSStyleApplyProperty.cpp
new file mode 100644
index 0000000..e075615
--- /dev/null
+++ b/Source/WebCore/css/CSSStyleApplyProperty.cpp
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CSSStyleApplyProperty.h"
+
+#include "CSSPrimitiveValueMappings.h"
+#include "CSSStyleSelector.h"
+#include "RenderStyle.h"
+#include <wtf/StdLibExtras.h>
+#include <wtf/UnusedParam.h>
+
+using namespace std;
+
+namespace WebCore {
+
+class ApplyPropertyNull : public ApplyPropertyBase {
+public:
+    virtual void inherit(CSSStyleSelector*) const {}
+    virtual void initial(CSSStyleSelector*) const {}
+    virtual void value(CSSStyleSelector*, CSSValue*) const {}
+};
+
+template <typename T>
+class ApplyPropertyDefault : public ApplyPropertyBase {
+public:
+    ApplyPropertyDefault(T (RenderStyle::*getter)() const, void (RenderStyle::*setter)(T), T (*initial)())
+        : m_getter(getter)
+        , m_setter(setter)
+        , m_initial(initial)
+    {
+    }
+
+    virtual void inherit(CSSStyleSelector* selector) const
+    {
+        (selector->style()->*m_setter)((selector->parentStyle()->*m_getter)());
+    }
+
+    virtual void initial(CSSStyleSelector* selector) const
+    {
+        (selector->style()->*m_setter)((*m_initial)());
+    }
+
+    virtual void value(CSSStyleSelector* selector, CSSValue* value) const
+    {
+        if (value->isPrimitiveValue())
+            (selector->style()->*m_setter)(*(static_cast<CSSPrimitiveValue*>(value)));
+    }
+
+protected:
+    T (RenderStyle::*m_getter)() const;
+    void (RenderStyle::*m_setter)(T);
+    T (*m_initial)();
+};
+
+// CSSPropertyColor
+class ApplyPropertyColorBase : public ApplyPropertyBase {
+public:
+    ApplyPropertyColorBase(const Color& (RenderStyle::*getter)() const, const Color& (RenderStyle::*defaultValue)() const, void (RenderStyle::*setter)(const Color&))
+        : m_getter(getter)
+        , m_defaultValue(defaultValue)
+        , m_setter(setter)
+    {
+    }
+    virtual void inherit(CSSStyleSelector* selector) const
+    {
+        const Color& color = (selector->parentStyle()->*m_getter)();
+        if (m_defaultValue && !color.isValid())
+            (selector->style()->*m_setter)((selector->parentStyle()->*m_defaultValue)());
+        else
+            (selector->style()->*m_setter)(color);
+    }
+    virtual void initial(CSSStyleSelector* selector) const
+    {
+        Color color;
+        (selector->style()->*m_setter)(color);
+    }
+    virtual void value(CSSStyleSelector* selector, CSSValue* value) const
+    {
+        if (value->isPrimitiveValue())
+            (selector->style()->*m_setter)(selector->getColorFromPrimitiveValue(static_cast<CSSPrimitiveValue*>(value)));
+    }
+protected:
+    const Color& (RenderStyle::*m_getter)() const;
+    const Color& (RenderStyle::*m_defaultValue)() const;
+    void (RenderStyle::*m_setter)(const Color&);
+};
+
+class ApplyPropertyColor : public ApplyPropertyColorBase {
+public:
+    ApplyPropertyColor(const Color& (RenderStyle::*getter)() const, void (RenderStyle::*setter)(const Color&), Color (*initialValue)())
+        : ApplyPropertyColorBase(getter, 0, setter)
+        , m_initialValue(initialValue)
+    {
+    }
+
+    virtual void initial(CSSStyleSelector* selector) const
+    {
+        (selector->style()->*m_setter)(m_initialValue());
+    }
+
+    virtual void value(CSSStyleSelector* selector, CSSValue* value) const
+    {
+        if (!value->isPrimitiveValue())
+            return;
+
+        if ((static_cast<CSSPrimitiveValue*>(value))->getIdent() == CSSValueCurrentcolor)
+            inherit(selector);
+        else
+            ApplyPropertyColorBase::value(selector, value);
+    }
+protected:
+    Color (*m_initialValue)();
+};
+
+const CSSStyleApplyProperty& CSSStyleApplyProperty::sharedCSSStyleApplyProperty()
+{
+    DEFINE_STATIC_LOCAL(CSSStyleApplyProperty, cssStyleApplyPropertyInstance, ());
+    return cssStyleApplyPropertyInstance;
+}
+
+
+CSSStyleApplyProperty::CSSStyleApplyProperty()
+{
+    for (int i = 0; i < numCSSProperties; ++i)
+       m_propertyMap[i] = 0;
+
+    setPropertyValue(CSSPropertyColor, new ApplyPropertyColor(&RenderStyle::color, &RenderStyle::setColor, RenderStyle::initialColor));
+    setPropertyValue(CSSPropertyBackgroundColor, new ApplyPropertyColorBase(&RenderStyle::backgroundColor, 0, &RenderStyle::setBackgroundColor));
+    setPropertyValue(CSSPropertyBorderBottomColor, new ApplyPropertyColorBase(&RenderStyle::borderBottomColor, &RenderStyle::color, &RenderStyle::setBorderBottomColor));
+    setPropertyValue(CSSPropertyBorderLeftColor, new ApplyPropertyColorBase(&RenderStyle::borderLeftColor, &RenderStyle::color, &RenderStyle::setBorderLeftColor));
+    setPropertyValue(CSSPropertyBorderRightColor, new ApplyPropertyColorBase(&RenderStyle::borderRightColor, &RenderStyle::color, &RenderStyle::setBorderRightColor));
+    setPropertyValue(CSSPropertyBorderTopColor, new ApplyPropertyColorBase(&RenderStyle::borderTopColor, &RenderStyle::color, &RenderStyle::setBorderTopColor));
+    setPropertyValue(CSSPropertyOutlineColor, new ApplyPropertyColorBase(&RenderStyle::outlineColor, &RenderStyle::color, &RenderStyle::setOutlineColor));
+    setPropertyValue(CSSPropertyWebkitColumnRuleColor, new ApplyPropertyColorBase(&RenderStyle::columnRuleColor, &RenderStyle::color, &RenderStyle::setColumnRuleColor));
+    setPropertyValue(CSSPropertyWebkitTextEmphasisColor, new ApplyPropertyColorBase(&RenderStyle::textEmphasisColor, &RenderStyle::color, &RenderStyle::setTextEmphasisColor));
+    setPropertyValue(CSSPropertyWebkitTextFillColor, new ApplyPropertyColorBase(&RenderStyle::textFillColor, &RenderStyle::color, &RenderStyle::setTextFillColor));
+    setPropertyValue(CSSPropertyWebkitTextStrokeColor, new ApplyPropertyColorBase(&RenderStyle::textStrokeColor, &RenderStyle::color, &RenderStyle::setTextStrokeColor));
+}
+
+
+}
diff --git a/Source/WebCore/css/CSSStyleApplyProperty.h b/Source/WebCore/css/CSSStyleApplyProperty.h
new file mode 100644
index 0000000..48e08da
--- /dev/null
+++ b/Source/WebCore/css/CSSStyleApplyProperty.h
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CSSStyleApplyProperty_h
+#define CSSStyleApplyProperty_h
+
+#include "CSSPropertyNames.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class CSSStyleSelector;
+class CSSValue;
+class ApplyPropertyBase {
+    WTF_MAKE_NONCOPYABLE(ApplyPropertyBase);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    ApplyPropertyBase() { }
+    virtual ~ApplyPropertyBase() { }
+    virtual void inherit(CSSStyleSelector*) const = 0;
+    virtual void initial(CSSStyleSelector*) const = 0;
+    virtual void value(CSSStyleSelector*, CSSValue*) const = 0;
+};
+
+class CSSStyleApplyProperty : public RefCounted<CSSStyleApplyProperty> {
+public:
+    static const CSSStyleApplyProperty& sharedCSSStyleApplyProperty();
+
+    void inherit(CSSPropertyID property, CSSStyleSelector* selector) const
+    {
+        ASSERT(implements(property));
+        propertyValue(property)->inherit(selector);
+    }
+
+    void initial(CSSPropertyID property, CSSStyleSelector* selector) const
+    {
+        ASSERT(implements(property));
+        propertyValue(property)->initial(selector);
+    }
+
+    void value(CSSPropertyID property, CSSStyleSelector* selector, CSSValue* value) const
+    {
+        ASSERT(implements(property));
+        propertyValue(property)->value(selector, value);
+    }
+
+    bool implements(CSSPropertyID property) const
+    {
+        return propertyValue(property);
+    }
+
+private:
+    CSSStyleApplyProperty();
+    static int index(CSSPropertyID property)
+    {
+        return property - firstCSSProperty;
+    }
+
+    static bool valid(CSSPropertyID property)
+    {
+        int i = index(property);
+        return i >= 0 && i < numCSSProperties;
+    }
+
+    void setPropertyValue(CSSPropertyID property, ApplyPropertyBase* value)
+    {
+        ASSERT(valid(property));
+        m_propertyMap[index(property)] = value;
+    }
+
+    ApplyPropertyBase* propertyValue(CSSPropertyID property) const
+    {
+        ASSERT(valid(property));
+        return m_propertyMap[index(property)];
+    }
+
+    ApplyPropertyBase* m_propertyMap[numCSSProperties];
+};
+
+}
+
+#endif // CSSStyleApplyProperty_h
diff --git a/Source/WebCore/css/CSSStyleSelector.cpp b/Source/WebCore/css/CSSStyleSelector.cpp
index bcf7756..d41e41b 100644
--- a/Source/WebCore/css/CSSStyleSelector.cpp
+++ b/Source/WebCore/css/CSSStyleSelector.cpp
@@ -35,6 +35,7 @@
 #include "CSSCursorImageValue.h"
 #include "CSSFontFaceRule.h"
 #include "CSSImportRule.h"
+#include "CSSLineBoxContainValue.h"
 #include "CSSMediaRule.h"
 #include "CSSPageRule.h"
 #include "CSSParser.h"
@@ -44,6 +45,7 @@
 #include "CSSRuleList.h"
 #include "CSSSelector.h"
 #include "CSSSelectorList.h"
+#include "CSSStyleApplyProperty.h"
 #include "CSSStyleRule.h"
 #include "CSSStyleSheet.h"
 #include "CSSTimingFunctionValue.h"
@@ -435,9 +437,6 @@ static RuleSet* siblingRulesInDefaultStyle;
 RenderStyle* CSSStyleSelector::s_styleNotYetAvailable;
 
 static void loadFullDefaultStyle();
-#if ENABLE(FULLSCREEN_API)
-static void loadFullScreenRulesIfNeeded(Document*);
-#endif
 static void loadSimpleDefaultStyle();
 // FIXME: It would be nice to use some mechanism that guarantees this is in sync with the real UA stylesheet.
 static const char* simpleUserAgentStyleSheet = "html,body,div{display:block}body{margin:8px}div:focus,span:focus{outline:auto 5px -webkit-focus-ring-color}a:-webkit-any-link{color:-webkit-link;text-decoration:underline}a:-webkit-any-link:active{color:-webkit-activelink}";
@@ -507,6 +506,7 @@ CSSStyleSelector::CSSStyleSelector(Document* document, StyleSheetList* styleShee
     , m_styledElement(0)
     , m_elementLinkState(NotInsideLink)
     , m_fontSelector(CSSFontSelector::create(document))
+    , m_applyProperty(CSSStyleApplyProperty::sharedCSSStyleApplyProperty())
 {
     m_matchAuthorAndUserStyles = matchAuthorAndUserStyles;
     
@@ -517,9 +517,6 @@ CSSStyleSelector::CSSStyleSelector(Document* document, StyleSheetList* styleShee
             loadSimpleDefaultStyle();
         else {
             loadFullDefaultStyle();
-#if ENABLE(FULLSCREEN_API)
-            loadFullScreenRulesIfNeeded(document);
-#endif
         }
     }
 
@@ -654,19 +651,6 @@ static void loadFullDefaultStyle()
     defaultQuirksStyle->addRulesFromSheet(quirksSheet, screenEval());
 }
 
-#if ENABLE(FULLSCREEN_API)
-static void loadFullScreenRulesIfNeeded(Document* document)
-{
-    if (!document->webkitIsFullScreen())
-        return;
-    // Full-screen rules.
-    String fullscreenRules = String(fullscreenUserAgentStyleSheet, sizeof(fullscreenUserAgentStyleSheet)) + RenderTheme::defaultTheme()->extraDefaultStyleSheet();
-    CSSStyleSheet* fullscreenSheet = parseUASheet(fullscreenRules);
-    defaultStyle->addRulesFromSheet(fullscreenSheet, screenEval());
-    defaultQuirksStyle->addRulesFromSheet(fullscreenSheet, screenEval());
-}
-#endif
-
 static void loadSimpleDefaultStyle()
 {
     ASSERT(!defaultStyle);
@@ -1131,8 +1115,8 @@ bool CSSStyleSelector::canShareStyleWithElement(Node* node) const
         return false;
 
     if (isControl) {
-        InputElement* thisInputElement = toInputElement(element);
-        InputElement* otherInputElement = toInputElement(m_element);
+        InputElement* thisInputElement = element->toInputElement();
+        InputElement* otherInputElement = m_element->toInputElement();
 
         if (!thisInputElement || !otherInputElement)
             return false;
@@ -1386,9 +1370,6 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
     
     if (simpleDefaultStyleSheet && !elementCanUseSimpleDefaultStyle(e)) {
         loadFullDefaultStyle();
-#if ENABLE(FULLSCREEN_API)
-        loadFullScreenRulesIfNeeded(e->document());
-#endif
         assertNoSiblingRulesInDefaultStyle();
     }
 
@@ -1441,6 +1422,17 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
     }
 #endif
 
+#if ENABLE(FULLSCREEN_API)
+    static bool loadedFullScreenStyleSheet;
+    if (!loadedFullScreenStyleSheet && e->document()->webkitIsFullScreen()) {
+        loadedFullScreenStyleSheet = true;
+        String fullscreenRules = String(fullscreenUserAgentStyleSheet, sizeof(fullscreenUserAgentStyleSheet)) + RenderTheme::defaultTheme()->extraFullScreenStyleSheet();
+        CSSStyleSheet* fullscreenSheet = parseUASheet(fullscreenRules);
+        defaultStyle->addRulesFromSheet(fullscreenSheet, screenEval());
+        defaultQuirksStyle->addRulesFromSheet(fullscreenSheet, screenEval());
+    }
+#endif
+
     int firstUARule = -1, lastUARule = -1;
     int firstUserRule = -1, lastUserRule = -1;
     int firstAuthorRule = -1, lastAuthorRule = -1;
@@ -1932,8 +1924,8 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, RenderStyle* parent
         // After performing the display mutation, check table rows.  We do not honor position:relative on
         // table rows or cells.  This has been established in CSS2.1 (and caused a crash in containingBlock()
         // on some sites).
-        if ((style->display() == TABLE_HEADER_GROUP || style->display() == TABLE_ROW_GROUP ||
-             style->display() == TABLE_FOOTER_GROUP || style->display() == TABLE_ROW || style->display() == TABLE_CELL) &&
+        if ((style->display() == TABLE_HEADER_GROUP || style->display() == TABLE_ROW_GROUP
+             || style->display() == TABLE_FOOTER_GROUP || style->display() == TABLE_ROW) &&
              style->position() == RelativePosition)
             style->setPosition(StaticPosition);
 
@@ -1976,9 +1968,9 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, RenderStyle* parent
     }
 
     // Finally update our text decorations in effect, but don't allow text-decoration to percolate through
-    // tables, inline blocks, inline tables, or run-ins.
+    // tables, inline blocks, inline tables, run-ins, or shadow DOM.
     if (style->display() == TABLE || style->display() == INLINE_TABLE || style->display() == RUN_IN
-        || style->display() == INLINE_BLOCK || style->display() == INLINE_BOX)
+        || style->display() == INLINE_BLOCK || style->display() == INLINE_BOX || (e && e->isShadowRoot()))
         style->setTextDecorationsInEffect(style->textDecoration());
     else
         style->addToTextDecorationsInEffect(style->textDecoration());
@@ -2267,7 +2259,7 @@ CSSStyleSelector::SelectorMatch CSSStyleSelector::SelectorChecker::checkSelector
 #endif
 
     // first selector has to match
-    if (!checkOneSelector(sel, e, selectorAttrs, dynamicPseudo, isSubSelector, elementStyle, elementParentStyle))
+    if (!checkOneSelector(sel, e, selectorAttrs, dynamicPseudo, isSubSelector, encounteredLink, elementStyle, elementParentStyle))
         return SelectorFailsLocally;
 
     // The rest of the selectors has to match
@@ -2437,7 +2429,7 @@ static bool htmlAttributeHasCaseInsensitiveValue(const QualifiedName& attr)
     return isPossibleHTMLAttr && htmlCaseInsensitiveAttributesSet->contains(attr.localName().impl());
 }
 
-bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Element* e, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isSubSelector, RenderStyle* elementStyle, RenderStyle* elementParentStyle) const
+bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Element* e, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isSubSelector, bool encounteredLink, RenderStyle* elementStyle, RenderStyle* elementParentStyle) const
 {
     ASSERT(e);
     if (!e)
@@ -2526,14 +2518,14 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
     if (sel->m_match == CSSSelector::PseudoClass) {
         // Handle :not up front.
         if (sel->pseudoType() == CSSSelector::PseudoNot) {
-            // check the simple selector
-            for (CSSSelector* subSel = sel->simpleSelector(); subSel; subSel = subSel->tagHistory()) {
+            ASSERT(sel->selectorList());
+            for (CSSSelector* subSel = sel->selectorList()->first(); subSel; subSel = subSel->tagHistory()) {
                 // :not cannot nest. I don't really know why this is a
                 // restriction in CSS3, but it is, so let's honor it.
                 // the parser enforces that this never occurs
-                ASSERT(!subSel->simpleSelector());
+                ASSERT(subSel->pseudoType() != CSSSelector::PseudoNot);
 
-                if (!checkOneSelector(subSel, e, selectorAttrs, dynamicPseudo, true, elementStyle, elementParentStyle))
+                if (!checkOneSelector(subSel, e, selectorAttrs, dynamicPseudo, true, encounteredLink, elementStyle, elementParentStyle))
                     return true;
             }
         } else if (dynamicPseudo != NOPSEUDO && (RenderScrollbar::scrollbarForStyleResolve() || dynamicPseudo == SCROLLBAR_CORNER || dynamicPseudo == RESIZER)) {
@@ -2840,6 +2832,12 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 if (e == e->document()->cssTarget())
                     return true;
                 break;
+            case CSSSelector::PseudoAny:
+                for (CSSSelector* selector = sel->selectorList()->first(); selector; selector = CSSSelectorList::next(selector)) {
+                    if (checkSelector(selector, e, selectorAttrs, dynamicPseudo, true, encounteredLink, elementStyle, elementParentStyle) == SelectorMatches)
+                        return true;
+                }
+                break;
             case CSSSelector::PseudoAnyLink:
                 if (e && e->isLink())
                     return true;
@@ -2847,7 +2845,7 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoAutofill: {
                 if (!e || !e->isFormControlElement())
                     break;
-                if (InputElement* inputElement = toInputElement(e))
+                if (InputElement* inputElement = e->toInputElement())
                     return inputElement->isAutofilled();
                 break;
             }
@@ -2940,7 +2938,7 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 // Even though WinIE allows checked and indeterminate to co-exist, the CSS selector spec says that
                 // you can't be both checked and indeterminate.  We will behave like WinIE behind the scenes and just
                 // obey the CSS spec here in the test for matching the pseudo.
-                InputElement* inputElement = toInputElement(e);
+                InputElement* inputElement = e->toInputElement();
                 if (inputElement && inputElement->isChecked() && !inputElement->isIndeterminate())
                     return true;
                 break;
@@ -2948,7 +2946,7 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoIndeterminate: {
                 if (!e || !e->isFormControlElement())
                     break;
-                InputElement* inputElement = toInputElement(e);
+                InputElement* inputElement = e->toInputElement();
                 if (inputElement && inputElement->isIndeterminate())
                     return true;
                 break;
@@ -3313,9 +3311,14 @@ static void collectFeaturesFromList(CSSStyleSelector::Features& features, const
         bool foundSiblingSelector = false;
         for (CSSSelector* selector = ruleData.selector(); selector; selector = selector->tagHistory()) {
             collectFeaturesFromSelector(features, selector);
-            if (CSSSelector* simpleSelector = selector->simpleSelector())
-                collectFeaturesFromSelector(features, simpleSelector);
-            if (selector->isSiblingSelector())
+
+            if (CSSSelectorList* selectorList = selector->selectorList()) {
+                for (CSSSelector* subSelector = selectorList->first(); subSelector; subSelector = CSSSelectorList::next(subSelector)) {
+                    if (selector->isSiblingSelector())
+                        foundSiblingSelector = true;
+                    collectFeaturesFromSelector(features, subSelector);
+                }
+            } else if (selector->isSiblingSelector())
                 foundSiblingSelector = true;
         }
         if (foundSiblingSelector) {
@@ -3363,7 +3366,7 @@ void RuleSet::shrinkToFit()
 // -------------------------------------------------------------------------------------
 // this is mostly boring stuff on how to apply a certain rule to the renderstyle...
 
-static Length convertToLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, double multiplier = 1, bool *ok = 0)
+static Length convertToLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, bool toFloat, double multiplier = 1, bool *ok = 0)
 {
     // This function is tolerant of a null style value. The only place style is used is in
     // length measurements, like 'ems' and 'px'. And in those cases style is only used
@@ -3378,8 +3381,12 @@ static Length convertToLength(CSSPrimitiveValue* primitiveValue, RenderStyle* st
         if (!style && (type == CSSPrimitiveValue::CSS_EMS || type == CSSPrimitiveValue::CSS_EXS || type == CSSPrimitiveValue::CSS_REMS)) {
             if (ok)
                 *ok = false;
-        } else if (CSSPrimitiveValue::isUnitTypeLength(type))
-            l = Length(primitiveValue->computeLengthIntForLength(style, rootStyle, multiplier), Fixed);
+        } else if (CSSPrimitiveValue::isUnitTypeLength(type)) {
+            if (toFloat)
+                l = Length(primitiveValue->computeLengthDouble(style, rootStyle, multiplier), Fixed);
+            else
+                l = Length(primitiveValue->computeLengthIntForLength(style, rootStyle, multiplier), Fixed);
+        }
         else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
             l = Length(primitiveValue->getDoubleValue(), Percent);
         else if (type == CSSPrimitiveValue::CSS_NUMBER)
@@ -3389,6 +3396,16 @@ static Length convertToLength(CSSPrimitiveValue* primitiveValue, RenderStyle* st
     }
     return l;
 }
+    
+static Length convertToIntLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, double multiplier = 1, bool *ok = 0)
+{
+    return convertToLength(primitiveValue, style, rootStyle, false, multiplier, ok);
+}
+
+static Length convertToFloatLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, double multiplier = 1, bool *ok = 0)
+{
+    return convertToLength(primitiveValue, style, rootStyle, true, multiplier, ok);
+}
 
 template <bool applyFirst>
 void CSSStyleSelector::applyDeclarations(bool isImportant, int startIndex, int endIndex)
@@ -3406,7 +3423,7 @@ void CSSStyleSelector::applyDeclarations(bool isImportant, int startIndex, int e
 
                 if (applyFirst) {
                     COMPILE_ASSERT(firstCSSProperty == CSSPropertyColor, CSS_color_is_first_property);
-                    COMPILE_ASSERT(CSSPropertyZoom == CSSPropertyColor + 13, CSS_zoom_is_end_of_first_prop_range);
+                    COMPILE_ASSERT(CSSPropertyZoom == CSSPropertyColor + 14, CSS_zoom_is_end_of_first_prop_range);
                     COMPILE_ASSERT(CSSPropertyLineHeight == CSSPropertyZoom + 1, CSS_line_height_is_after_zoom);
 
                     // give special priority to font-xxx, color properties, etc
@@ -3612,10 +3629,22 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
     
+    CSSPropertyID property = static_cast<CSSPropertyID>(id);
+
+    // check lookup table for implementations and use when available
+    if (m_applyProperty.implements(property)) {
+      if (isInherit)
+          m_applyProperty.inherit(property, this);
+      else if (isInitial)
+          m_applyProperty.initial(property, this);
+      else
+          m_applyProperty.value(property, this, value);
+      return;
+    }
+
     // What follows is a list that maps the CSS properties into their corresponding front-end
     // RenderStyle values.  Shorthands (e.g. border, background) occur in this list as well and
     // are only hit when mapping "inherit" or "initial" into front-end values.
-    CSSPropertyID property = static_cast<CSSPropertyID>(id);
     switch (property) {
 // ident only properties
     case CSSPropertyBackgroundAttachment:
@@ -4020,87 +4049,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 m_style->setCursor(*primitiveValue);
         }
         return;
-// colors || inherit
-    case CSSPropertyColor:
-        // If the 'currentColor' keyword is set on the 'color' property itself,
-        // it is treated as 'color:inherit' at parse time
-        if (primitiveValue && primitiveValue->getIdent() == CSSValueCurrentcolor)
-            isInherit = true;
-    case CSSPropertyBackgroundColor:
-    case CSSPropertyBorderTopColor:
-    case CSSPropertyBorderRightColor:
-    case CSSPropertyBorderBottomColor:
-    case CSSPropertyBorderLeftColor:
-    case CSSPropertyOutlineColor:
-    case CSSPropertyWebkitColumnRuleColor:
-    case CSSPropertyWebkitTextStrokeColor:
-    case CSSPropertyWebkitTextEmphasisColor:
-    case CSSPropertyWebkitTextFillColor: {
-        Color col;
-        if (isInherit) {
-            HANDLE_INHERIT_COND(CSSPropertyBackgroundColor, backgroundColor, BackgroundColor)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyBorderTopColor, borderTopColor, color, BorderTopColor)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyBorderBottomColor, borderBottomColor, color, BorderBottomColor)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyBorderRightColor, borderRightColor, color, BorderRightColor)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyBorderLeftColor, borderLeftColor, color, BorderLeftColor)
-            HANDLE_INHERIT_COND(CSSPropertyColor, color, Color)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyOutlineColor, outlineColor, color, OutlineColor)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyWebkitColumnRuleColor, columnRuleColor, color, ColumnRuleColor)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyWebkitTextStrokeColor, textStrokeColor, color, TextStrokeColor)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyWebkitTextEmphasisColor, textEmphasisColor, color, TextEmphasisColor)
-            HANDLE_INHERIT_COND_WITH_BACKUP(CSSPropertyWebkitTextFillColor, textFillColor, color, TextFillColor)
-            return;
-        }
-        if (isInitial) {
-            // The border/outline colors will just map to the invalid color |col| above.  This will have the
-            // effect of forcing the use of the currentColor when it comes time to draw the borders (and of
-            // not painting the background since the color won't be valid).
-            if (id == CSSPropertyColor)
-                col = RenderStyle::initialColor();
-        } else {
-            if (!primitiveValue)
-                return;
-            col = getColorFromPrimitiveValue(primitiveValue);
-        }
-
-        switch (id) {
-        case CSSPropertyBackgroundColor:
-            m_style->setBackgroundColor(col);
-            break;
-        case CSSPropertyBorderTopColor:
-            m_style->setBorderTopColor(col);
-            break;
-        case CSSPropertyBorderRightColor:
-            m_style->setBorderRightColor(col);
-            break;
-        case CSSPropertyBorderBottomColor:
-            m_style->setBorderBottomColor(col);
-            break;
-        case CSSPropertyBorderLeftColor:
-            m_style->setBorderLeftColor(col);
-            break;
-        case CSSPropertyColor:
-            m_style->setColor(col);
-            break;
-        case CSSPropertyOutlineColor:
-            m_style->setOutlineColor(col);
-            break;
-        case CSSPropertyWebkitColumnRuleColor:
-            m_style->setColumnRuleColor(col);
-            break;
-        case CSSPropertyWebkitTextStrokeColor:
-            m_style->setTextStrokeColor(col);
-            break;
-        case CSSPropertyWebkitTextEmphasisColor:
-            m_style->setTextEmphasisColor(col);
-            break;
-        case CSSPropertyWebkitTextFillColor:
-            m_style->setTextFillColor(col);
-            break;
-        }
-        
-        return;
-    }
     
 // uri || inherit
     case CSSPropertyBackgroundImage:
@@ -4672,13 +4620,16 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         HANDLE_INHERIT_AND_INITIAL(textAlign, TextAlign)
         if (!primitiveValue)
             return;
-        int id = primitiveValue->getIdent();
-        if (id == CSSValueStart)
-            m_style->setTextAlign(m_style->isLeftToRightDirection() ? LEFT : RIGHT);
-        else if (id == CSSValueEnd)
-            m_style->setTextAlign(m_style->isLeftToRightDirection() ? RIGHT : LEFT);
-        else
-            m_style->setTextAlign(*primitiveValue);
+        if (primitiveValue->getIdent() == CSSValueWebkitMatchParent) {
+            if (m_parentStyle->textAlign() == TASTART)
+                m_style->setTextAlign(m_parentStyle->isLeftToRightDirection() ? LEFT : RIGHT);
+            else if (m_parentStyle->textAlign() == TAEND)
+                m_style->setTextAlign(m_parentStyle->isLeftToRightDirection() ? RIGHT : LEFT);
+            else
+                m_style->setTextAlign(m_parentStyle->textAlign());
+            return;
+        }
+        m_style->setTextAlign(*primitiveValue);
         return;
     }
 
@@ -4709,10 +4660,10 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             Rect* rect = primitiveValue->getRectValue();
             if (!rect)
                 return;
-            top = convertToLength(rect->top(), style(), m_rootElementStyle, zoomFactor);
-            right = convertToLength(rect->right(), style(), m_rootElementStyle, zoomFactor);
-            bottom = convertToLength(rect->bottom(), style(), m_rootElementStyle, zoomFactor);
-            left = convertToLength(rect->left(), style(), m_rootElementStyle, zoomFactor);
+            top = convertToIntLength(rect->top(), style(), m_rootElementStyle, zoomFactor);
+            right = convertToIntLength(rect->right(), style(), m_rootElementStyle, zoomFactor);
+            bottom = convertToIntLength(rect->bottom(), style(), m_rootElementStyle, zoomFactor);
+            left = convertToIntLength(rect->left(), style(), m_rootElementStyle, zoomFactor);
         } else if (primitiveValue->getIdent() != CSSValueAuto) {
             return;
         }
@@ -5318,8 +5269,8 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             radiusHeight = Length(pair->second()->getDoubleValue(), Percent);
         else
             radiusHeight = Length(max(intMinForLength, min(intMaxForLength, pair->second()->computeLengthInt(style(), m_rootElementStyle, zoomFactor))), Fixed);
-        int width = radiusWidth.rawValue();
-        int height = radiusHeight.rawValue();
+        int width = radiusWidth.value();
+        int height = radiusHeight.value();
         if (width < 0 || height < 0)
             return;
         if (width == 0)
@@ -5655,9 +5606,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         }
         else {
             bool ok = true;
-            Length l = convertToLength(primitiveValue, style(), m_rootElementStyle, 1, &ok);
+            Length marqueeLength = convertToIntLength(primitiveValue, style(), m_rootElementStyle, 1, &ok);
             if (ok)
-                m_style->setMarqueeIncrement(l);
+                m_style->setMarqueeIncrement(marqueeLength);
         }
         return;
     }
@@ -5819,10 +5770,10 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             
         DashboardRegion *first = region;
         while (region) {
-            Length top = convertToLength(region->top(), style(), m_rootElementStyle);
-            Length right = convertToLength(region->right(), style(), m_rootElementStyle);
-            Length bottom = convertToLength(region->bottom(), style(), m_rootElementStyle);
-            Length left = convertToLength(region->left(), style(), m_rootElementStyle);
+            Length top = convertToIntLength(region->top(), style(), m_rootElementStyle);
+            Length right = convertToIntLength(region->right(), style(), m_rootElementStyle);
+            Length bottom = convertToIntLength(region->bottom(), style(), m_rootElementStyle);
+            Length left = convertToIntLength(region->left(), style(), m_rootElementStyle);
             if (region->m_isCircle)
                 m_style->setDashboardRegion(StyleDashboardRegion::Circle, region->m_label, top, right, bottom, left, region == first ? false : true);
             else if (region->m_isRectangle)
@@ -6153,8 +6104,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 
     case CSSPropertyWebkitTextCombine:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(textCombine, TextCombine)
-        if (m_style->hasTextCombine())
-            m_style->setUnique(); // The style could be modified in RenderCombineText depending on text metrics.
         return;
 
     case CSSPropertyWebkitTextEmphasisPosition:
@@ -6174,8 +6123,11 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             if (list->length() != 2)
                 return;
             for (unsigned i = 0; i < 2; ++i) {
-                ASSERT(list->itemWithoutBoundsCheck(i)->isPrimitiveValue());
-                CSSPrimitiveValue* value = static_cast<CSSPrimitiveValue*>(list->itemWithoutBoundsCheck(i));
+                CSSValue* item = list->itemWithoutBoundsCheck(i);
+                if (!item->isPrimitiveValue())
+                    continue;
+
+                CSSPrimitiveValue* value = static_cast<CSSPrimitiveValue*>(item);
                 if (value->getIdent() == CSSValueFilled || value->getIdent() == CSSValueOpen)
                     m_style->setTextEmphasisFill(*value);
                 else
@@ -6207,6 +6159,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 
         return;
 
+<<<<<<< HEAD
 #ifdef ANDROID_CSS_RING
     case CSSPropertyWebkitRing:
         if (valueType != CSSValue::CSS_INHERIT || !m_parentNode) return;
@@ -6350,11 +6303,64 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
 #endif
+=======
+    case CSSPropertyWebkitTextOrientation: {
+        if (!isInherit && !isInitial && !primitiveValue)
+            return;
+        
+        TextOrientation result;
+        if (isInherit)
+            result = m_parentStyle->fontDescription().textOrientation();
+        else if (isInitial)
+            result = RenderStyle::initialTextOrientation();
+        else
+            result = *primitiveValue;
+        
+        FontDescription fontDescription = m_style->fontDescription();
+        if (fontDescription.textOrientation() != result) {
+            fontDescription.setTextOrientation(result);
+            if (m_style->setFontDescription(fontDescription))
+                m_fontDirty = true;
+        }
+        return;
+    }
+
+    case CSSPropertyWebkitLineBoxContain: {
+        HANDLE_INHERIT_AND_INITIAL(lineBoxContain, LineBoxContain)
+        if (primitiveValue && primitiveValue->getIdent() == CSSValueNone) {
+            m_style->setLineBoxContain(LineBoxContainNone);
+            return;
+        }
+        
+        if (!value->isCSSLineBoxContainValue())
+            return;
+        
+        CSSLineBoxContainValue* lineBoxContainValue = static_cast<CSSLineBoxContainValue*>(value);
+        m_style->setLineBoxContain(lineBoxContainValue->value());
+        return;
+    }
+
+    // These properties are implemented in the CSSStyleApplyProperty lookup table.
+    case CSSPropertyColor:
+    case CSSPropertyBackgroundColor:
+    case CSSPropertyBorderBottomColor:
+    case CSSPropertyBorderLeftColor:
+    case CSSPropertyBorderRightColor:
+    case CSSPropertyBorderTopColor:
+    case CSSPropertyOutlineColor:
+    case CSSPropertyWebkitColumnRuleColor:
+    case CSSPropertyWebkitTextEmphasisColor:
+    case CSSPropertyWebkitTextFillColor:
+    case CSSPropertyWebkitTextStrokeColor:
+        ASSERT_NOT_REACHED();
+        return;
+>>>>>>> webkit.org at r82507
 
 #if ENABLE(SVG)
     default:
         // Try the SVG properties
         applySVGProperty(id, value);
+        return;
 #endif
     }
 }
@@ -7424,13 +7430,13 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                 Length tx = Length(0, Fixed);
                 Length ty = Length(0, Fixed);
                 if (transformValue->operationType() == WebKitCSSTransformValue::TranslateYTransformOperation)
-                    ty = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    ty = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
                 else { 
-                    tx = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    tx = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
                     if (transformValue->operationType() != WebKitCSSTransformValue::TranslateXTransformOperation) {
                         if (transformValue->length() > 1) {
                             CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(1));
-                            ty = convertToLength(secondValue, style, rootStyle, zoomFactor, &ok);
+                            ty = convertToFloatLength(secondValue, style, rootStyle, zoomFactor, &ok);
                         }
                     }
                 }
@@ -7448,19 +7454,19 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                 Length ty = Length(0, Fixed);
                 Length tz = Length(0, Fixed);
                 if (transformValue->operationType() == WebKitCSSTransformValue::TranslateZTransformOperation)
-                    tz = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    tz = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
                 else if (transformValue->operationType() == WebKitCSSTransformValue::TranslateYTransformOperation)
-                    ty = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    ty = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
                 else { 
-                    tx = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    tx = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
                     if (transformValue->operationType() != WebKitCSSTransformValue::TranslateXTransformOperation) {
                         if (transformValue->length() > 2) {
                             CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(2));
-                            tz = convertToLength(thirdValue, style, rootStyle, zoomFactor, &ok);
+                            tz = convertToFloatLength(thirdValue, style, rootStyle, zoomFactor, &ok);
                         }
                         if (transformValue->length() > 1) {
                             CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(1));
-                            ty = convertToLength(secondValue, style, rootStyle, zoomFactor, &ok);
+                            ty = convertToFloatLength(secondValue, style, rootStyle, zoomFactor, &ok);
                         }
                     }
                 }
@@ -7591,7 +7597,7 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                 bool ok = true;
                 Length p = Length(0, Fixed);
                 if (CSSPrimitiveValue::isUnitTypeLength(firstValue->primitiveType()))
-                    p = convertToLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    p = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
                 else {
                     // This is a quirk that should go away when 3d transforms are finalized.
                     double val = firstValue->getDoubleValue();
diff --git a/Source/WebCore/css/CSSStyleSelector.h b/Source/WebCore/css/CSSStyleSelector.h
index 9f83f82..756c5bf 100644
--- a/Source/WebCore/css/CSSStyleSelector.h
+++ b/Source/WebCore/css/CSSStyleSelector.h
@@ -45,6 +45,7 @@ class CSSFontFaceRule;
 class CSSImageValue;
 class CSSRuleList;
 class CSSSelector;
+class CSSStyleApplyProperty;
 class CSSStyleRule;
 class CSSStyleSheet;
 class CSSValue;
@@ -95,6 +96,7 @@ public:
         void pushParent(Element* parent);
         void popParent(Element* parent);
 
+
         PassRefPtr<RenderStyle> styleForElement(Element* e, RenderStyle* parentStyle = 0, bool allowSharing = true, bool resolveForRootDefault = false, bool matchVisitedPseudoClass = false);
         
         void keyframeStylesForAnimation(Element*, const RenderStyle*, KeyframeList& list);
@@ -111,6 +113,9 @@ public:
         PassRefPtr<RenderStyle> pseudoStyleForDataGridColumnHeader(DataGridColumn*, RenderStyle* parentStyle);
 #endif
 
+        RenderStyle* style() const { return m_style.get(); }
+        RenderStyle* parentStyle() const { return m_parentStyle; }
+
     private:
         void initForStyleResolve(Element*, RenderStyle* parentStyle = 0, PseudoId = NOPSEUDO);
         void initElement(Element*);
@@ -123,8 +128,6 @@ public:
         void pushParentStackFrame(Element* parent);
         void popParentStackFrame();
 
-        RenderStyle* style() const { return m_style.get(); }
-
         PassRefPtr<RenderStyle> styleForKeyframe(const RenderStyle*, const WebKitCSSKeyframeRule*, KeyframeValue&);
 
     public:
@@ -156,7 +159,6 @@ public:
     private:
         void setFontSize(FontDescription&, float size);
         static float getComputedSizeFromSpecifiedSize(Document*, RenderStyle*, bool isAbsoluteSize, float specifiedSize, bool useSVGZoomRules);
-
     public:
         Color getColorFromPrimitiveValue(CSSPrimitiveValue*) const;
 
@@ -256,7 +258,7 @@ public:
 
             bool checkSelector(CSSSelector*, Element*) const;
             SelectorMatch checkSelector(CSSSelector*, Element*, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isSubSelector, bool encounteredLink, RenderStyle* = 0, RenderStyle* elementParentStyle = 0) const;
-            bool checkOneSelector(CSSSelector*, Element*, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isSubSelector, RenderStyle*, RenderStyle* elementParentStyle) const;
+            bool checkOneSelector(CSSSelector*, Element*, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isSubSelector, bool encounteredLink, RenderStyle*, RenderStyle* elementParentStyle) const;
             bool checkScrollbarPseudoClass(CSSSelector*, PseudoId& dynamicPseudo) const;
             static bool fastCheckSelector(const CSSSelector*, const Element*);
 
@@ -355,6 +357,8 @@ public:
         HashSet<AtomicStringImpl*> m_selectorAttrs;
         Vector<CSSMutableStyleDeclaration*> m_additionalAttributeStyleDecls;
         Vector<MediaQueryResult*> m_viewportDependentMediaQueryResults;
+
+        const CSSStyleApplyProperty& m_applyProperty;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSValue.h b/Source/WebCore/css/CSSValue.h
index a101c66..de46ff9 100644
--- a/Source/WebCore/css/CSSValue.h
+++ b/Source/WebCore/css/CSSValue.h
@@ -65,7 +65,8 @@ public:
     virtual bool isTimingFunctionValue() const { return false; }
     virtual bool isValueList() const { return false; }
     virtual bool isWebKitCSSTransformValue() const { return false; }
-
+    virtual bool isCSSLineBoxContainValue() const { return false; }
+    
 #if ENABLE(SVG)
     virtual bool isSVGColor() const { return false; }
     virtual bool isSVGPaint() const { return false; }
diff --git a/Source/WebCore/css/CSSValueKeywords.in b/Source/WebCore/css/CSSValueKeywords.in
index 4fce4f3..6dac06f 100644
--- a/Source/WebCore/css/CSSValueKeywords.in
+++ b/Source/WebCore/css/CSSValueKeywords.in
@@ -4,7 +4,7 @@
 # --------
 #
 # The Values are sorted according to the properties they belong to,
-# and have to be in the same order as the enums in RenderStyle.h.
+# and have to be in the same order as the enums in RenderStyleConstants.h.
 #
 # If not, the optimizations in the cssparser and style selector will fail,
 # and produce incorrect results.
@@ -212,6 +212,7 @@ justify
 -webkit-left
 -webkit-right
 -webkit-center
+-webkit-match-parent
 #
 # CSS_PROP_LIST_STYLE_POSITION:
 #
@@ -406,6 +407,7 @@ hand
 hide
 higher
 invert
+-webkit-isolate
 landscape
 ledger
 legal
@@ -790,3 +792,15 @@ farthest-side
 farthest-corner
 # contain
 # cover
+
+# -webkit-text-orientation
+upright
+vertical-right
+
+# -webkit-line-box-contain
+font
+glyphs
+inline-box
+replaced
+
+
diff --git a/Source/WebCore/css/MediaQueryListListener.cpp b/Source/WebCore/css/MediaQueryListListener.cpp
index ab73b1d..7512161 100644
--- a/Source/WebCore/css/MediaQueryListListener.cpp
+++ b/Source/WebCore/css/MediaQueryListListener.cpp
@@ -37,6 +37,11 @@ void MediaQueryListListener::queryChanged(ScriptState* state, MediaQueryList* qu
 #if USE(JSC)
     callback.appendArgument(toJS(state, query));
 #else
+    v8::HandleScope handleScope;
+    v8::Handle<v8::Context> context = state->context();
+    if (context.IsEmpty())
+       return; // JS may not be enabled.
+    v8::Context::Scope scope(context);
     callback.appendArgument(toV8(query));
 #endif
     callback.call();
diff --git a/Source/WebCore/css/StyleSheetList.h b/Source/WebCore/css/StyleSheetList.h
index a486511..a019691 100644
--- a/Source/WebCore/css/StyleSheetList.h
+++ b/Source/WebCore/css/StyleSheetList.h
@@ -50,6 +50,11 @@ public:
     {
         m_sheets.swap(sheets);
     }
+
+    Document* document()
+    {
+        return m_doc;
+    }
     
 private:
     StyleSheetList(Document*);
diff --git a/Source/WebCore/css/fullscreenQuickTime.css b/Source/WebCore/css/fullscreenQuickTime.css
new file mode 100644
index 0000000..80cf9e4
--- /dev/null
+++ b/Source/WebCore/css/fullscreenQuickTime.css
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2011 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+/* alternate media controls - Extend fullscreen.css */
+
+video:-webkit-full-screen::-webkit-media-controls-panel {
+    -webkit-box-align: start;
+    -webkit-box-pack: end;    
+    -webkit-appearance: none;
+
+    bottom: 50px;
+    left: 50%;
+    margin-left: -220px;
+    padding: 12px 0 0 10px;
+    width: 430px;
+    height: 48px;
+    
+    background-image: -webkit-gradient(
+        linear,
+        left top,
+        left bottom,
+        color-stop(0, rgba(30, 30, 30, .97)),
+        color-stop(0.333, rgba(45, 45, 45, .97)),
+        color-stop(0.35,  rgba(25, 25, 25, .97)),
+        color-stop(0.366, rgba(25, 25, 25, .97)),
+        color-stop(0.366, rgba(12, 12, 12, .97)),
+        color-stop(1, rgba(19, 19, 19, .97))
+    );
+
+    -webkit-box-shadow: 
+        inset 0 -1px 1px rgba(0, 0, 0, 0.5),
+        inset 0  1px 0 0px   rgba(255, 255, 255, 0.15),
+        inset 0 -1px 0 0px   rgba(202, 202, 202, 0.09),
+        0  0   0 1px rgba(0, 0, 0, 0.5);
+    -webkit-border-radius: 8px;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-mute-button {
+    display: none;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-volume-slider-container {
+    display: none;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-volume-slider {
+    display: none;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-volume-slider-mute-button {
+    display: none;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-min-button {
+    -webkit-appearance: media-mute-button;
+    display: block;
+    position: absolute;
+    left: 11px;
+    top: 15px;
+    width: 14px;
+    height: 12px;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-slider {
+    -webkit-appearance: media-slider;
+    display: block;
+    position: absolute;
+    left: 28px;
+    top: 15px;
+    height: 12px;
+    width: 50px;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-max-button {
+    -webkit-appearance: media-mute-button;
+    display: block;
+    position: absolute;
+    left: 84px;
+    top: 15px;
+    width: 14px;
+    height: 12px;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-play-button {
+    position: absolute;
+    width: 22px;
+    height: 23px;
+    left: 209px;
+    top: 9px;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-rewind-button {
+    position: absolute;
+    left: 162px;
+    top: 13px;
+    width: 18px;
+    height: 18px;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-seek-back-button {
+    position: absolute;
+    display: -webkit-box;
+    width: 23px;
+    height: 16px;
+    left: 162px;
+    top: 13px;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-seek-forward-button {
+    position: absolute;
+    display: -webkit-box;
+    width: 23px;
+    height: 16px;
+    left: 262px;
+    top: 13px;
+}
+
+video:-webkit-full-screen::-webkit-media-controls-timeline-container {
+    height: auto;
+    width: 420px;
+    position: absolute;
+    bottom: 9px;
+    left: 8px;
+    right: 8px;
+}
+
+video:-webkit-full-screen::video::-webkit-media-controls-status-display {
+    width: 420px;
+    position: absolute;
+    bottom: 9px;
+    left: 8px;
+    right: 8px;
+}
diff --git a/Source/WebCore/css/html.css b/Source/WebCore/css/html.css
index 61178d0..bd3bde0 100644
--- a/Source/WebCore/css/html.css
+++ b/Source/WebCore/css/html.css
@@ -152,6 +152,36 @@ h1 {
     font-weight: bold
 }
 
+:-webkit-any(article,aside,nav,section) h1 {
+    font-size: 1.5em;
+    -webkit-margin-before: 0.83__qem;
+    -webkit-margin-after: 0.83em;
+}
+
+:-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1 {
+    font-size: 1.17em;
+    -webkit-margin-before: 1__qem;
+    -webkit-margin-after: 1em;
+}
+
+:-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1 {
+    font-size: 1.00em;
+    -webkit-margin-before: 1.33__qem;
+    -webkit-margin-after: 1.33em;
+}
+
+:-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1 {
+    font-size: .83em;
+    -webkit-margin-before: 1.67__qem;
+    -webkit-margin-after: 1.67em;
+}
+
+:-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1 {
+    font-size: .67em;
+    -webkit-margin-before: 2.33__qem;
+    -webkit-margin-after: 2.33em;
+}
+
 h2 {
     display: block;
     font-size: 1.5em;
@@ -476,6 +506,7 @@ input[type="file"] {
 input:-webkit-autofill {
     background-color: #FAFFBD !important;
     background-image:none !important;
+    color: #000000 !important;
 }
 
 input[type="radio"], input[type="checkbox"] {
@@ -587,55 +618,55 @@ output {
 /* form validation message bubble */
 
 ::-webkit-validation-bubble {
-    display: block;
+    display: inline-block;
     z-index: 2147483647;
     position: absolute;
-    opacity: 0.9;
+    opacity: 0.95;
     line-height: 0;
+    margin: 0;
     -webkit-text-security: none;
     -webkit-transition: opacity 05.5s ease;
 }
 
 ::-webkit-validation-bubble-message {
     display: block;
+    position: relative;
+    top: -4px;
     font: message-box;
+    color: black;
     min-width: 50px;
     max-width: 200px;
-    border: solid 2px black;
-    background: -webkit-gradient(linear, left top, left bottom, from(#fbf9f9), to(#f0e4e4));
+    border: solid 2px #400;
+    background: -webkit-gradient(linear, left top, left bottom, from(#f8ecec), to(#e8cccc));
     padding: 8px;
     -webkit-border-radius: 8px;
-    -webkit-box-shadow: 4px 4px 4px rgba(204,204,204,0.7);
+    -webkit-box-shadow: 4px 4px 4px rgba(100,100,100,0.6),
+        inset -2px -2px 1px #d0c4c4,
+        inset 2px 2px 1px white;
     line-height: normal;
+    z-index: 2147483644;
 }
 
-::-webkit-validation-bubble-top-outer-arrow {
+::-webkit-validation-bubble-arrow {
     display: inline-block;
     position: relative;
-    left: 14px;
-    height: 0;
-    width: 0;
+    left: 32px;
+    width: 16px;
+    height: 16px;
+    background-color: #f8ecec;
+    border-width: 2px 0 0 2px;
     border-style: solid;
-    border-width: 14px;
-    border-bottom-color: black;
-    border-right-color: transparent;
-    border-top-width: 0;
-    border-left-width: 0;
+    border-color: #400;
+    box-shadow: inset 2px 2px 1px white;
+    -webkit-transform-origin: 0 0;
+    -webkit-transform: rotate(45deg);
+    z-index: 2147483645;
 }
 
-::-webkit-validation-bubble-top-inner-arrow {
-    display: inline-block;
-    height: 0;
-    width: 0;
-    border-style: solid;
-    border-width: 10px; /* <border box width of outer-arrow> - <message border width> * 2 */
-    border-bottom-color: #fbf9f9;
-    border-right-color: transparent;
-    border-top-width: 0;
-    border-left-width: 0;
-    position: relative;
-    top: 2px; /* <message border width> */
-    left: 2px; /* <outer-arrow position> + <message border width> - <border box width of outer-arrow>  */
+::-webkit-validation-bubble-arrow-clipper {
+    display: block;
+    overflow: hidden;
+    height: 16px;
 }
 
 /* meter */
diff --git a/Source/WebCore/css/mediaControls.css b/Source/WebCore/css/mediaControls.css
index 88144b4..874cb13 100644
--- a/Source/WebCore/css/mediaControls.css
+++ b/Source/WebCore/css/mediaControls.css
@@ -171,3 +171,15 @@ audio::-webkit-media-controls-volume-slider-mute-button, video::-webkit-media-co
     border: initial;
     color: inherit;
 }
+
+audio::-webkit-media-controls-fullscreen-volume-slider, video::-webkit-media-controls-fullscreen-volume-slider {
+    display: none;
+}
+
+audio::-webkit-media-controls-fullscreen-volume-min-button, video::-webkit-media-controls-fullscreen-volume-min-button {
+    display: none;
+}
+
+audio::-webkit-media-controls-fullscreen-volume-max-button, video::-webkit-media-controls-fullscreen-volume-max-button {
+    display: none;
+}
diff --git a/Source/WebCore/css/mediaControlsEfl.css b/Source/WebCore/css/mediaControlsEfl.css
new file mode 100644
index 0000000..938d7e8
--- /dev/null
+++ b/Source/WebCore/css/mediaControlsEfl.css
@@ -0,0 +1,174 @@
+/*
+ * Copyright (C) 2009, 2010 Apple Inc.  All rights reserved.
+ * Copyright (C) 2011 Samsung Electronics
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+/* EFLWebKit media controls. Extends mediaControls.css */
+
+audio {
+    width: 200px;
+    height: 25px;
+}
+
+audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    display: -webkit-box;
+    -webkit-box-orient: horizontal;
+    -webkit-box-align: center;
+    -webkit-user-select: none;
+    position: absolute;
+    bottom: 0;
+    width: 100%;
+    z-index: 0;
+    overflow: hidden;
+    height: 25px;
+    text-align: right;
+}
+
+video:-webkit-full-page-media::-webkit-media-controls-panel {
+    bottom: -25px;
+}
+
+audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
+    -webkit-appearance: media-mute-button;
+    display: -webkit-box;
+    width: 25px;
+    height: 25px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
+
+audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
+    -webkit-appearance: media-play-button;
+    display: -webkit-box;
+    width: 25px;
+    height: 25px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
+
+audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    -webkit-appearance: media-controls-background;
+    display: -webkit-box;
+    -webkit-box-orient: horizontal;
+    -webkit-box-align: center;
+    -webkit-box-pack: end;
+    -webkit-box-flex: 1;
+    -webkit-user-select: none;
+    height: 25px;
+}
+
+audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
+    display: none;
+}
+
+audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
+    display: none;
+}
+
+audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
+    -webkit-appearance: media-slider;
+    display: -webkit-box;
+    -webkit-box-flex: 1;
+    height: 25px;
+    padding: 0px 2px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+    margin: initial;
+}
+
+audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
+    display: none;
+}
+
+audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
+    display: none;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+    margin: initial;
+}
+
+audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
+    -webkit-appearance: media-seek-back-button;
+    display: -webkit-box;
+    width: 25px;
+    height: 25px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
+
+audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
+    -webkit-appearance: media-seek-forward-button;
+    display: -webkit-box;
+    width: 25px;
+    height: 25px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
+
+audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
+    -webkit-appearance: media-fullscreen-button;
+    display: -webkit-box;
+    width: 25px;
+    height: 25px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
+
+audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button {
+    display: none;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
+
+audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button {
+    display: none;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
+
+audio::-webkit-media-controls-toggle-closed-captions-button, video::-webkit-media-controls-toggle-closed-captions-button {
+    -webkit-appearance: media-toggle-closed-captions-button;
+    display: -webkit-box;
+    width: 25px;
+    height: 25px;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
+
+audio::-webkit-media-controls-volume-slider-mute-button, video::-webkit-media-controls-volume-slider-mute-button {
+    -webkit-appearance: media-volume-slider-mute-button;
+    display: none;
+    background-color: initial;
+    border: initial;
+    color: inherit;
+}
diff --git a/Source/WebCore/css/themeChromiumLinux.css b/Source/WebCore/css/themeChromiumLinux.css
index cb7e900..a6a8828 100644
--- a/Source/WebCore/css/themeChromiumLinux.css
+++ b/Source/WebCore/css/themeChromiumLinux.css
@@ -34,6 +34,7 @@ select {
     background-color: #dddddd;
 }
 
+select:not([size]):not([multiple]) option,
 select[size="0"] option,
 select[size="1"] option {
     background-color: #f7f7f7;
diff --git a/Source/WebCore/css/tokenizer.flex b/Source/WebCore/css/tokenizer.flex
index eb18cb9..88a92a2 100644
--- a/Source/WebCore/css/tokenizer.flex
+++ b/Source/WebCore/css/tokenizer.flex
@@ -102,13 +102,18 @@ nth             [\+-]?{intnum}*n([\t\r\n ]*[\+-][\t\r\n ]*{intnum})?
 {num}Hz                 {yyTok = HERTZ; return yyTok;}
 {num}kHz                {yyTok = KHERTZ; return yyTok;}
 {num}{ident}            {yyTok = DIMEN; return yyTok;}
+{num}{ident}\+          {yyTok = INVALIDDIMEN; return yyTok;}
 {num}%+                 {yyTok = PERCENTAGE; return yyTok;}
 {intnum}                {yyTok = INTEGER; return yyTok;}
 {num}                   {yyTok = FLOATTOKEN; return yyTok;}
 
+"-webkit-any("          {yyTok = ANYFUNCTION; return yyTok;}
 "not("                  {yyTok = NOTFUNCTION; return yyTok;}
 "url("{w}{string}{w}")" {yyTok = URI; return yyTok;}
 "url("{w}{url}{w}")"    {yyTok = URI; return yyTok;}
+"-webkit-calc("         {yyTok = CALCFUNCTION; return yyTok;}
+"-webkit-min("          {yyTok = MINFUNCTION; return yyTok;}
+"-webkit-max("          {yyTok = MAXFUNCTION; return yyTok;}
 {ident}"("              {yyTok = FUNCTION; return yyTok;}
 
 U\+{range}              {yyTok = UNICODERANGE; return yyTok;}
diff --git a/Source/WebCore/css/wml.css b/Source/WebCore/css/wml.css
index 4bcf08f..38169fc 100644
--- a/Source/WebCore/css/wml.css
+++ b/Source/WebCore/css/wml.css
@@ -147,6 +147,7 @@ input[type="password"] {
 input:-webkit-autofill {
     background-color: #FAFFBD !important;
     background-image:none !important;
+    color: #000000 !important;
 }
 
 do:disabled, select:disabled, optgroup:disabled, option:disabled {
diff --git a/Source/WebCore/dom/CheckedRadioButtons.cpp b/Source/WebCore/dom/CheckedRadioButtons.cpp
index 3cf8848..20662a2 100644
--- a/Source/WebCore/dom/CheckedRadioButtons.cpp
+++ b/Source/WebCore/dom/CheckedRadioButtons.cpp
@@ -77,7 +77,7 @@ void CheckedRadioButtons::removeButton(HTMLFormControlElement* element)
     if (it == m_nameToCheckedRadioButtonMap->end() || it->second != element)
         return;
     
-    InputElement* inputElement = toInputElement(element);
+    InputElement* inputElement = element->toInputElement();
     ASSERT_UNUSED(inputElement, inputElement);
     ASSERT(inputElement->isChecked());
     ASSERT(element->isRadioButton());
diff --git a/Source/WebCore/dom/Clipboard.h b/Source/WebCore/dom/Clipboard.h
index b8eadfb..40141af 100644
--- a/Source/WebCore/dom/Clipboard.h
+++ b/Source/WebCore/dom/Clipboard.h
@@ -33,6 +33,7 @@
 
 namespace WebCore {
 
+    class DataTransferItems;
     class DragData;
     class FileList;
     class Frame;
@@ -84,6 +85,7 @@ namespace WebCore {
         virtual bool hasData() = 0;
         
         void setAccessPolicy(ClipboardAccessPolicy);
+        ClipboardAccessPolicy policy() const { return m_policy; }
 
         DragOperation sourceOperation() const;
         DragOperation destinationOperation() const;
@@ -91,11 +93,14 @@ namespace WebCore {
         void setDestinationOperation(DragOperation);
         
         void setDragHasStarted() { m_dragStarted = true; }
+
+#if ENABLE(DATA_TRANSFER_ITEMS)
+        virtual PassRefPtr<DataTransferItems> items() = 0;
+#endif
         
     protected:
         Clipboard(ClipboardAccessPolicy, ClipboardType);
 
-        ClipboardAccessPolicy policy() const { return m_policy; }
         bool dragStarted() const { return m_dragStarted; }
         
     private:
diff --git a/Source/WebCore/dom/Clipboard.idl b/Source/WebCore/dom/Clipboard.idl
index 1024a36..d5bb331 100644
--- a/Source/WebCore/dom/Clipboard.idl
+++ b/Source/WebCore/dom/Clipboard.idl
@@ -42,6 +42,8 @@ module core {
         [RequiresAllArguments] boolean setData(in DOMString type, in DOMString data);
         [Custom] void setDragImage(in HTMLImageElement image, in long x, in long y)
             raises(DOMException);
+
+        readonly attribute [Conditional=DATA_TRANSFER_ITEMS, EnabledAtRuntime=DataTransferItems] DataTransferItems items;
     };
 
 }
diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
index 7424875..4014cca 100644
--- a/Source/WebCore/dom/ContainerNode.cpp
+++ b/Source/WebCore/dom/ContainerNode.cpp
@@ -735,7 +735,7 @@ void ContainerNode::insertedIntoDocument()
 {
     Node::insertedIntoDocument();
     insertedIntoTree(false);
-    for (Node* child = m_firstChild; child; child = child->nextSibling())
+    for (Node* child = m_firstChild; child && inDocument(); child = child->nextSibling())
         child->insertedIntoDocument();
 }
 
diff --git a/Source/WebCore/dom/DOMAllInOne.cpp b/Source/WebCore/dom/DOMAllInOne.cpp
index c88aecf..cc4888f 100644
--- a/Source/WebCore/dom/DOMAllInOne.cpp
+++ b/Source/WebCore/dom/DOMAllInOne.cpp
@@ -26,7 +26,6 @@
 // This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
 
 #include "ActiveDOMObject.cpp"
-#include "AsyncScriptRunner.cpp"
 #include "Attr.cpp"
 #include "Attribute.cpp"
 #include "BeforeProcessEvent.cpp"
@@ -70,6 +69,7 @@
 #include "ErrorEvent.cpp"
 #include "Event.cpp"
 #include "EventContext.cpp"
+#include "EventDispatcher.cpp"
 #include "EventNames.cpp"
 #include "EventQueue.cpp"
 #include "EventTarget.cpp"
@@ -104,6 +104,7 @@
 #include "ScopedEventQueue.cpp"
 #include "ScriptElement.cpp"
 #include "ScriptExecutionContext.cpp"
+#include "ScriptRunner.cpp"
 #include "ScriptableDocumentParser.cpp"
 #include "SelectElement.cpp"
 #include "SelectorNodeList.cpp"
diff --git a/Source/WebCore/dom/DOMImplementation.cpp b/Source/WebCore/dom/DOMImplementation.cpp
index 3ba1137..782f203 100644
--- a/Source/WebCore/dom/DOMImplementation.cpp
+++ b/Source/WebCore/dom/DOMImplementation.cpp
@@ -262,7 +262,8 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& namespaceUR
     // WRONG_DOCUMENT_ERR: Raised if doctype has already been used with a different document or was
     // created from a different implementation.
     // Hixie's interpretation of the DOM Core spec suggests we should prefer
-    // other exceptions to WRONG_DOCUMENT_ERR (based on order mentioned in spec).
+    // other exceptions to WRONG_DOCUMENT_ERR (based on order mentioned in spec),
+    // but this matches the new DOM Core spec (http://www.w3.org/TR/domcore/).
     if (doctype && doctype->document()) {
         ec = WRONG_DOCUMENT_ERR;
         return 0;
diff --git a/Source/WebCore/dom/DataTransferItem.cpp b/Source/WebCore/dom/DataTransferItem.cpp
new file mode 100644
index 0000000..8eec869
--- /dev/null
+++ b/Source/WebCore/dom/DataTransferItem.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DataTransferItem.h"
+
+#if ENABLE(DATA_TRANSFER_ITEMS)
+
+namespace WebCore {
+
+const char DataTransferItem::kindString[] = "string";
+const char DataTransferItem::kindFile[] = "file";
+
+} // namespace WebCore
+
+#endif // ENABLE(DATA_TRANSFER_ITEMS)
diff --git a/Source/WebCore/dom/DataTransferItem.h b/Source/WebCore/dom/DataTransferItem.h
new file mode 100644
index 0000000..7b5886a
--- /dev/null
+++ b/Source/WebCore/dom/DataTransferItem.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DataTransferItem_h
+#define DataTransferItem_h
+
+#if ENABLE(DATA_TRANSFER_ITEMS)
+
+#include <wtf/Forward.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class StringCallback;
+
+class DataTransferItem : public RefCounted<DataTransferItem> {
+public:
+    ~DataTransferItem() {}
+
+    static const char kindString[];
+    static const char kindFile[];
+
+    virtual String kind() const = 0;
+    virtual String type() const = 0;
+
+    virtual void getAsString(PassRefPtr<StringCallback>) = 0;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(DATA_TRANSFER_ITEMS)
+
+#endif // DataTransferItem_h
diff --git a/Source/WebCore/dom/DataTransferItem.idl b/Source/WebCore/dom/DataTransferItem.idl
new file mode 100644
index 0000000..a2c9942
--- /dev/null
+++ b/Source/WebCore/dom/DataTransferItem.idl
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+
+    interface [
+        Conditional=DATA_TRANSFER_ITEMS
+    ] DataTransferItem {
+        readonly attribute DOMString kind;
+        readonly attribute DOMString type;
+
+        void getAsString(in [Callback] StringCallback callback);
+    };
+
+}
diff --git a/Source/WebCore/dom/DataTransferItems.h b/Source/WebCore/dom/DataTransferItems.h
new file mode 100644
index 0000000..0873384
--- /dev/null
+++ b/Source/WebCore/dom/DataTransferItems.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DataTransferItems_h
+#define DataTransferItems_h
+
+#if ENABLE(DATA_TRANSFER_ITEMS)
+
+#include <wtf/Forward.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class DataTransferItem;
+
+typedef int ExceptionCode;
+
+class DataTransferItems : public RefCounted<DataTransferItems> {
+public:
+    ~DataTransferItems() {}
+
+    virtual unsigned long length() const = 0;
+    virtual PassRefPtr<DataTransferItem> item(unsigned long index) const = 0;
+    virtual void deleteItem(unsigned long index, ExceptionCode&) = 0;
+    virtual void clear() = 0;
+
+    virtual void add(const String& data, const String& type, ExceptionCode&) = 0;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(DATA_TRANSFER_ITEMS)
+
+#endif // DataTransferItems_h
+
diff --git a/Source/WebCore/dom/DataTransferItems.idl b/Source/WebCore/dom/DataTransferItems.idl
new file mode 100644
index 0000000..1cb36b8
--- /dev/null
+++ b/Source/WebCore/dom/DataTransferItems.idl
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+
+    interface [
+        Conditional=DATA_TRANSFER_ITEMS,
+        HasIndexGetter,
+        CustomDeleteProperty,
+    ] DataTransferItems {
+        readonly attribute long length;
+        DataTransferItem item(in unsigned long index) getter;
+
+        void clear();
+        void add(in DOMString data, in DOMString type) raises(DOMException);
+    };
+
+}
diff --git a/Source/WebCore/dom/DatasetDOMStringMap.cpp b/Source/WebCore/dom/DatasetDOMStringMap.cpp
index 6359d55..a143743 100644
--- a/Source/WebCore/dom/DatasetDOMStringMap.cpp
+++ b/Source/WebCore/dom/DatasetDOMStringMap.cpp
@@ -72,13 +72,30 @@ static String convertAttributeNameToPropertyName(const String& name)
 
 static bool propertyNameMatchesAttributeName(const String& propertyName, const String& attributeName)
 {
-    // FIXME: This should be able to match without creating a new string.
-
-    if (!isValidAttributeName(attributeName))
+    if (!attributeName.startsWith("data-"))
         return false;
 
-    String convertedName = convertAttributeNameToPropertyName(attributeName);
-    return (convertedName == propertyName);
+    const UChar* property = propertyName.characters();
+    const UChar* attribute = attributeName.characters();
+    unsigned propertyLength = propertyName.length();
+    unsigned attributeLength = attributeName.length();
+   
+    unsigned a = 5;
+    unsigned p = 0;
+    bool wordBoundary = false;
+    while (a < attributeLength && p < propertyLength) {
+        if (attribute[a] == '-' && a + 1 < attributeLength && attribute[a + 1] != '-')
+            wordBoundary = true;
+        else {
+            if ((wordBoundary ? toASCIIUpper(attribute[a]) : attribute[a]) != property[p])
+                return false;
+            p++;
+            wordBoundary = false;
+        }
+        a++;
+    }
+
+    return (a == attributeLength && p == propertyLength);
 }
 
 static bool isValidPropertyName(const String& name)
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index a2a8040..233b798 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -7,7 +7,6 @@
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
- * Copyright (C) Research In Motion, Limited 2010-2011.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,7 +29,6 @@
 
 #include "AXObjectCache.h"
 #include "AnimationController.h"
-#include "AsyncScriptRunner.h"
 #include "Attr.h"
 #include "Attribute.h"
 #include "CDATASection.h"
@@ -44,6 +42,7 @@
 #include "ChromeClient.h"
 #include "Comment.h"
 #include "Console.h"
+#include "ContentSecurityPolicy.h"
 #include "CookieJar.h"
 #include "CustomEvent.h"
 #include "DateComponents.h"
@@ -120,6 +119,7 @@
 #include "RegisteredEventListener.h"
 #include "RenderArena.h"
 #include "RenderLayer.h"
+#include "RenderLayerBacking.h"
 #include "RenderTextControl.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
@@ -128,6 +128,7 @@
 #include "ScriptController.h"
 #include "ScriptElement.h"
 #include "ScriptEventListener.h"
+#include "ScriptRunner.h"
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
 #include "SelectionController.h"
@@ -333,7 +334,7 @@ static Widget* widgetForNode(Node* focusedNode)
 static bool acceptsEditingFocus(Node* node)
 {
     ASSERT(node);
-    ASSERT(node->isContentEditable());
+    ASSERT(node->rendererIsEditable());
 
     Node* root = node->rootEditableElement();
     Frame* frame = node->document()->frame();
@@ -358,7 +359,7 @@ static bool disableRangeMutation(Page* page)
 
 static HashSet<Document*>* documentsThatNeedStyleRecalc = 0;
 
-class DocumentWeakReference : public ThreadSafeShared<DocumentWeakReference> {
+class DocumentWeakReference : public ThreadSafeRefCounted<DocumentWeakReference> {
 public:
     static PassRefPtr<DocumentWeakReference> create(Document* document)
     {
@@ -387,14 +388,20 @@ private:
     Document* m_document;
 };
 
+uint64_t Document::s_globalTreeVersion = 0;
+
 Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     : ContainerNode(0)
     , m_compatibilityMode(NoQuirksMode)
     , m_compatibilityModeLocked(false)
+<<<<<<< HEAD
     , m_domTreeVersion(0)
 #ifdef ANDROID_STYLE_VERSION
     , m_styleVersion(0)
 #endif
+=======
+    , m_domTreeVersion(++s_globalTreeVersion)
+>>>>>>> webkit.org at r82507
     , m_styleSheets(StyleSheetList::create(this))
     , m_readyState(Complete)
     , m_styleRecalcTimer(this, &Document::styleRecalcTimerFired)
@@ -410,7 +417,7 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_startTime(currentTime())
     , m_overMinimumLayoutThreshold(false)
     , m_extraLayoutDelay(0)
-    , m_asyncScriptRunner(AsyncScriptRunner::create(this))
+    , m_scriptRunner(ScriptRunner::create(this))
     , m_xmlVersion("1.0")
     , m_xmlStandalone(false)
     , m_savedRenderer(0)
@@ -454,7 +461,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_writingModeSetOnDocumentElement(false)
     , m_writeRecursionIsTooDeep(false)
     , m_writeRecursionDepth(0)
-    , m_pendingTasksTimer(this, &Document::pendingTasksTimerFired)
 {
     m_document = this;
 
@@ -563,6 +569,11 @@ void Document::removedLastRef()
 
         m_cssCanvasElements.clear();
 
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+        // FIXME: consider using ActiveDOMObject.
+        m_scriptedAnimationController = 0;
+#endif
+
 #ifndef NDEBUG
         m_inRemovedLastRefFunction = false;
 #endif
@@ -584,7 +595,7 @@ Document::~Document()
     ASSERT(m_ranges.isEmpty());
     ASSERT(!m_styleRecalcTimer.isActive());
 
-    m_asyncScriptRunner.clear();
+    m_scriptRunner.clear();
 
     removeAllEventListeners();
 
@@ -1345,43 +1356,51 @@ static inline String canonicalizedTitle(Document* document, const String& title)
     return String::adopt(buffer);
 }
 
-void Document::updateTitle()
+void Document::updateTitle(const String& title)
 {
+    if (m_rawTitle == title)
+        return;
+
+    m_rawTitle = title;
     m_title = canonicalizedTitle(this, m_rawTitle);
     if (Frame* f = frame())
         f->loader()->setTitle(m_title);
 }
 
-void Document::setTitle(const String& title, Element* titleElement)
+void Document::setTitle(const String& title)
 {
-    if (!titleElement) {
-        // Title set by JavaScript -- overrides any title elements.
-        m_titleSetExplicitly = true;
-        if (!isHTMLDocument())
-            m_titleElement = 0;
-        else if (!m_titleElement) {
-            if (HTMLElement* headElement = head()) {
-                m_titleElement = createElement(titleTag, false);
-                ExceptionCode ec = 0;
-                headElement->appendChild(m_titleElement, ec);
-                ASSERT(!ec);
-            }
+    // Title set by JavaScript -- overrides any title elements.
+    m_titleSetExplicitly = true;
+    if (!isHTMLDocument())
+        m_titleElement = 0;
+    else if (!m_titleElement) {
+        if (HTMLElement* headElement = head()) {
+            m_titleElement = createElement(titleTag, false);
+            ExceptionCode ec = 0;
+            headElement->appendChild(m_titleElement, ec);
+            ASSERT(!ec);
         }
-    } else if (titleElement != m_titleElement) {
+    }
+
+    updateTitle(title);
+
+    if (m_titleElement) {
+        ASSERT(m_titleElement->hasTagName(titleTag));
+        if (m_titleElement->hasTagName(titleTag))
+            static_cast<HTMLTitleElement*>(m_titleElement.get())->setText(m_title);
+    }
+}
+
+void Document::setTitleElement(const String& title, Element* titleElement)
+{
+    if (titleElement != m_titleElement) {
         if (m_titleElement || m_titleSetExplicitly)
             // Only allow the first title element to change the title -- others have no effect.
             return;
         m_titleElement = titleElement;
     }
 
-    if (m_rawTitle == title)
-        return;
-
-    m_rawTitle = title;
-    updateTitle();
-
-    if (m_titleSetExplicitly && m_titleElement && m_titleElement->hasTagName(titleTag) && !titleElement)
-        static_cast<HTMLTitleElement*>(m_titleElement.get())->setText(m_title);
+    updateTitle(title);
 }
 
 void Document::removeTitle(Element* titleElement)
@@ -1397,15 +1416,13 @@ void Document::removeTitle(Element* titleElement)
         for (Node* e = headElement->firstChild(); e; e = e->nextSibling())
             if (e->hasTagName(titleTag)) {
                 HTMLTitleElement* titleElement = static_cast<HTMLTitleElement*>(e);
-                setTitle(titleElement->text(), titleElement);
+                setTitleElement(titleElement->text(), titleElement);
                 break;
             }
     }
 
-    if (!m_titleElement && !m_rawTitle.isEmpty()) {
-        m_rawTitle = "";
-        updateTitle();
-    }
+    if (!m_titleElement)
+        updateTitle("");
 }
 
 String Document::nodeName() const
@@ -1793,7 +1810,12 @@ void Document::detach()
 
     clearAXObjectCache();
     stopActiveDOMObjects();
-    
+
+#if ENABLE(REQUEST_ANIMATION_FRAME)
+    // FIXME: consider using ActiveDOMObject.
+    m_scriptedAnimationController = 0;
+#endif
+
     RenderObject* render = renderer();
 
     // Send out documentWillBecomeInactive() notifications to registered elements,
@@ -3994,7 +4016,7 @@ void Document::setInPageCache(bool flag)
         ASSERT(!m_savedRenderer);
         m_savedRenderer = renderer();
         if (FrameView* v = view())
-            v->resetScrollbars();
+            v->resetScrollbarsAndClearContentsSize();
         m_styleRecalcTimer.stop();
     } else {
         ASSERT(!renderer() || renderer() == m_savedRenderer);
@@ -4486,7 +4508,7 @@ void FormElementKey::deref() const
 
 unsigned FormElementKeyHash::hash(const FormElementKey& key)
 {
-    return WTF::StringHasher::createBlobHash<sizeof(FormElementKey)>(&key);
+    return StringHasher::hashMemory<sizeof(FormElementKey)>(&key);
 }
 
 void Document::setIconURL(const String& iconURL, const String& type)
@@ -4551,7 +4573,7 @@ void Document::initSecurityContext()
     // loading URL with a fresh content security policy.
     m_cookieURL = m_url;
     ScriptExecutionContext::setSecurityOrigin(SecurityOrigin::create(m_url, m_frame->loader()->sandboxFlags()));
-    m_contentSecurityPolicy = ContentSecurityPolicy::create();
+    m_contentSecurityPolicy = ContentSecurityPolicy::create(securityOrigin());
 
     if (SecurityOrigin::allowSubstituteDataAccessToLocal()) {
         // If this document was loaded with substituteData, then the document can
@@ -4780,59 +4802,22 @@ public:
     OwnPtr<ScriptExecutionContext::Task> task;
 };
 
-void Document::didReceiveTask(void* untypedContext)
+static void performTask(void* ctx)
 {
     ASSERT(isMainThread());
 
-    OwnPtr<PerformTaskContext> context = adoptPtr(static_cast<PerformTaskContext*>(untypedContext));
+    PerformTaskContext* context = reinterpret_cast<PerformTaskContext*>(ctx);
     ASSERT(context);
 
-    Document* document = context->documentReference->document();
-    if (!document)
-        return;
-
-    Page* page = document->page();
-    if ((page && page->defersLoading()) || !document->m_pendingTasks.isEmpty()) {
-        document->m_pendingTasks.append(context->task.release());
-        return;
-    }
+    if (Document* document = context->documentReference->document())
+        context->task->performTask(document);
 
-    context->task->performTask(document);
+    delete context;
 }
 
 void Document::postTask(PassOwnPtr<Task> task)
 {
-    callOnMainThread(didReceiveTask, new PerformTaskContext(m_weakReference, task));
-}
-
-void Document::pendingTasksTimerFired(Timer<Document>*)
-{
-    while (!m_pendingTasks.isEmpty()) {
-        OwnPtr<Task> task = m_pendingTasks[0].release();
-        m_pendingTasks.remove(0);
-        task->performTask(this);
-    }
-}
-
-void Document::suspendScheduledTasks()
-{
-    suspendScriptedAnimationControllerCallbacks();
-    suspendActiveDOMObjects(ActiveDOMObject::WillShowDialog);
-    asyncScriptRunner()->suspend();
-    m_pendingTasksTimer.stop();
-    if (m_parser)
-        m_parser->suspendScheduledTasks();
-}
-
-void Document::resumeScheduledTasks()
-{
-    if (m_parser)
-        m_parser->resumeScheduledTasks();
-    if (!m_pendingTasks.isEmpty())
-        m_pendingTasksTimer.startOneShot(0);
-    asyncScriptRunner()->resume();
-    resumeActiveDOMObjects();
-    resumeScriptedAnimationControllerCallbacks();
+    callOnMainThread(performTask, new PerformTaskContext(m_weakReference, task));
 }
 
 void Document::suspendScriptedAnimationControllerCallbacks()
@@ -4947,6 +4932,20 @@ bool Document::isXHTMLMPDocument() const
 #endif
 
 #if ENABLE(FULLSCREEN_API)
+bool Document::fullScreenIsAllowedForElement(Element* element) const
+{
+    ASSERT(element);
+    while (HTMLFrameOwnerElement* ownerElement = element->document()->ownerElement()) {
+        if (!ownerElement->hasTagName(frameTag) && !ownerElement->hasTagName(iframeTag))
+            continue;
+
+        if (!static_cast<HTMLFrameElementBase*>(ownerElement)->allowFullScreen())
+            return false;
+        element = ownerElement;
+    }
+    return true;
+}
+
 void Document::webkitRequestFullScreenForElement(Element* element, unsigned short flags)
 {
     if (!page() || !page()->settings()->fullScreenEnabled())
@@ -4955,7 +4954,13 @@ void Document::webkitRequestFullScreenForElement(Element* element, unsigned shor
     if (!element)
         element = documentElement();
     
-    if (!page()->chrome()->client()->supportsFullScreenForElement(element))
+    if (!fullScreenIsAllowedForElement(element))
+        return;
+    
+    if (!ScriptController::processingUserGesture())
+        return;
+    
+    if (!page()->chrome()->client()->supportsFullScreenForElement(element, flags & Element::ALLOW_KEYBOARD_INPUT))
         return;
     
     m_areKeysEnabledInFullScreen = flags & Element::ALLOW_KEYBOARD_INPUT;
@@ -4983,23 +4988,40 @@ void Document::webkitWillEnterFullScreenForElement(Element* element)
 
     recalcStyle(Force);
     
-    if (m_fullScreenRenderer)
+    if (m_fullScreenRenderer) {
         m_fullScreenRenderer->setAnimating(true);
+#if USE(ACCELERATED_COMPOSITING)
+        view()->updateCompositingLayers();
+        ASSERT(m_fullScreenRenderer->layer()->backing());
+        page()->chrome()->client()->setRootFullScreenLayer(m_fullScreenRenderer->layer()->backing()->graphicsLayer());
+#endif
+    }
 }
     
 void Document::webkitDidEnterFullScreenForElement(Element*)
 {
-    if (m_fullScreenRenderer)
+    if (m_fullScreenRenderer) {
         m_fullScreenRenderer->setAnimating(false);
+#if USE(ACCELERATED_COMPOSITING)
+        view()->updateCompositingLayers();
+        ASSERT(!m_fullScreenRenderer->layer()->backing());
+        page()->chrome()->client()->setRootFullScreenLayer(0);
+#endif
+    }
     m_fullScreenChangeDelayTimer.startOneShot(0);
 }
 
 void Document::webkitWillExitFullScreenForElement(Element*)
 {
-    if (m_fullScreenRenderer)
+    if (m_fullScreenRenderer) {
         m_fullScreenRenderer->setAnimating(true);
-
-    recalcStyle(Force);
+        m_fullScreenRenderer->setAnimating(true);
+#if USE(ACCELERATED_COMPOSITING)
+        view()->updateCompositingLayers();
+        ASSERT(m_fullScreenRenderer->layer()->backing());
+        page()->chrome()->client()->setRootFullScreenLayer(m_fullScreenRenderer->layer()->backing()->graphicsLayer());
+#endif
+    }
 }
 
 void Document::webkitDidExitFullScreenForElement(Element*)
@@ -5014,6 +5036,9 @@ void Document::webkitDidExitFullScreenForElement(Element*)
         m_fullScreenElement->detach();
     
     setFullScreenRenderer(0);
+#if USE(ACCELERATED_COMPOSITING)
+    page()->chrome()->client()->setRootFullScreenLayer(0);
+#endif
     recalcStyle(Force);
     
     m_fullScreenChangeDelayTimer.startOneShot(0);
@@ -5021,6 +5046,11 @@ void Document::webkitDidExitFullScreenForElement(Element*)
     
 void Document::setFullScreenRenderer(RenderFullScreen* renderer)
 {
+    if (renderer == m_fullScreenRenderer)
+        return;
+
+    if (m_fullScreenRenderer)
+        m_fullScreenRenderer->destroy();
     m_fullScreenRenderer = renderer;
     
     // This notification can come in after the page has been destroyed.
@@ -5041,6 +5071,7 @@ void Document::setFullScreenRendererSize(const IntSize& size)
         newStyle->setTop(Length(0, WebCore::Fixed));
         newStyle->setLeft(Length(0, WebCore::Fixed));
         m_fullScreenRenderer->setStyle(newStyle);
+        updateLayout();
     }
 }
     
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index ae9b24e..c9a1b55 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -32,7 +32,6 @@
 #include "CollectionType.h"
 #include "Color.h"
 #include "ContainerNode.h"
-#include "ContentSecurityPolicy.h"
 #include "DOMTimeStamp.h"
 #include "DocumentOrderedMap.h"
 #include "DocumentTiming.h"
@@ -51,20 +50,20 @@
 
 namespace WebCore {
 
-class AsyncScriptRunner;
-class Attr;
 class AXObjectCache;
+class Attr;
 class CDATASection;
+class CSSPrimitiveValueCache;
+class CSSStyleDeclaration;
+class CSSStyleSelector;
+class CSSStyleSheet;
 class CachedCSSStyleSheet;
 class CachedResourceLoader;
 class CachedScript;
 class CanvasRenderingContext;
 class CharacterData;
-class CSSPrimitiveValueCache;
-class CSSStyleDeclaration;
-class CSSStyleSelector;
-class CSSStyleSheet;
 class Comment;
+class ContentSecurityPolicy;
 class DOMImplementation;
 class DOMSelection;
 class DOMWindow;
@@ -115,6 +114,7 @@ class RenderView;
 class RenderFullScreen;
 class ScriptableDocumentParser;
 class ScriptElementData;
+class ScriptRunner;
 class SecurityOrigin;
 class SerializedScriptValue;
 class SegmentedString;
@@ -820,7 +820,8 @@ public:
     HTMLFrameOwnerElement* ownerElement() const;
 
     String title() const { return m_title; }
-    void setTitle(const String&, Element* titleElement = 0);
+    void setTitle(const String&);
+    void setTitleElement(const String& title, Element* titleElement);
     void removeTitle(Element* titleElement);
 
     String cookie(ExceptionCode&) const;
@@ -908,7 +909,7 @@ public:
 
     int docID() const { return m_docID; }
     
-    AsyncScriptRunner* asyncScriptRunner() { return m_asyncScriptRunner.get(); }
+    ScriptRunner* scriptRunner() { return m_scriptRunner.get(); }
 
 #if ENABLE(XSLT)
     void applyXSLTransform(ProcessingInstruction* pi);
@@ -919,8 +920,8 @@ public:
     TransformSource* transformSource() const { return m_transformSource.get(); }
 #endif
 
-    void incDOMTreeVersion() { ++m_domTreeVersion; }
-    unsigned domTreeVersion() const { return m_domTreeVersion; }
+    void incDOMTreeVersion() { m_domTreeVersion = ++s_globalTreeVersion; }
+    uint64_t domTreeVersion() const { return m_domTreeVersion; }
 
 #ifdef ANDROID_STYLE_VERSION
     void incStyleVersion() { ++m_styleVersion; }
@@ -1106,6 +1107,7 @@ public:
     void setFullScreenRendererBackgroundColor(Color);
     
     void fullScreenChangeDelayTimerFired(Timer<Document>*);
+    bool fullScreenIsAllowedForElement(Element*) const;
 #endif
 
     // Used to allow element that loads data without going through a FrameLoader to delay the 'load' event.
@@ -1135,9 +1137,6 @@ public:
 
     ContentSecurityPolicy* contentSecurityPolicy() { return m_contentSecurityPolicy.get(); }
 
-    void suspendScheduledTasks();
-    void resumeScheduledTasks();
-
 protected:
     Document(Frame*, const KURL&, bool isXHTML, bool isHTML);
 
@@ -1173,7 +1172,7 @@ private:
 
     String encoding() const;
 
-    void updateTitle();
+    void updateTitle(const String& title);
     void updateFocusAppearanceTimerFired(Timer<Document>*);
     void updateBaseURL();
 
@@ -1185,10 +1184,6 @@ private:
 
     void loadEventDelayTimerFired(Timer<Document>*);
 
-    void pendingTasksTimerFired(Timer<Document>*);
-
-    static void didReceiveTask(void*);
-
     OwnPtr<CSSStyleSelector> m_styleSelector;
     bool m_didCalculateStyleSelector;
     bool m_hasDirtyStyleSelector;
@@ -1258,10 +1253,15 @@ private:
     RefPtr<Node> m_activeNode;
     mutable RefPtr<Element> m_documentElement;
 
+<<<<<<< HEAD
     unsigned m_domTreeVersion;
 #ifdef ANDROID_STYLE_VERSION
     unsigned m_styleVersion;
 #endif
+=======
+    uint64_t m_domTreeVersion;
+    static uint64_t s_globalTreeVersion;
+>>>>>>> webkit.org at r82507
     
     HashSet<NodeIterator*> m_nodeIterators;
     HashSet<Range*> m_ranges;
@@ -1341,7 +1341,7 @@ private:
     // points during the lifetime of the Document.
     int m_extraLayoutDelay;
     
-    OwnPtr<AsyncScriptRunner> m_asyncScriptRunner;
+    OwnPtr<ScriptRunner> m_scriptRunner;
 
 #if ENABLE(XSLT)
     OwnPtr<TransformSource> m_transformSource;
@@ -1460,9 +1460,6 @@ private:
 #endif
 
     RefPtr<ContentSecurityPolicy> m_contentSecurityPolicy;
-
-    Timer<Document> m_pendingTasksTimer;
-    Vector<OwnPtr<Task> > m_pendingTasks;
 };
 
 inline bool Document::hasElementWithId(AtomicStringImpl* id) const
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index 41c0fb1..81668cf 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -55,7 +55,9 @@
 #include "RenderWidget.h"
 #include "Settings.h"
 #include "TextIterator.h"
+#include "WebKitAnimationList.h"
 #include "XMLNames.h"
+#include "htmlediting.h"
 #include <wtf/text/CString.h>
 
 #if ENABLE(SVG)
@@ -1199,6 +1201,15 @@ bool Element::childTypeAllowed(NodeType type)
     return false;
 }
 
+static void checkForEmptyStyleChange(Element* element, RenderStyle* style)
+{
+    if (!style)
+        return;
+
+    if (style->affectedByEmpty() && (!style->emptyState() || element->hasChildNodes()))
+        element->setNeedsStyleRecalc();
+}
+
 static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool finishedParsingCallback,
                                         Node* beforeChange, Node* afterChange, int childCountDelta)
 {
@@ -1275,17 +1286,18 @@ static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool fin
         e->setNeedsStyleRecalc();
     
     // :empty selector.
-    if (style->affectedByEmpty() && (!style->emptyState() || e->hasChildNodes()))
-        e->setNeedsStyleRecalc();
+    checkForEmptyStyleChange(e, style);
 }
 
 void Element::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     ContainerNode::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
-    if (!changedByParser)
+    if (changedByParser)
+        checkForEmptyStyleChange(this, renderStyle());
+    else
         checkForSiblingStyleChanges(this, renderStyle(), false, beforeChange, afterChange, childCountDelta);
 }
-    
+
 void Element::beginParsingChildren()
 {
     clearIsParsingChildrenFinished();
@@ -1413,10 +1425,8 @@ PassRefPtr<Attr> Element::removeAttributeNode(Attr* attr, ExceptionCode& ec)
         ec = NOT_FOUND_ERR;
         return 0;
     }
-    if (document() != attr->document()) {
-        ec = WRONG_DOCUMENT_ERR;
-        return 0;
-    }
+
+    ASSERT(document() == attr->document());
 
     NamedNodeMap* attrs = attributes(true);
     if (!attrs)
@@ -1508,6 +1518,9 @@ CSSStyleDeclaration *Element::style()
 
 void Element::focus(bool restorePreviousSelection)
 {
+    if (!inDocument())
+        return;
+
     Document* doc = document();
     if (doc->focusedNode() == this)
         return;
@@ -1558,7 +1571,7 @@ void Element::updateFocusAppearance(bool /*restorePreviousSelection*/)
             return;
 
         // FIXME: We should restore the previous selection if there is one.
-        VisibleSelection newSelection = VisibleSelection(firstPositionInNode(this), DOWNSTREAM);
+        VisibleSelection newSelection = VisibleSelection(firstPositionInOrBeforeNode(this), DOWNSTREAM);
         
         if (frame->selection()->shouldChangeSelection(newSelection)) {
             frame->selection()->setSelection(newSelection);
@@ -1891,4 +1904,17 @@ bool Element::isSpellCheckingEnabled() const
     return true;
 }
 
+PassRefPtr<WebKitAnimationList> Element::webkitGetAnimations() const
+{
+    if (!renderer())
+        return 0;
+
+    AnimationController* animController = renderer()->animation();
+
+    if (!animController)
+        return 0;
+    
+    return animController->animationsForRenderer(renderer());
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index 5c54ce4..ba0870c 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -39,6 +39,7 @@ class DOMStringMap;
 class DOMTokenList;
 class ElementRareData;
 class IntSize;
+class WebKitAnimationList;
 
 enum SpellcheckAttributeState {
     SpellcheckAttributeTrue,
@@ -344,6 +345,8 @@ public:
 
     virtual bool isSpellCheckingEnabled() const;
 
+    PassRefPtr<WebKitAnimationList> webkitGetAnimations() const;
+
 protected:
     Element(const QualifiedName& tagName, Document* document, ConstructionType type)
         : ContainerNode(document, type)
diff --git a/Source/WebCore/dom/Element.idl b/Source/WebCore/dom/Element.idl
index 652a75b..fc28642 100644
--- a/Source/WebCore/dom/Element.idl
+++ b/Source/WebCore/dom/Element.idl
@@ -96,6 +96,8 @@ module core {
         void scrollByLines(in long lines);
         void scrollByPages(in long pages);
 
+        WebKitAnimationList webkitGetAnimations();
+
         // HTML 5
         NodeList getElementsByClassName(in DOMString name);
 
diff --git a/Source/WebCore/dom/Event.cpp b/Source/WebCore/dom/Event.cpp
index 795dace..a1352dc 100644
--- a/Source/WebCore/dom/Event.cpp
+++ b/Source/WebCore/dom/Event.cpp
@@ -22,6 +22,7 @@
 
 #include "config.h"
 #include "Event.h"
+#include "EventDispatcher.h"
 #include "EventTarget.h"
 
 #include "UserGestureIndicator.h"
@@ -270,8 +271,16 @@ void Event::storeResult(const String&)
 {
 }
 
+bool Event::dispatch(EventDispatcher* dispatcher)
+{
+    return dispatcher->dispatchEvent(this);
+}
+
 void Event::setTarget(PassRefPtr<EventTarget> target)
 {
+    if (m_target == target)
+        return;
+
     m_target = target;
     if (m_target)
         receivedTarget();
diff --git a/Source/WebCore/dom/Event.h b/Source/WebCore/dom/Event.h
index ba9576b..d4d7e06 100644
--- a/Source/WebCore/dom/Event.h
+++ b/Source/WebCore/dom/Event.h
@@ -32,6 +32,7 @@
 namespace WebCore {
 
     class EventTarget;
+    class EventDispatcher;
 
     class Event : public RefCounted<Event> {
     public:
@@ -165,6 +166,8 @@ namespace WebCore {
 
         virtual Clipboard* clipboard() const { return 0; }
 
+        virtual bool dispatch(EventDispatcher*);
+
     protected:
         Event();
         Event(const AtomicString& type, bool canBubble, bool cancelable);
diff --git a/Source/WebCore/dom/EventDispatcher.cpp b/Source/WebCore/dom/EventDispatcher.cpp
new file mode 100644
index 0000000..c8b330d
--- /dev/null
+++ b/Source/WebCore/dom/EventDispatcher.cpp
@@ -0,0 +1,396 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ *           (C) 2001 Dirk Mueller (mueller@kde.org)
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "EventDispatcher.h"
+
+#include "Event.h"
+#include "EventContext.h"
+#include "EventTarget.h"
+#include "FrameView.h"
+#include "InspectorInstrumentation.h"
+#include "MouseEvent.h"
+#include "Node.h"
+#include "PlatformWheelEvent.h"
+#include "ScopedEventQueue.h"
+
+#if ENABLE(SVG)
+#include "SVGElementInstance.h"
+#include "SVGNames.h"
+#include "SVGUseElement.h"
+#endif
+
+#include "UIEvent.h"
+#include "UIEventWithKeyState.h"
+#include "WheelEvent.h"
+#include "WindowEventContext.h"
+
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+static HashSet<Node*>* gNodesDispatchingSimulatedClicks = 0;
+
+bool EventDispatcher::dispatchEvent(Node* node, PassRefPtr<Event> prpEvent)
+{
+    RefPtr<Event> event = prpEvent;
+
+    EventDispatcher dispatcher(node);
+    return event->dispatch(&dispatcher);
+}
+
+static EventTarget* findElementInstance(Node* referenceNode)
+{
+#if ENABLE(SVG)
+    // Spec: The event handling for the non-exposed tree works as if the referenced element had been textually included
+    // as a deeply cloned child of the 'use' element, except that events are dispatched to the SVGElementInstance objects
+    for (Node* n = referenceNode; n; n = n->parentNode()) {
+        if (!n->isShadowRoot() || !n->isSVGElement())
+            continue;
+
+        Element* shadowTreeParentElement = n->shadowHost();
+        ASSERT(shadowTreeParentElement->hasTagName(SVGNames::useTag));
+
+        if (SVGElementInstance* instance = static_cast<SVGUseElement*>(shadowTreeParentElement)->instanceForShadowTreeElement(referenceNode))
+            return instance;
+    }
+#else
+    // SVG elements with SVG disabled should not be possible.
+    ASSERT_NOT_REACHED();
+#endif
+
+    return referenceNode;
+}
+
+inline static EventTarget* eventTargetRespectingSVGTargetRules(Node* referenceNode)
+{
+    ASSERT(referenceNode);
+
+    return referenceNode->isSVGElement() ? findElementInstance(referenceNode) : referenceNode;
+}
+
+void EventDispatcher::dispatchScopedEvent(Node* node, PassRefPtr<Event> event)
+{
+    // We need to set the target here because it can go away by the time we actually fire the event.
+    event->setTarget(eventTargetRespectingSVGTargetRules(node));
+
+    ScopedEventQueue::instance()->enqueueEvent(event);
+}
+
+void EventDispatcher::dispatchSimulatedClick(Node* node, PassRefPtr<Event> underlyingEvent, bool sendMouseEvents, bool showPressedLook)
+{
+    EventDispatcher dispatcher(node);
+
+    if (!gNodesDispatchingSimulatedClicks)
+        gNodesDispatchingSimulatedClicks = new HashSet<Node*>;
+    else if (gNodesDispatchingSimulatedClicks->contains(node))
+        return;
+
+    gNodesDispatchingSimulatedClicks->add(node);
+
+    // send mousedown and mouseup before the click, if requested
+    if (sendMouseEvents)
+        dispatcher.dispatchEvent(SimulatedMouseEvent::create(eventNames().mousedownEvent, node->document()->defaultView(), underlyingEvent));
+    node->setActive(true, showPressedLook);
+    if (sendMouseEvents)
+        dispatcher.dispatchEvent(SimulatedMouseEvent::create(eventNames().mouseupEvent, node->document()->defaultView(), underlyingEvent));
+    node->setActive(false);
+
+    // always send click
+    dispatcher.dispatchEvent(SimulatedMouseEvent::create(eventNames().clickEvent, node->document()->defaultView(), underlyingEvent));
+
+    gNodesDispatchingSimulatedClicks->remove(node);
+}
+
+inline static WheelEvent::Granularity granularity(const PlatformWheelEvent& event)
+{
+    return event.granularity() == ScrollByPageWheelEvent ? WheelEvent::Page : WheelEvent::Pixel;
+}
+
+void EventDispatcher::dispatchWheelEvent(Node* node, PlatformWheelEvent& event)
+{
+    ASSERT(!eventDispatchForbidden());
+    if (!(event.deltaX() || event.deltaY()))
+        return;
+
+    EventDispatcher dispatcher(node);
+
+    if (!dispatcher.m_view)
+        return;
+
+    IntPoint position = dispatcher.m_view->windowToContents(event.pos());
+
+    int adjustedPageX = position.x();
+    int adjustedPageY = position.y();
+    if (Frame* frame = node->document()->frame()) {
+        float pageZoom = frame->pageZoomFactor();
+        if (pageZoom != 1.0f) {
+            adjustedPageX = lroundf(position.x() / pageZoom);
+            adjustedPageY = lroundf(position.y() / pageZoom);
+        }
+    }
+
+    RefPtr<WheelEvent> wheelEvent = WheelEvent::create(event.wheelTicksX(), event.wheelTicksY(), event.deltaX(), event.deltaY(), granularity(event),
+        node->document()->defaultView(), event.globalX(), event.globalY(), adjustedPageX, adjustedPageY,
+        event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey());
+
+    wheelEvent->setAbsoluteLocation(position);
+
+    if (!dispatcher.dispatchEvent(wheelEvent) || wheelEvent->defaultHandled())
+        event.accept();
+
+}
+
+// FIXME: Once https://bugs.webkit.org/show_bug.cgi?id=52963 lands, this should
+// be greatly improved. See https://bugs.webkit.org/show_bug.cgi?id=54025.
+static Node* pullOutOfShadow(Node* node)
+{
+    Node* outermostShadowBoundary = node;
+    for (Node* n = node; n; n = n->parentOrHostNode()) {
+        if (n->isShadowRoot())
+            outermostShadowBoundary = n->parentOrHostNode();
+    }
+    return outermostShadowBoundary;
+}
+
+EventDispatcher::EventDispatcher(Node* node)
+    : m_node(node)
+{
+    ASSERT(node);
+    m_view = node->document()->view();
+}
+
+void EventDispatcher::getEventAncestors(EventTarget* originalTarget, EventDispatchBehavior behavior)
+{
+    if (!m_node->inDocument())
+        return;
+
+    if (ancestorsInitialized())
+        return;
+
+    EventTarget* target = originalTarget;
+    Node* ancestor = m_node.get();
+    bool shouldSkipNextAncestor = false;
+    while (true) {
+        if (ancestor->isShadowRoot()) {
+            if (behavior == StayInsideShadowDOM)
+                return;
+            ancestor = ancestor->shadowHost();
+            if (!shouldSkipNextAncestor)
+                target = ancestor;
+        } else
+            ancestor = ancestor->parentNodeGuaranteedHostFree();
+
+        if (!ancestor)
+            return;
+
+#if ENABLE(SVG)
+        // Skip SVGShadowTreeRootElement.
+        shouldSkipNextAncestor = ancestor->isSVGElement() && ancestor->isShadowRoot();
+        if (shouldSkipNextAncestor)
+            continue;
+#endif
+        // FIXME: Unroll the extra loop inside eventTargetRespectingSVGTargetRules into this loop.
+        m_ancestors.append(EventContext(ancestor, eventTargetRespectingSVGTargetRules(ancestor), target));
+    }
+}
+
+bool EventDispatcher::dispatchEvent(PassRefPtr<Event> event)
+{
+    event->setTarget(eventTargetRespectingSVGTargetRules(m_node.get()));
+
+    ASSERT(!eventDispatchForbidden());
+    ASSERT(event->target());
+    ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
+
+    RefPtr<EventTarget> originalTarget = event->target();
+    getEventAncestors(originalTarget.get(), determineDispatchBehavior(event.get()));
+
+    WindowEventContext windowContext(event.get(), m_node.get(), topEventContext());
+
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willDispatchEvent(m_node->document(), *event, windowContext.window(), m_node.get(), m_ancestors);
+
+    // Give the target node a chance to do some work before DOM event handlers get a crack.
+    void* data = m_node->preDispatchEventHandler(event.get());
+    if (event->propagationStopped())
+        goto doneDispatching;
+
+    // Trigger capturing event handlers, starting at the top and working our way down.
+    event->setEventPhase(Event::CAPTURING_PHASE);
+
+    if (windowContext.handleLocalEvents(event.get()) && event->propagationStopped())
+        goto doneDispatching;
+
+    for (size_t i = m_ancestors.size(); i; --i) {
+        m_ancestors[i - 1].handleLocalEvents(event.get());
+        if (event->propagationStopped())
+            goto doneDispatching;
+    }
+
+    event->setEventPhase(Event::AT_TARGET);
+    event->setTarget(originalTarget.get());
+    event->setCurrentTarget(eventTargetRespectingSVGTargetRules(m_node.get()));
+    m_node->handleLocalEvents(event.get());
+    if (event->propagationStopped())
+        goto doneDispatching;
+
+    if (event->bubbles() && !event->cancelBubble()) {
+        // Trigger bubbling event handlers, starting at the bottom and working our way up.
+        event->setEventPhase(Event::BUBBLING_PHASE);
+
+        size_t size = m_ancestors.size();
+        for (size_t i = 0; i < size; ++i) {
+            m_ancestors[i].handleLocalEvents(event.get());
+            if (event->propagationStopped() || event->cancelBubble())
+                goto doneDispatching;
+        }
+        windowContext.handleLocalEvents(event.get());
+    }
+
+doneDispatching:
+    event->setTarget(originalTarget.get());
+    event->setCurrentTarget(0);
+    event->setEventPhase(0);
+
+    // Pass the data from the preDispatchEventHandler to the postDispatchEventHandler.
+    m_node->postDispatchEventHandler(event.get(), data);
+
+    // Call default event handlers. While the DOM does have a concept of preventing
+    // default handling, the detail of which handlers are called is an internal
+    // implementation detail and not part of the DOM.
+    if (!event->defaultPrevented() && !event->defaultHandled()) {
+        // Non-bubbling events call only one default event handler, the one for the target.
+        m_node->defaultEventHandler(event.get());
+        ASSERT(!event->defaultPrevented());
+        if (event->defaultHandled())
+            goto doneWithDefault;
+        // For bubbling events, call default event handlers on the same targets in the
+        // same order as the bubbling phase.
+        if (event->bubbles()) {
+            size_t size = m_ancestors.size();
+            for (size_t i = 0; i < size; ++i) {
+                m_ancestors[i].node()->defaultEventHandler(event.get());
+                ASSERT(!event->defaultPrevented());
+                if (event->defaultHandled())
+                    goto doneWithDefault;
+            }
+        }
+    }
+
+doneWithDefault:
+
+    // Ensure that after event dispatch, the event's target object is the
+    // outermost shadow DOM boundary.
+    event->setTarget(windowContext.target());
+    event->setCurrentTarget(0);
+    InspectorInstrumentation::didDispatchEvent(cookie);
+
+    return !event->defaultPrevented();
+}
+bool EventDispatcher::dispatchMouseEvent(Node* node, const PlatformMouseEvent& event, const AtomicString& eventType,
+    int detail, Node* relatedTargetArg)
+{
+    ASSERT(!eventDispatchForbidden());
+    ASSERT(event.eventType() == MouseEventMoved || event.button() != NoButton);
+
+    if (node->disabled()) // Don't even send DOM events for disabled controls..
+        return true;
+
+    if (eventType.isEmpty())
+        return false; // Shouldn't happen.
+
+    EventDispatcher dispatcher(node);
+
+    // Attempting to dispatch with a non-EventTarget relatedTarget causes the relatedTarget to be silently ignored.
+    RefPtr<Node> relatedTarget = pullOutOfShadow(relatedTargetArg);
+
+    IntPoint contentsPosition;
+    if (FrameView* view = node->document()->view())
+        contentsPosition = view->windowToContents(event.pos());
+
+    IntPoint adjustedPagePosition = contentsPosition;
+    if (Frame* frame = node->document()->frame()) {
+        float pageZoom = frame->pageZoomFactor();
+        if (pageZoom != 1.0f) {
+            // Adjust our pageX and pageY to account for the page zoom.
+            adjustedPagePosition.setX(lroundf(contentsPosition.x() / pageZoom));
+            adjustedPagePosition.setY(lroundf(contentsPosition.y() / pageZoom));
+        }
+    }
+
+    RefPtr<MouseEvent> mouseEvent = MouseEvent::create(eventType, node->document()->defaultView(), event, adjustedPagePosition, detail, relatedTarget);
+    mouseEvent->setAbsoluteLocation(contentsPosition);
+
+    bool swallowEvent = false;
+
+    dispatcher.dispatchEvent(mouseEvent);
+    bool defaultHandled = mouseEvent->defaultHandled();
+    bool defaultPrevented = mouseEvent->defaultPrevented();
+    if (defaultHandled || defaultPrevented)
+        swallowEvent = true;
+
+    // Special case: If it's a double click event, we also send the dblclick event. This is not part
+    // of the DOM specs, but is used for compatibility with the ondblclick="" attribute. This is treated
+    // as a separate event in other DOM-compliant browsers like Firefox, and so we do the same.
+    if (eventType == eventNames().clickEvent && detail == 2) {
+        RefPtr<Event> doubleClickEvent = MouseEvent::create(eventNames().dblclickEvent, node->document()->defaultView(), event, adjustedPagePosition, detail, relatedTarget);
+        if (defaultHandled)
+            doubleClickEvent->setDefaultHandled();
+        dispatcher.dispatchEvent(doubleClickEvent);
+        if (doubleClickEvent->defaultHandled() || doubleClickEvent->defaultPrevented())
+            swallowEvent = true;
+    }
+
+    return swallowEvent;
+}
+
+const EventContext* EventDispatcher::topEventContext()
+{
+    return m_ancestors.isEmpty() ? 0 : &m_ancestors.last();
+}
+
+bool EventDispatcher::ancestorsInitialized() const
+{
+    return m_ancestors.size();
+}
+
+EventDispatchBehavior EventDispatcher::determineDispatchBehavior(Event* event)
+{
+    // Per XBL 2.0 spec, mutation events should never cross shadow DOM boundary:
+    // http://dev.w3.org/2006/xbl2/#event-flow-and-targeting-across-shadow-s
+    if (event->isMutationEvent())
+        return StayInsideShadowDOM;
+
+    // WebKit never allowed selectstart event to cross the the shadow DOM boundary.
+    // Changing this breaks existing sites.
+    // See https://bugs.webkit.org/show_bug.cgi?id=52195 for details.
+    if (event->type() == eventNames().selectstartEvent)
+        return StayInsideShadowDOM;
+
+    return RetargetEvent;
+}
+
+}
+
diff --git a/Source/WebCore/dom/EventDispatcher.h b/Source/WebCore/dom/EventDispatcher.h
new file mode 100644
index 0000000..d43127f
--- /dev/null
+++ b/Source/WebCore/dom/EventDispatcher.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ *           (C) 2001 Dirk Mueller (mueller@kde.org)
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef EventDispatcher_h
+#define EventDispatcher_h
+
+#include <wtf/Forward.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Event;
+class EventContext;
+class EventTarget;
+class FrameView;
+class Node;
+class PlatformKeyboardEvent;
+class PlatformMouseEvent;
+class PlatformWheelEvent;
+
+enum EventDispatchBehavior {
+    RetargetEvent,
+    StayInsideShadowDOM
+};
+
+class EventDispatcher {
+public:
+    static bool dispatchEvent(Node*, PassRefPtr<Event>);
+    static void dispatchScopedEvent(Node*, PassRefPtr<Event>);
+
+    static bool dispatchMouseEvent(Node*, const PlatformMouseEvent&, const AtomicString& eventType, int clickCount = 0, Node* relatedTarget = 0);
+    static void dispatchSimulatedClick(Node*, PassRefPtr<Event> underlyingEvent, bool sendMouseEvents, bool showPressedLook);
+    static void dispatchWheelEvent(Node*, PlatformWheelEvent&);
+
+    bool dispatchEvent(PassRefPtr<Event>);
+private:
+    EventDispatcher(Node*);
+
+    EventDispatchBehavior determineDispatchBehavior(Event*);
+    void getEventAncestors(EventTarget* originalTarget, EventDispatchBehavior);
+    const EventContext* topEventContext();
+    bool ancestorsInitialized() const;
+
+    bool dispatchMouseEvent(const AtomicString& eventType, int button, int detail,
+        int pageX, int pageY, int screenX, int screenY, bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
+        bool isSimulated, Node* relatedTargetArg, PassRefPtr<Event> underlyingEvent);
+
+    Vector<EventContext> m_ancestors;
+    RefPtr<Node> m_node;
+    RefPtr<EventTarget> m_originalTarget;
+    RefPtr<FrameView> m_view;
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/dom/ExceptionCode.h b/Source/WebCore/dom/ExceptionCode.h
index dd976c7..881c3a3 100644
--- a/Source/WebCore/dom/ExceptionCode.h
+++ b/Source/WebCore/dom/ExceptionCode.h
@@ -57,13 +57,13 @@ namespace WebCore {
         NETWORK_ERR = 19,
         ABORT_ERR = 20,
         URL_MISMATCH_ERR = 21,
-        QUOTA_EXCEEDED_ERR = 22,
+        QUOTA_EXCEEDED_ERR = 22
 
         // Introduced in File API:
         // http://www.w3.org/TR/file-upload/#dfn-fileerror
 #if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
-        NOT_READABLE_ERR = 24,
-        ENCODING_ERR = 26,
+        , NOT_READABLE_ERR = 24
+        , ENCODING_ERR = 26
 #endif
     };
 
diff --git a/Source/WebCore/dom/InputElement.cpp b/Source/WebCore/dom/InputElement.cpp
index b60fd44..b467df3 100644
--- a/Source/WebCore/dom/InputElement.cpp
+++ b/Source/WebCore/dom/InputElement.cpp
@@ -38,22 +38,13 @@
 #include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
-#include "HTMLInputElement.h"
-#include "HTMLNames.h"
 #include "Page.h"
 #include "RenderTextControlSingleLine.h"
 #include "SelectionController.h"
 #include "TextIterator.h"
 
-#if ENABLE(WML)
-#include "WMLInputElement.h"
-#include "WMLNames.h"
-#endif
-
 namespace WebCore {
 
-using namespace HTMLNames;
-
 // FIXME: According to HTML4, the length attribute's value can be arbitrarily
 // large. However, due to https://bugs.webkit.org/show_bug.cgi?id=14536 things
 // get rather sluggish when a text field has a larger number of characters than
@@ -287,19 +278,6 @@ const AtomicString& InputElementData::name() const
     return m_name.isNull() ? emptyAtom : m_name;
 }
 
-InputElement* toInputElement(Element* element)
-{
-    if (element->isHTMLElement() && (element->hasTagName(inputTag) || element->hasTagName(isindexTag)))
-        return static_cast<HTMLInputElement*>(element);
-
-#if ENABLE(WML)
-    if (element->isWMLElement() && element->hasTagName(WMLNames::inputTag))
-        return static_cast<WMLInputElement*>(element);
-#endif
-
-    return 0;
-}
-
 #if ENABLE(WCSS)
 static inline const AtomicString& formatCodes()
 {
diff --git a/Source/WebCore/dom/InputElement.h b/Source/WebCore/dom/InputElement.h
index 838adf5..26bf58d 100644
--- a/Source/WebCore/dom/InputElement.h
+++ b/Source/WebCore/dom/InputElement.h
@@ -160,8 +160,6 @@ private:
 #endif
 };
 
-InputElement* toInputElement(Element*);
-
 }
 
 #endif
diff --git a/Source/WebCore/dom/KeyboardEvent.cpp b/Source/WebCore/dom/KeyboardEvent.cpp
index 7b0f3af..109135d 100644
--- a/Source/WebCore/dom/KeyboardEvent.cpp
+++ b/Source/WebCore/dom/KeyboardEvent.cpp
@@ -25,6 +25,7 @@
 
 #include "Document.h"
 #include "DOMWindow.h"
+#include "EventDispatcher.h"
 #include "EventNames.h"
 #include "EventHandler.h"
 #include "Frame.h"
@@ -160,4 +161,10 @@ KeyboardEvent* findKeyboardEvent(Event* event)
     return 0;
 }
 
+bool KeyboardEvent::dispatch(EventDispatcher* dispatcher)
+{
+    // Make sure not to return true if we already took default action while handling the event.
+    return dispatcher->dispatchEvent(this) && !defaultHandled();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/KeyboardEvent.h b/Source/WebCore/dom/KeyboardEvent.h
index eeaef80..ebdb9c8 100644
--- a/Source/WebCore/dom/KeyboardEvent.h
+++ b/Source/WebCore/dom/KeyboardEvent.h
@@ -29,6 +29,8 @@
 
 namespace WebCore {
 
+    class EventDispatcher;
+    class Node;
     class PlatformKeyboardEvent;
 
 #if PLATFORM(MAC)
@@ -99,6 +101,7 @@ namespace WebCore {
         KeyboardEvent(const AtomicString& type, bool canBubble, bool cancelable, AbstractView*,
                       const String& keyIdentifier, unsigned keyLocation,
                       bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, bool altGraphKey);
+        virtual bool dispatch(EventDispatcher*);
 
         OwnPtr<PlatformKeyboardEvent> m_keyEvent;
         String m_keyIdentifier;
diff --git a/Source/WebCore/dom/MouseEvent.cpp b/Source/WebCore/dom/MouseEvent.cpp
index bdd39d3..0acbd74 100644
--- a/Source/WebCore/dom/MouseEvent.cpp
+++ b/Source/WebCore/dom/MouseEvent.cpp
@@ -23,10 +23,23 @@
 #include "config.h"
 #include "MouseEvent.h"
 
+#include "Frame.h"
+#include "FrameView.h"
 #include "EventNames.h"
+#include "PlatformMouseEvent.h"
 
 namespace WebCore {
 
+PassRefPtr<MouseEvent> MouseEvent::create(const AtomicString& eventType, PassRefPtr<AbstractView> view, const PlatformMouseEvent& event, const IntPoint& position, int detail, PassRefPtr<Node> relatedTarget)
+{
+    bool isCancelable = eventType != eventNames().mousemoveEvent;
+
+    return MouseEvent::create(eventType, true, isCancelable, view,
+        detail, event.globalX(), event.globalY(), position.x(), position.y(),
+        event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey(), event.button(),
+        relatedTarget, 0, false);
+}
+
 MouseEvent::MouseEvent()
     : m_button(0)
     , m_buttonDown(false)
@@ -115,4 +128,25 @@ Node* MouseEvent::fromElement() const
     return target() ? target()->toNode() : 0;
 }
 
+PassRefPtr<SimulatedMouseEvent> SimulatedMouseEvent::create(const AtomicString& eventType, PassRefPtr<AbstractView> view, PassRefPtr<Event> underlyingEvent)
+{
+    return adoptRef(new SimulatedMouseEvent(eventType, view, underlyingEvent));
+}
+
+SimulatedMouseEvent::~SimulatedMouseEvent()
+{
+}
+
+SimulatedMouseEvent::SimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<AbstractView> view, PassRefPtr<Event> underlyingEvent)
+    : MouseEvent(eventType, true, true, view, 0, 0, 0, 0, 0, false, false, false, false, 0, 0, 0, true)
+{
+    if (UIEventWithKeyState* keyStateEvent = findEventWithKeyState(underlyingEvent.get())) {
+        m_ctrlKey = keyStateEvent->ctrlKey();
+        m_altKey = keyStateEvent->altKey();
+        m_shiftKey = keyStateEvent->shiftKey();
+        m_metaKey = keyStateEvent->metaKey();
+    }
+    setUnderlyingEvent(underlyingEvent);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/MouseEvent.h b/Source/WebCore/dom/MouseEvent.h
index 7454b04..06e6218 100644
--- a/Source/WebCore/dom/MouseEvent.h
+++ b/Source/WebCore/dom/MouseEvent.h
@@ -29,6 +29,8 @@
 
 namespace WebCore {
 
+class PlatformMouseEvent;
+
     // Introduced in DOM Level 2
     class MouseEvent : public MouseRelatedEvent {
     public:
@@ -44,6 +46,8 @@ namespace WebCore {
             return adoptRef(new MouseEvent(type, canBubble, cancelable, view, detail, screenX, screenY, pageX, pageY,
                 ctrlKey, altKey, shiftKey, metaKey, button, relatedTarget, clipboard, isSimulated));
         }
+        static PassRefPtr<MouseEvent> create(const AtomicString& eventType, PassRefPtr<AbstractView>, const PlatformMouseEvent&, const IntPoint&, int detail, PassRefPtr<Node> relatedTarget);
+
         virtual ~MouseEvent();
 
         void initMouseEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView>,
@@ -68,19 +72,30 @@ namespace WebCore {
         virtual bool isDragEvent() const;
         virtual int which() const;
 
-    private:
-        MouseEvent();
+    protected:
         MouseEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView>,
                    int detail, int screenX, int screenY, int pageX, int pageY,
                    bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, unsigned short button,
                    PassRefPtr<EventTarget> relatedTarget, PassRefPtr<Clipboard> clipboard, bool isSimulated);
 
+    private:
+        MouseEvent();
+
         unsigned short m_button;
         bool m_buttonDown;
         RefPtr<EventTarget> m_relatedTarget;
         RefPtr<Clipboard> m_clipboard;
     };
 
+class SimulatedMouseEvent : public MouseEvent {
+public:
+    static PassRefPtr<SimulatedMouseEvent> create(const AtomicString& eventType, PassRefPtr<AbstractView>, PassRefPtr<Event> underlyingEvent);
+    virtual ~SimulatedMouseEvent();
+
+private:
+    SimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<AbstractView>, PassRefPtr<Event> underlyingEvent);
+};
+
 } // namespace WebCore
 
 #endif // MouseEvent_h
diff --git a/Source/WebCore/dom/MouseRelatedEvent.cpp b/Source/WebCore/dom/MouseRelatedEvent.cpp
index 072656e..f752670 100644
--- a/Source/WebCore/dom/MouseRelatedEvent.cpp
+++ b/Source/WebCore/dom/MouseRelatedEvent.cpp
@@ -44,6 +44,7 @@ MouseRelatedEvent::MouseRelatedEvent()
     , m_offsetX(0)
     , m_offsetY(0)
     , m_isSimulated(false)
+    , m_hasCachedRelativePosition(false)
 {
 }
 
@@ -91,21 +92,20 @@ MouseRelatedEvent::MouseRelatedEvent(const AtomicString& eventType, bool canBubb
 void MouseRelatedEvent::initCoordinates()
 {
     // Set up initial values for coordinates.
-    // Correct values can't be computed until we have at target, so receivedTarget
-    // does the "real" computation.
+    // Correct values are computed lazily, see computeRelativePosition.
     m_layerX = m_pageX;
     m_layerY = m_pageY;
     m_offsetX = m_pageX;
     m_offsetY = m_pageY;
 
     computePageLocation();
+    m_hasCachedRelativePosition = false;
 }
 
 void MouseRelatedEvent::initCoordinates(int clientX, int clientY)
 {
     // Set up initial values for coordinates.
-    // Correct values can't be computed until we have at target, so receivedTarget
-    // does the "real" computation.
+    // Correct values are computed lazily, see computeRelativePosition.
     m_clientX = clientX;
     m_clientY = clientY;
     m_pageX = clientX + contentsX(view());
@@ -116,9 +116,10 @@ void MouseRelatedEvent::initCoordinates(int clientX, int clientY)
     m_offsetY = m_pageY;
 
     computePageLocation();
+    m_hasCachedRelativePosition = false;
 }
 
-static float pageZoomFactor(UIEvent* event)
+static float pageZoomFactor(const UIEvent* event)
 {
     DOMWindow* window = event->view();
     if (!window)
@@ -137,9 +138,13 @@ void MouseRelatedEvent::computePageLocation()
 
 void MouseRelatedEvent::receivedTarget()
 {
-    ASSERT(target());
-    Node* targ = target()->toNode();
-    if (!targ)
+    m_hasCachedRelativePosition = false;
+}
+
+void MouseRelatedEvent::computeRelativePosition()
+{
+    Node* targetNode = target() ? target()->toNode() : 0;
+    if (!targetNode)
         return;
 
     // Compute coordinates that are based on the target.
@@ -149,11 +154,11 @@ void MouseRelatedEvent::receivedTarget()
     m_offsetY = m_pageY;
 
     // Must have an updated render tree for this math to work correctly.
-    targ->document()->updateStyleIfNeeded();
+    targetNode->document()->updateStyleIfNeeded();
 
     // Adjust offsetX/Y to be relative to the target's position.
     if (!isSimulated()) {
-        if (RenderObject* r = targ->renderer()) {
+        if (RenderObject* r = targetNode->renderer()) {
             FloatPoint localPos = r->absoluteToLocal(absoluteLocation(), false, true);
             float zoomFactor = pageZoomFactor(this);
             m_offsetX = lroundf(localPos.x() / zoomFactor);
@@ -166,17 +171,48 @@ void MouseRelatedEvent::receivedTarget()
     // Our RenderLayer is a more modern concept, and layerX/Y is some
     // other notion about groups of elements (left over from the Netscape 4 days?);
     // we should test and fix this.
-    Node* n = targ;
+    Node* n = targetNode;
     while (n && !n->renderer())
         n = n->parentNode();
-    if (n) {
-        RenderLayer* layer = n->renderer()->enclosingLayer();
+
+    RenderLayer* layer;
+    if (n && (layer = n->renderer()->enclosingLayer())) {
         layer->updateLayerPosition();
         for (; layer; layer = layer->parent()) {
             m_layerX -= layer->x();
             m_layerY -= layer->y();
         }
     }
+
+    m_hasCachedRelativePosition = true;
+}
+
+int MouseRelatedEvent::layerX()
+{
+    if (!m_hasCachedRelativePosition)
+        computeRelativePosition();
+    return m_layerX;
+}
+
+int MouseRelatedEvent::layerY()
+{
+    if (!m_hasCachedRelativePosition)
+        computeRelativePosition();
+    return m_layerY;
+}
+
+int MouseRelatedEvent::offsetX()
+{
+    if (!m_hasCachedRelativePosition)
+        computeRelativePosition();
+    return m_offsetX;
+}
+
+int MouseRelatedEvent::offsetY()
+{
+    if (!m_hasCachedRelativePosition)
+        computeRelativePosition();
+    return m_offsetY;
 }
 
 int MouseRelatedEvent::pageX() const
diff --git a/Source/WebCore/dom/MouseRelatedEvent.h b/Source/WebCore/dom/MouseRelatedEvent.h
index fc494d1..b03b28a 100644
--- a/Source/WebCore/dom/MouseRelatedEvent.h
+++ b/Source/WebCore/dom/MouseRelatedEvent.h
@@ -38,10 +38,10 @@ namespace WebCore {
         int screenY() const { return m_screenY; }
         int clientX() const { return m_clientX; }
         int clientY() const { return m_clientY; }
-        int layerX() const { return m_layerX; }
-        int layerY() const { return m_layerY; }
-        int offsetX() const { return m_offsetX; }
-        int offsetY() const { return m_offsetY; }
+        int layerX();
+        int layerY();
+        int offsetX();
+        int offsetY();
         bool isSimulated() const { return m_isSimulated; }
         virtual int pageX() const;
         virtual int pageY() const;
@@ -64,6 +64,7 @@ namespace WebCore {
         virtual void receivedTarget();
 
         void computePageLocation();
+        void computeRelativePosition();
         
         // Expose these so MouseEvent::initMouseEvent can set them.
         int m_screenX;
@@ -80,6 +81,7 @@ namespace WebCore {
         int m_offsetY;
         IntPoint m_absoluteLocation;
         bool m_isSimulated;
+        bool m_hasCachedRelativePosition;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/NamedNodeMap.cpp b/Source/WebCore/dom/NamedNodeMap.cpp
index 2861226..6fa30bf 100644
--- a/Source/WebCore/dom/NamedNodeMap.cpp
+++ b/Source/WebCore/dom/NamedNodeMap.cpp
@@ -100,12 +100,6 @@ PassRefPtr<Node> NamedNodeMap::setNamedItem(Node* arg, ExceptionCode& ec)
         return 0;
     }
 
-    // WRONG_DOCUMENT_ERR: Raised if arg was created from a different document than the one that created this map.
-    if (arg->document() != m_element->document()) {
-        ec = WRONG_DOCUMENT_ERR;
-        return 0;
-    }
-
     // Not mentioned in spec: throw a HIERARCHY_REQUEST_ERROR if the user passes in a non-attribute node
     if (!arg->isAttributeNode()) {
         ec = HIERARCHY_REQUEST_ERR;
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index c125d16..4def034 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -51,6 +51,7 @@
 #include "Element.h"
 #include "Event.h"
 #include "EventContext.h"
+#include "EventDispatcher.h"
 #include "EventException.h"
 #include "EventHandler.h"
 #include "EventListener.h"
@@ -106,10 +107,13 @@
 
 #if ENABLE(SVG)
 #include "SVGElementInstance.h"
-#include "SVGNames.h"
 #include "SVGUseElement.h"
 #endif
 
+#if ENABLE(WML)
+#include "WMLNames.h"
+#endif
+
 #if ENABLE(XHTMLMP)
 #include "HTMLNoScriptElement.h"
 #endif
@@ -126,8 +130,6 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-static HashSet<Node*>* gNodesDispatchingSimulatedClicks = 0;
-
 bool Node::isSupported(const String& feature, const String& version)
 {
     return DOMImplementation::hasFeature(feature, version);
@@ -347,6 +349,12 @@ Node::StyleChange Node::diff(const RenderStyle* s1, const RenderStyle* s2)
         }
     }
 
+    // When text-combine property has been changed, we need to prepare a separate renderer object.
+    // When text-combine is on, we use RenderCombineText, otherwise RenderText.
+    // https://bugs.webkit.org/show_bug.cgi?id=55069
+    if ((s1 && s2) && (s1->hasTextCombine() != s2->hasTextCombine()))
+        ch = Detach;
+
     return ch;
 }
 
@@ -506,6 +514,18 @@ void Node::setShadowHost(Element* host)
     setParent(host);
 }
 
+InputElement* Node::toInputElement()
+{
+    // If one of the below ASSERTs trigger, you are calling this function
+    // directly or indirectly from a constructor or destructor of this object.
+    // Don't do this!
+    ASSERT(!(isHTMLElement() && hasTagName(inputTag)));
+#if ENABLE(WML)
+    ASSERT(!(isWMLElement() && hasTagName(WMLNames::inputTag)));
+#endif
+    return 0;
+}
+
 short Node::tabIndex() const
 {
     return hasRareData() ? rareData()->tabIndex() : 0;
@@ -694,19 +714,36 @@ void Node::deprecatedParserAddChild(PassRefPtr<Node>)
 {
 }
 
-bool Node::isContentEditable() const
+bool Node::rendererIsEditable(EditableLevel editableLevel) const
 {
-    return parentOrHostNode() && parentOrHostNode()->isContentEditable();
-}
+    if (document()->inDesignMode() || (document()->frame() && document()->frame()->page() && document()->frame()->page()->isEditable()))
+        return true;
 
-bool Node::isContentRichlyEditable() const
-{
-    return parentOrHostNode() && parentOrHostNode()->isContentRichlyEditable();
+    // Ideally we'd call ASSERT(!needsStyleRecalc()) here, but
+    // ContainerNode::setFocus() calls setNeedsStyleRecalc(), so the assertion
+    // would fire in the middle of Document::setFocusedNode().
+
+    for (const Node* node = this; node; node = node->parentNode()) {
+        if ((node->isHTMLElement() || node->isDocumentNode()) && node->renderer()) {
+            switch (node->renderer()->style()->userModify()) {
+            case READ_ONLY:
+                return false;
+            case READ_WRITE:
+                return true;
+            case READ_WRITE_PLAINTEXT_ONLY:
+                return editableLevel != RichlyEditable;
+            }
+            ASSERT_NOT_REACHED();
+            return false;
+        }
+    }
+
+    return false;
 }
 
 bool Node::shouldUseInputMethod() const
 {
-    return isContentEditable();
+    return rendererIsEditable();
 }
 
 RenderBox* Node::renderBox() const
@@ -764,10 +801,16 @@ bool Node::hasNonEmptyBoundingBox() const
 
 void Node::setDocumentRecursively(Document* document)
 {
-    // FIXME: To match Gecko, we should do this for nodes that are already in the document as well.
-    if (this->document() == document || this->inDocument())
+    if (this->document() == document)
         return;
 
+    // If an element is moved from a document and then eventually back again the collection cache for
+    // that element may contain stale data as changes made to it will have updated the DOMTreeVersion
+    // of the document it was moved to. By increasing the DOMTreeVersion of the donating document here
+    // we ensure that the collection cache will be invalidated as needed when the element is moved back.
+    if (this->document())
+        this->document()->incDOMTreeVersion();
+
     for (Node* node = this; node; node = node->traverseNextNode(this)) {
         node->setDocument(document);
         if (!node->isElementNode())
@@ -1147,37 +1190,25 @@ bool Node::canReplaceChild(Node* newChild, Node*)
 
 static void checkAcceptChild(Node* newParent, Node* newChild, ExceptionCode& ec)
 {
-    // Perform error checking as required by spec for adding a new child. Used by replaceChild().
-    
     // Not mentioned in spec: throw NOT_FOUND_ERR if newChild is null
     if (!newChild) {
         ec = NOT_FOUND_ERR;
         return;
     }
     
-    // NO_MODIFICATION_ALLOWED_ERR: Raised if this node is readonly
     if (newParent->isReadOnlyNode()) {
         ec = NO_MODIFICATION_ALLOWED_ERR;
         return;
     }
-    
-    // WRONG_DOCUMENT_ERR: Raised if newChild was created from a different document than the one that
-    // created this node.
-    // We assume that if newChild is a DocumentFragment, all children are created from the same document
-    // as the fragment itself (otherwise they could not have been added as children)
-    if (newChild->document() != newParent->document() && newChild->inDocument()) {
-        // but if the child is not in a document yet then loosen the
-        // restriction, so that e.g. creating an element with the Option()
-        // constructor and then adding it to a different document works,
-        // as it does in Mozilla and Mac IE.
-        ec = WRONG_DOCUMENT_ERR;
+
+    if (newChild->inDocument() && newChild->nodeType() == Node::DOCUMENT_TYPE_NODE) {
+        ec = HIERARCHY_REQUEST_ERR;
         return;
     }
-    
+
     // HIERARCHY_REQUEST_ERR: Raised if this node is of a type that does not allow children of the type of the
     // newChild node, or if the node to append is one of this node's ancestors.
 
-    // check for ancestor/same node
     if (newChild == newParent || newParent->isDescendantOf(newChild)) {
         ec = HIERARCHY_REQUEST_ERR;
         return;
@@ -1186,6 +1217,11 @@ static void checkAcceptChild(Node* newParent, Node* newChild, ExceptionCode& ec)
 
 void Node::checkReplaceChild(Node* newChild, Node* oldChild, ExceptionCode& ec)
 {
+    if (!oldChild) {
+        ec = NOT_FOUND_ERR;
+        return;
+    }
+
     checkAcceptChild(this, newChild, ec);
     if (ec)
         return;
@@ -1481,7 +1517,7 @@ int Node::maxCharacterOffset() const
 // is obviously misplaced.
 bool Node::canStartSelection() const
 {
-    if (isContentEditable())
+    if (rendererIsEditable())
         return true;
 
     if (renderer()) {
@@ -1559,7 +1595,7 @@ Element *Node::enclosingBlockFlowElement() const
 Element* Node::rootEditableElement() const
 {
     Element* result = 0;
-    for (Node* n = const_cast<Node*>(this); n && n->isContentEditable(); n = n->parentNode()) {
+    for (Node* n = const_cast<Node*>(this); n && n->rendererIsEditable(); n = n->parentNode()) {
         if (n->isElementNode())
             result = static_cast<Element*>(n);
         if (n->hasTagName(bodyTag))
@@ -2638,200 +2674,14 @@ void Node::handleLocalEvents(Event* event)
     fireEventListeners(event);
 }
 
-static inline EventTarget* eventTargetRespectingSVGTargetRules(Node* referenceNode)
-{
-    ASSERT(referenceNode);
-
-#if ENABLE(SVG)
-    if (!referenceNode->isSVGElement())
-        return referenceNode;
-
-    // Spec: The event handling for the non-exposed tree works as if the referenced element had been textually included
-    // as a deeply cloned child of the 'use' element, except that events are dispatched to the SVGElementInstance objects
-    for (Node* n = referenceNode; n; n = n->parentNode()) {
-        if (!n->isShadowRoot() || !n->isSVGElement())
-            continue;
-
-        Element* shadowTreeParentElement = n->shadowHost();
-        ASSERT(shadowTreeParentElement->hasTagName(SVGNames::useTag));
-
-        if (SVGElementInstance* instance = static_cast<SVGUseElement*>(shadowTreeParentElement)->instanceForShadowTreeElement(referenceNode))
-            return instance;
-    }
-#endif
-
-    return referenceNode;
-}
-
-void Node::getEventAncestors(Vector<EventContext>& ancestors, EventTarget* originalTarget, EventDispatchBehavior behavior)
-{
-    if (!inDocument())
-        return;
-
-    EventTarget* target = originalTarget;
-    Node* ancestor = this;
-    bool shouldSkipNextAncestor = false;
-    while (true) {
-        if (ancestor->isShadowRoot()) {
-            if (behavior == StayInsideShadowDOM)
-                return;
-            ancestor = ancestor->shadowHost();
-            if (!shouldSkipNextAncestor)
-                target = ancestor;
-        } else
-            ancestor = ancestor->parentNodeGuaranteedHostFree();
-
-        if (!ancestor)
-            return;
-
-#if ENABLE(SVG)
-        // Skip SVGShadowTreeRootElement.
-        shouldSkipNextAncestor = ancestor->isSVGElement() && ancestor->isShadowRoot();
-        if (shouldSkipNextAncestor)
-            continue;
-#endif
-        // FIXME: Unroll the extra loop inside eventTargetRespectingSVGTargetRules into this loop.
-        ancestors.append(EventContext(ancestor, eventTargetRespectingSVGTargetRules(ancestor), target));
-
-    }
-}
-
-bool Node::dispatchEvent(PassRefPtr<Event> prpEvent)
-{
-    RefPtr<EventTarget> protect = this;
-    RefPtr<Event> event = prpEvent;
-
-    event->setTarget(eventTargetRespectingSVGTargetRules(this));
-
-    RefPtr<FrameView> view = document()->view();
-    return dispatchGenericEvent(event.release());
-}
-
 void Node::dispatchScopedEvent(PassRefPtr<Event> event)
 {
-    // We need to set the target here because it can go away by the time we actually fire the event.
-    event->setTarget(eventTargetRespectingSVGTargetRules(this));
-
-    ScopedEventQueue::instance()->enqueueEvent(event);
-}
-
-static const EventContext* topEventContext(const Vector<EventContext>& ancestors)
-{
-    return ancestors.isEmpty() ? 0 : &ancestors.last();
+    EventDispatcher::dispatchScopedEvent(this, event);
 }
 
-static EventDispatchBehavior determineDispatchBehavior(Event* event)
+bool Node::dispatchEvent(PassRefPtr<Event> event)
 {
-    // Per XBL 2.0 spec, mutation events should never cross shadow DOM boundary:
-    // http://dev.w3.org/2006/xbl2/#event-flow-and-targeting-across-shadow-s
-    if (event->isMutationEvent())
-        return StayInsideShadowDOM;
-
-    // WebKit never allowed selectstart event to cross the the shadow DOM boundary.
-    // Changing this breaks existing sites.
-    // See https://bugs.webkit.org/show_bug.cgi?id=52195 for details.
-    if (event->type() == eventNames().selectstartEvent)
-        return StayInsideShadowDOM;
-
-    return RetargetEvent;
-}
-
-bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
-{
-    RefPtr<Event> event(prpEvent);
-
-    ASSERT(!eventDispatchForbidden());
-    ASSERT(event->target());
-    ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
-
-    // Make a vector of ancestors to send the event to.
-    // If the node is not in a document just send the event to it.
-    // Be sure to ref all of nodes since event handlers could result in the last reference going away.
-    RefPtr<Node> thisNode(this);
-    RefPtr<EventTarget> originalTarget = event->target();
-    Vector<EventContext> ancestors;
-    getEventAncestors(ancestors, originalTarget.get(), determineDispatchBehavior(event.get()));
-
-    WindowEventContext windowContext(event.get(), this, topEventContext(ancestors));
-
-    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willDispatchEvent(document(), *event, windowContext.window(), this, ancestors);
-
-    // Give the target node a chance to do some work before DOM event handlers get a crack.
-    void* data = preDispatchEventHandler(event.get());
-    if (event->propagationStopped())
-        goto doneDispatching;
-
-    // Trigger capturing event handlers, starting at the top and working our way down.
-    event->setEventPhase(Event::CAPTURING_PHASE);
-
-    if (windowContext.handleLocalEvents(event.get()) && event->propagationStopped())
-        goto doneDispatching;
-
-    for (size_t i = ancestors.size(); i; --i) {
-        ancestors[i - 1].handleLocalEvents(event.get());
-        if (event->propagationStopped())
-            goto doneDispatching;
-    }
-
-    event->setEventPhase(Event::AT_TARGET);
-    event->setTarget(originalTarget.get());
-    event->setCurrentTarget(eventTargetRespectingSVGTargetRules(this));
-    handleLocalEvents(event.get());
-    if (event->propagationStopped())
-        goto doneDispatching;
-
-    if (event->bubbles() && !event->cancelBubble()) {
-        // Trigger bubbling event handlers, starting at the bottom and working our way up.
-        event->setEventPhase(Event::BUBBLING_PHASE);
-
-        size_t size = ancestors.size();
-        for (size_t i = 0; i < size; ++i) {
-            ancestors[i].handleLocalEvents(event.get());
-            if (event->propagationStopped() || event->cancelBubble())
-                goto doneDispatching;
-        }
-        windowContext.handleLocalEvents(event.get());
-    }
-
-doneDispatching:
-    event->setTarget(originalTarget.get());
-    event->setCurrentTarget(0);
-    event->setEventPhase(0);
-
-    // Pass the data from the preDispatchEventHandler to the postDispatchEventHandler.
-    postDispatchEventHandler(event.get(), data);
-
-    // Call default event handlers. While the DOM does have a concept of preventing
-    // default handling, the detail of which handlers are called is an internal
-    // implementation detail and not part of the DOM.
-    if (!event->defaultPrevented() && !event->defaultHandled()) {
-        // Non-bubbling events call only one default event handler, the one for the target.
-        defaultEventHandler(event.get());
-        ASSERT(!event->defaultPrevented());
-        if (event->defaultHandled())
-            goto doneWithDefault;
-        // For bubbling events, call default event handlers on the same targets in the
-        // same order as the bubbling phase.
-        if (event->bubbles()) {
-            size_t size = ancestors.size();
-            for (size_t i = 0; i < size; ++i) {
-                ancestors[i].node()->defaultEventHandler(event.get());
-                ASSERT(!event->defaultPrevented());
-                if (event->defaultHandled())
-                    goto doneWithDefault;
-            }
-        }
-    }
-
-doneWithDefault:
-
-    // Ensure that after event dispatch, the event's target object is the
-    // outermost shadow DOM boundary.
-    event->setTarget(windowContext.target());
-    event->setCurrentTarget(0);
-    InspectorInstrumentation::didDispatchEvent(cookie);
-
-    return !event->defaultPrevented();
+    return EventDispatcher::dispatchEvent(this, event);
 }
 
 void Node::dispatchSubtreeModifiedEvent()
@@ -2861,209 +2711,25 @@ void Node::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr
     dispatchScopedEvent(event.release());
 }
 
-bool Node::dispatchKeyEvent(const PlatformKeyboardEvent& key)
+bool Node::dispatchKeyEvent(const PlatformKeyboardEvent& event)
 {
-    RefPtr<KeyboardEvent> keyboardEvent = KeyboardEvent::create(key, document()->defaultView());
-    bool r = dispatchEvent(keyboardEvent);
-    
-    // we want to return false if default is prevented (already taken care of)
-    // or if the element is default-handled by the DOM. Otherwise we let it just
-    // let it get handled by AppKit 
-    if (keyboardEvent->defaultHandled())
-        r = false;
-    
-    return r;
+    return EventDispatcher::dispatchEvent(this, KeyboardEvent::create(event, document()->defaultView()));
 }
 
 bool Node::dispatchMouseEvent(const PlatformMouseEvent& event, const AtomicString& eventType,
     int detail, Node* relatedTarget)
 {
-    ASSERT(!eventDispatchForbidden());
-    
-    IntPoint contentsPos;
-    if (FrameView* view = document()->view())
-        contentsPos = view->windowToContents(event.pos());
-
-    short button = event.button();
-
-    ASSERT(event.eventType() == MouseEventMoved || button != NoButton);
-    
-    return dispatchMouseEvent(eventType, button, detail,
-        contentsPos.x(), contentsPos.y(), event.globalX(), event.globalY(),
-        event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey(),
-        false, relatedTarget, 0);
-}
-
-void Node::dispatchSimulatedMouseEvent(const AtomicString& eventType,
-    PassRefPtr<Event> underlyingEvent)
-{
-    ASSERT(!eventDispatchForbidden());
-
-    bool ctrlKey = false;
-    bool altKey = false;
-    bool shiftKey = false;
-    bool metaKey = false;
-    if (UIEventWithKeyState* keyStateEvent = findEventWithKeyState(underlyingEvent.get())) {
-        ctrlKey = keyStateEvent->ctrlKey();
-        altKey = keyStateEvent->altKey();
-        shiftKey = keyStateEvent->shiftKey();
-        metaKey = keyStateEvent->metaKey();
-    }
-
-    // Like Gecko, we just pass 0 for everything when we make a fake mouse event.
-    // Internet Explorer instead gives the current mouse position and state.
-    dispatchMouseEvent(eventType, 0, 0, 0, 0, 0, 0,
-        ctrlKey, altKey, shiftKey, metaKey, true, 0, underlyingEvent);
+    return EventDispatcher::dispatchMouseEvent(this, event, eventType, detail, relatedTarget);
 }
 
 void Node::dispatchSimulatedClick(PassRefPtr<Event> event, bool sendMouseEvents, bool showPressedLook)
 {
-    if (!gNodesDispatchingSimulatedClicks)
-        gNodesDispatchingSimulatedClicks = new HashSet<Node*>;
-    else if (gNodesDispatchingSimulatedClicks->contains(this))
-        return;
-    
-    gNodesDispatchingSimulatedClicks->add(this);
-    
-    // send mousedown and mouseup before the click, if requested
-    if (sendMouseEvents)
-        dispatchSimulatedMouseEvent(eventNames().mousedownEvent, event.get());
-    setActive(true, showPressedLook);
-    if (sendMouseEvents)
-        dispatchSimulatedMouseEvent(eventNames().mouseupEvent, event.get());
-    setActive(false);
-
-    // always send click
-    dispatchSimulatedMouseEvent(eventNames().clickEvent, event);
-    
-    gNodesDispatchingSimulatedClicks->remove(this);
-}
-
-// FIXME: Once https://bugs.webkit.org/show_bug.cgi?id=52963 lands, this should
-// be greatly improved. See https://bugs.webkit.org/show_bug.cgi?id=54025.
-static Node* pullOutOfShadow(Node* node)
-{
-    Node* outermostShadowBoundary = node;
-    for (Node* n = node; n; n = n->parentOrHostNode()) {
-        if (n->isShadowRoot())
-            outermostShadowBoundary = n->parentOrHostNode();
-    }
-    return outermostShadowBoundary;
-}
-
-bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int detail,
-    int pageX, int pageY, int screenX, int screenY,
-    bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, 
-    bool isSimulated, Node* relatedTargetArg, PassRefPtr<Event> underlyingEvent)
-{
-    ASSERT(!eventDispatchForbidden());
-    if (disabled()) // Don't even send DOM events for disabled controls..
-        return true;
-    
-    if (eventType.isEmpty())
-        return false; // Shouldn't happen.
-    
-    // Dispatching the first event can easily result in this node being destroyed.
-    // Since we dispatch up to three events here, we need to make sure we're referenced
-    // so the pointer will be good for the two subsequent ones.
-    RefPtr<Node> protect(this);
-    
-    bool cancelable = eventType != eventNames().mousemoveEvent;
-    
-    bool swallowEvent = false;
-    
-    // Attempting to dispatch with a non-EventTarget relatedTarget causes the relatedTarget to be silently ignored.
-    RefPtr<Node> relatedTarget = pullOutOfShadow(relatedTargetArg);
-
-    int adjustedPageX = pageX;
-    int adjustedPageY = pageY;
-    if (Frame* frame = document()->frame()) {
-        float pageZoom = frame->pageZoomFactor();
-        if (pageZoom != 1.0f) {
-            // Adjust our pageX and pageY to account for the page zoom.
-            adjustedPageX = lroundf(pageX / pageZoom);
-            adjustedPageY = lroundf(pageY / pageZoom);
-        }
-    }
-
-    RefPtr<MouseEvent> mouseEvent = MouseEvent::create(eventType,
-        true, cancelable, document()->defaultView(),
-        detail, screenX, screenY, adjustedPageX, adjustedPageY,
-        ctrlKey, altKey, shiftKey, metaKey, button,
-        relatedTarget, 0, isSimulated);
-    mouseEvent->setUnderlyingEvent(underlyingEvent.get());
-    mouseEvent->setAbsoluteLocation(IntPoint(pageX, pageY));
-    
-    dispatchEvent(mouseEvent);
-    bool defaultHandled = mouseEvent->defaultHandled();
-    bool defaultPrevented = mouseEvent->defaultPrevented();
-    if (defaultHandled || defaultPrevented)
-        swallowEvent = true;
-    
-    // Special case: If it's a double click event, we also send the dblclick event. This is not part
-    // of the DOM specs, but is used for compatibility with the ondblclick="" attribute.  This is treated
-    // as a separate event in other DOM-compliant browsers like Firefox, and so we do the same.
-    if (eventType == eventNames().clickEvent && detail == 2) {
-        RefPtr<Event> doubleClickEvent = MouseEvent::create(eventNames().dblclickEvent,
-            true, cancelable, document()->defaultView(),
-            detail, screenX, screenY, adjustedPageX, adjustedPageY,
-            ctrlKey, altKey, shiftKey, metaKey, button,
-            relatedTarget, 0, isSimulated);
-        doubleClickEvent->setUnderlyingEvent(underlyingEvent.get());
-        if (defaultHandled)
-            doubleClickEvent->setDefaultHandled();
-        dispatchEvent(doubleClickEvent);
-        if (doubleClickEvent->defaultHandled() || doubleClickEvent->defaultPrevented())
-            swallowEvent = true;
-    }
-
-    return swallowEvent;
+    EventDispatcher::dispatchSimulatedClick(this, event, sendMouseEvents, showPressedLook);
 }
 
 void Node::dispatchWheelEvent(PlatformWheelEvent& e)
 {
-    ASSERT(!eventDispatchForbidden());
-    if (e.deltaX() == 0 && e.deltaY() == 0)
-        return;
-    
-    FrameView* view = document()->view();
-    if (!view)
-        return;
-    
-    IntPoint pos = view->windowToContents(e.pos());
-
-    int adjustedPageX = pos.x();
-    int adjustedPageY = pos.y();
-    if (Frame* frame = document()->frame()) {
-        float pageZoom = frame->pageZoomFactor();
-        if (pageZoom != 1.0f) {
-            // Adjust our pageX and pageY to account for the page zoom.
-            adjustedPageX = lroundf(pos.x() / pageZoom);
-            adjustedPageY = lroundf(pos.y() / pageZoom);
-        }
-    }
-    
-    WheelEvent::Granularity granularity;
-    switch (e.granularity()) {
-    case ScrollByPageWheelEvent:
-        granularity = WheelEvent::Page;
-        break;
-    case ScrollByPixelWheelEvent:
-    default:
-        granularity = WheelEvent::Pixel;
-        break;
-    }
-    
-    RefPtr<WheelEvent> we = WheelEvent::create(e.wheelTicksX(), e.wheelTicksY(), e.deltaX(), e.deltaY(), granularity,
-        document()->defaultView(), e.globalX(), e.globalY(), adjustedPageX, adjustedPageY,
-        e.ctrlKey(), e.altKey(), e.shiftKey(), e.metaKey());
-
-    we->setAbsoluteLocation(IntPoint(pos.x(), pos.y()));
-
-    if (!dispatchEvent(we) || we->defaultHandled())
-        e.accept();
-
-    we.release();
+    EventDispatcher::dispatchWheelEvent(this, e);
 }
 
 void Node::dispatchFocusEvent()
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index 7ef7e80..31f6ae8 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -53,6 +53,7 @@ class EventContext;
 class EventListener;
 class FloatPoint;
 class Frame;
+class InputElement;
 class IntRect;
 class KeyboardEvent;
 class NSResolver;
@@ -86,11 +87,6 @@ enum StyleChangeType {
     SyntheticStyleChange = 3 << nodeStyleChangeShift
 };
 
-enum EventDispatchBehavior {
-    RetargetEvent,
-    StayInsideShadowDOM
-};
-
 class Node : public EventTarget, public TreeShared<ContainerNode>, public ScriptWrappable {
     friend class Document;
 public:
@@ -224,9 +220,6 @@ public:
     // Returns the enclosing event parent node (or self) that, when clicked, would trigger a navigation.
     Node* enclosingLinkEventParentOrSelf();
 
-    // Node ancestors when concerned about event flow.
-    void getEventAncestors(Vector<EventContext>& ancestors, EventTarget*, EventDispatchBehavior = RetargetEvent);
-
     bool isBlockFlow() const;
     bool isBlockFlowOrBlockTable() const;
     
@@ -326,8 +319,12 @@ public:
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
 
-    virtual bool isContentEditable() const;
-    virtual bool isContentRichlyEditable() const;
+#if PLATFORM(MAC)
+    // Objective-C extensions
+    bool isContentEditable() const { return rendererIsEditable(Editable); }
+#endif
+    bool rendererIsEditable() const { return rendererIsEditable(Editable); }
+    bool rendererIsRichlyEditable() const { return rendererIsEditable(RichlyEditable); }
     virtual bool shouldUseInputMethod() const;
     virtual IntRect getRect() const;
     IntRect renderRect(bool* isReplaced);
@@ -529,6 +526,8 @@ public:
 
     virtual Node* toNode() { return this; }
 
+    virtual InputElement* toInputElement();
+
     virtual ScriptExecutionContext* scriptExecutionContext() const;
 
     virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
@@ -543,7 +542,6 @@ public:
     bool dispatchEvent(PassRefPtr<Event>);
     void dispatchScopedEvent(PassRefPtr<Event>);
 
-    bool dispatchGenericEvent(PassRefPtr<Event>);
     virtual void handleLocalEvents(Event*);
 
     void dispatchSubtreeModifiedEvent();
@@ -551,11 +549,6 @@ public:
     bool dispatchKeyEvent(const PlatformKeyboardEvent&);
     void dispatchWheelEvent(PlatformWheelEvent&);
     bool dispatchMouseEvent(const PlatformMouseEvent&, const AtomicString& eventType, int clickCount = 0, Node* relatedTarget = 0);
-    bool dispatchMouseEvent(const AtomicString& eventType, int button, int clickCount,
-        int pageX, int pageY, int screenX, int screenY,
-        bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
-        bool isSimulated, Node* relatedTarget, PassRefPtr<Event> underlyingEvent);
-    void dispatchSimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<Event> underlyingEvent);
     void dispatchSimulatedClick(PassRefPtr<Event> underlyingEvent, bool sendMouseEvents = false, bool showPressedLook = true);
 
     virtual void dispatchFocusEvent();
@@ -668,6 +661,9 @@ private:
     void markCachedNodeListsSlow(JSC::MarkStack&, JSC::JSGlobalData&);
 #endif
 
+    enum EditableLevel { Editable, RichlyEditable };
+    bool rendererIsEditable(EditableLevel) const;
+
     void setStyleChange(StyleChangeType);
 
     // Used to share code between lazyAttach and setNeedsStyleRecalc.
diff --git a/Source/WebCore/dom/Position.cpp b/Source/WebCore/dom/Position.cpp
index 473610a..1b58a42 100644
--- a/Source/WebCore/dom/Position.cpp
+++ b/Source/WebCore/dom/Position.cpp
@@ -46,7 +46,7 @@ using namespace HTMLNames;
 static Node* nextRenderedEditable(Node* node)
 {
     while ((node = node->nextLeafNode())) {
-        if (!node->isContentEditable())
+        if (!node->rendererIsEditable())
             continue;
         RenderObject* renderer = node->renderer();
         if (!renderer)
@@ -60,7 +60,7 @@ static Node* nextRenderedEditable(Node* node)
 static Node* previousRenderedEditable(Node* node)
 {
     while ((node = node->previousLeafNode())) {
-        if (!node->isContentEditable())
+        if (!node->rendererIsEditable())
             continue;
         RenderObject* renderer = node->renderer();
         if (!renderer)
@@ -94,11 +94,13 @@ Position::Position(PassRefPtr<Node> anchorNode, int offset, AnchorType anchorTyp
     , m_anchorType(anchorType)
     , m_isLegacyEditingPosition(false)
 {
+    ASSERT(!m_anchorNode || !editingIgnoresContent(m_anchorNode.get()));
     ASSERT(anchorType == PositionIsOffsetInAnchor);
 }
 
 void Position::moveToPosition(PassRefPtr<Node> node, int offset)
 {
+    ASSERT(!editingIgnoresContent(node.get()));
     ASSERT(anchorType() == PositionIsOffsetInAnchor || m_isLegacyEditingPosition);
     m_anchorNode = node;
     m_offset = offset;
@@ -161,12 +163,12 @@ Position Position::parentAnchoredEquivalent() const
         return Position();
     
     // FIXME: This should only be necessary for legacy positions, but is also needed for positions before and after Tables
-    if (m_offset <= 0) {
+    if (m_offset <= 0 && m_anchorType != PositionIsAfterAnchor) {
         if (m_anchorNode->parentNode() && (editingIgnoresContent(m_anchorNode.get()) || isTableElement(m_anchorNode.get())))
             return positionInParentBeforeNode(m_anchorNode.get());
-        return Position(m_anchorNode, 0, PositionIsOffsetInAnchor);
+        return firstPositionInOrBeforeNode(m_anchorNode.get());
     }
-    if (!m_anchorNode->offsetInCharacters() && static_cast<unsigned>(m_offset) == m_anchorNode->childNodeCount()
+    if (!m_anchorNode->offsetInCharacters() && (m_anchorType == PositionIsAfterAnchor || static_cast<unsigned>(m_offset) == m_anchorNode->childNodeCount())
         && (editingIgnoresContent(m_anchorNode.get()) || isTableElement(m_anchorNode.get()))) {
         return positionInParentAfterNode(m_anchorNode.get());
     }
@@ -240,15 +242,15 @@ Position Position::previous(PositionMoveType moveType) const
     Node* n = deprecatedNode();
     if (!n)
         return *this;
-    
-    int o = m_offset;
+
+    int o = deprecatedEditingOffset();
     // FIXME: Negative offsets shouldn't be allowed. We should catch this earlier.
     ASSERT(o >= 0);
 
     if (o > 0) {
         Node* child = n->childNode(o - 1);
         if (child)
-            return lastDeepEditingPositionForNode(child);
+            return lastPositionInOrAfterNode(child);
 
         // There are two reasons child might be 0:
         //   1) The node is node like a text node that is not an element, and therefore has no children.
@@ -279,15 +281,15 @@ Position Position::next(PositionMoveType moveType) const
     Node* n = deprecatedNode();
     if (!n)
         return *this;
-    
-    int o = m_offset;
+
+    int o = deprecatedEditingOffset();
     // FIXME: Negative offsets shouldn't be allowed. We should catch this earlier.
     ASSERT(o >= 0);
 
     Node* child = n->childNode(o);
     if (child || (!n->hasChildNodes() && o < lastOffsetForEditing(n))) {
         if (child)
-            return firstDeepEditingPositionForNode(child);
+            return firstPositionInOrBeforeNode(child);
 
         // There are two reasons child might be 0:
         //   1) The node is node like a text node that is not an element, and therefore has no children.
@@ -323,14 +325,14 @@ bool Position::atFirstEditingPositionForNode() const
 {
     if (isNull())
         return true;
-    return m_offset <= 0;
+    return m_anchorType == PositionIsBeforeAnchor || m_offset <= 0;
 }
 
 bool Position::atLastEditingPositionForNode() const
 {
     if (isNull())
         return true;
-    return m_offset >= lastOffsetForEditing(deprecatedNode());
+    return m_anchorType == PositionIsAfterAnchor || m_offset >= lastOffsetForEditing(deprecatedNode());
 }
 
 // A position is considered at editing boundary if one of the following is true:
@@ -343,15 +345,15 @@ bool Position::atLastEditingPositionForNode() const
 bool Position::atEditingBoundary() const
 {
     Position nextPosition = downstream(CanCrossEditingBoundary);
-    if (atFirstEditingPositionForNode() && nextPosition.isNotNull() && !nextPosition.deprecatedNode()->isContentEditable())
+    if (atFirstEditingPositionForNode() && nextPosition.isNotNull() && !nextPosition.deprecatedNode()->rendererIsEditable())
         return true;
         
     Position prevPosition = upstream(CanCrossEditingBoundary);
-    if (atLastEditingPositionForNode() && prevPosition.isNotNull() && !prevPosition.deprecatedNode()->isContentEditable())
+    if (atLastEditingPositionForNode() && prevPosition.isNotNull() && !prevPosition.deprecatedNode()->rendererIsEditable())
         return true;
         
-    return nextPosition.isNotNull() && !nextPosition.deprecatedNode()->isContentEditable()
-        && prevPosition.isNotNull() && !prevPosition.deprecatedNode()->isContentEditable();
+    return nextPosition.isNotNull() && !nextPosition.deprecatedNode()->rendererIsEditable()
+        && prevPosition.isNotNull() && !prevPosition.deprecatedNode()->rendererIsEditable();
 }
 
 Node* Position::parentEditingBoundary() const
@@ -364,7 +366,7 @@ Node* Position::parentEditingBoundary() const
         return 0;
 
     Node* boundary = m_anchorNode.get();
-    while (boundary != documentElement && boundary->parentNode() && m_anchorNode->isContentEditable() == boundary->parentNode()->isContentEditable())
+    while (boundary != documentElement && boundary->parentNode() && m_anchorNode->rendererIsEditable() == boundary->parentNode()->rendererIsEditable())
         boundary = boundary->parentNode();
     
     return boundary;
@@ -523,17 +525,17 @@ Position Position::upstream(EditingBoundaryCrossingRule rule) const
     // FIXME: PositionIterator should respect Before and After positions.
     PositionIterator lastVisible = m_anchorType == PositionIsAfterAnchor ? Position(m_anchorNode, caretMaxOffset(m_anchorNode.get())) : *this;
     PositionIterator currentPos = lastVisible;
-    bool startEditable = startNode->isContentEditable();
+    bool startEditable = startNode->rendererIsEditable();
     Node* lastNode = startNode;
     bool boundaryCrossed = false;
     for (; !currentPos.atStart(); currentPos.decrement()) {
         Node* currentNode = currentPos.node();
         
         // Don't check for an editability change if we haven't moved to a different node,
-        // to avoid the expense of computing isContentEditable().
+        // to avoid the expense of computing rendererIsEditable().
         if (currentNode != lastNode) {
             // Don't change editability.
-            bool currentEditable = currentNode->isContentEditable();
+            bool currentEditable = currentNode->rendererIsEditable();
             if (startEditable != currentEditable) {
                 if (rule == CannotCrossEditingBoundary)
                     break;
@@ -569,7 +571,7 @@ Position Position::upstream(EditingBoundaryCrossingRule rule) const
         // Return position after tables and nodes which have content that can be ignored.
         if (editingIgnoresContent(currentNode) || isTableElement(currentNode)) {
             if (currentPos.atEndOfNode())
-                return lastDeepEditingPositionForNode(currentNode);
+                return positionAfterNode(currentNode);
             continue;
         }
 
@@ -645,17 +647,17 @@ Position Position::downstream(EditingBoundaryCrossingRule rule) const
     // FIXME: PositionIterator should respect Before and After positions.
     PositionIterator lastVisible = m_anchorType == PositionIsAfterAnchor ? Position(m_anchorNode, caretMaxOffset(m_anchorNode.get())) : *this;
     PositionIterator currentPos = lastVisible;
-    bool startEditable = startNode->isContentEditable();
+    bool startEditable = startNode->rendererIsEditable();
     Node* lastNode = startNode;
     bool boundaryCrossed = false;
     for (; !currentPos.atEnd(); currentPos.increment()) {   
         Node* currentNode = currentPos.node();
         
         // Don't check for an editability change if we haven't moved to a different node,
-        // to avoid the expense of computing isContentEditable().
+        // to avoid the expense of computing rendererIsEditable().
         if (currentNode != lastNode) {
             // Don't change editability.
-            bool currentEditable = currentNode->isContentEditable();
+            bool currentEditable = currentNode->rendererIsEditable();
             if (startEditable != currentEditable) {
                 if (rule == CannotCrossEditingBoundary)
                     break;
@@ -781,7 +783,8 @@ bool Position::isCandidate() const
         return false;
 
     if (renderer->isBR())
-        return !m_offset && !nodeIsUserSelectNone(deprecatedNode()->parentNode());
+        // FIXME: The condition should be m_anchorType == PositionIsBeforeAnchor, but for now we still need to support legacy positions.
+        return !m_offset && m_anchorType != PositionIsAfterAnchor && !nodeIsUserSelectNone(deprecatedNode()->parentNode());
 
     if (renderer->isText())
         return !nodeIsUserSelectNone(deprecatedNode()) && inRenderedText();
@@ -796,10 +799,10 @@ bool Position::isCandidate() const
         if (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)) {
             if (!Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer))
                 return atFirstEditingPositionForNode() && !Position::nodeIsUserSelectNone(deprecatedNode());
-            return m_anchorNode->isContentEditable() && !Position::nodeIsUserSelectNone(deprecatedNode()) && atEditingBoundary();
+            return m_anchorNode->rendererIsEditable() && !Position::nodeIsUserSelectNone(deprecatedNode()) && atEditingBoundary();
         }
     } else
-        return m_anchorNode->isContentEditable() && !Position::nodeIsUserSelectNone(deprecatedNode()) && atEditingBoundary();
+        return m_anchorNode->rendererIsEditable() && !Position::nodeIsUserSelectNone(deprecatedNode()) && atEditingBoundary();
 
     return false;
 }
@@ -982,7 +985,7 @@ Position Position::trailingWhitespacePosition(EAffinity, bool considerNonCollaps
     VisiblePosition v(*this);
     UChar c = v.characterAfter();
     // The space must not be in another paragraph and it must be editable.
-    if (!isEndOfParagraph(v) && v.next(true).isNotNull())
+    if (!isEndOfParagraph(v) && v.next(CannotCrossEditingBoundary).isNotNull())
         if (considerNonCollapsibleWhitespace ? (isSpaceOrNewline(c) || c == noBreakSpace) : isCollapsibleWhitespace(c))
             return *this;
     
@@ -1053,7 +1056,7 @@ static Position upstreamIgnoringEditingBoundaries(Position position)
 
 void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDirection, InlineBox*& inlineBox, int& caretOffset) const
 {
-    caretOffset = m_offset;
+    caretOffset = deprecatedEditingOffset();
     RenderObject* renderer = deprecatedNode()->renderer();
 
     if (!renderer->isText()) {
diff --git a/Source/WebCore/dom/Position.h b/Source/WebCore/dom/Position.h
index 4e1eff4..a72664e 100644
--- a/Source/WebCore/dom/Position.h
+++ b/Source/WebCore/dom/Position.h
@@ -133,6 +133,7 @@ public:
 
     // These can be either inside or just before/after the node, depending on
     // if the node is ignored by editing or not.
+    // FIXME: These should go away. They only make sense for legacy positions.
     bool atFirstEditingPositionForNode() const;
     bool atLastEditingPositionForNode() const;
 
@@ -196,7 +197,7 @@ inline bool operator==(const Position& a, const Position& b)
 {
     // FIXME: In <div><img></div> [div, 0] != [img, 0] even though most of the
     // editing code will treat them as identical.
-    return a.anchorNode() == b.anchorNode() && a.deprecatedEditingOffset() == b.deprecatedEditingOffset();
+    return a.anchorNode() == b.anchorNode() && a.deprecatedEditingOffset() == b.deprecatedEditingOffset() && a.anchorType() == b.anchorType();
 }
 
 inline bool operator!=(const Position& a, const Position& b)
diff --git a/Source/WebCore/dom/PositionIterator.cpp b/Source/WebCore/dom/PositionIterator.cpp
index 5de9d9d..6821308 100644
--- a/Source/WebCore/dom/PositionIterator.cpp
+++ b/Source/WebCore/dom/PositionIterator.cpp
@@ -38,10 +38,13 @@ PositionIterator::operator Position() const
 {
     if (m_nodeAfterPositionInAnchor) {
         ASSERT(m_nodeAfterPositionInAnchor->parentNode() == m_anchorNode);
+        // FIXME: This check is inadaquete because any ancestor could be ignored by editing
+        if (editingIgnoresContent(m_nodeAfterPositionInAnchor->parentNode()))
+            return positionBeforeNode(m_anchorNode);
         return positionInParentBeforeNode(m_nodeAfterPositionInAnchor);
     }
     if (m_anchorNode->hasChildNodes())
-        return lastDeepEditingPositionForNode(m_anchorNode);
+        return lastPositionInOrAfterNode(m_anchorNode);
     return Position(m_anchorNode, m_offsetInAnchor);
 }
 
@@ -166,7 +169,7 @@ bool PositionIterator::isCandidate() const
         if (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)) {
             if (!Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer))
                 return atStartOfNode() && !Position::nodeIsUserSelectNone(m_anchorNode);
-            return m_anchorNode->isContentEditable() && !Position::nodeIsUserSelectNone(m_anchorNode) && Position(*this).atEditingBoundary();
+            return m_anchorNode->rendererIsEditable() && !Position::nodeIsUserSelectNone(m_anchorNode) && Position(*this).atEditingBoundary();
         }
     }
 
diff --git a/Source/WebCore/dom/QualifiedName.h b/Source/WebCore/dom/QualifiedName.h
index cb95f20..192e7bc 100644
--- a/Source/WebCore/dom/QualifiedName.h
+++ b/Source/WebCore/dom/QualifiedName.h
@@ -113,7 +113,7 @@ inline bool operator!=(const QualifiedName& q, const AtomicString& a) { return a
 
 inline unsigned hashComponents(const QualifiedNameComponents& buf)
 {
-    return WTF::StringHasher::createBlobHash<sizeof(QualifiedNameComponents)>(&buf);
+    return StringHasher::hashMemory<sizeof(QualifiedNameComponents)>(&buf);
 }
 
 struct QualifiedNameHash {
diff --git a/Source/WebCore/dom/Range.cpp b/Source/WebCore/dom/Range.cpp
index a0370fa..423d43f 100644
--- a/Source/WebCore/dom/Range.cpp
+++ b/Source/WebCore/dom/Range.cpp
@@ -932,13 +932,6 @@ void Range::insertNode(PassRefPtr<Node> prpNewNode, ExceptionCode& ec)
         return;
     }
 
-    // WRONG_DOCUMENT_ERR: Raised if newParent and the container of the start of the Range were
-    // not created from the same document.
-    if (newNode->document() != m_start.container()->document()) {
-        ec = WRONG_DOCUMENT_ERR;
-        return;
-    }
-
     // HIERARCHY_REQUEST_ERR: Raised if the container of the start of the Range is of a type that
     // does not allow children of the type of newNode or if newNode is an ancestor of the container.
 
@@ -1423,13 +1416,6 @@ void Range::surroundContents(PassRefPtr<Node> passNewParent, ExceptionCode& ec)
         return;
     }
 
-    // WRONG_DOCUMENT_ERR: Raised if newParent and the container of the start of the Range were
-    // not created from the same document.
-    if (newParent->document() != m_start.container()->document()) {
-        ec = WRONG_DOCUMENT_ERR;
-        return;
-    }
-
     // Raise a HIERARCHY_REQUEST_ERR if m_start.container() doesn't accept children like newParent.
     Node* parentOfNewParent = m_start.container();
 
diff --git a/Source/WebCore/dom/ScriptElement.cpp b/Source/WebCore/dom/ScriptElement.cpp
index 3bba9a0..9a07bb8 100644
--- a/Source/WebCore/dom/ScriptElement.cpp
+++ b/Source/WebCore/dom/ScriptElement.cpp
@@ -24,9 +24,9 @@
 #include "config.h"
 #include "ScriptElement.h"
 
-#include "AsyncScriptRunner.h"
 #include "CachedScript.h"
 #include "CachedResourceLoader.h"
+#include "ContentSecurityPolicy.h"
 #include "Document.h"
 #include "DocumentParser.h"
 #include "Frame.h"
@@ -37,6 +37,7 @@
 #include "MIMETypeRegistry.h"
 #include "Page.h"
 #include "ScriptController.h"
+#include "ScriptRunner.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "Settings.h"
@@ -61,6 +62,8 @@ ScriptElement::ScriptElement(Element* element, bool parserInserted, bool already
     , m_willBeParserExecuted(false)
     , m_readyToBeParserExecuted(false)
     , m_willExecuteWhenDocumentFinishedParsing(false)
+    , m_forceAsync(!parserInserted)
+    , m_willExecuteInOrder(false)
 {
     ASSERT(m_element);
 }
@@ -96,6 +99,11 @@ void ScriptElement::handleSourceAttribute(const String& sourceUrl)
     prepareScript(); // FIXME: Provide a real starting line number here.
 }
 
+void ScriptElement::handleAsyncAttribute()
+{
+    m_forceAsync = false;
+}
+
 // Helper function
 static bool isLegacySupportedJavaScriptLanguage(const String& language)
 {
@@ -159,7 +167,8 @@ bool ScriptElement::prepareScript(const TextPosition1& scriptStartPosition, Lega
     } else
         wasParserInserted = false;
 
-    // FIXME: HTML5 spec says we should set forceAsync.
+    if (wasParserInserted && !asyncAttributeValue())
+        m_forceAsync = true;
 
     // FIXME: HTML5 spec says we should check that all children are either comments or empty text nodes.
     if (!hasSourceAttribute() && !m_element->firstChild())
@@ -171,8 +180,10 @@ bool ScriptElement::prepareScript(const TextPosition1& scriptStartPosition, Lega
     if (!isScriptTypeSupported(supportLegacyTypes))
         return false;
 
-    if (wasParserInserted)
+    if (wasParserInserted) {
         m_parserInserted = true;
+        m_forceAsync = false;
+    }
 
     m_alreadyStarted = true;
 
@@ -207,6 +218,10 @@ bool ScriptElement::prepareScript(const TextPosition1& scriptStartPosition, Lega
     else if (!hasSourceAttribute() && m_parserInserted && !m_element->document()->haveStylesheetsLoaded()) {
         m_willBeParserExecuted = true;
         m_readyToBeParserExecuted = true;
+    } else if (hasSourceAttribute() && !asyncAttributeValue() && !m_forceAsync) {
+        m_willExecuteInOrder = true;
+        m_element->document()->scriptRunner()->queueScriptForExecution(this, m_cachedScript, ScriptRunner::IN_ORDER_EXECUTION);
+        m_cachedScript->addClient(this);
     } else if (hasSourceAttribute())
         m_cachedScript->addClient(this);
     else
@@ -217,9 +232,6 @@ bool ScriptElement::prepareScript(const TextPosition1& scriptStartPosition, Lega
 
 bool ScriptElement::requestScript(const String& sourceUrl)
 {
-    if (!m_element->document()->contentSecurityPolicy()->canLoadExternalScriptFromSrc(sourceUrl))
-        return false;
-
     RefPtr<Document> originalDocument = m_element->document();
     if (!m_element->dispatchBeforeLoadEvent(sourceUrl))
         return false;
@@ -286,7 +298,10 @@ void ScriptElement::notifyFinished(CachedResource* o)
 {
     ASSERT(!m_willBeParserExecuted);
     ASSERT_UNUSED(o, o == m_cachedScript);
-    m_element->document()->asyncScriptRunner()->executeScriptSoon(this, m_cachedScript);
+    if (m_willExecuteInOrder)
+        m_element->document()->scriptRunner()->notifyInOrderScriptReady();
+    else
+        m_element->document()->scriptRunner()->queueScriptForExecution(this, m_cachedScript, ScriptRunner::ASYNC_EXECUTION);
     m_cachedScript = 0;
 }
 
diff --git a/Source/WebCore/dom/ScriptElement.h b/Source/WebCore/dom/ScriptElement.h
index 79dff33..9ce66e5 100644
--- a/Source/WebCore/dom/ScriptElement.h
+++ b/Source/WebCore/dom/ScriptElement.h
@@ -63,12 +63,14 @@ protected:
     void setHaveFiredLoadEvent(bool haveFiredLoad) { m_haveFiredLoad = haveFiredLoad; }
     bool isParserInserted() const { return m_parserInserted; }
     bool alreadyStarted() const { return m_alreadyStarted; }
+    bool forceAsync() const { return m_forceAsync; }
 
     // Helper functions used by our parent classes.
     void insertedIntoDocument();
     void removedFromDocument();
     void childrenChanged();
     void handleSourceAttribute(const String& sourceUrl);
+    void handleAsyncAttribute();
 
 private:
     bool ignoresLoadRequest() const;
@@ -98,6 +100,8 @@ private:
     bool m_willBeParserExecuted : 1; // Same as "The parser will handle executing the script."
     bool m_readyToBeParserExecuted : 1;
     bool m_willExecuteWhenDocumentFinishedParsing : 1;
+    bool m_forceAsync : 1;
+    bool m_willExecuteInOrder : 1;
     String m_characterEncoding;
     String m_fallbackCharacterEncoding;
 };
diff --git a/Source/WebCore/dom/ScriptExecutionContext.cpp b/Source/WebCore/dom/ScriptExecutionContext.cpp
index 6685416..b9a1e92 100644
--- a/Source/WebCore/dom/ScriptExecutionContext.cpp
+++ b/Source/WebCore/dom/ScriptExecutionContext.cpp
@@ -382,6 +382,8 @@ KURL ScriptExecutionContext::createPublicBlobURL(Blob* blob)
     if (!blob)
         return KURL();
     KURL publicURL = BlobURL::createPublicURL(securityOrigin());
+    if (publicURL.isEmpty())
+        return KURL();
     ThreadableBlobRegistry::registerBlobURL(publicURL, blob->url());
     m_publicBlobURLs.add(publicURL.string());
     return publicURL;
diff --git a/Source/WebCore/dom/AsyncScriptRunner.cpp b/Source/WebCore/dom/ScriptRunner.cpp
index 28b1b31..10198bf 100644
--- a/Source/WebCore/dom/AsyncScriptRunner.cpp
+++ b/Source/WebCore/dom/ScriptRunner.cpp
@@ -24,7 +24,7 @@
  */
 
 #include "config.h"
-#include "AsyncScriptRunner.h"
+#include "ScriptRunner.h"
 
 #include "CachedScript.h"
 #include "Document.h"
@@ -34,52 +34,79 @@
 
 namespace WebCore {
 
-AsyncScriptRunner::AsyncScriptRunner(Document* document)
+ScriptRunner::ScriptRunner(Document* document)
     : m_document(document)
-    , m_timer(this, &AsyncScriptRunner::timerFired)
+    , m_timer(this, &ScriptRunner::timerFired)
 {
     ASSERT(document);
 }
 
-AsyncScriptRunner::~AsyncScriptRunner()
+ScriptRunner::~ScriptRunner()
 {
     for (size_t i = 0; i < m_scriptsToExecuteSoon.size(); ++i)
         m_document->decrementLoadEventDelayCount();
+    for (size_t i = 0; i < m_scriptsToExecuteInOrder.size(); ++i)
+        m_document->decrementLoadEventDelayCount();
 }
 
-void AsyncScriptRunner::executeScriptSoon(ScriptElement* scriptElement, CachedResourceHandle<CachedScript> cachedScript)
+void ScriptRunner::queueScriptForExecution(ScriptElement* scriptElement, CachedResourceHandle<CachedScript> cachedScript, ExecutionType executionType)
 {
-    ASSERT_ARG(scriptElement, scriptElement);
+    ASSERT(scriptElement);
 
     Element* element = scriptElement->element();
     ASSERT(element);
     ASSERT(element->inDocument());
 
     m_document->incrementLoadEventDelayCount();
-    m_scriptsToExecuteSoon.append(PendingScript(element, cachedScript.get()));
-    if (!m_timer.isActive())
-        m_timer.startOneShot(0);
+
+    switch (executionType) {
+    case ASYNC_EXECUTION:
+        m_scriptsToExecuteSoon.append(PendingScript(element, cachedScript.get()));
+        if (!m_timer.isActive())
+            m_timer.startOneShot(0);
+        break;
+
+    case IN_ORDER_EXECUTION:
+        m_scriptsToExecuteInOrder.append(PendingScript(element, cachedScript.get()));
+        break;
+
+    default:
+        ASSERT_NOT_REACHED();
+    }
 }
 
-void AsyncScriptRunner::suspend()
+void ScriptRunner::suspend()
 {
     m_timer.stop();
 }
 
-void AsyncScriptRunner::resume()
+void ScriptRunner::resume()
 {
     if (hasPendingScripts())
         m_timer.startOneShot(0);
 }
 
-void AsyncScriptRunner::timerFired(Timer<AsyncScriptRunner>* timer)
+void ScriptRunner::notifyInOrderScriptReady()
+{
+    ASSERT(!m_scriptsToExecuteInOrder.isEmpty());
+    m_timer.startOneShot(0);
+}
+
+void ScriptRunner::timerFired(Timer<ScriptRunner>* timer)
 {
     ASSERT_UNUSED(timer, timer == &m_timer);
 
     RefPtr<Document> protect(m_document);
-    
+
     Vector<PendingScript> scripts;
     scripts.swap(m_scriptsToExecuteSoon);
+
+    size_t numInOrderScriptsToExecute = 0;
+    for (; numInOrderScriptsToExecute < m_scriptsToExecuteInOrder.size() && m_scriptsToExecuteInOrder[numInOrderScriptsToExecute].cachedScript()->isLoaded(); ++numInOrderScriptsToExecute)
+        scripts.append(m_scriptsToExecuteInOrder[numInOrderScriptsToExecute]);
+    if (numInOrderScriptsToExecute)
+        m_scriptsToExecuteInOrder.remove(0, numInOrderScriptsToExecute);
+
     size_t size = scripts.size();
     for (size_t i = 0; i < size; ++i) {
         CachedScript* cachedScript = scripts[i].cachedScript();
diff --git a/Source/WebCore/dom/AsyncScriptRunner.h b/Source/WebCore/dom/ScriptRunner.h
index 6a75323..d6d7411 100644
--- a/Source/WebCore/dom/AsyncScriptRunner.h
+++ b/Source/WebCore/dom/ScriptRunner.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef AsyncScriptRunner_h
-#define AsyncScriptRunner_h
+#ifndef ScriptRunner_h
+#define ScriptRunner_h
 
 #include "CachedResourceHandle.h"
 #include "Timer.h"
@@ -38,26 +38,29 @@ class CachedScript;
 class Document;
 class PendingScript;
 class ScriptElement;
-    
-class AsyncScriptRunner {
-    WTF_MAKE_NONCOPYABLE(AsyncScriptRunner); WTF_MAKE_FAST_ALLOCATED;
+
+class ScriptRunner {
+    WTF_MAKE_NONCOPYABLE(ScriptRunner); WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassOwnPtr<AsyncScriptRunner> create(Document* document) { return new AsyncScriptRunner(document); }
-    ~AsyncScriptRunner();
+    static PassOwnPtr<ScriptRunner> create(Document* document) { return new ScriptRunner(document); }
+    ~ScriptRunner();
 
-    void executeScriptSoon(ScriptElement*, CachedResourceHandle<CachedScript>);
-    bool hasPendingScripts() const { return !m_scriptsToExecuteSoon.isEmpty(); }
+    enum ExecutionType { ASYNC_EXECUTION, IN_ORDER_EXECUTION };
+    void queueScriptForExecution(ScriptElement*, CachedResourceHandle<CachedScript>, ExecutionType);
+    bool hasPendingScripts() const { return !m_scriptsToExecuteSoon.isEmpty() || !m_scriptsToExecuteInOrder.isEmpty(); }
     void suspend();
     void resume();
+    void notifyInOrderScriptReady();
 
 private:
-    AsyncScriptRunner(Document*);
+    ScriptRunner(Document*);
 
-    void timerFired(Timer<AsyncScriptRunner>*);
+    void timerFired(Timer<ScriptRunner>*);
 
     Document* m_document;
+    Vector<PendingScript> m_scriptsToExecuteInOrder;
     Vector<PendingScript> m_scriptsToExecuteSoon; // http://www.whatwg.org/specs/web-apps/current-work/#set-of-scripts-that-will-execute-as-soon-as-possible
-    Timer<AsyncScriptRunner> m_timer;
+    Timer<ScriptRunner> m_timer;
 };
 
 }
diff --git a/Source/WebCore/dom/StringCallback.cpp b/Source/WebCore/dom/StringCallback.cpp
new file mode 100644
index 0000000..c6285b1
--- /dev/null
+++ b/Source/WebCore/dom/StringCallback.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StringCallback.h"
+
+#include "ScriptExecutionContext.h"
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+namespace {
+
+class DispatchCallbackTask : public ScriptExecutionContext::Task {
+public:
+    static PassOwnPtr<DispatchCallbackTask> create(PassRefPtr<StringCallback> callback, const String& data)
+    {
+        return adoptPtr(new DispatchCallbackTask(callback, data));
+    }
+
+    virtual void performTask(ScriptExecutionContext*)
+    {
+        m_callback->handleEvent(m_data);
+    }
+
+private:
+    DispatchCallbackTask(PassRefPtr<StringCallback> callback, const String& data)
+        : m_callback(callback)
+        , m_data(data)
+    {
+    }
+
+    RefPtr<StringCallback> m_callback;
+    const String m_data;
+};
+
+} // namespace
+
+void StringCallback::scheduleCallback(ScriptExecutionContext* context, const String& data)
+{
+    context->postTask(DispatchCallbackTask::create(this, data));
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/dom/StringCallback.h b/Source/WebCore/dom/StringCallback.h
new file mode 100644
index 0000000..92e83e2
--- /dev/null
+++ b/Source/WebCore/dom/StringCallback.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StringCallback_h
+#define StringCallback_h
+
+#include <wtf/Forward.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class ScriptExecutionContext;
+
+class StringCallback : public RefCounted<StringCallback> {
+public:
+    virtual ~StringCallback() { }
+    virtual bool handleEvent(const String& data) = 0;
+
+    // Helper to post callback task.
+    void scheduleCallback(ScriptExecutionContext*, const String& data);
+};
+
+} // namespace WebCore
+
+#endif // StringCallback_h
diff --git a/Source/WebCore/platform/chromium/WindowsVersion.h b/Source/WebCore/dom/StringCallback.idl
index 3b2010a..1e18d83 100644
--- a/Source/WebCore/platform/chromium/WindowsVersion.h
+++ b/Source/WebCore/dom/StringCallback.idl
@@ -1,10 +1,10 @@
 /*
- * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
- * 
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,13 +28,10 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WindowsVersion_h
-#define WindowsVersion_h
-
-namespace WebCore {
-
-    bool isVistaOrNewer();
-
-} // namespace WebCore
-
-#endif
+module core {
+    interface [
+        Callback
+    ] StringCallback {
+        boolean handleEvent(in DOMString data);
+    };
+}
diff --git a/Source/WebCore/dom/StyleElement.cpp b/Source/WebCore/dom/StyleElement.cpp
index f984fda..e9d035d 100644
--- a/Source/WebCore/dom/StyleElement.cpp
+++ b/Source/WebCore/dom/StyleElement.cpp
@@ -103,8 +103,15 @@ void StyleElement::process(Element* e)
     for (Node* c = e->firstChild(); c; c = c->nextSibling()) {
         if (isValidStyleChild(c)) {
             unsigned length = c->nodeValue().length();
+<<<<<<< HEAD
             if (length > std::numeric_limits<unsigned>::max() - resultLength)
                 CRASH();
+=======
+            if (length > std::numeric_limits<unsigned>::max() - resultLength) {
+                createSheet(e, m_startLineNumber, "");
+                return;
+            }
+>>>>>>> webkit.org at r82507
             resultLength += length;
         }
     }
diff --git a/Source/WebCore/dom/StyledElement.cpp b/Source/WebCore/dom/StyledElement.cpp
index d6a532f..3c55591 100644
--- a/Source/WebCore/dom/StyledElement.cpp
+++ b/Source/WebCore/dom/StyledElement.cpp
@@ -412,7 +412,7 @@ unsigned MappedAttributeHash::hash(const MappedAttributeKey& key)
     COMPILE_ASSERT(sizeof(key.name) == 4 || sizeof(key.name) == 8, key_name_size);
     COMPILE_ASSERT(sizeof(key.value) == 4 || sizeof(key.value) == 8, key_value_size);
 
-    WTF::StringHasher hasher;
+    StringHasher hasher;
     const UChar* data;
 
     data = reinterpret_cast<const UChar*>(&key.name);
diff --git a/Source/WebCore/dom/UIEvent.cpp b/Source/WebCore/dom/UIEvent.cpp
index 401015b..dfdd34d 100644
--- a/Source/WebCore/dom/UIEvent.cpp
+++ b/Source/WebCore/dom/UIEvent.cpp
@@ -69,12 +69,12 @@ int UIEvent::charCode() const
     return 0;
 }
 
-int UIEvent::layerX() const
+int UIEvent::layerX()
 {
     return 0;
 }
 
-int UIEvent::layerY() const
+int UIEvent::layerY()
 {
     return 0;
 }
diff --git a/Source/WebCore/dom/UIEvent.h b/Source/WebCore/dom/UIEvent.h
index 8e330a5..a2f4e65 100644
--- a/Source/WebCore/dom/UIEvent.h
+++ b/Source/WebCore/dom/UIEvent.h
@@ -53,8 +53,8 @@ namespace WebCore {
         virtual int keyCode() const;
         virtual int charCode() const;
 
-        virtual int layerX() const;
-        virtual int layerY() const;
+        virtual int layerX();
+        virtual int layerY();
 
         virtual int pageX() const;
         virtual int pageY() const;
diff --git a/Source/WebCore/dom/ViewportArguments.cpp b/Source/WebCore/dom/ViewportArguments.cpp
index e75a3eb..49c94d7 100644
--- a/Source/WebCore/dom/ViewportArguments.cpp
+++ b/Source/WebCore/dom/ViewportArguments.cpp
@@ -257,32 +257,32 @@ static float findScaleValue(const String& keyString, const String& valueString,
     return value;
 }
 
-static bool findUserScalableValue(const String& keyString, const String& valueString, Document* document)
+static float findUserScalableValue(const String& keyString, const String& valueString, Document* document)
 {
     // yes and no are used as keywords.
     // Numbers >= 1, numbers <= -1, device-width and device-height are mapped to yes.
     // Numbers in the range <-1, 1>, and unknown values, are mapped to no.
 
     if (equalIgnoringCase(valueString, "yes"))
-        return true;
+        return 1;
     if (equalIgnoringCase(valueString, "no"))
-        return false;
+        return 0;
     if (equalIgnoringCase(valueString, "desktop-width"))
-        return true;
+        return 1;
     if (equalIgnoringCase(valueString, "device-width"))
-        return true;
+        return 1;
     if (equalIgnoringCase(valueString, "device-height"))
-        return true;
+        return 1;
 
     bool ok;
     float value = numericPrefix(keyString, valueString, document, &ok);
     if (!ok)
-        return false;
+        return 0;
 
     if (fabs(value) < 1)
-        return false;
+        return 0;
 
-    return true;
+    return 1;
 }
 
 static float findTargetDensityDPIValue(const String& keyString, const String& valueString, Document* document)
diff --git a/Source/WebCore/dom/ViewportArguments.h b/Source/WebCore/dom/ViewportArguments.h
index 2e0fd19..66bb281 100644
--- a/Source/WebCore/dom/ViewportArguments.h
+++ b/Source/WebCore/dom/ViewportArguments.h
@@ -51,7 +51,7 @@ struct ViewportAttributes {
     float minimumScale;
     float maximumScale;
 
-    bool userScalable;
+    float userScalable;
 };
 
 struct ViewportArguments {
@@ -74,7 +74,7 @@ struct ViewportArguments {
         , width(ValueAuto)
         , height(ValueAuto)
         , targetDensityDpi(ValueAuto)
-        , userScalable(true)
+        , userScalable(ValueAuto)
     {
     }
 
@@ -84,8 +84,7 @@ struct ViewportArguments {
     float width;
     float height;
     float targetDensityDpi;
-
-    bool userScalable;
+    float userScalable;
 
     bool operator==(const ViewportArguments& other) const
     {
diff --git a/Source/WebCore/dom/default/PlatformMessagePortChannel.h b/Source/WebCore/dom/default/PlatformMessagePortChannel.h
index 2aad952..651810b 100644
--- a/Source/WebCore/dom/default/PlatformMessagePortChannel.h
+++ b/Source/WebCore/dom/default/PlatformMessagePortChannel.h
@@ -44,7 +44,7 @@ namespace WebCore {
     // PlatformMessagePortChannel is a platform-dependent interface to the remote side of a message channel.
     // This default implementation supports multiple threads running within a single process. Implementations for multi-process platforms should define these public APIs in their own platform-specific PlatformMessagePortChannel file.
     // The goal of this implementation is to eliminate contention except when cloning or closing the port, so each side of the channel has its own separate mutex.
-    class PlatformMessagePortChannel : public ThreadSafeShared<PlatformMessagePortChannel> {
+    class PlatformMessagePortChannel : public ThreadSafeRefCounted<PlatformMessagePortChannel> {
     public:
         static void createChannel(PassRefPtr<MessagePort>, PassRefPtr<MessagePort>);
 
@@ -59,7 +59,7 @@ namespace WebCore {
         MessagePort* locallyEntangledPort(const ScriptExecutionContext*);
 
         // Wrapper for MessageQueue that allows us to do thread safe sharing by two proxies.
-        class MessagePortQueue : public ThreadSafeShared<MessagePortQueue> {
+        class MessagePortQueue : public ThreadSafeRefCounted<MessagePortQueue> {
         public:
             static PassRefPtr<MessagePortQueue> create() { return adoptRef(new MessagePortQueue()); }
 
diff --git a/Source/WebCore/editing/AppendNodeCommand.cpp b/Source/WebCore/editing/AppendNodeCommand.cpp
index 58f7fa6..9395968 100644
--- a/Source/WebCore/editing/AppendNodeCommand.cpp
+++ b/Source/WebCore/editing/AppendNodeCommand.cpp
@@ -31,7 +31,7 @@
 
 namespace WebCore {
 
-AppendNodeCommand::AppendNodeCommand(PassRefPtr<Element> parent, PassRefPtr<Node> node)
+AppendNodeCommand::AppendNodeCommand(PassRefPtr<ContainerNode> parent, PassRefPtr<Node> node)
     : SimpleEditCommand(parent->document())
     , m_parent(parent)
     , m_node(node)
@@ -40,7 +40,7 @@ AppendNodeCommand::AppendNodeCommand(PassRefPtr<Element> parent, PassRefPtr<Node
     ASSERT(m_node);
     ASSERT(!m_node->parentNode());
 
-    ASSERT(m_parent->isContentEditable() || !m_parent->attached());
+    ASSERT(m_parent->rendererIsEditable() || !m_parent->attached());
 }
 
 static void sendAXTextChangedIgnoringLineBreaks(Node* node, AXObjectCache::AXTextChange textChange)
@@ -56,7 +56,7 @@ static void sendAXTextChangedIgnoringLineBreaks(Node* node, AXObjectCache::AXTex
 
 void AppendNodeCommand::doApply()
 {
-    if (!m_parent->isContentEditable() && m_parent->attached())
+    if (!m_parent->rendererIsEditable() && m_parent->attached())
         return;
         
     ExceptionCode ec;
@@ -68,7 +68,7 @@ void AppendNodeCommand::doApply()
 
 void AppendNodeCommand::doUnapply()
 {
-    if (!m_parent->isContentEditable())
+    if (!m_parent->rendererIsEditable())
         return;
         
     // Need to notify this before actually deleting the text
diff --git a/Source/WebCore/editing/AppendNodeCommand.h b/Source/WebCore/editing/AppendNodeCommand.h
index 5ffb881..87a8cd2 100644
--- a/Source/WebCore/editing/AppendNodeCommand.h
+++ b/Source/WebCore/editing/AppendNodeCommand.h
@@ -32,18 +32,18 @@ namespace WebCore {
 
 class AppendNodeCommand : public SimpleEditCommand {
 public:
-    static PassRefPtr<AppendNodeCommand> create(PassRefPtr<Element> parent, PassRefPtr<Node> node)
+    static PassRefPtr<AppendNodeCommand> create(PassRefPtr<ContainerNode> parent, PassRefPtr<Node> node)
     {
         return adoptRef(new AppendNodeCommand(parent, node));
     }
 
 private:
-    AppendNodeCommand(PassRefPtr<Element> parent, PassRefPtr<Node> node);
+    AppendNodeCommand(PassRefPtr<ContainerNode> parent, PassRefPtr<Node>);
 
     virtual void doApply();
     virtual void doUnapply();
 
-    RefPtr<Element> m_parent;
+    RefPtr<ContainerNode> m_parent;
     RefPtr<Node> m_node;
 };
 
diff --git a/Source/WebCore/editing/ApplyBlockElementCommand.cpp b/Source/WebCore/editing/ApplyBlockElementCommand.cpp
index 7e20acc..c8f2161 100644
--- a/Source/WebCore/editing/ApplyBlockElementCommand.cpp
+++ b/Source/WebCore/editing/ApplyBlockElementCommand.cpp
@@ -72,7 +72,7 @@ void ApplyBlockElementCommand::doApply()
     // margin/padding, but not others.  We should make the gap painting more consistent and 
     // then use a left margin/padding rule here.
     if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd))
-        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
+        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(CannotCrossEditingBoundary)));
 
     VisibleSelection selection = selectionForParagraphIteration(endingSelection());
     VisiblePosition startOfSelection = selection.visibleStart();
@@ -193,7 +193,7 @@ void ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded(const
         if (!startStyle->collapseWhiteSpace() && start.offsetInContainerNode() > 0) {
             int startOffset = start.offsetInContainerNode();
             splitTextNode(static_cast<Text*>(start.deprecatedNode()), startOffset);
-            start = positionBeforeNode(start.deprecatedNode());
+            start = firstPositionInOrBeforeNode(start.deprecatedNode());
             if (isStartAndEndOnSameNode) {
                 ASSERT(end.offsetInContainerNode() >= startOffset);
                 end = Position(end.deprecatedNode(), end.offsetInContainerNode() - startOffset, Position::PositionIsOffsetInAnchor);
@@ -224,7 +224,7 @@ void ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded(const
             && end.offsetInContainerNode() < end.containerNode()->maxCharacterOffset()) {
             splitTextNode(static_cast<Text*>(end.deprecatedNode()), end.offsetInContainerNode());
             if (isStartAndEndOnSameNode)
-                start = positionBeforeNode(end.deprecatedNode()->previousSibling());
+                start = firstPositionInOrBeforeNode(end.deprecatedNode()->previousSibling());
             if (isEndAndEndOfLastParagraphOnSameNode) {
                 if (m_endOfLastParagraph.offsetInContainerNode() == end.offsetInContainerNode())
                     m_endOfLastParagraph = lastPositionInNode(end.deprecatedNode()->previousSibling());
diff --git a/Source/WebCore/editing/ApplyStyleCommand.cpp b/Source/WebCore/editing/ApplyStyleCommand.cpp
index f9ed18e..59540ec 100644
--- a/Source/WebCore/editing/ApplyStyleCommand.cpp
+++ b/Source/WebCore/editing/ApplyStyleCommand.cpp
@@ -57,11 +57,9 @@ using namespace HTMLNames;
 static RGBA32 getRGBAFontColor(CSSStyleDeclaration* style)
 {
     RefPtr<CSSValue> colorValue = style->getPropertyCSSValue(CSSPropertyColor);
-    if (!colorValue)
+    if (!colorValue || !colorValue->isPrimitiveValue())
         return Color::transparent;
 
-    ASSERT(colorValue->isPrimitiveValue());
-
     CSSPrimitiveValue* primitiveColor = static_cast<CSSPrimitiveValue*>(colorValue.get());
     RGBA32 rgba = 0;
     if (primitiveColor->primitiveType() != CSSPrimitiveValue::CSS_RGBCOLOR) {
@@ -76,7 +74,7 @@ static RGBA32 getRGBAFontColor(CSSStyleDeclaration* style)
 
 class StyleChange {
 public:
-    explicit StyleChange(CSSStyleDeclaration*, const Position&);
+    StyleChange(EditingStyle*, const Position&);
 
     String cssStyle() const { return m_cssStyle; }
     bool applyBold() const { return m_applyBold; }
@@ -111,7 +109,7 @@ public:
         return !(*this == other);
     }
 private:
-    void init(PassRefPtr<CSSStyleDeclaration>, const Position&);
+    void init(EditingStyle*, const Position&);
     void reconcileTextDecorationProperties(CSSMutableStyleDeclaration*);
     void extractTextStyles(Document*, CSSMutableStyleDeclaration*, bool shouldUseFixedFontDefaultSize);
 
@@ -128,7 +126,7 @@ private:
 };
 
 
-StyleChange::StyleChange(CSSStyleDeclaration* style, const Position& position)
+StyleChange::StyleChange(EditingStyle* style, const Position& position)
     : m_applyBold(false)
     , m_applyItalic(false)
     , m_applyUnderline(false)
@@ -139,14 +137,14 @@ StyleChange::StyleChange(CSSStyleDeclaration* style, const Position& position)
     init(style, position);
 }
 
-void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position& position)
+void StyleChange::init(EditingStyle* style, const Position& position)
 {
     Document* document = position.anchorNode() ? position.anchorNode()->document() : 0;
-    if (!style || !document || !document->frame())
+    if (!style || !style->style() || !document || !document->frame())
         return;
 
     RefPtr<CSSComputedStyleDeclaration> computedStyle = position.computedStyle();
-    RefPtr<CSSMutableStyleDeclaration> mutableStyle = getPropertiesNotIn(style.get(), computedStyle.get());
+    RefPtr<CSSMutableStyleDeclaration> mutableStyle = getPropertiesNotIn(style->style(), computedStyle.get());
 
     reconcileTextDecorationProperties(mutableStyle.get());
     if (!document->frame()->editor()->shouldStyleWithCSS())
@@ -158,8 +156,8 @@ void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position& po
 
     // If unicode-bidi is present in mutableStyle and direction is not, then add direction to mutableStyle.
     // FIXME: Shouldn't this be done in getPropertiesNotIn?
-    if (mutableStyle->getPropertyCSSValue(CSSPropertyUnicodeBidi) && !style->getPropertyCSSValue(CSSPropertyDirection))
-        mutableStyle->setProperty(CSSPropertyDirection, style->getPropertyValue(CSSPropertyDirection));
+    if (mutableStyle->getPropertyCSSValue(CSSPropertyUnicodeBidi) && !style->style()->getPropertyCSSValue(CSSPropertyDirection))
+        mutableStyle->setProperty(CSSPropertyDirection, style->style()->getPropertyValue(CSSPropertyDirection));
 
     // Save the result for later
     m_cssStyle = mutableStyle->cssText().stripWhiteSpace();
@@ -591,7 +589,7 @@ void ApplyStyleCommand::applyBlockStyle(EditingStyle *style)
     VisiblePosition nextParagraphStart(endOfParagraph(paragraphStart).next());
     VisiblePosition beyondEnd(endOfParagraph(visibleEnd).next());
     while (paragraphStart.isNotNull() && paragraphStart != beyondEnd) {
-        StyleChange styleChange(style->style(), paragraphStart.deepEquivalent());
+        StyleChange styleChange(style, paragraphStart.deepEquivalent());
         if (styleChange.cssStyle().length() || m_removeOnly) {
             RefPtr<Node> block = enclosingBlock(paragraphStart.deepEquivalent().deprecatedNode());
             if (!m_removeOnly) {
@@ -1017,12 +1015,12 @@ void ApplyStyleCommand::fixRangeAndApplyInlineStyle(EditingStyle* style, const P
 
 static bool containsNonEditableRegion(Node* node)
 {
-    if (!node->isContentEditable())
+    if (!node->rendererIsEditable())
         return true;
 
     Node* sibling = node->traverseNextSibling();
     for (Node* descendent = node->firstChild(); descendent && descendent != sibling; descendent = descendent->traverseNextNode()) {
-        if (!descendent->isContentEditable())
+        if (!descendent->rendererIsEditable())
             return true;
     }
 
@@ -1037,10 +1035,10 @@ void ApplyStyleCommand::applyInlineStyleToNodeRange(EditingStyle* style, Node* n
     for (RefPtr<Node> next; node && node != pastEndNode; node = next.get()) {
         next = node->traverseNextNode();
 
-        if (!node->renderer() || !node->isContentEditable())
+        if (!node->renderer() || !node->rendererIsEditable())
             continue;
         
-        if (!node->isContentRichlyEditable() && node->isHTMLElement()) {
+        if (!node->rendererIsRichlyEditable() && node->isHTMLElement()) {
             // This is a plaintext-only region. Only proceed if it's fully selected.
             // pastEndNode is the node after the last fully selected node, so if it's inside node then
             // node isn't fully selected.
@@ -1059,7 +1057,7 @@ void ApplyStyleCommand::applyInlineStyleToNodeRange(EditingStyle* style, Node* n
             continue;
         
         if (node->childNodeCount()) {
-            if (node->contains(pastEndNode) || containsNonEditableRegion(node) || !node->parentNode()->isContentEditable())
+            if (node->contains(pastEndNode) || containsNonEditableRegion(node) || !node->parentNode()->rendererIsEditable())
                 continue;
             if (editingIgnoresContent(node)) {
                 next = node->traverseNextSibling();
@@ -1080,7 +1078,7 @@ void ApplyStyleCommand::applyInlineStyleToNodeRange(EditingStyle* style, Node* n
 
         if (!removeStyleFromRunBeforeApplyingStyle(style, runStart, runEnd))
             continue;
-        addInlineStyleIfNeeded(style->style(), runStart.get(), runEnd.get(), AddStyledElement);
+        addInlineStyleIfNeeded(style, runStart.get(), runEnd.get(), AddStyledElement);
     }
 }
 
@@ -1099,7 +1097,7 @@ bool ApplyStyleCommand::removeStyleFromRunBeforeApplyingStyle(EditingStyle* styl
         if (node->childNodeCount())
             continue;
         // We don't consider m_isInlineElementToRemoveFunction here because we never apply style when m_isInlineElementToRemoveFunction is specified
-        if ((!style->isEmpty() && getPropertiesNotIn(style->style(), computedStyle(node).get())->length())
+        if (!style->styleIsPresentInComputedStyleOfNode(node)
             || (m_styledInlineElement && !enclosingNodeWithTag(positionBeforeNode(node), m_styledInlineElement->tagQName()))) {
             needToApplyStyle = true;
             break;
@@ -1134,26 +1132,18 @@ bool ApplyStyleCommand::removeInlineStyleFromElement(EditingStyle* style, PassRe
 {
     ASSERT(element);
 
-    if (!element->parentNode() || !element->parentNode()->isContentEditable())
+    if (!element->parentNode() || !element->parentNode()->rendererIsEditable())
         return false;
 
     if (isStyledInlineElementToRemove(element.get())) {
         if (mode == RemoveNone)
             return true;
         ASSERT(extractedStyle);
-        if (element->inlineStyleDecl()) {
-            if (extractedStyle->style())
-                extractedStyle->style()->merge(element->inlineStyleDecl());
-            else
-                extractedStyle->setStyle(element->inlineStyleDecl()->copy());
-        }
+        extractedStyle->mergeInlineStyleOfElement(element.get());
         removeNodePreservingChildren(element);
         return true;
     }
 
-    if (!style->style())
-        return false;
-
     bool removed = false;
     if (removeImplicitlyStyledElement(style, element.get(), mode, extractedStyle))
         removed = true;
@@ -1296,7 +1286,7 @@ void ApplyStyleCommand::applyInlineStyleToPushDown(Node* node, EditingStyle* sty
     // We can't wrap node with the styled element here because new styled element will never be removed if we did.
     // If we modified the child pointer in pushDownInlineStyleAroundNode to point to new style element
     // then we fall into an infinite loop where we keep removing and adding styled element wrapping node.
-    addInlineStyleIfNeeded(newInlineStyle->style(), node, node, DoNotAddStyledElement);
+    addInlineStyleIfNeeded(newInlineStyle.get(), node, node, DoNotAddStyledElement);
 }
 
 void ApplyStyleCommand::pushDownInlineStyleAroundNode(EditingStyle* style, Node* targetNode)
@@ -1312,7 +1302,6 @@ void ApplyStyleCommand::pushDownInlineStyleAroundNode(EditingStyle* style, Node*
     Vector<RefPtr<Element> > elementsToPushDown;
     while (current != targetNode) {
         ASSERT(current);
-        ASSERT(current->isHTMLElement());
         ASSERT(current->contains(targetNode));
         Node* child = current->firstChild();
         Node* lastChild = current->lastChild();
@@ -1321,8 +1310,10 @@ void ApplyStyleCommand::pushDownInlineStyleAroundNode(EditingStyle* style, Node*
             styledElement = static_cast<StyledElement*>(current);
             elementsToPushDown.append(styledElement);
         }
+
         RefPtr<EditingStyle> styleToPushDown = EditingStyle::create();
-        removeInlineStyleFromElement(style, toHTMLElement(current), RemoveIfNeeded, styleToPushDown.get());
+        if (current->isHTMLElement())
+            removeInlineStyleFromElement(style, toHTMLElement(current), RemoveIfNeeded, styleToPushDown.get());
 
         // The inner loop will go through children on each level
         // FIXME: we should aggregate inline child elements together so that we don't wrap each child separately.
@@ -1659,13 +1650,13 @@ void ApplyStyleCommand::surroundNodeRangeWithElement(PassRefPtr<Node> passedStar
 
     RefPtr<Node> nextSibling = element->nextSibling();
     RefPtr<Node> previousSibling = element->previousSibling();
-    if (nextSibling && nextSibling->isElementNode() && nextSibling->isContentEditable()
+    if (nextSibling && nextSibling->isElementNode() && nextSibling->rendererIsEditable()
         && areIdenticalElements(element.get(), static_cast<Element*>(nextSibling.get())))
         mergeIdenticalElements(element.get(), static_cast<Element*>(nextSibling.get()));
 
-    if (previousSibling && previousSibling->isElementNode() && previousSibling->isContentEditable()) {
+    if (previousSibling && previousSibling->isElementNode() && previousSibling->rendererIsEditable()) {
         Node* mergedElement = previousSibling->nextSibling();
-        if (mergedElement->isElementNode() && mergedElement->isContentEditable()
+        if (mergedElement->isElementNode() && mergedElement->rendererIsEditable()
             && areIdenticalElements(static_cast<Element*>(previousSibling.get()), static_cast<Element*>(mergedElement)))
             mergeIdenticalElements(static_cast<Element*>(previousSibling.get()), static_cast<Element*>(mergedElement));
     }
@@ -1689,7 +1680,7 @@ void ApplyStyleCommand::addBlockStyle(const StyleChange& styleChange, HTMLElemen
     setNodeAttribute(block, styleAttr, cssText);
 }
 
-void ApplyStyleCommand::addInlineStyleIfNeeded(CSSMutableStyleDeclaration *style, PassRefPtr<Node> passedStart, PassRefPtr<Node> passedEnd, EAddStyledElement addStyledElement)
+void ApplyStyleCommand::addInlineStyleIfNeeded(EditingStyle* style, PassRefPtr<Node> passedStart, PassRefPtr<Node> passedEnd, EAddStyledElement addStyledElement)
 {
     if (!passedStart || !passedEnd || !passedStart->inDocument() || !passedEnd->inDocument())
         return;
@@ -1704,7 +1695,7 @@ void ApplyStyleCommand::addInlineStyleIfNeeded(CSSMutableStyleDeclaration *style
         insertNodeAt(dummyElement, positionBeforeNode(startNode.get()));
         positionForStyleComparison = positionBeforeNode(dummyElement.get());
     } else
-        positionForStyleComparison = firstPositionInNode(startNode.get());
+        positionForStyleComparison = firstPositionInOrBeforeNode(startNode.get());
 
     StyleChange styleChange(style, positionForStyleComparison);
 
diff --git a/Source/WebCore/editing/ApplyStyleCommand.h b/Source/WebCore/editing/ApplyStyleCommand.h
index d4444e4..dc2217e 100644
--- a/Source/WebCore/editing/ApplyStyleCommand.h
+++ b/Source/WebCore/editing/ApplyStyleCommand.h
@@ -97,7 +97,7 @@ private:
     void fixRangeAndApplyInlineStyle(EditingStyle*, const Position& start, const Position& end);
     void applyInlineStyleToNodeRange(EditingStyle*, Node* startNode, Node* pastEndNode);
     void addBlockStyle(const StyleChange&, HTMLElement*);
-    void addInlineStyleIfNeeded(CSSMutableStyleDeclaration*, PassRefPtr<Node> start, PassRefPtr<Node> end, EAddStyledElement addStyledElement = AddStyledElement);
+    void addInlineStyleIfNeeded(EditingStyle*, PassRefPtr<Node> start, PassRefPtr<Node> end, EAddStyledElement = AddStyledElement);
     void splitTextAtStart(const Position& start, const Position& end);
     void splitTextAtEnd(const Position& start, const Position& end);
     void splitTextElementAtStart(const Position& start, const Position& end);
diff --git a/Source/WebCore/editing/BreakBlockquoteCommand.cpp b/Source/WebCore/editing/BreakBlockquoteCommand.cpp
index 011a787..91f496c 100644
--- a/Source/WebCore/editing/BreakBlockquoteCommand.cpp
+++ b/Source/WebCore/editing/BreakBlockquoteCommand.cpp
@@ -66,12 +66,8 @@ void BreakBlockquoteCommand::doApply()
     Position pos = endingSelection().start().downstream();
     
     // Find the top-most blockquote from the start.
-    Element* topBlockquote = 0;
-    for (ContainerNode* node = pos.deprecatedNode()->parentNode(); node; node = node->parentNode()) {
-        if (isMailBlockquote(node))
-            topBlockquote = static_cast<Element*>(node);
-    }
-    if (!topBlockquote || !topBlockquote->parentNode())
+    Node* topBlockquote = highestEnclosingNodeOfType(pos, isMailBlockquote);
+    if (!topBlockquote || !topBlockquote->parentNode() || !topBlockquote->isElementNode())
         return;
     
     RefPtr<Element> breakNode = createBreakElement(document());
@@ -103,7 +99,7 @@ void BreakBlockquoteCommand::doApply()
         pos = pos.next();
         
     // Adjust the position so we don't split at the beginning of a quote.  
-    while (isFirstVisiblePositionInNode(VisiblePosition(pos), nearestMailBlockquote(pos.deprecatedNode())))
+    while (isFirstVisiblePositionInNode(VisiblePosition(pos), enclosingNodeOfType(pos, isMailBlockquote)))
         pos = pos.previous();
     
     // startNode is the first node that we need to move to the new blockquote.
@@ -135,7 +131,7 @@ void BreakBlockquoteCommand::doApply()
         ancestors.append(node);
     
     // Insert a clone of the top blockquote after the break.
-    RefPtr<Element> clonedBlockquote = topBlockquote->cloneElementWithoutChildren();
+    RefPtr<Element> clonedBlockquote = static_cast<Element*>(topBlockquote)->cloneElementWithoutChildren();
     insertNodeAfter(clonedBlockquote.get(), breakNode.get());
     
     // Clone startNode's ancestors into the cloned blockquote.
@@ -152,7 +148,7 @@ void BreakBlockquoteCommand::doApply()
             // find the first one so that we know where to start numbering.
             while (listChildNode && !listChildNode->hasTagName(liTag))
                 listChildNode = listChildNode->nextSibling();
-            if (listChildNode && listChildNode->renderer())
+            if (listChildNode && listChildNode->renderer() && listChildNode->renderer()->isListItem())
                 setNodeAttribute(static_cast<Element*>(clonedChild.get()), startAttr, String::number(toRenderListItem(listChildNode->renderer())->value()));
         }
             
diff --git a/Source/WebCore/editing/CompositeEditCommand.cpp b/Source/WebCore/editing/CompositeEditCommand.cpp
index b7672ee..2a69fb7 100644
--- a/Source/WebCore/editing/CompositeEditCommand.cpp
+++ b/Source/WebCore/editing/CompositeEditCommand.cpp
@@ -144,7 +144,7 @@ void CompositeEditCommand::insertNodeAfter(PassRefPtr<Node> insertChild, PassRef
     ASSERT(insertChild);
     ASSERT(refChild);
     ASSERT(!refChild->hasTagName(bodyTag));
-    Element* parent = refChild->parentElement();
+    ContainerNode* parent = refChild->parentNode();
     ASSERT(parent);
     if (parent->lastChild() == refChild)
         appendNode(insertChild, parent);
@@ -184,7 +184,7 @@ void CompositeEditCommand::insertNodeAt(PassRefPtr<Node> insertChild, const Posi
         insertNodeAfter(insertChild, refChild);
 }
 
-void CompositeEditCommand::appendNode(PassRefPtr<Node> node, PassRefPtr<Element> parent)
+void CompositeEditCommand::appendNode(PassRefPtr<Node> node, PassRefPtr<ContainerNode> parent)
 {
     ASSERT(canHaveChildrenForEditing(parent.get()));
     applyCommandToComposite(AppendNodeCommand::create(parent, node));
@@ -830,10 +830,10 @@ void CompositeEditCommand::cloneParagraphUnderNewElement(Position& start, Positi
 // Deleting a paragraph will leave a placeholder. Remove it (and prune
 // empty or unrendered parents).
 
-void CompositeEditCommand::cleanupAfterDeletion()
+void CompositeEditCommand::cleanupAfterDeletion(VisiblePosition destination)
 {
     VisiblePosition caretAfterDelete = endingSelection().visibleStart();
-    if (isStartOfParagraph(caretAfterDelete) && isEndOfParagraph(caretAfterDelete)) {
+    if (caretAfterDelete != destination && isStartOfParagraph(caretAfterDelete) && isEndOfParagraph(caretAfterDelete)) {
         // Note: We want the rightmost candidate.
         Position position = caretAfterDelete.deepEquivalent().downstream();
         Node* node = position.deprecatedNode();
@@ -947,8 +947,8 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
         }
     }
     
-    VisiblePosition beforeParagraph = startOfParagraphToMove.previous();
-    VisiblePosition afterParagraph(endOfParagraphToMove.next());
+    VisiblePosition beforeParagraph = startOfParagraphToMove.previous(CannotCrossEditingBoundary);
+    VisiblePosition afterParagraph(endOfParagraphToMove.next(CannotCrossEditingBoundary));
 
     // We upstream() the end and downstream() the start so that we don't include collapsed whitespace in the move.
     // When we paste a fragment, spaces after the end and before the start are treated as though they were rendered.
@@ -985,8 +985,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     deleteSelection(false, false, false, false);
 
     ASSERT(destination.deepEquivalent().anchorNode()->inDocument());
-
-    cleanupAfterDeletion();
+    cleanupAfterDeletion(destination);
     ASSERT(destination.deepEquivalent().anchorNode()->inDocument());
 
     // Add a br if pruning an empty block level element caused a collapse. For example:
@@ -1049,7 +1048,7 @@ bool CompositeEditCommand::breakOutOfEmptyListItem()
     // FIXME: Can't we do something better when the immediate parent wasn't a list node?
     if (!listNode
         || (!listNode->hasTagName(ulTag) && !listNode->hasTagName(olTag))
-        || !listNode->isContentEditable()
+        || !listNode->rendererIsEditable()
         || listNode == emptyListItem->rootEditableElement())
         return false;
 
@@ -1114,7 +1113,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
     if (!isStartOfParagraph(caret) || !isEndOfParagraph(caret))
         return false;
     
-    VisiblePosition previous(caret.previous(true));
+    VisiblePosition previous(caret.previous(CannotCrossEditingBoundary));
     // Only move forward if there's nothing before the caret, or if there's unquoted content before it.
     if (enclosingNodeOfType(previous.deepEquivalent(), &isMailBlockquote))
         return false;
@@ -1173,8 +1172,8 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
 
     // Don't avoid block level anchors, because that would insert content into the wrong paragraph.
     if (enclosingAnchor && !isBlock(enclosingAnchor)) {
-        VisiblePosition firstInAnchor(firstDeepEditingPositionForNode(enclosingAnchor));
-        VisiblePosition lastInAnchor(lastDeepEditingPositionForNode(enclosingAnchor));
+        VisiblePosition firstInAnchor(firstPositionInNode(enclosingAnchor));
+        VisiblePosition lastInAnchor(lastPositionInNode(enclosingAnchor));
         // If visually just after the anchor, insert *inside* the anchor unless it's the last
         // VisiblePosition in the document, to match NSTextView.
         if (visiblePos == lastInAnchor) {
diff --git a/Source/WebCore/editing/CompositeEditCommand.h b/Source/WebCore/editing/CompositeEditCommand.h
index 9066b65..4b96d8f 100644
--- a/Source/WebCore/editing/CompositeEditCommand.h
+++ b/Source/WebCore/editing/CompositeEditCommand.h
@@ -32,7 +32,6 @@
 
 namespace WebCore {
 
-class CSSStyleDeclaration;
 class EditingStyle;
 class HTMLElement;
 class StyledElement;
@@ -50,7 +49,7 @@ protected:
     //
     // sugary-sweet convenience functions to help create and apply edit commands in composite commands
     //
-    void appendNode(PassRefPtr<Node>, PassRefPtr<Element> parent);
+    void appendNode(PassRefPtr<Node>, PassRefPtr<ContainerNode> parent);
     void applyCommandToComposite(PassRefPtr<EditCommand>);
     void applyStyle(const EditingStyle*, EditAction = EditActionChangeAttributes);
     void applyStyle(const EditingStyle*, const Position& start, const Position& end, EditAction = EditActionChangeAttributes);
@@ -110,7 +109,7 @@ protected:
     void moveParagraphs(const VisiblePosition&, const VisiblePosition&, const VisiblePosition&, bool preserveSelection = false, bool preserveStyle = true);
     void moveParagraphWithClones(const VisiblePosition& startOfParagraphToMove, const VisiblePosition& endOfParagraphToMove, Element* blockElement, Node* outerNode);
     void cloneParagraphUnderNewElement(Position& start, Position& end, Node* outerNode, Element* blockElement);
-    void cleanupAfterDeletion();
+    void cleanupAfterDeletion(VisiblePosition destination = VisiblePosition());
     
     bool breakOutOfEmptyListItem();
     bool breakOutOfEmptyMailBlockquotedParagraph();
diff --git a/Source/WebCore/editing/DeleteButtonController.cpp b/Source/WebCore/editing/DeleteButtonController.cpp
index 75b9a96..332e68f 100644
--- a/Source/WebCore/editing/DeleteButtonController.cpp
+++ b/Source/WebCore/editing/DeleteButtonController.cpp
@@ -63,7 +63,7 @@ DeleteButtonController::DeleteButtonController(Frame* frame)
 
 static bool isDeletableElement(const Node* node)
 {
-    if (!node || !node->isHTMLElement() || !node->inDocument() || !node->isContentEditable())
+    if (!node || !node->isHTMLElement() || !node->inDocument() || !node->rendererIsEditable())
         return false;
 
     // In general we want to only draw the UI around object of a certain area, but we still keep the min width/height to
@@ -156,15 +156,11 @@ static HTMLElement* enclosingDeletableElement(const VisibleSelection& selection)
 
     // The enclosingNodeOfType function only works on nodes that are editable
     // (which is strange, given its name).
-    if (!container->isContentEditable())
+    if (!container->rendererIsEditable())
         return 0;
 
     Node* element = enclosingNodeOfType(firstPositionInNode(container), &isDeletableElement);
-    if (!element)
-        return 0;
-
-    ASSERT(element->isHTMLElement());
-    return toHTMLElement(element);
+    return element && element->isHTMLElement() ? toHTMLElement(element) : 0;
 }
 
 void DeleteButtonController::respondToChangedSelection(const VisibleSelection& oldSelection)
diff --git a/Source/WebCore/editing/DeleteFromTextNodeCommand.cpp b/Source/WebCore/editing/DeleteFromTextNodeCommand.cpp
index fe572e1..8ee28a1 100644
--- a/Source/WebCore/editing/DeleteFromTextNodeCommand.cpp
+++ b/Source/WebCore/editing/DeleteFromTextNodeCommand.cpp
@@ -46,7 +46,7 @@ void DeleteFromTextNodeCommand::doApply()
 {
     ASSERT(m_node);
 
-    if (!m_node->isContentEditable())
+    if (!m_node->rendererIsEditable())
         return;
 
     ExceptionCode ec = 0;
@@ -65,7 +65,7 @@ void DeleteFromTextNodeCommand::doUnapply()
 {
     ASSERT(m_node);
 
-    if (!m_node->isContentEditable())
+    if (!m_node->rendererIsEditable())
         return;
         
     ExceptionCode ec;
diff --git a/Source/WebCore/editing/DeleteSelectionCommand.cpp b/Source/WebCore/editing/DeleteSelectionCommand.cpp
index 897c305..cbebe54 100644
--- a/Source/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/Source/WebCore/editing/DeleteSelectionCommand.cpp
@@ -52,7 +52,7 @@ static bool isTableRow(const Node* node)
 static bool isTableCellEmpty(Node* cell)
 {
     ASSERT(isTableCell(cell));
-    return VisiblePosition(firstDeepEditingPositionForNode(cell)) == VisiblePosition(lastDeepEditingPositionForNode(cell));
+    return VisiblePosition(firstPositionInNode(cell)) == VisiblePosition(lastPositionInNode(cell));
 }
 
 static bool isTableRowEmpty(Node* row)
@@ -72,6 +72,7 @@ DeleteSelectionCommand::DeleteSelectionCommand(Document *document, bool smartDel
       m_hasSelectionToDelete(false), 
       m_smartDelete(smartDelete), 
       m_mergeBlocksAfterDelete(mergeBlocksAfterDelete),
+      m_needPlaceholder(false),
       m_replace(replace),
       m_expandForSpecialElements(expandForSpecialElements),
       m_pruneStartBlockIfNecessary(false),
@@ -88,6 +89,7 @@ DeleteSelectionCommand::DeleteSelectionCommand(const VisibleSelection& selection
       m_hasSelectionToDelete(true), 
       m_smartDelete(smartDelete), 
       m_mergeBlocksAfterDelete(mergeBlocksAfterDelete),
+      m_needPlaceholder(false),
       m_replace(replace),
       m_expandForSpecialElements(expandForSpecialElements),
       m_pruneStartBlockIfNecessary(false),
@@ -188,8 +190,8 @@ void DeleteSelectionCommand::initializePositionData()
     // Don't move content out of a table cell.
     // If the cell is non-editable, enclosingNodeOfType won't return it by default, so
     // tell that function that we don't care if it returns non-editable nodes.
-    Node* startCell = enclosingNodeOfType(m_upstreamStart, &isTableCell, false);
-    Node* endCell = enclosingNodeOfType(m_downstreamEnd, &isTableCell, false);
+    Node* startCell = enclosingNodeOfType(m_upstreamStart, &isTableCell, CanCrossEditingBoundary);
+    Node* endCell = enclosingNodeOfType(m_downstreamEnd, &isTableCell, CanCrossEditingBoundary);
     // FIXME: This isn't right.  A borderless table with two rows and a single column would appear as two paragraphs.
     if (endCell && endCell != startCell)
         m_mergeBlocksAfterDelete = false;
@@ -262,8 +264,8 @@ void DeleteSelectionCommand::initializePositionData()
     // like the one below, since editing functions should obviously accept editing positions.
     // FIXME: Passing false to enclosingNodeOfType tells it that it's OK to return a non-editable
     // node.  This was done to match existing behavior, but it seems wrong.
-    m_startBlock = enclosingNodeOfType(m_downstreamStart.parentAnchoredEquivalent(), &isBlock, false);
-    m_endBlock = enclosingNodeOfType(m_upstreamEnd.parentAnchoredEquivalent(), &isBlock, false);
+    m_startBlock = enclosingNodeOfType(m_downstreamStart.parentAnchoredEquivalent(), &isBlock, CanCrossEditingBoundary);
+    m_endBlock = enclosingNodeOfType(m_upstreamEnd.parentAnchoredEquivalent(), &isBlock, CanCrossEditingBoundary);
 }
 
 void DeleteSelectionCommand::saveTypingStyleState()
@@ -284,7 +286,7 @@ void DeleteSelectionCommand::saveTypingStyleState()
 
     // If we're deleting into a Mail blockquote, save the style at end() instead of start()
     // We'll use this later in computeTypingStyleAfterDelete if we end up outside of a Mail blockquote
-    if (nearestMailBlockquote(m_selectionToDelete.start().deprecatedNode()))
+    if (enclosingNodeOfType(m_selectionToDelete.start(), isMailBlockquote))
         m_deleteIntoBlockquoteStyle = EditingStyle::create(m_selectionToDelete.end());
     else
         m_deleteIntoBlockquoteStyle = 0;
@@ -340,7 +342,7 @@ void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
         
     if (m_startRoot != m_endRoot && !(node->isDescendantOf(m_startRoot.get()) && node->isDescendantOf(m_endRoot.get()))) {
         // If a node is not in both the start and end editable roots, remove it only if its inside an editable region.
-        if (!node->parentNode()->isContentEditable()) {
+        if (!node->parentNode()->rendererIsEditable()) {
             // Don't remove non-editable atomic nodes.
             if (!node->firstChild())
                 return;
@@ -378,9 +380,9 @@ void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
         return;
     }
     
-    if (node == m_startBlock && !isEndOfBlock(VisiblePosition(firstDeepEditingPositionForNode(m_startBlock.get())).previous()))
+    if (node == m_startBlock && !isEndOfBlock(VisiblePosition(firstPositionInNode(m_startBlock.get())).previous()))
         m_needPlaceholder = true;
-    else if (node == m_endBlock && !isStartOfBlock(VisiblePosition(lastDeepEditingPositionForNode(m_startBlock.get())).next()))
+    else if (node == m_endBlock && !isStartOfBlock(VisiblePosition(lastPositionInNode(m_startBlock.get())).next()))
         m_needPlaceholder = true;
     
     // FIXME: Update the endpoints of the range being deleted.
@@ -592,7 +594,7 @@ void DeleteSelectionCommand::mergeParagraphs()
     }
     
     // We need to merge into m_upstreamStart's block, but it's been emptied out and collapsed by deletion.
-    if (!mergeDestination.deepEquivalent().deprecatedNode() || !mergeDestination.deepEquivalent().deprecatedNode()->isDescendantOf(m_upstreamStart.deprecatedNode()->enclosingBlockFlowElement()) || m_startsAtEmptyLine) {
+    if (!mergeDestination.deepEquivalent().deprecatedNode() || !mergeDestination.deepEquivalent().deprecatedNode()->isDescendantOf(enclosingBlock(m_upstreamStart.containerNode())) || m_startsAtEmptyLine) {
         insertNodeAt(createBreakElement(document()).get(), m_upstreamStart);
         mergeDestination = VisiblePosition(m_upstreamStart);
     }
@@ -687,7 +689,7 @@ void DeleteSelectionCommand::calculateTypingStyleAfterDelete()
     // has completed.
     
     // If we deleted into a blockquote, but are now no longer in a blockquote, use the alternate typing style
-    if (m_deleteIntoBlockquoteStyle && !nearestMailBlockquote(m_endingPosition.deprecatedNode()))
+    if (m_deleteIntoBlockquoteStyle && !enclosingNodeOfType(m_endingPosition, isMailBlockquote, CanCrossEditingBoundary))
         m_typingStyle = m_deleteIntoBlockquoteStyle;
     m_deleteIntoBlockquoteStyle = 0;
 
diff --git a/Source/WebCore/editing/EditingStyle.cpp b/Source/WebCore/editing/EditingStyle.cpp
index de71fb7..668c943 100644
--- a/Source/WebCore/editing/EditingStyle.cpp
+++ b/Source/WebCore/editing/EditingStyle.cpp
@@ -377,15 +377,13 @@ bool EditingStyle::textDirection(WritingDirection& writingDirection) const
         return false;
 
     RefPtr<CSSValue> unicodeBidi = m_mutableStyle->getPropertyCSSValue(CSSPropertyUnicodeBidi);
-    if (!unicodeBidi)
+    if (!unicodeBidi || !unicodeBidi->isPrimitiveValue())
         return false;
 
-    ASSERT(unicodeBidi->isPrimitiveValue());
     int unicodeBidiValue = static_cast<CSSPrimitiveValue*>(unicodeBidi.get())->getIdent();
     if (unicodeBidiValue == CSSValueEmbed) {
         RefPtr<CSSValue> direction = m_mutableStyle->getPropertyCSSValue(CSSPropertyDirection);
-        ASSERT(!direction || direction->isPrimitiveValue());
-        if (!direction)
+        if (!direction || !direction->isPrimitiveValue())
             return false;
 
         writingDirection = static_cast<CSSPrimitiveValue*>(direction.get())->getIdent() == CSSValueLtr ? LeftToRightWritingDirection : RightToLeftWritingDirection;
@@ -675,6 +673,11 @@ bool EditingStyle::extractConflictingImplicitStyleOfAttributes(HTMLElement* elem
     return removed;
 }
 
+bool EditingStyle::styleIsPresentInComputedStyleOfNode(Node* node) const
+{
+    return !m_mutableStyle || !getPropertiesNotIn(m_mutableStyle.get(), computedStyle(node).get())->length();
+}
+
 void EditingStyle::prepareToApplyAt(const Position& position, ShouldPreserveWritingDirection shouldPreserveWritingDirection)
 {
     if (!m_mutableStyle)
@@ -702,13 +705,10 @@ void EditingStyle::prepareToApplyAt(const Position& position, ShouldPreserveWrit
         m_mutableStyle->removeProperty(CSSPropertyBackgroundColor, ec);
     }
 
-    if (unicodeBidi) {
-        ASSERT(unicodeBidi->isPrimitiveValue());
+    if (unicodeBidi && unicodeBidi->isPrimitiveValue()) {
         m_mutableStyle->setProperty(CSSPropertyUnicodeBidi, static_cast<CSSPrimitiveValue*>(unicodeBidi.get())->getIdent());
-        if (direction) {
-            ASSERT(direction->isPrimitiveValue());
+        if (direction && direction->isPrimitiveValue())
             m_mutableStyle->setProperty(CSSPropertyDirection, static_cast<CSSPrimitiveValue*>(direction.get())->getIdent());
-        }
     }
 }
 
diff --git a/Source/WebCore/editing/EditingStyle.h b/Source/WebCore/editing/EditingStyle.h
index aa310ac..37bfea7 100644
--- a/Source/WebCore/editing/EditingStyle.h
+++ b/Source/WebCore/editing/EditingStyle.h
@@ -113,6 +113,7 @@ public:
     bool conflictsWithImplicitStyleOfAttributes(HTMLElement*) const;
     bool extractConflictingImplicitStyleOfAttributes(HTMLElement*, ShouldPreserveWritingDirection, EditingStyle* extractedStyle,
             Vector<QualifiedName>& conflictingAttributes, ShouldExtractMatchingStyle) const;
+    bool styleIsPresentInComputedStyleOfNode(Node*) const;
     void prepareToApplyAt(const Position&, ShouldPreserveWritingDirection = DoNotPreserveWritingDirection);
     void mergeTypingStyle(Document*);
     void mergeInlineStyleOfElement(StyledElement*);
diff --git a/Source/WebCore/editing/Editor.cpp b/Source/WebCore/editing/Editor.cpp
index 8807965..a793e0b 100644
--- a/Source/WebCore/editing/Editor.cpp
+++ b/Source/WebCore/editing/Editor.cpp
@@ -289,7 +289,7 @@ bool Editor::canDeleteRange(Range* range) const
     if (!startContainer || !endContainer)
         return false;
     
-    if (!startContainer->isContentEditable() || !endContainer->isContentEditable())
+    if (!startContainer->rendererIsEditable() || !endContainer->rendererIsEditable())
         return false;
     
     if (range->collapsed(ec)) {
@@ -653,10 +653,9 @@ WritingDirection Editor::textDirectionForSelection(bool& hasNestedOrMultipleEmbe
 
             RefPtr<CSSComputedStyleDeclaration> style = computedStyle(n);
             RefPtr<CSSValue> unicodeBidi = style->getPropertyCSSValue(CSSPropertyUnicodeBidi);
-            if (!unicodeBidi)
+            if (!unicodeBidi || !unicodeBidi->isPrimitiveValue())
                 continue;
 
-            ASSERT(unicodeBidi->isPrimitiveValue());
             int unicodeBidiValue = static_cast<CSSPrimitiveValue*>(unicodeBidi.get())->getIdent();
             if (unicodeBidiValue == CSSValueEmbed || unicodeBidiValue == CSSValueBidiOverride)
                 return NaturalWritingDirection;
@@ -684,10 +683,9 @@ WritingDirection Editor::textDirectionForSelection(bool& hasNestedOrMultipleEmbe
 
         RefPtr<CSSComputedStyleDeclaration> style = computedStyle(node);
         RefPtr<CSSValue> unicodeBidi = style->getPropertyCSSValue(CSSPropertyUnicodeBidi);
-        if (!unicodeBidi)
+        if (!unicodeBidi || !unicodeBidi->isPrimitiveValue())
             continue;
 
-        ASSERT(unicodeBidi->isPrimitiveValue());
         int unicodeBidiValue = static_cast<CSSPrimitiveValue*>(unicodeBidi.get())->getIdent();
         if (unicodeBidiValue == CSSValueNormal)
             continue;
@@ -697,10 +695,9 @@ WritingDirection Editor::textDirectionForSelection(bool& hasNestedOrMultipleEmbe
 
         ASSERT(unicodeBidiValue == CSSValueEmbed);
         RefPtr<CSSValue> direction = style->getPropertyCSSValue(CSSPropertyDirection);
-        if (!direction)
+        if (!direction || !direction->isPrimitiveValue())
             continue;
 
-        ASSERT(direction->isPrimitiveValue());
         int directionValue = static_cast<CSSPrimitiveValue*>(direction.get())->getIdent();
         if (directionValue != CSSValueLtr && directionValue != CSSValueRtl)
             continue;
@@ -1371,7 +1368,7 @@ int Editor::spellCheckerDocumentTag()
     return client() ? client()->spellCheckerDocumentTag() : 0;
 }
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(AUTOMATIC_TEXT_REPLACEMENT)
 
 void Editor::uppercaseWord()
 {
@@ -1823,14 +1820,16 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
     int searchEndOffsetAfterWrap = spellingSearchRange->endOffset(ec);
     
     int misspellingOffset = 0;
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-    RefPtr<Range> grammarSearchRange = spellingSearchRange->cloneRange(ec);
-    String misspelledWord;
-    String badGrammarPhrase;
+    GrammarDetail grammarDetail;
     int grammarPhraseOffset = 0;
+    RefPtr<Range> grammarSearchRange;
+    String badGrammarPhrase;
+    String misspelledWord;
+
+#if USE(UNIFIED_TEXT_CHECKING)
+    grammarSearchRange = spellingSearchRange->cloneRange(ec);
     bool isSpelling = true;
     int foundOffset = 0;
-    GrammarDetail grammarDetail;
     String foundItem = TextCheckingHelper(client(), spellingSearchRange).findFirstMisspellingOrBadGrammar(isGrammarCheckingEnabled(), isSpelling, foundOffset, grammarDetail);
     if (isSpelling) {
         misspelledWord = foundItem;
@@ -1841,15 +1840,11 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
     }
 #else
     RefPtr<Range> firstMisspellingRange;
-    String misspelledWord = TextCheckingHelper(client(), spellingSearchRange).findFirstMisspelling(misspellingOffset, false, firstMisspellingRange);
-    String badGrammarPhrase;
-
-#ifndef BUILDING_ON_TIGER
-    int grammarPhraseOffset = 0;
-    GrammarDetail grammarDetail;
+    misspelledWord = TextCheckingHelper(client(), spellingSearchRange).findFirstMisspelling(misspellingOffset, false, firstMisspellingRange);
 
+#if USE(GRAMMAR_CHECKING)
     // Search for bad grammar that occurs prior to the next misspelled word (if any)
-    RefPtr<Range> grammarSearchRange = spellingSearchRange->cloneRange(ec);
+    grammarSearchRange = spellingSearchRange->cloneRange(ec);
     if (!misspelledWord.isEmpty()) {
         // Stop looking at start of next misspelled word
         CharacterIterator chars(grammarSearchRange.get());
@@ -1869,7 +1864,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
         // going until the end of the very first chunk we tested is far enough
         spellingSearchRange->setEnd(searchEndNodeAfterWrap, searchEndOffsetAfterWrap, ec);
         
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(UNIFIED_TEXT_CHECKING)
         grammarSearchRange = spellingSearchRange->cloneRange(ec);
         foundItem = TextCheckingHelper(client(), spellingSearchRange).findFirstMisspellingOrBadGrammar(isGrammarCheckingEnabled(), isSpelling, foundOffset, grammarDetail);
         if (isSpelling) {
@@ -1882,7 +1877,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
 #else
         misspelledWord = TextCheckingHelper(client(), spellingSearchRange).findFirstMisspelling(misspellingOffset, false, firstMisspellingRange);
 
-#ifndef BUILDING_ON_TIGER
+#if USE(GRAMMAR_CHECKING)
         grammarSearchRange = spellingSearchRange->cloneRange(ec);
         if (!misspelledWord.isEmpty()) {
             // Stop looking at start of next misspelled word
@@ -1898,9 +1893,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
     }
     
     if (!badGrammarPhrase.isEmpty()) {
-#ifdef BUILDING_ON_TIGER
-        ASSERT_NOT_REACHED();
-#else
+        ASSERT(WTF_USE_GRAMMAR_CHECKING);
         // We found bad grammar. Since we only searched for bad grammar up to the first misspelled word, the bad grammar
         // takes precedence and we ignore any potential misspelled word. Select the grammar detail, update the spelling
         // panel, and store a marker so we draw the green squiggle later.
@@ -1915,7 +1908,6 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
         
         client()->updateSpellingUIWithGrammarString(badGrammarPhrase, grammarDetail);
         frame()->document()->markers()->addMarker(badGrammarRange.get(), DocumentMarker::Grammar, grammarDetail.userDescription);
-#endif        
     } else if (!misspelledWord.isEmpty()) {
         // We found a misspelling, but not any earlier bad grammar. Select the misspelling, update the spelling panel, and store
         // a marker so we draw the red squiggle later.
@@ -1958,23 +1950,23 @@ bool Editor::isSelectionMisspelled()
 
 bool Editor::isSelectionUngrammatical()
 {
-#ifdef BUILDING_ON_TIGER
-    return false;
-#else
+#if USE(GRAMMAR_CHECKING)
     Vector<String> ignoredGuesses;
     return TextCheckingHelper(client(), frame()->selection()->toNormalizedRange()).isUngrammatical(ignoredGuesses);
+#else
+    return false;
 #endif
 }
 
 Vector<String> Editor::guessesForUngrammaticalSelection()
 {
-#ifdef BUILDING_ON_TIGER
-    return Vector<String>();
-#else
+#if USE(GRAMMAR_CHECKING)
     Vector<String> guesses;
     // Ignore the result of isUngrammatical; we just want the guesses, whether or not there are any
     TextCheckingHelper(client(), frame()->selection()->toNormalizedRange()).isUngrammatical(guesses);
     return guesses;
+#else
+    return Vector<String>();
 #endif
 }
 
@@ -1991,7 +1983,7 @@ Vector<String> Editor::guessesForMisspelledSelection()
 
 Vector<String> Editor::guessesForMisspelledOrUngrammaticalSelection(bool& misspelled, bool& ungrammatical)
 {
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(UNIFIED_TEXT_CHECKING)
     return TextCheckingHelper(client(), frame()->selection()->toNormalizedRange()).guessesForMisspelledOrUngrammaticalRange(isGrammarCheckingEnabled(), misspelled, ungrammatical);
 #else
     misspelled = isSelectionMisspelled();
@@ -2060,7 +2052,7 @@ void Editor::markMisspellingsAndBadGrammar(const VisibleSelection &movingSelecti
 
 void Editor::markMisspellingsAfterTypingToWord(const VisiblePosition &wordStart, const VisibleSelection& selectionAfterTyping)
 {
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(UNIFIED_TEXT_CHECKING)
 #if SUPPORT_AUTOCORRECTION_PANEL
     // Apply pending autocorrection before next round of spell checking.
     bool doApplyCorrection = true;
@@ -2072,7 +2064,7 @@ void Editor::markMisspellingsAfterTypingToWord(const VisiblePosition &wordStart,
             doApplyCorrection = false;
     }
     if (doApplyCorrection)
-        dismissCorrectionPanel(ReasonForDismissingCorrectionPanelAccepted);
+        handleCorrectionPanelResult(dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanelAccepted));
     else
         m_correctionPanelInfo.rangeToBeReplaced.clear();
 #else
@@ -2082,12 +2074,14 @@ void Editor::markMisspellingsAfterTypingToWord(const VisiblePosition &wordStart,
     if (isContinuousSpellCheckingEnabled())
         textCheckingOptions |= MarkSpelling;
 
+#if USE(AUTOMATIC_TEXT_REPLACEMENT)
     if (isAutomaticQuoteSubstitutionEnabled()
         || isAutomaticLinkDetectionEnabled()
         || isAutomaticDashSubstitutionEnabled()
         || isAutomaticTextReplacementEnabled()
         || ((textCheckingOptions & MarkSpelling) && isAutomaticSpellingCorrectionEnabled()))
         textCheckingOptions |= PerformReplacement;
+#endif
 
     if (!textCheckingOptions & (MarkSpelling | PerformReplacement))
         return;
@@ -2162,7 +2156,7 @@ void Editor::markMisspellingsOrBadGrammar(const VisibleSelection& selection, boo
     
     // If we're not in an editable node, bail.
     Node* editableNode = searchRange->startContainer();
-    if (!editableNode || !editableNode->isContentEditable())
+    if (!editableNode || !editableNode->rendererIsEditable())
         return;
 
     if (!isSpellCheckingEnabledFor(editableNode))
@@ -2176,12 +2170,9 @@ void Editor::markMisspellingsOrBadGrammar(const VisibleSelection& selection, boo
     if (checkSpelling)
         checker.markAllMisspellings(firstMisspellingRange);
     else {
-#ifdef BUILDING_ON_TIGER
-        ASSERT_NOT_REACHED();
-#else
+        ASSERT(WTF_USE_GRAMMAR_CHECKING);
         if (isGrammarCheckingEnabled())
             checker.markAllBadGrammar();
-#endif
     }    
 }
 
@@ -2207,17 +2198,14 @@ void Editor::markMisspellings(const VisibleSelection& selection, RefPtr<Range>&
     
 void Editor::markBadGrammar(const VisibleSelection& selection)
 {
-#ifndef BUILDING_ON_TIGER
+    ASSERT(WTF_USE_GRAMMAR_CHECKING);
     RefPtr<Range> firstMisspellingRange;
     markMisspellingsOrBadGrammar(selection, false, firstMisspellingRange);
-#else
-    UNUSED_PARAM(selection);
-#endif
 }
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
 void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCheckingOptions, Range* spellingRange, Range* grammarRange)
 {
+#if USE(UNIFIED_TEXT_CHECKING)
     // There shouldn't be pending autocorrection at this moment.
     ASSERT(!m_correctionPanelInfo.rangeToBeReplaced);
 
@@ -2233,7 +2221,7 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
 
     // If we're not in an editable node, bail.
     Node* editableNode = spellingRange->startContainer();
-    if (!editableNode || !editableNode->isContentEditable())
+    if (!editableNode || !editableNode->rendererIsEditable())
         return;
 
     if (!isSpellCheckingEnabledFor(editableNode))
@@ -2248,7 +2236,6 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
 
     TextCheckingParagraph spellingParagraph(spellingRange);
     TextCheckingParagraph grammarParagraph(shouldMarkGrammar ? grammarRange : 0);
-    TextCheckingParagraph& paragraph = shouldMarkGrammar ? grammarParagraph : spellingParagraph; 
 
     if (shouldMarkGrammar ? (spellingParagraph.isRangeEmpty() && grammarParagraph.isEmpty()) : spellingParagraph.isEmpty())
         return;
@@ -2257,13 +2244,13 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
         if (m_frame->selection()->selectionType() == VisibleSelection::CaretSelection) {
             // Attempt to save the caret position so we can restore it later if needed
             Position caretPosition = m_frame->selection()->end();
-            int offset = paragraph.offsetTo(caretPosition, ec);
+            int offset = spellingParagraph.offsetTo(caretPosition, ec);
             if (!ec) {
                 selectionOffset = offset;
                 restoreSelectionAfterChange = true;
-                if (selectionOffset > 0 && (selectionOffset > paragraph.textLength() || paragraph.textCharAt(selectionOffset - 1) == newlineCharacter))
+                if (selectionOffset > 0 && (selectionOffset > spellingParagraph.textLength() || spellingParagraph.textCharAt(selectionOffset - 1) == newlineCharacter))
                     adjustSelectionForParagraphBoundaries = true;
-                if (selectionOffset > 0 && selectionOffset <= paragraph.textLength() && isAmbiguousBoundaryCharacter(paragraph.textCharAt(selectionOffset - 1)))
+                if (selectionOffset > 0 && selectionOffset <= spellingParagraph.textLength() && isAmbiguousBoundaryCharacter(spellingParagraph.textCharAt(selectionOffset - 1)))
                     ambiguousBoundaryOffset = selectionOffset - 1;
             }
         }
@@ -2278,6 +2265,7 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
     if (shouldShowCorrectionPanel)
         checkingTypes |= TextCheckingTypeCorrection;
     if (shouldPerformReplacement) {
+#if USE(AUTOMATIC_TEXT_REPLACEMENT)
         if (isAutomaticLinkDetectionEnabled())
             checkingTypes |= TextCheckingTypeLink;
         if (isAutomaticQuoteSubstitutionEnabled())
@@ -2288,8 +2276,13 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
             checkingTypes |= TextCheckingTypeReplacement;
         if (shouldMarkSpelling && isAutomaticSpellingCorrectionEnabled())
             checkingTypes |= TextCheckingTypeCorrection;
+#endif
     }
-    textChecker()->checkTextOfParagraph(paragraph.textCharacters(), paragraph.textLength(), checkingTypes, results);
+    if (shouldMarkGrammar)
+        textChecker()->checkTextOfParagraph(grammarParagraph.textCharacters(), grammarParagraph.textLength(), checkingTypes, results);
+    else
+        textChecker()->checkTextOfParagraph(spellingParagraph.textCharacters(), spellingParagraph.textLength(), checkingTypes, results);
+        
 
 #if SUPPORT_AUTOCORRECTION_PANEL
     // If this checking is only for showing correction panel, we shouldn't bother to mark misspellings.
@@ -2348,7 +2341,7 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
             // 2. The result doesn't end at an ambiguous boundary.
             //    (FIXME: this is required until 6853027 is fixed and text checking can do this for us
             bool doReplacement = replacementLength > 0 && !resultEndsAtAmbiguousBoundary;
-            RefPtr<Range> rangeToReplace = paragraph.subrange(resultLocation, resultLength);
+            RefPtr<Range> rangeToReplace = spellingParagraph.subrange(resultLocation, resultLength);
             VisibleSelection selectionToReplace(rangeToReplace.get(), DOWNSTREAM);
 
             // adding links should be done only immediately after they are typed
@@ -2387,7 +2380,7 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
                     m_correctionPanelInfo.replacedString = plainText(rangeToReplace.get());
                     m_correctionPanelInfo.replacementString = result->replacement;
                     m_correctionPanelInfo.isActive = true;
-                    client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, result->replacement, Vector<String>(), this);
+                    client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, result->replacement, Vector<String>());
                     break;
                 }
                 // If this function is called for showing correction panel, we ignore other correction or replacement.
@@ -2433,7 +2426,7 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
 
                 if (result->type == TextCheckingTypeCorrection) {
                     // Add a marker so that corrections can easily be undone and won't be re-corrected.
-                    RefPtr<Range> replacedRange = paragraph.subrange(resultLocation, replacementLength);
+                    RefPtr<Range> replacedRange = spellingParagraph.subrange(resultLocation, replacementLength);
                     replacedRange->startContainer()->document()->markers()->addMarker(replacedRange.get(), DocumentMarker::Replacement, replacedString);
                     replacedRange->startContainer()->document()->markers()->addMarker(replacedRange.get(), DocumentMarker::CorrectionIndicator);
                     replacedRange->startContainer()->document()->markers()->addMarker(replacedRange.get(), DocumentMarker::SpellCheckingExemption);
@@ -2444,9 +2437,9 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
 
     if (selectionChanged) {
         // Restore the caret position if we have made any replacements
-        paragraph.expandRangeToNextEnd();
-        if (restoreSelectionAfterChange && selectionOffset >= 0 && selectionOffset <= paragraph.rangeLength()) {
-            RefPtr<Range> selectionRange = paragraph.subrange(0, selectionOffset);
+        spellingParagraph.expandRangeToNextEnd();
+        if (restoreSelectionAfterChange && selectionOffset >= 0 && selectionOffset <= spellingParagraph.rangeLength()) {
+            RefPtr<Range> selectionRange = spellingParagraph.subrange(0, selectionOffset);
             m_frame->selection()->moveTo(selectionRange->endPosition(), DOWNSTREAM);
             if (adjustSelectionForParagraphBoundaries)
                 m_frame->selection()->modify(SelectionController::AlterationMove, DirectionForward, CharacterGranularity);
@@ -2456,10 +2449,17 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
             m_frame->selection()->modify(SelectionController::AlterationMove, DirectionForward, CharacterGranularity);
         }
     }
+#else
+    ASSERT_NOT_REACHED();
+    UNUSED_PARAM(textCheckingOptions);
+    UNUSED_PARAM(spellingRange);
+    UNUSED_PARAM(grammarRange);
+#endif // USE(UNIFIED_TEXT_CHECKING)
 }
 
 void Editor::changeBackToReplacedString(const String& replacedString)
 {
+#if USE(UNIFIED_TEXT_CHECKING)
     if (replacedString.isEmpty())
         return;
 
@@ -2478,13 +2478,16 @@ void Editor::changeBackToReplacedString(const String& replacedString)
 #if SUPPORT_AUTOCORRECTION_PANEL
     changedRange->startContainer()->document()->markers()->addMarker(changedRange.get(), DocumentMarker::SpellCheckingExemption);
 #endif
+#else
+    ASSERT_NOT_REACHED();
+    UNUSED_PARAM(replacedString);
+#endif // USE(UNIFIED_TEXT_CHECKING)
 }
 
-#endif
 
 void Editor::markMisspellingsAndBadGrammar(const VisibleSelection& spellingSelection, bool markGrammar, const VisibleSelection& grammarSelection)
 {
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(UNIFIED_TEXT_CHECKING)
     if (!isContinuousSpellCheckingEnabled())
         return;
     TextCheckingOptions textCheckingOptions = MarkSpelling;
@@ -2517,7 +2520,7 @@ void Editor::correctionPanelTimerFired(Timer<Editor>*)
         m_correctionPanelInfo.replacedString = plainText(m_correctionPanelInfo.rangeToBeReplaced.get());
         FloatRect boundingBox = windowRectForRange(m_correctionPanelInfo.rangeToBeReplaced.get());
         if (!boundingBox.isEmpty())
-            client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, m_correctionPanelInfo.replacementString, Vector<String>(), this);
+            client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, m_correctionPanelInfo.replacementString, Vector<String>());
     }
         break;
     case CorrectionPanelInfo::PanelTypeSpellingSuggestions: {
@@ -2535,7 +2538,7 @@ void Editor::correctionPanelTimerFired(Timer<Editor>*)
         m_correctionPanelInfo.isActive = true;
         FloatRect boundingBox = windowRectForRange(m_correctionPanelInfo.rangeToBeReplaced.get());
         if (!boundingBox.isEmpty())
-            client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, topSuggestion, suggestions, this);
+            client()->showCorrectionPanel(m_correctionPanelInfo.panelType, boundingBox, m_correctionPanelInfo.replacedString, topSuggestion, suggestions);
     }
         break;
     }
@@ -2601,39 +2604,36 @@ void Editor::stopCorrectionPanelTimer()
 #endif
 }
 
-void Editor::handleCancelOperation()
+void Editor::dismissCorrectionPanel(ReasonForDismissingCorrectionPanel reasonForDismissing)
 {
 #if SUPPORT_AUTOCORRECTION_PANEL
     if (!m_correctionPanelInfo.isActive)
         return;
     m_correctionPanelInfo.isActive = false;
+    m_correctionPanelIsDismissedByEditor = true;
     if (client())
-        client()->dismissCorrectionPanel(ReasonForDismissingCorrectionPanelCancelled);
-#endif
-}
-
-bool Editor::isShowingCorrectionPanel()
-{
-#if SUPPORT_AUTOCORRECTION_PANEL
-    if (client())
-        return client()->isShowingCorrectionPanel();
+        client()->dismissCorrectionPanel(reasonForDismissing);
+#else
+    UNUSED_PARAM(reasonForDismissing);
 #endif
-    return false;
 }
 
-void Editor::dismissCorrectionPanel(ReasonForDismissingCorrectionPanel reasonForDismissing)
+String Editor::dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanel reasonForDismissing)
 {
 #if SUPPORT_AUTOCORRECTION_PANEL
     if (!m_correctionPanelInfo.isActive)
-        return;
+        return String();
     m_correctionPanelInfo.isActive = false;
     m_correctionPanelIsDismissedByEditor = true;
-    if (client())
-        client()->dismissCorrectionPanel(reasonForDismissing);
+    if (!client())
+        return String();
+    return client()->dismissCorrectionPanelSoon(reasonForDismissing);
 #else
     UNUSED_PARAM(reasonForDismissing);
+    return String();
 #endif
 }
+
 void Editor::removeSpellAndCorrectionMarkersFromWordsToBeEdited(bool doNotRemoveIfSelectionAtWordBoundary)
 {
     // We want to remove the markers from a word if an editing command will change the word. This can happen in one of
@@ -2768,7 +2768,7 @@ bool Editor::applyAutocorrectionBeforeTypingIfAppropriate()
     Position caretPosition = m_frame->selection()->selection().start();
 
     if (m_correctionPanelInfo.rangeToBeReplaced->endPosition() == caretPosition) {
-        dismissCorrectionPanel(ReasonForDismissingCorrectionPanelAccepted);
+        handleCorrectionPanelResult(dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanelAccepted));
         return true;
     } 
     
@@ -3572,7 +3572,7 @@ static Node* findFirstMarkable(Node* node)
     return 0;
 }
 
-bool Editor::selectionStartHasSpellingMarkerFor(int from, int length) const
+bool Editor::selectionStartHasMarkerFor(DocumentMarker::MarkerType markerType, int from, int length) const
 {
     Node* node = findFirstMarkable(m_frame->selection()->start().deprecatedNode());
     if (!node)
@@ -3583,7 +3583,7 @@ bool Editor::selectionStartHasSpellingMarkerFor(int from, int length) const
     Vector<DocumentMarker> markers = m_frame->document()->markers()->markersForNode(node);
     for (size_t i = 0; i < markers.size(); ++i) {
         DocumentMarker marker = markers[i];
-        if (marker.startOffset <= startOffset && endOffset <= marker.endOffset && marker.type == DocumentMarker::Spelling)
+        if (marker.startOffset <= startOffset && endOffset <= marker.endOffset && marker.type == markerType)
             return true;
     }
 
diff --git a/Source/WebCore/editing/Editor.h b/Source/WebCore/editing/Editor.h
index e1a7119..c723ddf 100644
--- a/Source/WebCore/editing/Editor.h
+++ b/Source/WebCore/editing/Editor.h
@@ -36,6 +36,7 @@
 #include "EditorInsertAction.h"
 #include "FindOptions.h"
 #include "SelectionController.h"
+#include "TextChecking.h"
 #include "Timer.h"
 #include "VisibleSelection.h"
 #include "WritingDirection.h"
@@ -222,7 +223,7 @@ public:
     void markMisspellings(const VisibleSelection&, RefPtr<Range>& firstMisspellingRange);
     void markBadGrammar(const VisibleSelection&);
     void markMisspellingsAndBadGrammar(const VisibleSelection& spellingSelection, bool markGrammar, const VisibleSelection& grammarSelection);
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(AUTOMATIC_TEXT_REPLACEMENT)
     void uppercaseWord();
     void lowercaseWord();
     void capitalizeWord();
@@ -239,6 +240,8 @@ public:
     void toggleAutomaticTextReplacement();
     bool isAutomaticSpellingCorrectionEnabled();
     void toggleAutomaticSpellingCorrection();
+#endif
+
     enum TextCheckingOptionFlags {
         MarkSpelling = 1 << 0,
         MarkGrammar = 1 << 1,
@@ -249,7 +252,7 @@ public:
 
     void markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions, Range* spellingRange, Range* grammarRange);
     void changeBackToReplacedString(const String& replacedString);
-#endif
+
     void advanceToNextMisspelling(bool startBeforeSelection = false);
     void showSpellingGuessPanel();
     bool spellingPanelIsShowing();
@@ -320,11 +323,9 @@ public:
 
     void addToKillRing(Range*, bool prepend);
 
-    void handleCancelOperation();
     void startCorrectionPanelTimer(CorrectionPanelInfo::PanelType);
     // If user confirmed a correction in the correction panel, correction has non-zero length, otherwise it means that user has dismissed the panel.
     void handleCorrectionPanelResult(const String& correction);
-    bool isShowingCorrectionPanel();
 
     void pasteAsFragment(PassRefPtr<DocumentFragment>, bool smartReplace, bool matchStyle);
     void pasteAsPlainText(const String&, bool smartReplace);
@@ -376,9 +377,10 @@ public:
     bool canCopyExcludingStandaloneImages();
     void takeFindStringFromSelection();
     void writeSelectionToPasteboard(const String& pasteboardName, const Vector<String>& pasteboardTypes);
+    void readSelectionFromPasteboard(const String& pasteboardName);
 #endif
 
-    bool selectionStartHasSpellingMarkerFor(int from, int length) const;
+    bool selectionStartHasMarkerFor(DocumentMarker::MarkerType, int from, int length) const;
     void removeSpellAndCorrectionMarkersFromWordsToBeEdited(bool doNotRemoveIfSelectionAtWordBoundary);
 
 private:
@@ -425,6 +427,7 @@ private:
     Node* findEventTargetFromSelection() const;
     void stopCorrectionPanelTimer();
     void dismissCorrectionPanel(ReasonForDismissingCorrectionPanel);
+    String dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanel);
     void applyCorrectionPanelInfo(const Vector<DocumentMarker::MarkerType>& markerTypesToAdd);
     // Return true if correction was applied, false otherwise.
     bool applyAutocorrectionBeforeTypingIfAppropriate();
diff --git a/Source/WebCore/editing/EditorCommand.cpp b/Source/WebCore/editing/EditorCommand.cpp
index 6ea9954..8ea37bb 100644
--- a/Source/WebCore/editing/EditorCommand.cpp
+++ b/Source/WebCore/editing/EditorCommand.cpp
@@ -56,6 +56,7 @@
 #include "Sound.h"
 #include "TypingCommand.h"
 #include "UnlinkCommand.h"
+#include "UserTypingGestureIndicator.h"
 #include "htmlediting.h"
 #include "markup.h"
 #include <wtf/text/AtomicString.h>
@@ -254,7 +255,7 @@ static int verticalScrollDistance(Frame* frame)
     RenderStyle* style = renderer->style();
     if (!style)
         return 0;
-    if (!(style->overflowY() == OSCROLL || style->overflowY() == OAUTO || focusedNode->isContentEditable()))
+    if (!(style->overflowY() == OSCROLL || style->overflowY() == OAUTO || focusedNode->rendererIsEditable()))
         return 0;
     int height = std::min<int>(toRenderBox(renderer)->clientHeight(),
                                frame->view()->visibleHeight());
@@ -294,19 +295,25 @@ static bool executeCreateLink(Frame* frame, Event*, EditorCommandSource, const S
     return true;
 }
 
-static bool executeCut(Frame* frame, Event*, EditorCommandSource, const String&)
+static bool executeCut(Frame* frame, Event*, EditorCommandSource source, const String&)
 {
-    frame->editor()->cut();
+    if (source == CommandFromMenuOrKeyBinding) {
+        UserTypingGestureIndicator typingGestureIndicator(frame);
+        frame->editor()->cut();
+    } else
+        frame->editor()->cut();
     return true;
 }
 
 static bool executeDelete(Frame* frame, Event*, EditorCommandSource source, const String&)
 {
     switch (source) {
-    case CommandFromMenuOrKeyBinding:
+    case CommandFromMenuOrKeyBinding: {
         // Doesn't modify the text if the current selection isn't a range.
+        UserTypingGestureIndicator typingGestureIndicator(frame);
         frame->editor()->performDelete();
         return true;
+    }
     case CommandFromDOM:
     case CommandFromDOMWithUserInterface:
         // If the current selection is a caret, delete the preceding character. IE performs forwardDelete, but we currently side with Firefox.
@@ -883,21 +890,33 @@ static bool executeOutdent(Frame* frame, Event*, EditorCommandSource, const Stri
     return true;
 }
 
-static bool executePaste(Frame* frame, Event*, EditorCommandSource, const String&)
+static bool executePaste(Frame* frame, Event*, EditorCommandSource source, const String&)
 {
-    frame->editor()->paste();
+    if (source == CommandFromMenuOrKeyBinding) {
+        UserTypingGestureIndicator typingGestureIndicator(frame);
+        frame->editor()->paste();
+    } else
+        frame->editor()->paste();
     return true;
 }
 
-static bool executePasteAndMatchStyle(Frame* frame, Event*, EditorCommandSource, const String&)
+static bool executePasteAndMatchStyle(Frame* frame, Event*, EditorCommandSource source, const String&)
 {
-    frame->editor()->pasteAsPlainText();
+    if (source == CommandFromMenuOrKeyBinding) {
+        UserTypingGestureIndicator typingGestureIndicator(frame);
+        frame->editor()->pasteAsPlainText();
+    } else
+        frame->editor()->pasteAsPlainText();
     return true;
 }
 
-static bool executePasteAsPlainText(Frame* frame, Event*, EditorCommandSource, const String&)
+static bool executePasteAsPlainText(Frame* frame, Event*, EditorCommandSource source, const String&)
 {
-    frame->editor()->pasteAsPlainText();
+    if (source == CommandFromMenuOrKeyBinding) {
+        UserTypingGestureIndicator typingGestureIndicator(frame);
+        frame->editor()->pasteAsPlainText();
+    } else
+        frame->editor()->pasteAsPlainText();
     return true;
 }
 
@@ -1091,14 +1110,6 @@ static bool executeYankAndSelect(Frame* frame, Event*, EditorCommandSource, cons
     return true;
 }
 
-#if SUPPORT_AUTOCORRECTION_PANEL
-static bool executeCancelOperation(Frame* frame, Event*, EditorCommandSource, const String&)
-{
-    frame->editor()->handleCancelOperation();
-    return true;
-}
-#endif
-
 // Supported functions
 
 static bool supported(Frame*)
@@ -1249,13 +1260,6 @@ static bool enabledUndo(Frame* frame, Event*, EditorCommandSource)
     return frame->editor()->canUndo();
 }
 
-#if SUPPORT_AUTOCORRECTION_PANEL
-static bool enabledDismissCorrectionPanel(Frame* frame, Event*, EditorCommandSource)
-{
-    return frame->editor()->isShowingCorrectionPanel();
-}
-#endif
-
 // State functions
 
 static TriState stateNone(Frame*, Event*)
@@ -1532,10 +1536,6 @@ static const CommandMap& createCommandMap()
 #if PLATFORM(MAC)
         { "TakeFindStringFromSelection", { executeTakeFindStringFromSelection, supportedFromMenuOrKeyBinding, enabledTakeFindStringFromSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
 #endif
-
-#if SUPPORT_AUTOCORRECTION_PANEL
-        { "CancelOperation", { executeCancelOperation, supportedFromMenuOrKeyBinding, enabledDismissCorrectionPanel, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-#endif
     };
 
     // These unsupported commands are listed here since they appear in the Microsoft
diff --git a/Source/WebCore/editing/EditorInsertAction.h b/Source/WebCore/editing/EditorInsertAction.h
index 5b732dc..b8b137d 100644
--- a/Source/WebCore/editing/EditorInsertAction.h
+++ b/Source/WebCore/editing/EditorInsertAction.h
@@ -32,7 +32,7 @@ namespace WebCore {
 enum EditorInsertAction {
     EditorInsertActionTyped,
     EditorInsertActionPasted,
-    EditorInsertActionDropped,
+    EditorInsertActionDropped
 };
 
 } // namespace
diff --git a/Source/WebCore/editing/FormatBlockCommand.cpp b/Source/WebCore/editing/FormatBlockCommand.cpp
index 9d90a1e..759ca31 100644
--- a/Source/WebCore/editing/FormatBlockCommand.cpp
+++ b/Source/WebCore/editing/FormatBlockCommand.cpp
@@ -112,8 +112,7 @@ Element* FormatBlockCommand::elementForFormatBlockCommand(Range* range)
     if (!rootEditableElement || commonAncestor->contains(rootEditableElement))
         return 0;
 
-    ASSERT(commonAncestor->isElementNode());
-    return static_cast<Element*>(commonAncestor);
+    return commonAncestor->isElementNode() ? toElement(commonAncestor) : 0;
 }
 
 bool isElementForFormatBlock(const QualifiedName& tagName)
@@ -149,14 +148,14 @@ Node* enclosingBlockToSplitTreeTo(Node* startNode)
 {
     Node* lastBlock = startNode;
     for (Node* n = startNode; n; n = n->parentNode()) {
-        if (!n->isContentEditable())
+        if (!n->rendererIsEditable())
             return lastBlock;
-        if (isTableCell(n) || n->hasTagName(bodyTag) || !n->parentNode() || !n->parentNode()->isContentEditable() || isElementForFormatBlock(n))
+        if (isTableCell(n) || n->hasTagName(bodyTag) || !n->parentNode() || !n->parentNode()->rendererIsEditable() || isElementForFormatBlock(n))
             return n;
         if (isBlock(n))
             lastBlock = n;
         if (isListElement(n))
-            return n->parentNode()->isContentEditable() ? n->parentNode() : n;
+            return n->parentNode()->rendererIsEditable() ? n->parentNode() : n;
     }
     return lastBlock;
 }
diff --git a/Source/WebCore/editing/IndentOutdentCommand.cpp b/Source/WebCore/editing/IndentOutdentCommand.cpp
index 82bec06..0229e85 100644
--- a/Source/WebCore/editing/IndentOutdentCommand.cpp
+++ b/Source/WebCore/editing/IndentOutdentCommand.cpp
@@ -120,7 +120,7 @@ void IndentOutdentCommand::outdentParagraph()
     VisiblePosition visibleEndOfParagraph = endOfParagraph(visibleStartOfParagraph);
 
     Node* enclosingNode = enclosingNodeOfType(visibleStartOfParagraph.deepEquivalent(), &isListOrIndentBlockquote);
-    if (!enclosingNode || !enclosingNode->parentNode()->isContentEditable())  // We can't outdent if there is no place to go!
+    if (!enclosingNode || !enclosingNode->parentNode()->rendererIsEditable()) // We can't outdent if there is no place to go!
         return;
 
     // Use InsertListCommand to remove the selection from the list
@@ -151,7 +151,7 @@ void IndentOutdentCommand::outdentParagraph()
             if (ContainerNode* splitPointParent = splitPoint->parentNode()) {
                 if (splitPointParent->hasTagName(blockquoteTag)
                     && !splitPoint->hasTagName(blockquoteTag)
-                    && splitPointParent->parentNode()->isContentEditable()) // We can't outdent if there is no place to go!
+                    && splitPointParent->parentNode()->rendererIsEditable()) // We can't outdent if there is no place to go!
                     splitElement(static_cast<Element*>(splitPointParent), splitPoint);
             }
         }
diff --git a/Source/WebCore/editing/InsertIntoTextNodeCommand.cpp b/Source/WebCore/editing/InsertIntoTextNodeCommand.cpp
index 9b7761c..b1a455b 100644
--- a/Source/WebCore/editing/InsertIntoTextNodeCommand.cpp
+++ b/Source/WebCore/editing/InsertIntoTextNodeCommand.cpp
@@ -44,7 +44,7 @@ InsertIntoTextNodeCommand::InsertIntoTextNodeCommand(PassRefPtr<Text> node, unsi
 
 void InsertIntoTextNodeCommand::doApply()
 {
-    if (!m_node->isContentEditable())
+    if (!m_node->rendererIsEditable())
         return;
     
     ExceptionCode ec;
@@ -56,7 +56,7 @@ void InsertIntoTextNodeCommand::doApply()
 
 void InsertIntoTextNodeCommand::doUnapply()
 {
-    if (!m_node->isContentEditable())
+    if (!m_node->rendererIsEditable())
         return;
         
     // Need to notify this before actually deleting the text
diff --git a/Source/WebCore/editing/InsertLineBreakCommand.cpp b/Source/WebCore/editing/InsertLineBreakCommand.cpp
index 2260a00..76c9052 100644
--- a/Source/WebCore/editing/InsertLineBreakCommand.cpp
+++ b/Source/WebCore/editing/InsertLineBreakCommand.cpp
@@ -171,7 +171,7 @@ void InsertLineBreakCommand::doApply()
         // leaves and then comes back, new input will have the right style.
         // FIXME: We shouldn't always apply the typing style to the line break here,
         // see <rdar://problem/5794462>.
-        applyStyle(typingStyle.get(), firstDeepEditingPositionForNode(nodeToInsert.get()), lastDeepEditingPositionForNode(nodeToInsert.get()));
+        applyStyle(typingStyle.get(), firstPositionInOrBeforeNode(nodeToInsert.get()), lastPositionInOrAfterNode(nodeToInsert.get()));
         // Even though this applyStyle operates on a Range, it still sets an endingSelection().
         // It tries to set a VisibleSelection around the content it operated on. So, that VisibleSelection
         // will either (a) select the line break we inserted, or it will (b) be a caret just 
diff --git a/Source/WebCore/editing/InsertListCommand.cpp b/Source/WebCore/editing/InsertListCommand.cpp
index 68661b4..4585b2e 100644
--- a/Source/WebCore/editing/InsertListCommand.cpp
+++ b/Source/WebCore/editing/InsertListCommand.cpp
@@ -121,8 +121,8 @@ void InsertListCommand::doApply()
     // FIXME: We paint the gap before some paragraphs that are indented with left 
     // margin/padding, but not others.  We should make the gap painting more consistent and 
     // then use a left margin/padding rule here.
-    if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd))
-        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
+    if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd, CanSkipOverEditingBoundary))
+        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(CannotCrossEditingBoundary)));
 
     const QualifiedName& listTag = (m_type == OrderedList) ? olTag : ulTag;
     if (endingSelection().isRange()) {
@@ -130,14 +130,14 @@ void InsertListCommand::doApply()
         ASSERT(selection.isRange());
         VisiblePosition startOfSelection = selection.visibleStart();
         VisiblePosition endOfSelection = selection.visibleEnd();
-        VisiblePosition startOfLastParagraph = startOfParagraph(endOfSelection);
+        VisiblePosition startOfLastParagraph = startOfParagraph(endOfSelection, CanSkipOverEditingBoundary);
 
-        if (startOfParagraph(startOfSelection) != startOfLastParagraph) {
+        if (startOfParagraph(startOfSelection, CanSkipOverEditingBoundary) != startOfLastParagraph) {
             bool forceCreateList = !selectionHasListOfType(selection, listTag);
 
             RefPtr<Range> currentSelection = endingSelection().firstRange();
             VisiblePosition startOfCurrentParagraph = startOfSelection;
-            while (startOfCurrentParagraph != startOfLastParagraph) {
+            while (!inSameParagraph(startOfCurrentParagraph, startOfLastParagraph, CanCrossEditingBoundary)) {
                 // doApply() may operate on and remove the last paragraph of the selection from the document 
                 // if it's in the same list item as startOfCurrentParagraph.  Return early to avoid an 
                 // infinite loop and because there is no more work to be done.
@@ -162,7 +162,7 @@ void InsertListCommand::doApply()
                     if (!lastSelectionRange)
                         return;
                     endOfSelection = lastSelectionRange->startPosition();
-                    startOfLastParagraph = startOfParagraph(endOfSelection);
+                    startOfLastParagraph = startOfParagraph(endOfSelection, CanSkipOverEditingBoundary);
                 }
 
                 // Fetch the start of the selection after moving the first paragraph,
@@ -257,14 +257,14 @@ void InsertListCommand::unlistifyParagraph(const VisiblePosition& originalStart,
     VisiblePosition start;
     VisiblePosition end;
     if (listChildNode->hasTagName(liTag)) {
-        start = firstDeepEditingPositionForNode(listChildNode);
-        end = lastDeepEditingPositionForNode(listChildNode);
+        start = firstPositionInNode(listChildNode);
+        end = lastPositionInNode(listChildNode);
         nextListChild = listChildNode->nextSibling();
         previousListChild = listChildNode->previousSibling();
     } else {
         // A paragraph is visually a list item minus a list marker.  The paragraph will be moved.
-        start = startOfParagraph(originalStart);
-        end = endOfParagraph(start);
+        start = startOfParagraph(originalStart, CanSkipOverEditingBoundary);
+        end = endOfParagraph(start, CanSkipOverEditingBoundary);
         nextListChild = enclosingListChild(end.next().deepEquivalent().deprecatedNode(), listNode);
         ASSERT(nextListChild != listChildNode);
         previousListChild = enclosingListChild(start.previous().deepEquivalent().deprecatedNode(), listNode);
@@ -327,8 +327,8 @@ static Element* adjacentEnclosingList(const VisiblePosition& pos, const VisibleP
 
 PassRefPtr<HTMLElement> InsertListCommand::listifyParagraph(const VisiblePosition& originalStart, const QualifiedName& listTag)
 {
-    VisiblePosition start = startOfParagraph(originalStart);
-    VisiblePosition end = endOfParagraph(start);
+    VisiblePosition start = startOfParagraph(originalStart, CanSkipOverEditingBoundary);
+    VisiblePosition end = endOfParagraph(start, CanSkipOverEditingBoundary);
     
     if (start.isNull() || end.isNull())
         return 0;
@@ -339,8 +339,8 @@ PassRefPtr<HTMLElement> InsertListCommand::listifyParagraph(const VisiblePositio
     appendNode(placeholder, listItemElement);
 
     // Place list item into adjoining lists.
-    Element* previousList = adjacentEnclosingList(start.deepEquivalent(), start.previous(true), listTag);
-    Element* nextList = adjacentEnclosingList(start.deepEquivalent(), end.next(true), listTag);
+    Element* previousList = adjacentEnclosingList(start.deepEquivalent(), start.previous(CannotCrossEditingBoundary), listTag);
+    Element* nextList = adjacentEnclosingList(start.deepEquivalent(), end.next(CannotCrossEditingBoundary), listTag);
     RefPtr<HTMLElement> listElement;
     if (previousList)
         appendNode(listItemElement, previousList);
@@ -375,8 +375,11 @@ PassRefPtr<HTMLElement> InsertListCommand::listifyParagraph(const VisiblePositio
 
         // We inserted the list at the start of the content we're about to move
         // Update the start of content, so we don't try to move the list into itself.  bug 19066
-        if (insertionPos == start.deepEquivalent())
-            start = startOfParagraph(originalStart);
+        // Layout is necessary since start's node's inline renderers may have been destroyed by the insertion
+        if (insertionPos == start.deepEquivalent()) {
+            listElement->document()->updateLayoutIgnorePendingStylesheets();
+            start = startOfParagraph(originalStart, CanSkipOverEditingBoundary);
+        }
     }
 
     moveParagraph(start, end, positionBeforeNode(placeholder.get()), true);
diff --git a/Source/WebCore/editing/InsertNodeBeforeCommand.cpp b/Source/WebCore/editing/InsertNodeBeforeCommand.cpp
index 5fae45e..4b028e7 100644
--- a/Source/WebCore/editing/InsertNodeBeforeCommand.cpp
+++ b/Source/WebCore/editing/InsertNodeBeforeCommand.cpp
@@ -41,13 +41,13 @@ InsertNodeBeforeCommand::InsertNodeBeforeCommand(PassRefPtr<Node> insertChild, P
     ASSERT(m_refChild);
     ASSERT(m_refChild->parentNode());
 
-    ASSERT(m_refChild->parentNode()->isContentEditable() || !m_refChild->parentNode()->attached());
+    ASSERT(m_refChild->parentNode()->rendererIsEditable() || !m_refChild->parentNode()->attached());
 }
 
 void InsertNodeBeforeCommand::doApply()
 {
     ContainerNode* parent = m_refChild->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
 
     ExceptionCode ec;
@@ -59,7 +59,7 @@ void InsertNodeBeforeCommand::doApply()
 
 void InsertNodeBeforeCommand::doUnapply()
 {
-    if (!m_insertChild->isContentEditable())
+    if (!m_insertChild->rendererIsEditable())
         return;
         
     // Need to notify this before actually deleting the text
diff --git a/Source/WebCore/editing/JoinTextNodesCommand.cpp b/Source/WebCore/editing/JoinTextNodesCommand.cpp
index 2766b84..86dd381 100644
--- a/Source/WebCore/editing/JoinTextNodesCommand.cpp
+++ b/Source/WebCore/editing/JoinTextNodesCommand.cpp
@@ -46,7 +46,7 @@ void JoinTextNodesCommand::doApply()
         return;
 
     ContainerNode* parent = m_text2->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
     
     ExceptionCode ec = 0;
@@ -63,7 +63,7 @@ void JoinTextNodesCommand::doUnapply()
         return;
 
     ContainerNode* parent = m_text2->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
 
     ExceptionCode ec = 0;
diff --git a/Source/WebCore/editing/MergeIdenticalElementsCommand.cpp b/Source/WebCore/editing/MergeIdenticalElementsCommand.cpp
index ff59f49..4ee9436 100644
--- a/Source/WebCore/editing/MergeIdenticalElementsCommand.cpp
+++ b/Source/WebCore/editing/MergeIdenticalElementsCommand.cpp
@@ -42,7 +42,7 @@ MergeIdenticalElementsCommand::MergeIdenticalElementsCommand(PassRefPtr<Element>
 
 void MergeIdenticalElementsCommand::doApply()
 {
-    if (m_element1->nextSibling() != m_element2 || !m_element1->isContentEditable() || !m_element2->isContentEditable())
+    if (m_element1->nextSibling() != m_element2 || !m_element1->rendererIsEditable() || !m_element2->rendererIsEditable())
         return;
 
     m_atChild = m_element2->firstChild();
@@ -68,7 +68,7 @@ void MergeIdenticalElementsCommand::doUnapply()
     RefPtr<Node> atChild = m_atChild.release();
 
     ContainerNode* parent = m_element2->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
 
     ExceptionCode ec = 0;
diff --git a/Source/WebCore/editing/RemoveNodeCommand.cpp b/Source/WebCore/editing/RemoveNodeCommand.cpp
index 94e3e62..4a52492 100644
--- a/Source/WebCore/editing/RemoveNodeCommand.cpp
+++ b/Source/WebCore/editing/RemoveNodeCommand.cpp
@@ -42,7 +42,7 @@ RemoveNodeCommand::RemoveNodeCommand(PassRefPtr<Node> node)
 void RemoveNodeCommand::doApply()
 {
     ContainerNode* parent = m_node->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
 
     m_parent = parent;
@@ -56,7 +56,7 @@ void RemoveNodeCommand::doUnapply()
 {
     RefPtr<ContainerNode> parent = m_parent.release();
     RefPtr<Node> refChild = m_refChild.release();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
 
     ExceptionCode ec;
diff --git a/Source/WebCore/editing/ReplaceSelectionCommand.cpp b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
index b0a2d68..94531a6 100644
--- a/Source/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -43,6 +43,7 @@
 #include "HTMLInputElement.h"
 #include "HTMLInterchange.h"
 #include "HTMLNames.h"
+#include "NodeList.h"
 #include "SelectionController.h"
 #include "SmartReplace.h"
 #include "TextIterator.h"
@@ -110,7 +111,7 @@ static bool isInterchangeConvertedSpaceSpan(const Node *node)
 static Position positionAvoidingPrecedingNodes(Position pos)
 {
     // If we're already on a break, it's probably a placeholder and we shouldn't change our position.
-    if (pos.deprecatedNode()->hasTagName(brTag))
+    if (editingIgnoresContent(pos.deprecatedNode()))
         return pos;
 
     // We also stop when changing block flow elements because even though the visual position is the
@@ -147,7 +148,7 @@ ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* f
     if (!editableRoot->getAttributeEventListener(eventNames().webkitBeforeTextInsertedEvent) &&
         // FIXME: Remove these checks once textareas and textfields actually register an event handler.
         !(shadowAncestorNode && shadowAncestorNode->renderer() && shadowAncestorNode->renderer()->isTextControl()) &&
-        editableRoot->isContentRichlyEditable()) {
+        editableRoot->rendererIsRichlyEditable()) {
         removeInterchangeNodes(m_fragment.get());
         return;
     }
@@ -162,7 +163,7 @@ ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* f
     ExceptionCode ec = 0;
     editableRoot->dispatchEvent(evt, ec);
     ASSERT(ec == 0);
-    if (text != evt->text() || !editableRoot->isContentRichlyEditable()) {
+    if (text != evt->text() || !editableRoot->rendererIsRichlyEditable()) {
         restoreTestRenderingNodesToFragment(holder.get());
         removeNode(holder);
 
@@ -357,7 +358,7 @@ static bool hasMatchingQuoteLevel(VisiblePosition endOfExistingContent, VisibleP
 {
     Position existing = endOfExistingContent.deepEquivalent();
     Position inserted = endOfInsertedContent.deepEquivalent();
-    bool isInsideMailBlockquote = nearestMailBlockquote(inserted.deprecatedNode());
+    bool isInsideMailBlockquote = enclosingNodeOfType(inserted, isMailBlockquote, CanCrossEditingBoundary);
     return isInsideMailBlockquote && (numEnclosingMailBlockquotes(existing) == numEnclosingMailBlockquotes(inserted));
 }
 
@@ -367,7 +368,7 @@ bool ReplaceSelectionCommand::shouldMergeStart(bool selectionStartWasStartOfPara
         return false;
     
     VisiblePosition startOfInsertedContent(positionAtStartOfInsertedContent());
-    VisiblePosition prev = startOfInsertedContent.previous(true);
+    VisiblePosition prev = startOfInsertedContent.previous(CannotCrossEditingBoundary);
     if (prev.isNull())
         return false;
     
@@ -389,7 +390,7 @@ bool ReplaceSelectionCommand::shouldMergeStart(bool selectionStartWasStartOfPara
 bool ReplaceSelectionCommand::shouldMergeEnd(bool selectionEndWasEndOfParagraph)
 {
     VisiblePosition endOfInsertedContent(positionAtEndOfInsertedContent());
-    VisiblePosition next = endOfInsertedContent.next(true);
+    VisiblePosition next = endOfInsertedContent.next(CannotCrossEditingBoundary);
     if (next.isNull())
         return false;
 
@@ -536,10 +537,10 @@ VisiblePosition ReplaceSelectionCommand::positionAtEndOfInsertedContent()
 {
     Node* lastNode = m_lastLeafInserted.get();
     // FIXME: Why is this hack here?  What's special about <select> tags?
-    Node* enclosingSelect = enclosingNodeWithTag(firstDeepEditingPositionForNode(lastNode), selectTag);
+    Node* enclosingSelect = enclosingNodeWithTag(firstPositionInOrBeforeNode(lastNode), selectTag);
     if (enclosingSelect)
         lastNode = enclosingSelect;
-    return lastDeepEditingPositionForNode(lastNode);
+    return lastPositionInOrAfterNode(lastNode);
 }
 
 VisiblePosition ReplaceSelectionCommand::positionAtStartOfInsertedContent()
@@ -556,7 +557,7 @@ static bool handleStyleSpansBeforeInsertion(ReplacementFragment& fragment, const
 
     // Handling the case where we are doing Paste as Quotation or pasting into quoted content is more complicated (see handleStyleSpans)
     // and doesn't receive the optimization.
-    if (isMailPasteAsQuotationNode(topNode) || nearestMailBlockquote(topNode))
+    if (isMailPasteAsQuotationNode(topNode) || enclosingNodeOfType(firstPositionInOrBeforeNode(topNode), isMailBlockquote, CanCrossEditingBoundary))
         return false;
 
     // Either there are no style spans in the fragment or a WebKit client has added content to the fragment
@@ -623,7 +624,7 @@ void ReplaceSelectionCommand::handleStyleSpans()
 
     // If Mail wraps the fragment with a Paste as Quotation blockquote, or if you're pasting into a quoted region,
     // styles from blockquoteNode are allowed to override those from the source document, see <rdar://problem/4930986> and <rdar://problem/5089327>.
-    Node* blockquoteNode = isMailPasteAsQuotationNode(context) ? context : nearestMailBlockquote(context);
+    Node* blockquoteNode = isMailPasteAsQuotationNode(context) ? context : enclosingNodeOfType(firstPositionInNode(context), isMailBlockquote, CanCrossEditingBoundary);
     if (blockquoteNode) {
         sourceDocumentStyle->removeStyleConflictingWithStyleOfNode(blockquoteNode);
         context = blockquoteNode->parentNode();
@@ -776,6 +777,34 @@ static Node* enclosingInline(Node* node)
     return node;
 }
 
+static bool isInlineNodeWithStyle(const Node* node)
+{
+    // We don't want to skip over any block elements.
+    if (!node->renderer() || !node->renderer()->isInline())
+        return false;
+
+    if (!node->isHTMLElement())
+        return false;
+    
+    // We can skip over elements whose class attribute is
+    // one of our internal classes.
+    const HTMLElement* element = static_cast<const HTMLElement*>(node);
+    AtomicString classAttributeValue = element->getAttribute(classAttr);
+    if (classAttributeValue == AppleStyleSpanClass
+        || classAttributeValue == AppleTabSpanClass
+        || classAttributeValue == AppleConvertedSpace
+        || classAttributeValue == ApplePasteAsQuotation)
+        return true;
+
+    // We can skip inline elements that don't have attributes or whose only
+    // attribute is the style attribute.
+    const NamedNodeMap* attributeMap = element->attributeMap();
+    if (!attributeMap || attributeMap->isEmpty() || (attributeMap->length() == 1 && element->hasAttribute(styleAttr)))
+        return true;
+
+    return false;
+}
+    
 void ReplaceSelectionCommand::doApply()
 {
     VisibleSelection selection = endingSelection();
@@ -811,8 +840,8 @@ void ReplaceSelectionCommand::doApply()
     Node* startBlock = enclosingBlock(visibleStart.deepEquivalent().deprecatedNode());
     
     Position insertionPos = selection.start();
-    bool startIsInsideMailBlockquote = nearestMailBlockquote(insertionPos.deprecatedNode());
-    
+    bool startIsInsideMailBlockquote = enclosingNodeOfType(insertionPos, isMailBlockquote, CanCrossEditingBoundary);
+
     if ((selectionStartWasStartOfParagraph && selectionEndWasEndOfParagraph && !startIsInsideMailBlockquote) ||
         startBlock == currentRoot || isListItem(startBlock) || selectionIsPlainText)
         m_preventNesting = false;
@@ -840,7 +869,7 @@ void ReplaceSelectionCommand::doApply()
     } else {
         ASSERT(selection.isCaret());
         if (fragment.hasInterchangeNewlineAtStart()) {
-            VisiblePosition next = visibleStart.next(true);
+            VisiblePosition next = visibleStart.next(CannotCrossEditingBoundary);
             if (isEndOfParagraph(visibleStart) && !isStartOfParagraph(visibleStart) && next.isNotNull())
                 setEndingSelection(next);
             else 
@@ -917,6 +946,29 @@ void ReplaceSelectionCommand::doApply()
     // outside of preceding tags.
     insertionPos = positionAvoidingPrecedingNodes(insertionPos);
 
+    // If we are not trying to match the destination style we prefer a position
+    // that is outside inline elements that provide style.
+    // This way we can produce a less verbose markup.
+    // We can skip this optimization for fragments not wrapped in one of
+    // our style spans and for positions inside list items
+    // since insertAsListItems already does the right thing.
+    if (!m_matchStyle && !enclosingList(insertionPos.anchorNode()) && isStyleSpan(fragment.firstChild())) {
+        Node* parentNode = insertionPos.anchorNode()->parentNode();
+        while (parentNode && parentNode->renderer() && isInlineNodeWithStyle(parentNode)) {
+            // If we are in the middle of a text node, we need to split it before we can
+            // move the insertion position.
+            if (insertionPos.anchorNode()->isTextNode() && insertionPos.anchorType() == Position::PositionIsOffsetInAnchor && insertionPos.offsetInContainerNode() && !insertionPos.atLastEditingPositionForNode())
+                splitTextNodeContainingElement(static_cast<Text*>(insertionPos.anchorNode()), insertionPos.offsetInContainerNode());
+            
+            // If the style element has more than one child, we need to split it.
+            if (parentNode->firstChild()->nextSibling())
+                splitElement(static_cast<Element*>(parentNode), insertionPos.computeNodeAfterPosition());
+            
+            insertionPos = positionInParentBeforeNode(parentNode);
+            parentNode = parentNode->parentNode();
+        }
+    }
+
     // FIXME: When pasting rich content we're often prevented from heading down the fast path by style spans.  Try
     // again here if they've been removed.
     
@@ -1036,7 +1088,7 @@ void ReplaceSelectionCommand::doApply()
     startOfInsertedContent = positionAtStartOfInsertedContent();
     
     if (interchangeNewlineAtEnd) {
-        VisiblePosition next = endOfInsertedContent.next(true);
+        VisiblePosition next = endOfInsertedContent.next(CannotCrossEditingBoundary);
 
         if (selectionEndWasEndOfParagraph || !isEndOfParagraph(endOfInsertedContent) || next.isNull()) {
             if (!isStartOfParagraph(endOfInsertedContent)) {
diff --git a/Source/WebCore/editing/SelectionController.cpp b/Source/WebCore/editing/SelectionController.cpp
index 65f9062..698ba2c 100644
--- a/Source/WebCore/editing/SelectionController.cpp
+++ b/Source/WebCore/editing/SelectionController.cpp
@@ -153,16 +153,14 @@ void SelectionController::setSelection(const VisibleSelection& s, SetSelectionOp
         return;
     }
 
-    Node* baseNode = s.base().deprecatedNode();
-    Document* document = 0;
-    if (baseNode)
-        document = baseNode->document();
-    
     // <http://bugs.webkit.org/show_bug.cgi?id=23464>: Infinite recursion at SelectionController::setSelection
     // if document->frame() == m_frame we can get into an infinite loop
-    if (document && document->frame() && document->frame() != m_frame && document != m_frame->document()) {
-        document->frame()->selection()->setSelection(s, options);
-        return;
+    if (s.base().anchorNode()) {
+        Document* document = s.base().anchorNode()->document();
+        if (document && document->frame() && document->frame() != m_frame && document != m_frame->document()) {
+            document->frame()->selection()->setSelection(s, options);
+            return;
+        }
     }
 
     if (closeTyping)
@@ -170,10 +168,13 @@ void SelectionController::setSelection(const VisibleSelection& s, SetSelectionOp
 
     if (shouldClearTypingStyle)
         clearTypingStyle();
-        
-    if (m_selection == s)
+
+    if (m_selection == s) {
+        // Even if selection was not changed, selection offsets may have been changed.
+        notifyRendererOfSelectionChange(userTriggered);
         return;
-    
+    }
+
     VisibleSelection oldSelection = m_selection;
 
     m_selection = s;
@@ -208,17 +209,17 @@ void SelectionController::setSelection(const VisibleSelection& s, SetSelectionOp
 
 static bool removingNodeRemovesPosition(Node* node, const Position& position)
 {
-    if (!position.deprecatedNode())
+    if (!position.anchorNode())
         return false;
 
-    if (position.deprecatedNode() == node)
+    if (position.anchorNode() == node)
         return true;
 
     if (!node->isElementNode())
         return false;
 
     Element* element = static_cast<Element*>(node);
-    return element->contains(position.deprecatedNode()) || element->contains(position.deprecatedNode()->shadowAncestorNode());
+    return element->contains(position.anchorNode()) || element->contains(position.anchorNode()->shadowAncestorNode());
 }
 
 void SelectionController::nodeWillBeRemoved(Node *node)
@@ -336,6 +337,11 @@ void SelectionController::setIsDirectional(bool isDirectional)
     m_isDirectional = !m_frame || m_frame->editor()->behavior().shouldConsiderSelectionAsDirectional() || isDirectional;
 }
 
+TextDirection SelectionController::directionOfEnclosingBlock()
+{
+    return WebCore::directionOfEnclosingBlock(m_selection.extent());
+}
+
 void SelectionController::willBeModified(EAlteration alter, SelectionDirection direction)
 {
     if (alter != AlterationExtend)
@@ -385,17 +391,6 @@ void SelectionController::willBeModified(EAlteration alter, SelectionDirection d
     }
 }
 
-TextDirection SelectionController::directionOfEnclosingBlock()
-{
-    Node* enclosingBlockNode = enclosingBlock(m_selection.extent().deprecatedNode());
-    if (!enclosingBlockNode)
-        return LTR;
-    RenderObject* renderer = enclosingBlockNode->renderer();
-    if (renderer)
-        return renderer->style()->direction();
-    return LTR;
-}
-
 VisiblePosition SelectionController::positionForPlatform(bool isGetStart) const
 {
     Settings* settings = m_frame ? m_frame->settings() : 0;
@@ -431,9 +426,9 @@ VisiblePosition SelectionController::modifyExtendingRight(TextGranularity granul
     switch (granularity) {
     case CharacterGranularity:
         if (directionOfEnclosingBlock() == LTR)
-            pos = pos.next(true);
+            pos = pos.next(CannotCrossEditingBoundary);
         else
-            pos = pos.previous(true);
+            pos = pos.previous(CannotCrossEditingBoundary);
         break;
     case WordGranularity:
         if (directionOfEnclosingBlock() == LTR)
@@ -464,7 +459,7 @@ VisiblePosition SelectionController::modifyExtendingForward(TextGranularity gran
     VisiblePosition pos(m_selection.extent(), m_selection.affinity());
     switch (granularity) {
     case CharacterGranularity:
-        pos = pos.next(true);
+        pos = pos.next(CannotCrossEditingBoundary);
         break;
     case WordGranularity:
         pos = nextWordPosition(pos);
@@ -538,7 +533,7 @@ VisiblePosition SelectionController::modifyMovingForward(TextGranularity granula
         if (isRange())
             pos = VisiblePosition(m_selection.end(), m_selection.affinity());
         else
-            pos = VisiblePosition(m_selection.extent(), m_selection.affinity()).next(true);
+            pos = VisiblePosition(m_selection.extent(), m_selection.affinity()).next(CannotCrossEditingBoundary);
         break;
     case WordGranularity:
         pos = nextWordPosition(VisiblePosition(m_selection.extent(), m_selection.affinity()));
@@ -589,9 +584,9 @@ VisiblePosition SelectionController::modifyExtendingLeft(TextGranularity granula
     switch (granularity) {
     case CharacterGranularity:
         if (directionOfEnclosingBlock() == LTR)
-            pos = pos.previous(true);
+            pos = pos.previous(CannotCrossEditingBoundary);
         else
-            pos = pos.next(true);
+            pos = pos.next(CannotCrossEditingBoundary);
         break;
     case WordGranularity:
         if (directionOfEnclosingBlock() == LTR)
@@ -626,7 +621,7 @@ VisiblePosition SelectionController::modifyExtendingBackward(TextGranularity gra
     // over everything.
     switch (granularity) {
     case CharacterGranularity:
-        pos = pos.previous(true);
+        pos = pos.previous(CannotCrossEditingBoundary);
         break;
     case WordGranularity:
         pos = previousWordPosition(pos);
@@ -698,7 +693,7 @@ VisiblePosition SelectionController::modifyMovingBackward(TextGranularity granul
         if (isRange())
             pos = VisiblePosition(m_selection.start(), m_selection.affinity());
         else
-            pos = VisiblePosition(m_selection.extent(), m_selection.affinity()).previous(true);
+            pos = VisiblePosition(m_selection.extent(), m_selection.affinity()).previous(CannotCrossEditingBoundary);
         break;
     case WordGranularity:
         pos = previousWordPosition(VisiblePosition(m_selection.extent(), m_selection.affinity()));
@@ -1256,11 +1251,11 @@ void SelectionController::debugRenderer(RenderObject *r, bool selected) const
         int textLength = text.length();
         if (selected) {
             int offset = 0;
-            if (r->node() == m_selection.start().deprecatedNode())
-                offset = m_selection.start().deprecatedEditingOffset();
-            else if (r->node() == m_selection.end().deprecatedNode())
-                offset = m_selection.end().deprecatedEditingOffset();
-                
+            if (r->node() == m_selection.start().containerNode())
+                offset = m_selection.start().computeOffsetInContainerNode();
+            else if (r->node() == m_selection.end().containerNode())
+                offset = m_selection.end().computeOffsetInContainerNode();
+
             int pos;
             InlineTextBox* box = textRenderer->findNextInlineTextBox(offset, pos);
             text = text.substring(box->start(), box->len());
@@ -1368,7 +1363,7 @@ void SelectionController::selectFrameElementInParentIfFullySelected()
         return;
         
     // This method's purpose is it to make it easier to select iframes (in order to delete them).  Don't do anything if the iframe isn't deletable.
-    if (!ownerElementParent->isContentEditable())
+    if (!ownerElementParent->rendererIsEditable())
         return;
 
     // Create compute positions before and after the element.
@@ -1456,7 +1451,9 @@ bool SelectionController::setSelectedRange(Range* range, EAffinity affinity, boo
 
 bool SelectionController::isInPasswordField() const
 {
-    Node* startNode = start().deprecatedNode();
+    ASSERT(start().isNull() || start().anchorType() == Position::PositionIsOffsetInAnchor
+           || start().containerNode() || !start().anchorNode()->shadowAncestorNode());
+    Node* startNode = start().containerNode();
     if (!startNode)
         return false;
 
@@ -1828,7 +1825,7 @@ void SelectionController::setSelectionFromNone()
 
     Document* document = m_frame->document();
     bool caretBrowsing = m_frame->settings() && m_frame->settings()->caretBrowsingEnabled();
-    if (!isNone() || !(document->inDesignMode() || caretBrowsing))
+    if (!isNone() || !(document->rendererIsEditable() || caretBrowsing))
         return;
 
     Node* node = document->documentElement();
diff --git a/Source/WebCore/editing/SelectionController.h b/Source/WebCore/editing/SelectionController.h
index d6a9dff..2e3a6cd 100644
--- a/Source/WebCore/editing/SelectionController.h
+++ b/Source/WebCore/editing/SelectionController.h
@@ -127,7 +127,7 @@ public:
     bool isRange() const { return m_selection.isRange(); }
     bool isCaretOrRange() const { return m_selection.isCaretOrRange(); }
     bool isInPasswordField() const;
-    bool isAll(StayInEditableContent stayInEditableContent = MustStayInEditableContent) const { return m_selection.isAll(stayInEditableContent); }
+    bool isAll(EditingBoundaryCrossingRule rule = CannotCrossEditingBoundary) const { return m_selection.isAll(rule); }
     
     PassRefPtr<Range> toNormalizedRange() const { return m_selection.toNormalizedRange(); }
 
diff --git a/Source/WebCore/editing/SplitElementCommand.cpp b/Source/WebCore/editing/SplitElementCommand.cpp
index 888c45f..fc135f7 100644
--- a/Source/WebCore/editing/SplitElementCommand.cpp
+++ b/Source/WebCore/editing/SplitElementCommand.cpp
@@ -54,7 +54,7 @@ void SplitElementCommand::executeApply()
     ExceptionCode ec = 0;
     
     ContainerNode* parent = m_element2->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
     parent->insertBefore(m_element1.get(), m_element2.get(), ec);
     if (ec)
@@ -78,7 +78,7 @@ void SplitElementCommand::doApply()
 
 void SplitElementCommand::doUnapply()
 {
-    if (!m_element1 || !m_element1->isContentEditable() || !m_element2->isContentEditable())
+    if (!m_element1 || !m_element1->rendererIsEditable() || !m_element2->rendererIsEditable())
         return;
 
     Vector<RefPtr<Node> > children;
diff --git a/Source/WebCore/editing/SplitTextNodeCommand.cpp b/Source/WebCore/editing/SplitTextNodeCommand.cpp
index aea36b9..5cf7ac8 100644
--- a/Source/WebCore/editing/SplitTextNodeCommand.cpp
+++ b/Source/WebCore/editing/SplitTextNodeCommand.cpp
@@ -51,7 +51,7 @@ SplitTextNodeCommand::SplitTextNodeCommand(PassRefPtr<Text> text, int offset)
 void SplitTextNodeCommand::doApply()
 {
     ContainerNode* parent = m_text2->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
 
     ExceptionCode ec = 0;
@@ -68,7 +68,7 @@ void SplitTextNodeCommand::doApply()
 
 void SplitTextNodeCommand::doUnapply()
 {
-    if (!m_text1 || !m_text1->isContentEditable())
+    if (!m_text1 || !m_text1->rendererIsEditable())
         return;
 
     ASSERT(m_text1->document() == document());
@@ -89,7 +89,7 @@ void SplitTextNodeCommand::doReapply()
         return;
 
     ContainerNode* parent = m_text2->parentNode();
-    if (!parent || !parent->isContentEditable())
+    if (!parent || !parent->rendererIsEditable())
         return;
 
     insertText1AndTrimText2();
diff --git a/Source/WebCore/editing/SplitTextNodeContainingElementCommand.cpp b/Source/WebCore/editing/SplitTextNodeContainingElementCommand.cpp
index 8c90fb0..7b9fd2a 100644
--- a/Source/WebCore/editing/SplitTextNodeContainingElementCommand.cpp
+++ b/Source/WebCore/editing/SplitTextNodeContainingElementCommand.cpp
@@ -48,7 +48,7 @@ void SplitTextNodeContainingElementCommand::doApply()
     splitTextNode(m_text.get(), m_offset);
 
     Element* parent = m_text->parentElement();
-    if (!parent || !parent->parentElement() || !parent->parentElement()->isContentEditable())
+    if (!parent || !parent->parentElement() || !parent->parentElement()->rendererIsEditable())
         return;
 
     RenderObject* parentRenderer = parent->renderer();
diff --git a/Source/WebCore/editing/TextCheckingHelper.cpp b/Source/WebCore/editing/TextCheckingHelper.cpp
index e5553fd..009c807 100644
--- a/Source/WebCore/editing/TextCheckingHelper.cpp
+++ b/Source/WebCore/editing/TextCheckingHelper.cpp
@@ -224,7 +224,7 @@ String TextCheckingHelper::findFirstMisspelling(int& firstMisspellingOffset, boo
 
 String TextCheckingHelper::findFirstMisspellingOrBadGrammar(bool checkGrammar, bool& outIsSpelling, int& outFirstFoundOffset, GrammarDetail& outGrammarDetail)
 {
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(UNIFIED_TEXT_CHECKING)
     String firstFoundItem;
     String misspelledWord;
     String badGrammarPhrase;
@@ -350,12 +350,12 @@ String TextCheckingHelper::findFirstMisspellingOrBadGrammar(bool checkGrammar, b
     UNUSED_PARAM(outFirstFoundOffset);
     UNUSED_PARAM(outGrammarDetail);
     return "";
-#endif
+#endif // USE(UNIFIED_TEXT_CHECKING)
 }
 
 int TextCheckingHelper::findFirstGrammarDetail(const Vector<GrammarDetail>& grammarDetails, int badGrammarPhraseLocation, int /*badGrammarPhraseLength*/, int startOffset, int endOffset, bool markAll)
 {
-#ifndef BUILDING_ON_TIGER
+#if USE(GRAMMAR_CHECKING)
     // Found some bad grammar. Find the earliest detail range that starts in our search range (if any).
     // Optionally add a DocumentMarker for each detail in the range.
     int earliestDetailLocationSoFar = -1;
@@ -402,7 +402,7 @@ int TextCheckingHelper::findFirstGrammarDetail(const Vector<GrammarDetail>& gram
 
 String TextCheckingHelper::findFirstBadGrammar(GrammarDetail& outGrammarDetail, int& outGrammarPhraseOffset, bool markAll)
 {
-#ifndef BUILDING_ON_TIGER
+    ASSERT(WTF_USE_GRAMMAR_CHECKING);
     // Initialize out parameters; these will be updated if we find something to return.
     outGrammarDetail.location = -1;
     outGrammarDetail.length = 0;
@@ -458,18 +458,12 @@ String TextCheckingHelper::findFirstBadGrammar(GrammarDetail& outGrammarDetail,
     }
     
     return firstBadGrammarPhrase;
-#else
-    ASSERT_NOT_REACHED();
-    UNUSED_PARAM(outGrammarDetail);
-    UNUSED_PARAM(outGrammarPhraseOffset);
-    UNUSED_PARAM(markAll);
-#endif
 }
 
 
 bool TextCheckingHelper::isUngrammatical(Vector<String>& guessesVector) const
 {
-#ifndef BUILDING_ON_TIGER
+    ASSERT(WTF_USE_GRAMMAR_CHECKING);
     if (!m_client)
         return false;
 
@@ -511,16 +505,11 @@ bool TextCheckingHelper::isUngrammatical(Vector<String>& guessesVector) const
     m_client->updateSpellingUIWithGrammarString(badGrammarPhrase, grammarDetail);
     
     return true;
-#else
-    ASSERT_NOT_REACHED();
-    UNUSED_PARAM(guessesVector);
-    return true;
-#endif
 }
 
 Vector<String> TextCheckingHelper::guessesForMisspelledOrUngrammaticalRange(bool checkGrammar, bool& misspelled, bool& ungrammatical) const
 {
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(UNIFIED_TEXT_CHECKING)
     Vector<String> guesses;
     ExceptionCode ec;
     misspelled = false;
@@ -578,7 +567,7 @@ Vector<String> TextCheckingHelper::guessesForMisspelledOrUngrammaticalRange(bool
     UNUSED_PARAM(misspelled);
     UNUSED_PARAM(ungrammatical);
     return Vector<String>();
-#endif
+#endif // USE(UNIFIED_TEXT_CHECKING)
 }
 
 
@@ -592,15 +581,12 @@ void TextCheckingHelper::markAllMisspellings(RefPtr<Range>& firstMisspellingRang
 
 void TextCheckingHelper::markAllBadGrammar()
 {
-#ifndef BUILDING_ON_TIGER
-    // Use the "markAll" feature of findFirstBadGrammar. Ignore the return value and "out parameters"; all we need to
+    ASSERT(WTF_USE_GRAMMAR_CHECKING);
+    // Use the "markAll" feature of ofindFirstBadGrammar. Ignore the return value and "out parameters"; all we need to
     // do is mark every instance.
     GrammarDetail ignoredGrammarDetail;
     int ignoredOffset;
     findFirstBadGrammar(ignoredGrammarDetail, ignoredOffset, true);
-#else
-    ASSERT_NOT_REACHED();
-#endif
 }
 
 }
diff --git a/Source/WebCore/editing/TextIterator.cpp b/Source/WebCore/editing/TextIterator.cpp
index a9546b8..1b25c87 100644
--- a/Source/WebCore/editing/TextIterator.cpp
+++ b/Source/WebCore/editing/TextIterator.cpp
@@ -2320,7 +2320,7 @@ PassRefPtr<Range> TextIterator::rangeFromLocationAndLength(Element* scope, int r
                     Position runEnd = VisiblePosition(runStart).next().deepEquivalent();
                     if (runEnd.isNotNull()) {
                         ExceptionCode ec = 0;
-                        textRunRange->setEnd(runEnd.deprecatedNode(), runEnd.deprecatedEditingOffset(), ec);
+                        textRunRange->setEnd(runEnd.containerNode(), runEnd.computeOffsetInContainerNode(), ec);
                         ASSERT(!ec);
                     }
                 }
@@ -2512,11 +2512,6 @@ tryAgain:
     return matchLength;
 }
 
-PassRefPtr<Range> findPlainText(const Range* range, const String& target, bool forward, bool caseSensitive)
-{
-    return findPlainText(range, target, (forward ? 0 : Backwards) | (caseSensitive ? 0 : CaseInsensitive));
-}
-
 PassRefPtr<Range> findPlainText(const Range* range, const String& target, FindOptions options)
 {
     // First, find the text.
diff --git a/Source/WebCore/editing/TextIterator.h b/Source/WebCore/editing/TextIterator.h
index b0c310a..0f1a6fd 100644
--- a/Source/WebCore/editing/TextIterator.h
+++ b/Source/WebCore/editing/TextIterator.h
@@ -60,8 +60,6 @@ inline bool isCollapsibleWhitespace(UChar c)
 String plainText(const Range*, TextIteratorBehavior defaultBehavior = TextIteratorDefaultBehavior);
 UChar* plainTextToMallocAllocatedBuffer(const Range*, unsigned& bufferLength, bool isDisplayString, TextIteratorBehavior = TextIteratorDefaultBehavior);
 PassRefPtr<Range> findPlainText(const Range*, const String&, FindOptions);
-// FIXME: Switch callers over to the FindOptions version and retire this one.
-PassRefPtr<Range> findPlainText(const Range*, const String&, bool forward, bool caseSensitive);
 
 class BitStack {
 public:
diff --git a/Source/WebCore/editing/TypingCommand.cpp b/Source/WebCore/editing/TypingCommand.cpp
index 3b42915..aedda31 100644
--- a/Source/WebCore/editing/TypingCommand.cpp
+++ b/Source/WebCore/editing/TypingCommand.cpp
@@ -47,6 +47,14 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+static bool canAppendNewLineFeed(const VisibleSelection& selection)
+{
+    ExceptionCode ec = 0;
+    RefPtr<BeforeTextInsertedEvent> event = BeforeTextInsertedEvent::create(String("\n"));
+    selection.rootEditableElement()->dispatchEvent(event, ec);
+    return event->text().length();
+}
+
 TypingCommand::TypingCommand(Document *document, ETypingCommand commandType, const String &textToInsert, TypingCommandOptions options, TextGranularity granularity, TextCompositionType compositionType)
     : CompositeEditCommand(document)
     , m_commandType(commandType)
@@ -403,12 +411,18 @@ void TypingCommand::insertTextRunWithoutNewlines(const String &text, bool select
 
 void TypingCommand::insertLineBreak()
 {
+    if (!canAppendNewLineFeed(endingSelection()))
+        return;
+
     applyCommandToComposite(InsertLineBreakCommand::create(document()));
     typingAddedToOpenCommand(InsertLineBreak);
 }
 
 void TypingCommand::insertParagraphSeparator()
 {
+    if (!canAppendNewLineFeed(endingSelection()))
+        return;
+
     applyCommandToComposite(InsertParagraphSeparatorCommand::create(document()));
     typingAddedToOpenCommand(InsertParagraphSeparator);
 }
@@ -429,7 +443,7 @@ void TypingCommand::insertParagraphSeparatorInQuotedContent()
 bool TypingCommand::makeEditableRootEmpty()
 {
     Element* root = endingSelection().rootEditableElement();
-    if (!root->firstChild())
+    if (!root || !root->firstChild())
         return false;
 
     if (root->firstChild() == root->lastChild() && root->firstElementChild() && root->firstElementChild()->hasTagName(brTag)) {
@@ -474,14 +488,14 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
         if (killRing && selection.isCaret() && granularity != CharacterGranularity)
             selection.modify(SelectionController::AlterationExtend, DirectionBackward, CharacterGranularity);
 
-        if (endingSelection().visibleStart().previous(true).isNull()) {
+        if (endingSelection().visibleStart().previous(CannotCrossEditingBoundary).isNull()) {
             // When the caret is at the start of the editable area in an empty list item, break out of the list item.
             if (breakOutOfEmptyListItem()) {
                 typingAddedToOpenCommand(DeleteKey);
                 return;
             }
             // When there are no visible positions in the editing root, delete its entire contents.
-            if (endingSelection().visibleStart().next(true).isNull() && makeEditableRootEmpty()) {
+            if (endingSelection().visibleStart().next(CannotCrossEditingBoundary).isNull() && makeEditableRootEmpty()) {
                 typingAddedToOpenCommand(DeleteKey);
                 return;
             }
@@ -493,7 +507,7 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
             return;
 
         // If the caret is at the start of a paragraph after a table, move content into the last table cell.
-        if (isStartOfParagraph(visibleStart) && isFirstPositionAfterTable(visibleStart.previous(true))) {
+        if (isStartOfParagraph(visibleStart) && isFirstPositionAfterTable(visibleStart.previous(CannotCrossEditingBoundary))) {
             // Unless the caret is just before a table.  We don't want to move a table into the last table cell.
             if (isLastPositionBeforeTable(visibleStart))
                 return;
@@ -574,10 +588,10 @@ void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool ki
         Position downstreamEnd = endingSelection().end().downstream();
         VisiblePosition visibleEnd = endingSelection().visibleEnd();
         if (visibleEnd == endOfParagraph(visibleEnd))
-            downstreamEnd = visibleEnd.next(true).deepEquivalent().downstream();
+            downstreamEnd = visibleEnd.next(CannotCrossEditingBoundary).deepEquivalent().downstream();
         // When deleting tables: Select the table first, then perform the deletion
         if (downstreamEnd.deprecatedNode() && downstreamEnd.deprecatedNode()->renderer() && downstreamEnd.deprecatedNode()->renderer()->isTable() && !downstreamEnd.deprecatedEditingOffset()) {
-            setEndingSelection(VisibleSelection(endingSelection().end(), lastDeepEditingPositionForNode(downstreamEnd.deprecatedNode()), DOWNSTREAM));
+            setEndingSelection(VisibleSelection(endingSelection().end(), positionAfterNode(downstreamEnd.deprecatedNode()), DOWNSTREAM));
             typingAddedToOpenCommand(ForwardDeleteKey);
             return;
         }
diff --git a/Source/WebCore/editing/VisiblePosition.cpp b/Source/WebCore/editing/VisiblePosition.cpp
index 10798ad..c3c05fd 100644
--- a/Source/WebCore/editing/VisiblePosition.cpp
+++ b/Source/WebCore/editing/VisiblePosition.cpp
@@ -59,18 +59,22 @@ void VisiblePosition::init(const Position& position, EAffinity affinity)
         m_affinity = DOWNSTREAM;
 }
 
-VisiblePosition VisiblePosition::next(bool stayInEditableContent) const
+VisiblePosition VisiblePosition::next(EditingBoundaryCrossingRule rule) const
 {
+    // FIXME: Support CanSkipEditingBoundary
+    ASSERT(rule == CanCrossEditingBoundary || rule == CannotCrossEditingBoundary);
     VisiblePosition next(nextVisuallyDistinctCandidate(m_deepPosition), m_affinity);
-    
-    if (!stayInEditableContent)
+
+    if (rule == CanCrossEditingBoundary)
         return next;
-    
+
     return honorEditableBoundaryAtOrAfter(next);
 }
 
-VisiblePosition VisiblePosition::previous(bool stayInEditableContent) const
+VisiblePosition VisiblePosition::previous(EditingBoundaryCrossingRule rule) const
 {
+    // FIXME: Support CanSkipEditingBoundary
+    ASSERT(rule == CanCrossEditingBoundary || rule == CannotCrossEditingBoundary);
     // find first previous DOM position that is visible
     Position pos = previousVisuallyDistinctCandidate(m_deepPosition);
     
@@ -91,7 +95,7 @@ VisiblePosition VisiblePosition::previous(bool stayInEditableContent) const
     }
 #endif
 
-    if (!stayInEditableContent)
+    if (rule == CanCrossEditingBoundary)
         return prev;
     
     return honorEditableBoundaryAtOrBefore(prev);
@@ -469,7 +473,7 @@ Position VisiblePosition::canonicalPosition(const Position& passedPosition)
 
     // The new position must be in the same editable element. Enforce that first.
     // Unless the descent is from a non-editable html element to an editable body.
-    if (node && node->hasTagName(htmlTag) && !node->isContentEditable() && node->document()->body() && node->document()->body()->isContentEditable())
+    if (node && node->hasTagName(htmlTag) && !node->rendererIsEditable() && node->document()->body() && node->document()->body()->rendererIsEditable())
         return next.isNotNull() ? next : prev;
 
     Node* editingRoot = editableRootForPosition(position);
diff --git a/Source/WebCore/editing/VisiblePosition.h b/Source/WebCore/editing/VisiblePosition.h
index 008d676..505c914 100644
--- a/Source/WebCore/editing/VisiblePosition.h
+++ b/Source/WebCore/editing/VisiblePosition.h
@@ -26,6 +26,7 @@
 #ifndef VisiblePosition_h
 #define VisiblePosition_h
 
+#include "EditingBoundary.h"
 #include "Node.h"
 #include "Position.h"
 #include "TextDirection.h"
@@ -47,8 +48,6 @@ namespace WebCore {
 
 class InlineBox;
 
-enum StayInEditableContent { MayLeaveEditableContent, MustStayInEditableContent };
-
 class VisiblePosition {
 public:
     // NOTE: UPSTREAM affinity will be used only if pos is at end of a wrapped line,
@@ -69,8 +68,8 @@ public:
     // FIXME: Change the following functions' parameter from a boolean to StayInEditableContent.
 
     // next() and previous() will increment/decrement by a character cluster.
-    VisiblePosition next(bool stayInEditableContent = false) const;
-    VisiblePosition previous(bool stayInEditableContent = false) const;
+    VisiblePosition next(EditingBoundaryCrossingRule = CanCrossEditingBoundary) const;
+    VisiblePosition previous(EditingBoundaryCrossingRule = CanCrossEditingBoundary) const;
     VisiblePosition honorEditableBoundaryAtOrBefore(const VisiblePosition&) const;
     VisiblePosition honorEditableBoundaryAtOrAfter(const VisiblePosition&) const;
 
diff --git a/Source/WebCore/editing/VisibleSelection.cpp b/Source/WebCore/editing/VisibleSelection.cpp
index 75531ca..5633c90 100644
--- a/Source/WebCore/editing/VisibleSelection.cpp
+++ b/Source/WebCore/editing/VisibleSelection.cpp
@@ -89,7 +89,8 @@ VisibleSelection::VisibleSelection(const Range* range, EAffinity affinity)
 
 VisibleSelection VisibleSelection::selectionFromContentsOfNode(Node* node)
 {
-    return VisibleSelection(firstDeepEditingPositionForNode(node), lastDeepEditingPositionForNode(node), DOWNSTREAM);
+    ASSERT(!editingIgnoresContent(node));
+    return VisibleSelection(firstPositionInNode(node), lastPositionInNode(node), DOWNSTREAM);
 }
 
 void VisibleSelection::setBase(const Position& position)
@@ -172,8 +173,8 @@ PassRefPtr<Range> VisibleSelection::toNormalizedRange() const
         s = s.parentAnchoredEquivalent();
         e = e.parentAnchoredEquivalent();
     }
-    
-    if (s.isNull() || e.isNull())
+
+    if (!s.containerNode() || !e.containerNode())
         return 0;
 
     // VisibleSelections are supposed to always be valid.  This constructor will ASSERT
@@ -208,7 +209,7 @@ static PassRefPtr<Range> makeSearchRange(const Position& pos)
 
     Position start(pos.parentAnchoredEquivalent());
     searchRange->selectNodeContents(boundary, ec);
-    searchRange->setStart(start.deprecatedNode(), start.deprecatedEditingOffset(), ec);
+    searchRange->setStart(start.containerNode(), start.offsetInContainerNode(), ec);
 
     ASSERT(!ec);
     if (ec)
@@ -217,9 +218,9 @@ static PassRefPtr<Range> makeSearchRange(const Position& pos)
     return searchRange.release();
 }
 
-bool VisibleSelection::isAll(StayInEditableContent stayInEditableContent) const
+bool VisibleSelection::isAll(EditingBoundaryCrossingRule rule) const
 {
-    return !shadowTreeRootNode() && visibleStart().previous(stayInEditableContent).isNull() && visibleEnd().next(stayInEditableContent).isNull();
+    return !shadowTreeRootNode() && visibleStart().previous(rule).isNull() && visibleEnd().next(rule).isNull();
 }
 
 void VisibleSelection::appendTrailingWhitespace()
@@ -305,7 +306,7 @@ void VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity(Text
                     // The paragraph break after the last paragraph in the last cell of a block table ends
                     // at the start of the paragraph after the table.
                     if (isBlock(table))
-                        end = end.next(true);
+                        end = end.next(CannotCrossEditingBoundary);
                     else
                         end = wordEnd;
                 }
@@ -355,7 +356,7 @@ void VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity(Text
                 // The paragraph break after the last paragraph in the last cell of a block table ends
                 // at the start of the paragraph after the table, not at the position just after the table.
                 if (isBlock(table))
-                    end = end.next(true);
+                    end = end.next(CannotCrossEditingBoundary);
                 // There is no parargraph break after the last paragraph in the last cell of an inline table.
                 else
                     end = visibleParagraphEnd;
@@ -457,7 +458,7 @@ void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
     Node* startRoot = highestEditableRoot(m_start);
     Node* endRoot = highestEditableRoot(m_end);
     
-    Node* baseEditableAncestor = lowestEditableAncestor(m_base.deprecatedNode());
+    Node* baseEditableAncestor = lowestEditableAncestor(m_base.containerNode());
     
     // The base, start and end are all in the same region.  No adjustment necessary.
     if (baseRoot == startRoot && baseRoot == endRoot)
@@ -492,19 +493,19 @@ void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
     
         // The selection ends in editable content or non-editable content inside a different editable ancestor, 
         // move backward until non-editable content inside the same lowest editable ancestor is reached.
-        Node* endEditableAncestor = lowestEditableAncestor(m_end.deprecatedNode());
+        Node* endEditableAncestor = lowestEditableAncestor(m_end.containerNode());
         if (endRoot || endEditableAncestor != baseEditableAncestor) {
             
             Position p = previousVisuallyDistinctCandidate(m_end);
             Node* shadowAncestor = endRoot ? endRoot->shadowAncestorNode() : 0;
             if (p.isNull() && endRoot && (shadowAncestor != endRoot))
-                p = lastDeepEditingPositionForNode(shadowAncestor);
-            while (p.isNotNull() && !(lowestEditableAncestor(p.deprecatedNode()) == baseEditableAncestor && !isEditablePosition(p))) {
+                p = positionAfterNode(shadowAncestor);
+            while (p.isNotNull() && !(lowestEditableAncestor(p.containerNode()) == baseEditableAncestor && !isEditablePosition(p))) {
                 Node* root = editableRootForPosition(p);
                 shadowAncestor = root ? root->shadowAncestorNode() : 0;
-                p = isAtomicNode(p.deprecatedNode()) ? positionInParentBeforeNode(p.deprecatedNode()) : previousVisuallyDistinctCandidate(p);
+                p = isAtomicNode(p.containerNode()) ? positionInParentBeforeNode(p.containerNode()) : previousVisuallyDistinctCandidate(p);
                 if (p.isNull() && (shadowAncestor != root))
-                    p = lastDeepEditingPositionForNode(shadowAncestor);
+                    p = positionAfterNode(shadowAncestor);
             }
             VisiblePosition previous(p);
 
@@ -522,16 +523,16 @@ void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
 
         // The selection starts in editable content or non-editable content inside a different editable ancestor, 
         // move forward until non-editable content inside the same lowest editable ancestor is reached.
-        Node* startEditableAncestor = lowestEditableAncestor(m_start.deprecatedNode());      
+        Node* startEditableAncestor = lowestEditableAncestor(m_start.containerNode());      
         if (startRoot || startEditableAncestor != baseEditableAncestor) {
             Position p = nextVisuallyDistinctCandidate(m_start);
             Node* shadowAncestor = startRoot ? startRoot->shadowAncestorNode() : 0;
             if (p.isNull() && startRoot && (shadowAncestor != startRoot))
                 p = positionBeforeNode(shadowAncestor);
-            while (p.isNotNull() && !(lowestEditableAncestor(p.deprecatedNode()) == baseEditableAncestor && !isEditablePosition(p))) {
+            while (p.isNotNull() && !(lowestEditableAncestor(p.containerNode()) == baseEditableAncestor && !isEditablePosition(p))) {
                 Node* root = editableRootForPosition(p);
                 shadowAncestor = root ? root->shadowAncestorNode() : 0;
-                p = isAtomicNode(p.deprecatedNode()) ? positionInParentAfterNode(p.deprecatedNode()) : nextVisuallyDistinctCandidate(p);
+                p = isAtomicNode(p.containerNode()) ? positionInParentAfterNode(p.containerNode()) : nextVisuallyDistinctCandidate(p);
                 if (p.isNull() && (shadowAncestor != root))
                     p = positionBeforeNode(shadowAncestor);
             }
@@ -551,7 +552,7 @@ void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
     }
     
     // Correct the extent if necessary.
-    if (baseEditableAncestor != lowestEditableAncestor(m_extent.deprecatedNode()))
+    if (baseEditableAncestor != lowestEditableAncestor(m_extent.containerNode()))
         m_extent = m_baseIsFirst ? m_end : m_start;
 }
 
diff --git a/Source/WebCore/editing/VisibleSelection.h b/Source/WebCore/editing/VisibleSelection.h
index 5d52a08..a352c20 100644
--- a/Source/WebCore/editing/VisibleSelection.h
+++ b/Source/WebCore/editing/VisibleSelection.h
@@ -79,7 +79,7 @@ public:
 
     bool isBaseFirst() const { return m_baseIsFirst; }
 
-    bool isAll(StayInEditableContent) const;
+    bool isAll(EditingBoundaryCrossingRule) const;
 
     void appendTrailingWhitespace();
 
diff --git a/Source/WebCore/editing/WrapContentsInDummySpanCommand.cpp b/Source/WebCore/editing/WrapContentsInDummySpanCommand.cpp
index 5fa0b39..51f744c 100644
--- a/Source/WebCore/editing/WrapContentsInDummySpanCommand.cpp
+++ b/Source/WebCore/editing/WrapContentsInDummySpanCommand.cpp
@@ -64,7 +64,7 @@ void WrapContentsInDummySpanCommand::doUnapply()
 {
     ASSERT(m_element);
 
-    if (!m_dummySpan || !m_element->isContentEditable())
+    if (!m_dummySpan || !m_element->rendererIsEditable())
         return;
 
     Vector<RefPtr<Node> > children;
@@ -84,7 +84,7 @@ void WrapContentsInDummySpanCommand::doReapply()
 {
     ASSERT(m_element);
     
-    if (!m_dummySpan || !m_element->isContentEditable())
+    if (!m_dummySpan || !m_element->rendererIsEditable())
         return;
 
     executeApply();
diff --git a/Source/WebCore/editing/htmlediting.cpp b/Source/WebCore/editing/htmlediting.cpp
index a078d91..564eff6 100644
--- a/Source/WebCore/editing/htmlediting.cpp
+++ b/Source/WebCore/editing/htmlediting.cpp
@@ -34,6 +34,7 @@
 #include "HTMLInterchange.h"
 #include "HTMLLIElement.h"
 #include "HTMLNames.h"
+#include "HTMLObjectElement.h"
 #include "HTMLOListElement.h"
 #include "HTMLUListElement.h"
 #include "PositionIterator.h"
@@ -73,22 +74,20 @@ bool editingIgnoresContent(const Node* node)
 
 bool canHaveChildrenForEditing(const Node* node)
 {
-    return !node->hasTagName(hrTag) &&
-           !node->hasTagName(brTag) &&
-           !node->hasTagName(imgTag) &&
-           !node->hasTagName(buttonTag) &&
-           !node->hasTagName(inputTag) &&
-           !node->hasTagName(textareaTag) &&
-           !node->hasTagName(objectTag) &&
-           !node->hasTagName(iframeTag) &&
-           !node->hasTagName(embedTag) &&
-           !node->hasTagName(appletTag) &&
-           !node->hasTagName(selectTag) &&
-           !node->hasTagName(datagridTag) &&
+    return !node->isTextNode()
+        && !node->hasTagName(brTag)
+        && !node->hasTagName(imgTag)
+        && !node->hasTagName(inputTag)
+        && !node->hasTagName(textareaTag)
+        && (!node->hasTagName(objectTag) || static_cast<const HTMLObjectElement*>(node)->useFallbackContent())
+        && !node->hasTagName(iframeTag)
+        && !node->hasTagName(embedTag)
+        && !node->hasTagName(appletTag)
+        && !node->hasTagName(selectTag)
 #if ENABLE(WML)
-           !node->hasTagName(WMLNames::doTag) &&
+        && !node->hasTagName(WMLNames::doTag)
 #endif
-           !node->isTextNode();
+        && ((!node->hasTagName(hrTag) && !node->hasTagName(datagridTag)) || node->hasChildNodes());
 }
 
 // Compare two positions, taking into account the possibility that one or both
@@ -144,7 +143,7 @@ Node* highestEditableRoot(const Position& position)
     
     node = highestRoot;
     while (node) {
-        if (node->isContentEditable())
+        if (node->rendererIsEditable())
             highestRoot = node;
         if (node->hasTagName(bodyTag))
             break;
@@ -161,7 +160,7 @@ Node* lowestEditableAncestor(Node* node)
     
     Node *lowestRoot = 0;
     while (node) {
-        if (node->isContentEditable())
+        if (node->rendererIsEditable())
             return node->rootEditableElement();
         if (node->hasTagName(bodyTag))
             break;
@@ -180,7 +179,7 @@ bool isEditablePosition(const Position& p)
     if (node->renderer() && node->renderer()->isTable())
         node = node->parentNode();
     
-    return node->isContentEditable();
+    return node->rendererIsEditable();
 }
 
 bool isAtUnsplittableElement(const Position& pos)
@@ -199,7 +198,7 @@ bool isRichlyEditablePosition(const Position& p)
     if (node->renderer() && node->renderer()->isTable())
         node = node->parentNode();
     
-    return node->isContentRichlyEditable();
+    return node->rendererIsRichlyEditable();
 }
 
 Element* editableRootForPosition(const Position& p)
@@ -221,7 +220,7 @@ Element* unsplittableElementForPosition(const Position& p)
 {
     // Since enclosingNodeOfType won't search beyond the highest root editable node,
     // this code works even if the closest table cell was outside of the root editable node.
-    Element* enclosingCell = static_cast<Element*>(enclosingNodeOfType(p, &isTableCell, true));
+    Element* enclosingCell = static_cast<Element*>(enclosingNodeOfType(p, &isTableCell));
     if (enclosingCell)
         return enclosingCell;
 
@@ -277,14 +276,14 @@ Position previousVisuallyDistinctCandidate(const Position& position)
 VisiblePosition firstEditablePositionAfterPositionInRoot(const Position& position, Node* highestRoot)
 {
     // position falls before highestRoot.
-    if (comparePositions(position, firstDeepEditingPositionForNode(highestRoot)) == -1 && highestRoot->isContentEditable())
-        return firstDeepEditingPositionForNode(highestRoot);
+    if (comparePositions(position, firstPositionInNode(highestRoot)) == -1 && highestRoot->rendererIsEditable())
+        return firstPositionInNode(highestRoot);
 
     Position p = position;
     
     if (Node* shadowAncestor = p.deprecatedNode()->shadowAncestorNode())
         if (shadowAncestor != p.deprecatedNode())
-            p = lastDeepEditingPositionForNode(shadowAncestor);
+            p = positionAfterNode(shadowAncestor);
     
     while (p.deprecatedNode() && !isEditablePosition(p) && p.deprecatedNode()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.deprecatedNode()) ? positionInParentAfterNode(p.deprecatedNode()) : nextVisuallyDistinctCandidate(p);
@@ -298,14 +297,15 @@ VisiblePosition firstEditablePositionAfterPositionInRoot(const Position& positio
 VisiblePosition lastEditablePositionBeforePositionInRoot(const Position& position, Node* highestRoot)
 {
     // When position falls after highestRoot, the result is easy to compute.
-    if (comparePositions(position, lastDeepEditingPositionForNode(highestRoot)) == 1)
-        return lastDeepEditingPositionForNode(highestRoot);
+    if (comparePositions(position, lastPositionInNode(highestRoot)) == 1)
+        return lastPositionInNode(highestRoot);
 
     Position p = position;
-    
-    if (Node* shadowAncestor = p.deprecatedNode()->shadowAncestorNode())
+
+    if (Node* shadowAncestor = p.deprecatedNode()->shadowAncestorNode()) {
         if (shadowAncestor != p.deprecatedNode())
-            p = firstDeepEditingPositionForNode(shadowAncestor);
+            p = firstPositionInOrBeforeNode(shadowAncestor);
+    }
     
     while (p.deprecatedNode() && !isEditablePosition(p) && p.deprecatedNode()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.deprecatedNode()) ? positionInParentBeforeNode(p.deprecatedNode()) : previousVisuallyDistinctCandidate(p);
@@ -327,9 +327,18 @@ bool isBlock(const Node* node)
 // FIXME: Pass a position to this function.  The enclosing block of [table, x] for example, should be the 
 // block that contains the table and not the table, and this function should be the only one responsible for 
 // knowing about these kinds of special cases.
-Node* enclosingBlock(Node* node)
+Node* enclosingBlock(Node* node, EditingBoundaryCrossingRule rule)
 {
-    return static_cast<Element*>(enclosingNodeOfType(firstPositionInOrBeforeNode(node), isBlock));
+    return static_cast<Element*>(enclosingNodeOfType(firstPositionInOrBeforeNode(node), isBlock, rule));
+}
+
+TextDirection directionOfEnclosingBlock(const Position& position)
+{
+    Node* enclosingBlockNode = enclosingBlock(position.containerNode());
+    if (!enclosingBlockNode)
+        return LTR;
+    RenderObject* renderer = enclosingBlockNode->renderer();
+    return renderer ? renderer->style()->direction() : LTR;
 }
 
 // This method is used to create positions in the DOM. It returns the maximum valid offset
@@ -561,7 +570,7 @@ PassRefPtr<Range> extendRangeToWrappingNodes(PassRefPtr<Range> range, const Rang
     Node* ancestor = range->commonAncestorContainer(ec);// find the cloeset common ancestor
     Node* highestNode = 0;
     // traverse through ancestors as long as they are contained within the range, content-editable, and below rootNode (could be =0).
-    while (ancestor && ancestor->isContentEditable() && isNodeVisiblyContainedWithin(ancestor, maximumRange) && ancestor != rootNode) {
+    while (ancestor && ancestor->rendererIsEditable() && isNodeVisiblyContainedWithin(ancestor, maximumRange) && ancestor != rootNode) {
         highestNode = ancestor;
         ancestor = ancestor->parentNode();
     }
@@ -592,7 +601,7 @@ Node* enclosingNodeWithTag(const Position& p, const QualifiedName& tagName)
         
     Node* root = highestEditableRoot(p);
     for (Node* n = p.deprecatedNode(); n; n = n->parentNode()) {
-        if (root && !n->isContentEditable())
+        if (root && !n->rendererIsEditable())
             continue;
         if (n->hasTagName(tagName))
             return n;
@@ -603,18 +612,20 @@ Node* enclosingNodeWithTag(const Position& p, const QualifiedName& tagName)
     return 0;
 }
 
-Node* enclosingNodeOfType(const Position& p, bool (*nodeIsOfType)(const Node*), bool onlyReturnEditableNodes)
+Node* enclosingNodeOfType(const Position& p, bool (*nodeIsOfType)(const Node*), EditingBoundaryCrossingRule rule)
 {
+    // FIXME: support CanSkipCrossEditingBoundary
+    ASSERT(rule == CanCrossEditingBoundary || rule == CannotCrossEditingBoundary);
     if (p.isNull())
         return 0;
         
-    Node* root = highestEditableRoot(p);
+    Node* root = rule == CannotCrossEditingBoundary ? highestEditableRoot(p) : 0;
     for (Node* n = p.deprecatedNode(); n; n = n->parentNode()) {
         // Don't return a non-editable node if the input position was editable, since
         // the callers from editing will no doubt want to perform editing inside the returned node.
-        if (root && !n->isContentEditable() && onlyReturnEditableNodes)
+        if (root && !n->rendererIsEditable())
             continue;
-        if ((*nodeIsOfType)(n))
+        if (nodeIsOfType(n))
             return n;
         if (n == root)
             return 0;
@@ -623,12 +634,14 @@ Node* enclosingNodeOfType(const Position& p, bool (*nodeIsOfType)(const Node*),
     return 0;
 }
 
-Node* highestEnclosingNodeOfType(const Position& p, bool (*nodeIsOfType)(const Node*))
+Node* highestEnclosingNodeOfType(const Position& p, bool (*nodeIsOfType)(const Node*), EditingBoundaryCrossingRule rule)
 {
     Node* highest = 0;
-    Node* root = highestEditableRoot(p);
+    Node* root = rule == CannotCrossEditingBoundary ? highestEditableRoot(p) : 0;
     for (Node* n = p.deprecatedNode(); n; n = n->parentNode()) {
-        if ((*nodeIsOfType)(n))
+        if (root && !n->rendererIsEditable())
+            continue;
+        if (nodeIsOfType(n))
             highest = n;
         if (n == root)
             break;
@@ -721,8 +734,8 @@ Node* enclosingEmptyListItem(const VisiblePosition& visiblePos)
     if (!listChildNode || !isStartOfParagraph(visiblePos) || !isEndOfParagraph(visiblePos))
         return 0;
 
-    VisiblePosition firstInListChild(firstDeepEditingPositionForNode(listChildNode));
-    VisiblePosition lastInListChild(lastDeepEditingPositionForNode(listChildNode));
+    VisiblePosition firstInListChild(firstPositionInOrBeforeNode(listChildNode));
+    VisiblePosition lastInListChild(lastPositionInOrAfterNode(listChildNode));
 
     if (firstInListChild != visiblePos || lastInListChild != visiblePos)
         return 0;
@@ -754,7 +767,7 @@ bool canMergeLists(Element* firstList, Element* secondList)
         return false;
 
     return firstList->hasTagName(secondList->tagQName())// make sure the list types match (ol vs. ul)
-    && firstList->isContentEditable() && secondList->isContentEditable()// both lists are editable
+    && firstList->rendererIsEditable() && secondList->rendererIsEditable() // both lists are editable
     && firstList->rootEditableElement() == secondList->rootEditableElement()// don't cross editing boundaries
     && isVisiblyAdjacent(positionInParentAfterNode(firstList), positionInParentBeforeNode(secondList));
     // Make sure there is no visible content between this li and the previous list
@@ -932,15 +945,6 @@ bool isNodeRendered(const Node *node)
     return renderer->style()->visibility() == VISIBLE;
 }
 
-Node *nearestMailBlockquote(const Node *node)
-{
-    for (Node *n = const_cast<Node *>(node); n; n = n->parentNode()) {
-        if (isMailBlockquote(n))
-            return n;
-    }
-    return 0;
-}
-
 unsigned numEnclosingMailBlockquotes(const Position& p)
 {
     unsigned num = 0;
@@ -1016,7 +1020,7 @@ VisibleSelection selectionForParagraphIteration(const VisibleSelection& original
     // (a table is itself a paragraph).
     if (Node* table = isFirstPositionAfterTable(endOfSelection))
         if (startOfSelection.deepEquivalent().deprecatedNode()->isDescendantOf(table))
-            newSelection = VisibleSelection(startOfSelection, endOfSelection.previous(true));
+            newSelection = VisibleSelection(startOfSelection, endOfSelection.previous(CannotCrossEditingBoundary));
     
     // If the start of the selection to modify is just before a table,
     // and if the end of the selection is inside that table, then the first paragraph
@@ -1024,7 +1028,7 @@ VisibleSelection selectionForParagraphIteration(const VisibleSelection& original
     // containing the table itself.
     if (Node* table = isLastPositionBeforeTable(startOfSelection))
         if (endOfSelection.deepEquivalent().deprecatedNode()->isDescendantOf(table))
-            newSelection = VisibleSelection(startOfSelection.next(true), endOfSelection);
+            newSelection = VisibleSelection(startOfSelection.next(CannotCrossEditingBoundary), endOfSelection);
     
     return newSelection;
 }
diff --git a/Source/WebCore/editing/htmlediting.h b/Source/WebCore/editing/htmlediting.h
index b71e879..cb2b2a4 100644
--- a/Source/WebCore/editing/htmlediting.h
+++ b/Source/WebCore/editing/htmlediting.h
@@ -26,9 +26,11 @@
 #ifndef htmlediting_h
 #define htmlediting_h
 
+#include "EditingBoundary.h"
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
 #include "Position.h"
+#include "TextDirection.h"
 #include <wtf/Forward.h>
 #include <wtf/unicode/CharacterNames.h>
 
@@ -54,18 +56,17 @@ class VisibleSelection;
 
 Node* highestAncestor(Node*);
 Node* highestEditableRoot(const Position&);
-Node* highestEnclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*));
+Node* highestEnclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*), EditingBoundaryCrossingRule = CannotCrossEditingBoundary);
 Node* lowestEditableAncestor(Node*);   
 
-Node* enclosingBlock(Node*);
+Node* enclosingBlock(Node*, EditingBoundaryCrossingRule = CannotCrossEditingBoundary);
 Node* enclosingTableCell(const Position&);
 Node* enclosingEmptyListItem(const VisiblePosition&);
 Node* enclosingAnchorElement(const Position&);
 Node* enclosingNodeWithTag(const Position&, const QualifiedName&);
-Node* enclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*), bool onlyReturnEditableNodes = true);
+Node* enclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*), EditingBoundaryCrossingRule = CannotCrossEditingBoundary);
 
 Node* tabSpanNode(const Node*);
-Node* nearestMailBlockquote(const Node*);
 Node* isLastPositionBeforeTable(const VisiblePosition&);
 Node* isFirstPositionAfterTable(const VisiblePosition&);
 
@@ -96,6 +97,8 @@ bool isNodeVisiblyContainedWithin(Node*, const Range*);
 bool isRenderedAsNonInlineTableImageOrHR(const Node*);
 bool isNodeInTextFormControl(Node* node);
     
+TextDirection directionOfEnclosingBlock(const Position&);
+
 // -------------------------------------------------------------------------
 // Position
 // -------------------------------------------------------------------------
@@ -115,34 +118,18 @@ Position positionOutsideContainingSpecialElement(const Position&, Node** contain
 
 inline Position firstPositionInOrBeforeNode(Node* node)
 {
+    if (!node)
+        return Position();
     return editingIgnoresContent(node) ? positionBeforeNode(node) : firstPositionInNode(node);
 }
 
 inline Position lastPositionInOrAfterNode(Node* node)
 {
+    if (!node)
+        return Position();
     return editingIgnoresContent(node) ? positionAfterNode(node) : lastPositionInNode(node);
 }
 
-// Position creation functions are inline to prevent ref-churn.
-// Other Position creation functions are in Position.h
-// but these depend on lastOffsetForEditing which is defined in htmlediting.h.
-
-// NOTE: first/lastDeepEditingPositionForNode return legacy editing positions (like [img, 0])
-// for elements which editing ignores.  The rest of the editing code will treat [img, 0]
-// as "the last position before the img".
-// New code should use the creation functions in Position.h instead.
-inline Position firstDeepEditingPositionForNode(Node* anchorNode)
-{
-    ASSERT(anchorNode);
-    return Position(anchorNode, 0);
-}
-
-inline Position lastDeepEditingPositionForNode(Node* anchorNode)
-{
-    ASSERT(anchorNode);
-    return Position(anchorNode, lastOffsetForEditing(anchorNode));
-}
-       
 // comparision functions on Position
     
 int comparePositions(const Position&, const Position&);
@@ -237,7 +224,7 @@ inline bool isWhitespace(UChar c)
 {
     return c == noBreakSpace || c == ' ' || c == '\n' || c == '\t';
 }
-String stringWithRebalancedWhitespace(const String&, bool, bool);
+String stringWithRebalancedWhitespace(const String&, bool startIsStartOfParagraph, bool endIsEndOfParagraph);
 const String& nonBreakingSpaceString();
 
 }
diff --git a/Source/WebCore/editing/mac/EditorMac.mm b/Source/WebCore/editing/mac/EditorMac.mm
index 4c617c0..60bfe6c 100644
--- a/Source/WebCore/editing/mac/EditorMac.mm
+++ b/Source/WebCore/editing/mac/EditorMac.mm
@@ -216,4 +216,13 @@ void Editor::writeSelectionToPasteboard(const String& pasteboardName, const Vect
     Pasteboard::writeSelection([NSPasteboard pasteboardWithName:pasteboardName], types.get(), selectedRange().get(), true, m_frame);
 }
     
+void Editor::readSelectionFromPasteboard(const String& pasteboardName)
+{
+    Pasteboard pasteboard([NSPasteboard pasteboardWithName:pasteboardName]);
+    if (m_frame->selection()->isContentRichlyEditable())
+        pasteWithPasteboard(&pasteboard, true);
+    else
+        pasteAsPlainTextWithPasteboard(&pasteboard);   
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/editing/markup.cpp b/Source/WebCore/editing/markup.cpp
index 9d97b3f..316cec7 100644
--- a/Source/WebCore/editing/markup.cpp
+++ b/Source/WebCore/editing/markup.cpp
@@ -488,10 +488,8 @@ static Node* highestAncestorToWrapMarkup(const Range* range, Node* fullySelected
         specialCommonAncestor = ancestorToRetainStructureAndAppearance(commonAncestor);
 
         // Retain the Mail quote level by including all ancestor mail block quotes.
-        for (Node* ancestor = range->firstNode(); ancestor; ancestor = ancestor->parentNode()) {
-            if (isMailBlockquote(ancestor))
-                specialCommonAncestor = ancestor;
-        }
+        if (Node* highestMailBlockquote = highestEnclosingNodeOfType(firstPositionInOrBeforeNode(range->firstNode()), isMailBlockquote, CanCrossEditingBoundary))
+            specialCommonAncestor = highestMailBlockquote;
     }
 
     Node* checkAncestor = specialCommonAncestor ? specialCommonAncestor : commonAncestor;
@@ -634,7 +632,7 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
         // Styles that Mail blockquotes contribute should only be placed on the Mail blockquote, to help
         // us differentiate those styles from ones that the user has applied.  This helps us
         // get the color of content pasted into blockquotes right.
-        style->removeStyleAddedByNode(nearestMailBlockquote(parentOfLastClosed));
+        style->removeStyleAddedByNode(enclosingNodeOfType(firstPositionInNode(parentOfLastClosed), isMailBlockquote, CanCrossEditingBoundary));
 
         // Document default styles will be added on another wrapper span.
         if (document && document->documentElement())
diff --git a/Source/WebCore/editing/visible_units.cpp b/Source/WebCore/editing/visible_units.cpp
index 0baacf2..c9ca8c0 100644
--- a/Source/WebCore/editing/visible_units.cpp
+++ b/Source/WebCore/editing/visible_units.cpp
@@ -126,6 +126,7 @@ static VisiblePosition previousBoundary(const VisiblePosition& c, BoundarySearch
     // Use the character iterator to translate the next value into a DOM position.
     BackwardsCharacterIterator charIt(searchRange.get());
     charIt.advance(string.size() - suffixLength - next);
+    // FIXME: charIt can get out of shadow host.
     return VisiblePosition(charIt.range()->endPosition(), DOWNSTREAM);
 }
 
@@ -377,8 +378,8 @@ static VisiblePosition startPositionForLine(const VisiblePosition& c)
         startBox = startBox->nextLeafChild();
     }
     
-    VisiblePosition visPos = startBox->isInlineTextBox() ? VisiblePosition(Position(startNode, static_cast<InlineTextBox *>(startBox)->start(), Position::PositionIsOffsetInAnchor), DOWNSTREAM)
-                                                         : VisiblePosition(positionBeforeNode(startNode), DOWNSTREAM);
+    VisiblePosition visPos = startNode->isTextNode() ? VisiblePosition(Position(startNode, static_cast<InlineTextBox *>(startBox)->start(), Position::PositionIsOffsetInAnchor), DOWNSTREAM)
+                                                     : VisiblePosition(positionBeforeNode(startNode), DOWNSTREAM);
     return positionAvoidingFirstPositionInTable(visPos);
 }
 
@@ -476,10 +477,10 @@ bool isEndOfLine(const VisiblePosition &p)
 // The first leaf before node that has the same editability as node.
 static Node* previousLeafWithSameEditability(Node* node)
 {
-    bool editable = node->isContentEditable();
+    bool editable = node->rendererIsEditable();
     Node* n = node->previousLeafNode();
     while (n) {
-        if (editable == n->isContentEditable())
+        if (editable == n->rendererIsEditable())
             return n;
         n = n->previousLeafNode();
     }
@@ -571,18 +572,20 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
     // Could not find a previous line. This means we must already be on the first line.
     // Move to the start of the content in this block, which effectively moves us
     // to the start of the line we're on.
-    Element* rootElement = node->isContentEditable() ? node->rootEditableElement() : node->document()->documentElement();
+    Element* rootElement = node->rendererIsEditable() ? node->rootEditableElement() : node->document()->documentElement();
+    if (!rootElement)
+        return VisiblePosition();
     return VisiblePosition(firstPositionInNode(rootElement), DOWNSTREAM);
 }
 
 static Node* nextLeafWithSameEditability(Node* node, int offset)
 {
-    bool editable = node->isContentEditable();
+    bool editable = node->rendererIsEditable();
     ASSERT(offset >= 0);
     Node* child = node->childNode(offset);
     Node* n = child ? child->nextLeafNode() : node->lastDescendant()->nextLeafNode();
     while (n) {
-        if (editable == n->isContentEditable())
+        if (editable == n->rendererIsEditable())
             return n;
         n = n->nextLeafNode();
     }
@@ -594,10 +597,10 @@ static Node* nextLeafWithSameEditability(Node* node)
     if (!node)
         return 0;
     
-    bool editable = node->isContentEditable();
+    bool editable = node->rendererIsEditable();
     Node* n = node->nextLeafNode();
     while (n) {
-        if (editable == n->isContentEditable())
+        if (editable == n->rendererIsEditable())
             return n;
         n = n->nextLeafNode();
     }
@@ -676,7 +679,9 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int x)
     // Could not find a next line. This means we must already be on the last line.
     // Move to the end of the content in this block, which effectively moves us
     // to the end of the line we're on.
-    Element* rootElement = node->isContentEditable() ? node->rootEditableElement() : node->document()->documentElement();
+    Element* rootElement = node->rendererIsEditable() ? node->rootEditableElement() : node->document()->documentElement();
+    if (!rootElement)
+        return VisiblePosition();
     return VisiblePosition(lastPositionInNode(rootElement), DOWNSTREAM);
 }
 
@@ -743,18 +748,25 @@ VisiblePosition startOfParagraph(const VisiblePosition& c, EditingBoundaryCrossi
         return VisiblePosition();
     
     if (isRenderedAsNonInlineTableImageOrHR(startNode))
-        return firstDeepEditingPositionForNode(startNode);
+        return positionBeforeNode(startNode);
 
     Node* startBlock = enclosingBlock(startNode);
 
-    Node *node = startNode;
+    Node* node = startNode;
+    Node* highestRoot = highestEditableRoot(p);
     int offset = p.deprecatedEditingOffset();
     Position::AnchorType type = p.anchorType();
 
-    Node *n = startNode;
+    Node* n = startNode;
     while (n) {
-        if (boundaryCrossingRule == CannotCrossEditingBoundary && n->isContentEditable() != startNode->isContentEditable())
+        if (boundaryCrossingRule == CannotCrossEditingBoundary && n->rendererIsEditable() != startNode->rendererIsEditable())
             break;
+        if (boundaryCrossingRule == CanSkipOverEditingBoundary) {
+            while (n && n->rendererIsEditable() != startNode->rendererIsEditable())
+                n = n->traversePreviousNodePostOrder(startBlock);
+            if (!n || !n->isDescendantOf(highestRoot))
+                break;
+        }
         RenderObject *r = n->renderer();
         if (!r) {
             n = n->traversePreviousNodePostOrder(startBlock);
@@ -807,19 +819,27 @@ VisiblePosition endOfParagraph(const VisiblePosition &c, EditingBoundaryCrossing
     Node* startNode = p.deprecatedNode();
 
     if (isRenderedAsNonInlineTableImageOrHR(startNode))
-        return lastDeepEditingPositionForNode(startNode);
+        return positionAfterNode(startNode);
     
     Node* startBlock = enclosingBlock(startNode);
-    Node *stayInsideBlock = startBlock;
+    Node* stayInsideBlock = startBlock;
     
-    Node *node = startNode;
+    Node* node = startNode;
+    Node* highestRoot = highestEditableRoot(p);
     int offset = p.deprecatedEditingOffset();
     Position::AnchorType type = p.anchorType();
 
-    Node *n = startNode;
+    Node* n = startNode;
     while (n) {
-        if (boundaryCrossingRule == CannotCrossEditingBoundary && n->isContentEditable() != startNode->isContentEditable())
+        if (boundaryCrossingRule == CannotCrossEditingBoundary && n->rendererIsEditable() != startNode->rendererIsEditable())
             break;
+        if (boundaryCrossingRule == CanSkipOverEditingBoundary) {
+            while (n && n->rendererIsEditable() != startNode->rendererIsEditable())
+                n = n->traverseNextNode(stayInsideBlock);
+            if (!n || !n->isDescendantOf(highestRoot))
+                break;
+        }
+
         RenderObject *r = n->renderer();
         if (!r) {
             n = n->traverseNextNode(stayInsideBlock);
@@ -862,20 +882,21 @@ VisiblePosition endOfParagraph(const VisiblePosition &c, EditingBoundaryCrossing
     return VisiblePosition(Position(node, type), DOWNSTREAM);
 }
 
+// FIXME: isStartOfParagraph(startOfNextParagraph(pos)) is not always true
 VisiblePosition startOfNextParagraph(const VisiblePosition& visiblePosition)
 {
-    VisiblePosition paragraphEnd(endOfParagraph(visiblePosition));
-    VisiblePosition afterParagraphEnd(paragraphEnd.next(true));
+    VisiblePosition paragraphEnd(endOfParagraph(visiblePosition, CanSkipOverEditingBoundary));
+    VisiblePosition afterParagraphEnd(paragraphEnd.next(CannotCrossEditingBoundary));
     // The position after the last position in the last cell of a table
     // is not the start of the next paragraph.
     if (isFirstPositionAfterTable(afterParagraphEnd))
-        return afterParagraphEnd.next(true);
+        return afterParagraphEnd.next(CannotCrossEditingBoundary);
     return afterParagraphEnd;
 }
 
-bool inSameParagraph(const VisiblePosition &a, const VisiblePosition &b)
+bool inSameParagraph(const VisiblePosition &a, const VisiblePosition &b, EditingBoundaryCrossingRule boundaryCrossingRule)
 {
-    return a.isNotNull() && startOfParagraph(a) == startOfParagraph(b);
+    return a.isNotNull() && startOfParagraph(a, boundaryCrossingRule) == startOfParagraph(b, boundaryCrossingRule);
 }
 
 bool isStartOfParagraph(const VisiblePosition &pos, EditingBoundaryCrossingRule boundaryCrossingRule)
@@ -914,41 +935,37 @@ VisiblePosition nextParagraphPosition(const VisiblePosition& p, int x)
 
 // ---------
 
-VisiblePosition startOfBlock(const VisiblePosition &c)
+VisiblePosition startOfBlock(const VisiblePosition& visiblePosition, EditingBoundaryCrossingRule rule)
 {
-    Position p = c.deepEquivalent();
-    Node* startNode = p.deprecatedNode();
-    if (!startNode)
+    Position position = visiblePosition.deepEquivalent();
+    Node* startBlock;
+    if (!position.containerNode() || !(startBlock = enclosingBlock(position.containerNode(), rule)))
         return VisiblePosition();
-    return VisiblePosition(firstPositionInNode(startNode->enclosingBlockFlowElement()), DOWNSTREAM);
+    return firstPositionInNode(startBlock);
 }
 
-VisiblePosition endOfBlock(const VisiblePosition &c)
+VisiblePosition endOfBlock(const VisiblePosition& visiblePosition, EditingBoundaryCrossingRule rule)
 {
-    Position p = c.deepEquivalent();
-
-    Node* startNode = p.deprecatedNode();
-    if (!startNode)
+    Position position = visiblePosition.deepEquivalent();
+    Node* endBlock;
+    if (!position.containerNode() || !(endBlock = enclosingBlock(position.containerNode(), rule)))
         return VisiblePosition();
-
-    Node *startBlock = startNode->enclosingBlockFlowElement();
-    
-    return VisiblePosition(lastPositionInNode(startBlock), VP_DEFAULT_AFFINITY);   
+    return lastPositionInNode(endBlock);
 }
 
 bool inSameBlock(const VisiblePosition &a, const VisiblePosition &b)
 {
-    return !a.isNull() && enclosingBlockFlowElement(a) == enclosingBlockFlowElement(b);
+    return !a.isNull() && enclosingBlock(a.deepEquivalent().containerNode()) == enclosingBlock(b.deepEquivalent().containerNode());
 }
 
 bool isStartOfBlock(const VisiblePosition &pos)
 {
-    return pos.isNotNull() && pos == startOfBlock(pos);
+    return pos.isNotNull() && pos == startOfBlock(pos, CanCrossEditingBoundary);
 }
 
 bool isEndOfBlock(const VisiblePosition &pos)
 {
-    return pos.isNotNull() && pos == endOfBlock(pos);
+    return pos.isNotNull() && pos == endOfBlock(pos, CanCrossEditingBoundary);
 }
 
 // ---------
@@ -1012,7 +1029,7 @@ VisiblePosition startOfEditableContent(const VisiblePosition& visiblePosition)
     if (!highestRoot)
         return VisiblePosition();
 
-    return firstDeepEditingPositionForNode(highestRoot);
+    return firstPositionInNode(highestRoot);
 }
 
 VisiblePosition endOfEditableContent(const VisiblePosition& visiblePosition)
@@ -1021,88 +1038,7 @@ VisiblePosition endOfEditableContent(const VisiblePosition& visiblePosition)
     if (!highestRoot)
         return VisiblePosition();
 
-    return lastDeepEditingPositionForNode(highestRoot);
-}
-
-static void getLeafBoxesInLogicalOrder(RootInlineBox* rootBox, Vector<InlineBox*>& leafBoxesInLogicalOrder)
-{
-    unsigned char minLevel = 128;
-    unsigned char maxLevel = 0;
-    unsigned count = 0;
-    InlineBox* r = rootBox->firstLeafChild();
-    // First find highest and lowest levels,
-    // and initialize leafBoxesInLogicalOrder with the leaf boxes in visual order.
-    while (r) {
-        if (r->bidiLevel() > maxLevel)
-            maxLevel = r->bidiLevel();
-        if (r->bidiLevel() < minLevel)
-            minLevel = r->bidiLevel();
-        leafBoxesInLogicalOrder.append(r);
-        r = r->nextLeafChild();
-        ++count;
-    }
-
-    if (rootBox->renderer()->style()->visuallyOrdered())
-        return;
-    // Reverse of reordering of the line (L2 according to Bidi spec):
-    // L2. From the highest level found in the text to the lowest odd level on each line,
-    // reverse any contiguous sequence of characters that are at that level or higher.
-
-    // Reversing the reordering of the line is only done up to the lowest odd level.
-    if (!(minLevel % 2))
-        minLevel++;
-    
-    InlineBox** end = leafBoxesInLogicalOrder.end();
-    while (minLevel <= maxLevel) {
-        InlineBox** iter = leafBoxesInLogicalOrder.begin();
-        while (iter != end) {
-            while (iter != end) {
-                if ((*iter)->bidiLevel() >= minLevel)
-                    break;
-                ++iter;
-            }
-            InlineBox** first = iter;
-            while (iter != end) {
-                if ((*iter)->bidiLevel() < minLevel)
-                    break;
-                ++iter;
-            }
-            InlineBox** last = iter;
-            std::reverse(first, last);
-        }                
-        ++minLevel;
-    }
-}
-
-static void getLogicalStartBoxAndNode(RootInlineBox* rootBox, InlineBox*& startBox, Node*& startNode)
-{
-    Vector<InlineBox*> leafBoxesInLogicalOrder;
-    getLeafBoxesInLogicalOrder(rootBox, leafBoxesInLogicalOrder);
-    startBox = 0;
-    startNode = 0;
-    for (size_t i = 0; i < leafBoxesInLogicalOrder.size(); ++i) {
-        startBox = leafBoxesInLogicalOrder[i];
-        startNode = startBox->renderer()->node();
-        if (startNode)
-            return; 
-    }
-}
-
-static void getLogicalEndBoxAndNode(RootInlineBox* rootBox, InlineBox*& endBox, Node*& endNode)
-{
-    Vector<InlineBox*> leafBoxesInLogicalOrder;
-    getLeafBoxesInLogicalOrder(rootBox, leafBoxesInLogicalOrder);
-    endBox = 0;
-    endNode = 0;
-    // Generated content (e.g. list markers and CSS :before and :after
-    // pseudoelements) have no corresponding DOM element, and so cannot be
-    // represented by a VisiblePosition.  Use whatever precedes instead.
-    for (size_t i = leafBoxesInLogicalOrder.size(); i > 0; --i) { 
-        endBox = leafBoxesInLogicalOrder[i - 1];
-        endNode = endBox->renderer()->node();
-        if (endNode)
-            return;
-    }
+    return lastPositionInNode(highestRoot);
 }
 
 static VisiblePosition logicalStartPositionForLine(const VisiblePosition& c)
@@ -1122,8 +1058,7 @@ static VisiblePosition logicalStartPositionForLine(const VisiblePosition& c)
     }
     
     InlineBox* logicalStartBox;
-    Node* logicalStartNode;
-    getLogicalStartBoxAndNode(rootBox, logicalStartBox, logicalStartNode);
+    Node* logicalStartNode = rootBox->getLogicalStartBoxWithNode(logicalStartBox);
 
     if (!logicalStartNode)
         return VisiblePosition();
@@ -1158,8 +1093,8 @@ static VisiblePosition logicalEndPositionForLine(const VisiblePosition& c)
     }
     
     InlineBox* logicalEndBox;
-    Node* logicalEndNode;
-    getLogicalEndBoxAndNode(rootBox, logicalEndBox, logicalEndNode);
+    Node* logicalEndNode = rootBox->getLogicalEndBoxWithNode(logicalEndBox);
+
     if (!logicalEndNode)
         return VisiblePosition();
     
diff --git a/Source/WebCore/editing/visible_units.h b/Source/WebCore/editing/visible_units.h
index 167bd2c..18b9665 100644
--- a/Source/WebCore/editing/visible_units.h
+++ b/Source/WebCore/editing/visible_units.h
@@ -32,6 +32,7 @@
 
 namespace WebCore {
 
+class RootInlineBox;
 class VisiblePosition;
 
 enum EWordSide { RightWordIfOnBoundary = false, LeftWordIfOnBoundary = true };
@@ -70,11 +71,11 @@ VisiblePosition previousParagraphPosition(const VisiblePosition &, int x);
 VisiblePosition nextParagraphPosition(const VisiblePosition &, int x);
 bool isStartOfParagraph(const VisiblePosition &, EditingBoundaryCrossingRule = CannotCrossEditingBoundary);
 bool isEndOfParagraph(const VisiblePosition &, EditingBoundaryCrossingRule = CannotCrossEditingBoundary);
-bool inSameParagraph(const VisiblePosition &, const VisiblePosition &);
+bool inSameParagraph(const VisiblePosition &, const VisiblePosition &, EditingBoundaryCrossingRule = CannotCrossEditingBoundary);
 
 // blocks (true paragraphs; line break elements don't break blocks)
-VisiblePosition startOfBlock(const VisiblePosition &);
-VisiblePosition endOfBlock(const VisiblePosition &);
+VisiblePosition startOfBlock(const VisiblePosition &, EditingBoundaryCrossingRule = CannotCrossEditingBoundary);
+VisiblePosition endOfBlock(const VisiblePosition &, EditingBoundaryCrossingRule = CannotCrossEditingBoundary);
 bool inSameBlock(const VisiblePosition &, const VisiblePosition &);
 bool isStartOfBlock(const VisiblePosition &);
 bool isEndOfBlock(const VisiblePosition &);
diff --git a/Source/WebCore/features.pri b/Source/WebCore/features.pri
index 8c5bf2f..8fbcfee 100644
--- a/Source/WebCore/features.pri
+++ b/Source/WebCore/features.pri
@@ -135,7 +135,7 @@ contains(MOBILITY_CONFIG, sensors) {
 symbian|maemo5|maemo6 {
     !CONFIG(QTDIR_build):!contains(DEFINES, ENABLE_QT_USERAGENT_DEVICEMODEL=.) {
         contains(MOBILITY_CONFIG, systeminfo) {
-            DEFINES += QT_USERAGENT_DEVICEMODEL=1
+            DEFINES += ENABLE_QT_USERAGENT_DEVICEMODEL=1
         }
     }
 }
@@ -214,6 +214,9 @@ contains(DEFINES, ENABLE_WCSS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WCSS=1
 contains(DEFINES, ENABLE_WML=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WML=1
 contains(DEFINES, ENABLE_XHTMLMP=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_XHTMLMP=1
 contains(DEFINES, ENABLE_SVG=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG=1
+contains(DEFINES, ENABLE_SVG_ANIMATION=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG_ANIMATION=1
+contains(DEFINES, ENABLE_SVG_FONTS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG_FONTS=1
+contains(DEFINES, ENABLE_SVG_FOREIGN_OBJECT=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG_FOREIGN_OBJECT=1
 contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
 contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_OFFLINE_WEB_APPLICATIONS=1
 contains(DEFINES, ENABLE_WEB_SOCKETS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WEB_SOCKETS=1
diff --git a/Source/WebCore/fileapi/BlobURL.cpp b/Source/WebCore/fileapi/BlobURL.cpp
index 47ebe8d..5d79141 100644
--- a/Source/WebCore/fileapi/BlobURL.cpp
+++ b/Source/WebCore/fileapi/BlobURL.cpp
@@ -52,16 +52,6 @@ KURL BlobURL::createInternalURL()
     return createBlobURL("blobinternal://");
 }
 
-KURL BlobURL::getOrigin(const KURL& url)
-{
-    ASSERT(url.protocolIs(kBlobProtocol));
-
-    unsigned startIndex = url.pathStart();
-    unsigned afterEndIndex = url.pathAfterLastSlash();
-    String origin = url.string().substring(startIndex, afterEndIndex - startIndex);
-    return KURL(ParsedURLString, decodeURLEscapeSequences(origin));
-}
-
 String BlobURL::getIdentifier(const KURL& url)
 {
     ASSERT(url.protocolIs(kBlobProtocol));
@@ -72,6 +62,9 @@ String BlobURL::getIdentifier(const KURL& url)
 
 KURL BlobURL::createBlobURL(const String& originString)
 {
+    ASSERT(!originString.isEmpty());
+    if (originString == "null")
+        return KURL();
     String urlString = kBlobProtocol;
     urlString += ":";
     urlString += encodeWithURLEscapeSequences(originString);
diff --git a/Source/WebCore/fileapi/BlobURL.h b/Source/WebCore/fileapi/BlobURL.h
index 4526e63..4ea59fe 100644
--- a/Source/WebCore/fileapi/BlobURL.h
+++ b/Source/WebCore/fileapi/BlobURL.h
@@ -50,7 +50,6 @@ class BlobURL {
 public:
     static KURL createPublicURL(SecurityOrigin*);
     static KURL createInternalURL();
-    static KURL getOrigin(const KURL&);
     static String getIdentifier(const KURL&);
     static const char* blobProtocol() { return kBlobProtocol; }
 
diff --git a/Source/WebCore/fileapi/DOMFileSystem.cpp b/Source/WebCore/fileapi/DOMFileSystem.cpp
index c1710cd..01d56d5 100644
--- a/Source/WebCore/fileapi/DOMFileSystem.cpp
+++ b/Source/WebCore/fileapi/DOMFileSystem.cpp
@@ -39,6 +39,7 @@
 #include "ErrorCallback.h"
 #include "File.h"
 #include "FileEntry.h"
+#include "FileMetadata.h"
 #include "FileSystemCallbacks.h"
 #include "FileWriter.h"
 #include "FileWriterBaseCallback.h"
@@ -111,12 +112,46 @@ void DOMFileSystem::createWriter(const FileEntry* fileEntry, PassRefPtr<FileWrit
     m_asyncFileSystem->createWriter(fileWriter.get(), platformPath, callbacks.release());
 }
 
-void DOMFileSystem::createFile(const FileEntry* fileEntry, PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback>)
+namespace {
+
+class GetPathCallback : public FileSystemCallbacksBase {
+public:
+    static PassOwnPtr<GetPathCallback> create(PassRefPtr<DOMFileSystem> filesystem, const String& path, PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+    {
+        return adoptPtr(new GetPathCallback(filesystem, path, successCallback, errorCallback));
+    }
+
+    virtual void didReadMetadata(const FileMetadata& metadata)
+    {
+        if (!metadata.platformPath.isEmpty())
+            m_path = metadata.platformPath;
+
+        m_filesystem->scheduleCallback(m_successCallback.release(), File::create(m_path));
+    }
+
+private:
+    GetPathCallback(PassRefPtr<DOMFileSystem> filesystem, const String& path, PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+        : FileSystemCallbacksBase(errorCallback)
+        , m_filesystem(filesystem)
+        , m_path(path)
+        , m_successCallback(successCallback)
+    {
+    }
+
+    RefPtr<DOMFileSystem> m_filesystem;
+    String m_path;
+    RefPtr<FileCallback> m_successCallback;
+};
+
+} // namespace
+
+void DOMFileSystem::createFile(const FileEntry* fileEntry, PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
     String platformPath = m_asyncFileSystem->virtualToPlatformPath(fileEntry->fullPath());
-    scheduleCallback(successCallback, File::create(platformPath));
+
+    m_asyncFileSystem->readMetadata(platformPath, GetPathCallback::create(this, platformPath, successCallback, errorCallback));
 }
 
-} // namespace
+} // namespace WebCore
 
 #endif // ENABLE(FILE_SYSTEM)
diff --git a/Source/WebCore/fileapi/DOMFileSystemSync.cpp b/Source/WebCore/fileapi/DOMFileSystemSync.cpp
index 5ae7545..0d26bb6 100644
--- a/Source/WebCore/fileapi/DOMFileSystemSync.cpp
+++ b/Source/WebCore/fileapi/DOMFileSystemSync.cpp
@@ -33,6 +33,8 @@
 
 #if ENABLE(FILE_SYSTEM)
 
+#include "AsyncFileSystem.h"
+#include "AsyncFileWriter.h"
 #include "DOMFilePath.h"
 #include "DirectoryEntrySync.h"
 #include "ErrorCallback.h"
@@ -40,6 +42,7 @@
 #include "FileEntrySync.h"
 #include "FileError.h"
 #include "FileException.h"
+#include "FileMetadata.h"
 #include "FileSystemCallbacks.h"
 #include "FileWriterBaseCallback.h"
 #include "FileWriterSync.h"
@@ -67,10 +70,105 @@ PassRefPtr<DirectoryEntrySync> DOMFileSystemSync::root()
     return DirectoryEntrySync::create(this, DOMFilePath::root);
 }
 
+namespace {
+
+class GetPathHelper : public AsyncFileSystemCallbacks {
+public:
+    class GetPathResult : public RefCounted<GetPathResult> {
+      public:
+        static PassRefPtr<GetPathResult> create()
+        {
+            return adoptRef(new GetPathResult());
+        }
+
+        bool m_failed;
+        int m_code;
+        String m_path;
+
+      private:
+        GetPathResult()
+            : m_failed(false)
+            , m_code(0)
+        {
+        }
+
+        ~GetPathResult()
+        {
+        }
+        friend class WTF::RefCounted<GetPathResult>;
+    };
+
+    static PassOwnPtr<GetPathHelper> create(PassRefPtr<GetPathResult> result)
+    {
+        return adoptPtr(new GetPathHelper(result));
+    }
+
+    virtual void didSucceed()
+    {
+        ASSERT_NOT_REACHED();
+    }
+
+    virtual void didOpenFileSystem(const String&, PassOwnPtr<AsyncFileSystem>)
+    {
+        ASSERT_NOT_REACHED();
+    }
+
+    virtual void didReadDirectoryEntry(const String&, bool)
+    {
+        ASSERT_NOT_REACHED();
+    }
+
+    virtual void didReadDirectoryEntries(bool)
+    {
+        ASSERT_NOT_REACHED();
+    }
+
+    virtual void didCreateFileWriter(PassOwnPtr<AsyncFileWriter>, long long)
+    {
+        ASSERT_NOT_REACHED();
+    }
+
+    virtual void didFail(int code)
+    {
+        m_result->m_failed = true;
+        m_result->m_code = code;
+    }
+
+    virtual ~GetPathHelper()
+    {
+    }
+
+    void didReadMetadata(const FileMetadata& metadata)
+    {
+        m_result->m_path = metadata.platformPath;
+    }
+private:
+    GetPathHelper(PassRefPtr<GetPathResult> result)
+        : m_result(result)
+    {
+    }
+
+    RefPtr<GetPathResult> m_result;
+};
+
+} // namespace
+
 PassRefPtr<File> DOMFileSystemSync::createFile(const FileEntrySync* fileEntry, ExceptionCode& ec)
 {
     ec = 0;
     String platformPath = m_asyncFileSystem->virtualToPlatformPath(fileEntry->fullPath());
+    RefPtr<GetPathHelper::GetPathResult> result(GetPathHelper::GetPathResult::create());
+    m_asyncFileSystem->readMetadata(platformPath, GetPathHelper::create(result));
+    if (!m_asyncFileSystem->waitForOperationToComplete()) {
+        ec = FileException::ABORT_ERR;
+        return 0;
+    }
+    if (result->m_failed) {
+        ec = result->m_code;
+        return 0;
+    }
+    if (!result->m_path.isEmpty())
+        platformPath = result->m_path;
     return File::create(platformPath);
 }
 
diff --git a/Source/WebCore/fileapi/Entry.idl b/Source/WebCore/fileapi/Entry.idl
index f144b31..557ade4 100644
--- a/Source/WebCore/fileapi/Entry.idl
+++ b/Source/WebCore/fileapi/Entry.idl
@@ -43,7 +43,7 @@ module storage {
         void getMetadata(in [Optional, Callback] MetadataCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
         void moveTo(in DirectoryEntry parent, in [Optional, ConvertUndefinedOrNullToNullString] DOMString name, in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
         void copyTo(in DirectoryEntry parent, in [Optional, ConvertUndefinedOrNullToNullString] DOMString name, in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
-        DOMString toURI();
+        DOMString toURL();
         void remove(in [Optional, Callback] VoidCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
         void getParent(in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
     };
diff --git a/Source/WebCore/fileapi/EntryBase.cpp b/Source/WebCore/fileapi/EntryBase.cpp
index ad3bec0..e10964a 100644
--- a/Source/WebCore/fileapi/EntryBase.cpp
+++ b/Source/WebCore/fileapi/EntryBase.cpp
@@ -54,11 +54,15 @@ EntryBase::~EntryBase()
 {
 }
 
-String EntryBase::toURI()
+String EntryBase::toURL()
 {
+    String originString = m_fileSystem->securityOrigin()->toString();
+    ASSERT(!originString.isEmpty());
+    if (originString == "null")
+        return String();
     StringBuilder result;
     result.append("filesystem:");
-    result.append(m_fileSystem->securityOrigin()->toString());
+    result.append(originString);
     result.append("/");
     result.append(m_fileSystem->asyncFileSystem()->type() == AsyncFileSystem::Temporary ? DOMFileSystemBase::kTemporaryPathPrefix : DOMFileSystemBase::kPersistentPathPrefix);
     result.append(m_fullPath);
diff --git a/Source/WebCore/fileapi/EntryBase.h b/Source/WebCore/fileapi/EntryBase.h
index babd295..a34a914 100644
--- a/Source/WebCore/fileapi/EntryBase.h
+++ b/Source/WebCore/fileapi/EntryBase.h
@@ -55,7 +55,7 @@ public:
     const String& fullPath() const { return m_fullPath; }
     const String& name() const { return m_name; }
 
-    String toURI();
+    String toURL();
 
 protected:
     EntryBase(PassRefPtr<DOMFileSystemBase>, const String& fullPath);
diff --git a/Source/WebCore/fileapi/EntrySync.idl b/Source/WebCore/fileapi/EntrySync.idl
index 0a180e8..459a014 100644
--- a/Source/WebCore/fileapi/EntrySync.idl
+++ b/Source/WebCore/fileapi/EntrySync.idl
@@ -43,7 +43,7 @@ module storage {
         Metadata getMetadata() raises (FileException);
         EntrySync moveTo(in DirectoryEntrySync parent, in [ConvertUndefinedOrNullToNullString] DOMString name) raises (FileException);
         EntrySync copyTo(in DirectoryEntrySync parent, in [ConvertUndefinedOrNullToNullString] DOMString name) raises (FileException);
-        DOMString toURI();
+        DOMString toURL();
         void remove() raises (FileException);
         DirectoryEntrySync getParent();
     };
diff --git a/Source/WebCore/fileapi/FileReaderLoader.cpp b/Source/WebCore/fileapi/FileReaderLoader.cpp
index 07b32a6..918ffba 100644
--- a/Source/WebCore/fileapi/FileReaderLoader.cpp
+++ b/Source/WebCore/fileapi/FileReaderLoader.cpp
@@ -75,6 +75,10 @@ void FileReaderLoader::start(ScriptExecutionContext* scriptExecutionContext, Blo
 {
     // The blob is read by routing through the request handling layer given a temporary public url.
     m_urlForReading = BlobURL::createPublicURL(scriptExecutionContext->securityOrigin());
+    if (m_urlForReading.isEmpty()) {
+        failed(FileError::SECURITY_ERR);
+        return;
+    }
     ThreadableBlobRegistry::registerBlobURL(m_urlForReading, blob->url());
 
     // Construct and load the request.
diff --git a/Source/WebCore/fileapi/FileThread.h b/Source/WebCore/fileapi/FileThread.h
index 45205c4..9c1d267 100644
--- a/Source/WebCore/fileapi/FileThread.h
+++ b/Source/WebCore/fileapi/FileThread.h
@@ -42,7 +42,7 @@ namespace WebCore {
 
 class FileStream;
 
-class FileThread : public ThreadSafeShared<FileThread> {
+class FileThread : public ThreadSafeRefCounted<FileThread> {
 public:
     static PassRefPtr<FileThread> create()
     {
diff --git a/Source/WebCore/fileapi/LocalFileSystem.cpp b/Source/WebCore/fileapi/LocalFileSystem.cpp
index 688d155..955d723 100644
--- a/Source/WebCore/fileapi/LocalFileSystem.cpp
+++ b/Source/WebCore/fileapi/LocalFileSystem.cpp
@@ -81,7 +81,7 @@ static void openFileSystem(ScriptExecutionContext*, const String& basePath, cons
     AsyncFileSystem::openFileSystem(basePath, identifier, type, create, callbacks);
 }
 
-void LocalFileSystem::readFileSystem(ScriptExecutionContext* context, AsyncFileSystem::Type type, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+void LocalFileSystem::readFileSystem(ScriptExecutionContext* context, AsyncFileSystem::Type type, PassOwnPtr<AsyncFileSystemCallbacks> callbacks, bool)
 {
     // AsyncFileSystem::openFileSystem calls callbacks synchronously, so the method needs to be called asynchronously.
     context->postTask(createCallbackTask(&openFileSystem, fileSystemBasePath(), context->securityOrigin()->databaseIdentifier(), type, false, callbacks));
diff --git a/Source/WebCore/fileapi/LocalFileSystem.h b/Source/WebCore/fileapi/LocalFileSystem.h
index baf72d9..2eabd7a 100644
--- a/Source/WebCore/fileapi/LocalFileSystem.h
+++ b/Source/WebCore/fileapi/LocalFileSystem.h
@@ -54,7 +54,7 @@ public:
     static LocalFileSystem& localFileSystem();
 
     // Does not create the root path for file system, just reads it if available.
-    void readFileSystem(ScriptExecutionContext*, AsyncFileSystem::Type, PassOwnPtr<AsyncFileSystemCallbacks>);
+    void readFileSystem(ScriptExecutionContext*, AsyncFileSystem::Type, PassOwnPtr<AsyncFileSystemCallbacks>, bool synchronous = false);
 
     void requestFileSystem(ScriptExecutionContext*, AsyncFileSystem::Type, long long size, PassOwnPtr<AsyncFileSystemCallbacks>, bool synchronous = false);
 
diff --git a/Source/WebCore/gyp/WebCore.gyp b/Source/WebCore/gyp/WebCore.gyp
index b811b52..ce78b67 100644
--- a/Source/WebCore/gyp/WebCore.gyp
+++ b/Source/WebCore/gyp/WebCore.gyp
@@ -3,7 +3,26 @@
     '../../gyp/common.gypi',
     '../WebCore.gypi',
   ],
-  'xcode_config_file': '../Configurations/DebugRelease.xcconfig',
+  'configurations': {
+    'Production': {
+      'xcode_config_file': '<(project_dir)/Configurations/Base.xcconfig',
+    },
+    'Release': {
+      'xcode_config_file': '<(project_dir)/Configurations/DebugRelease.xcconfig',
+      'xcode_settings': {
+        'STRIP_INSTALLED_PRODUCT': 'NO',
+      },
+    },
+    'Debug': {
+      'xcode_config_file': '<(project_dir)/Configurations/DebugRelease.xcconfig',
+      'xcode_settings': {
+        'DEAD_CODE_STRIPPING': '$(DEAD_CODE_STRIPPING_debug)',
+        'DEBUG_DEFINES': '$(DEBUG_DEFINES_debug)',
+        'GCC_OPTIMIZATION_LEVEL': '$(GCC_OPTIMIZATION_LEVEL_debug)',
+        'STRIP_INSTALLED_PRODUCT': '$(STRIP_INSTALLED_PRODUCT_debug)',
+      },
+    },
+  },
   'targets': [
     {
       'target_name': 'WebCore',
@@ -16,14 +35,16 @@
         # FIXME: Add 'Copy Inspector Resources',
       ],
       'include_dirs': [
-        '<(DEPTH)/WebCore/icu',
-        '<(DEPTH)/WebCore/ForwardingHeaders',
+        '<(project_dir)',
+        '<(project_dir)/icu',
+        '<(project_dir)/ForwardingHeaders',
         '<(PRODUCT_DIR)/usr/local/include',
         '/usr/include/libxml2',
+        '<(PRODUCT_DIR)/DerivedSources',
+        '<(PRODUCT_DIR)/DerivedSources/WebCore',
       ],
       'sources': [
         '<@(webcore_files)',
-        '<@(webcore_publicheader_files)',
         '<@(webcore_privateheader_files)',
         '<@(webcore_derived_source_files)',
         '$(SDKROOT)/System/Library/Frameworks/Accelerate.framework',
@@ -44,105 +65,121 @@
         'libz.dylib',
       ],
       'sources/': [
-        ['exclude', 'accessibility/[^/]+/'],
-        ['include', 'accessibility/mac/'],
         ['exclude', 'bindings/[^/]+/'],
         ['include', 'bindings/generic/'],
         ['include', 'bindings/js/'],
         ['include', 'bindings/objc/'],
-        ['exclude', 'bridge/jni/v8/'],
-        ['exclude', 'bridge/qt/'],
-        # FIXME: These files shouldn't be in this directory.
-        ['exclude', 'bridge/testbindings\.cpp'],
-        ['exclude', 'bridge/testbindings\.mm'],
-        ['exclude', 'bridge/testqtbindings\.cpp'],
-        ['exclude', 'editing/[^/]+/'],
-        ['include', 'editing/mac/'],
-        ['exclude', 'history/[^/]+/'],
-        ['include', 'history/cf/'],
-        ['include', 'history/mac/'],
-        ['exclude', 'loader/[^/]+/'],
-        ['include', 'loader/appcache/'],
-        ['include', 'loader/archive/'],
-        ['include', 'loader/cache/'],
-        ['include', 'loader/cf/'],
-        ['include', 'loader/icon/'],
-        ['include', 'loader/mac/'],
-        ['exclude', 'page/[^/]+/'],
-        ['include', 'page/animation/'],
-        ['include', 'page/mac/'],
-        ['exclude', 'platform/[^/]+/'],
-        ['include', 'platform/animation/'],
-        ['include', 'platform/audio/'],
-        ['exclude', 'platform/audio/[^/]+/'],
-        ['include', 'platform/audio/mac/'],
-        ['include', 'platform/audio/fftw/'], # FIXME: Is this correct? mkl is the other choice.
-        ['include', 'platform/audio/resources/'],
-        ['include', 'platform/cf/'],
-        ['include', 'platform/cocoa/'],
-        ['include', 'platform/graphics/'],
-        ['exclude', 'platform/graphics/[^/]+/'],
-        ['include', 'platform/graphics/ca/'],
-        ['include', 'platform/graphics/cg/'],
-        # FIXME: This file appears to be misplaced.
-        ['exclude', 'platform/graphics/cg/FontPlatformData\.h'],
-        ['include', 'platform/graphics/cocoa/'],
-        ['include', 'platform/graphics/filters/'],
-        ['include', 'platform/graphics/gpu/'],
-        ['include', 'platform/graphics/mac/'],
-        ['include', 'platform/graphics/opengl/'],
-        ['include', 'platform/graphics/transforms/'],
-        ['include', 'platform/mac/'],
-        ['include', 'platform/mock/'],
-        ['include', 'platform/network/'],
-        ['exclude', 'platform/network/[^/]+/'],
-        ['include', 'platform/network/cf'],
-        ['include', 'platform/network/mac'],
-        ['include', 'platform/posix/'],
-        ['include', 'platform/sql/'],
-        ['exclude', 'platform/sql/chromium'],
-        ['include', 'platform/text/'],
-        ['exclude', 'platform/text/[^/]+/'],
-        ['include', 'platform/text/cf'],
-        ['include', 'platform/text/mac'],
-        ['include', 'platform/text/transcoder'],
-        ['exclude', 'DerivedSources\.cpp$'],
-        # FIXME: Consider using one or more AllInOne files.
-        ['exclude', '(Chromium|Win|Qt)\.cpp$'],
-        ['exclude', 'AllInOne\.cpp$'],
-        ['exclude', 'WebCore\.gyp/mac/Empty\.cpp$']
-      ],
-      'mac_framework_headers': [
-        '<@(webcore_publicheader_files)',
+
+        # FIXME: This could should move to Source/ThirdParty.
+        ['exclude', 'thirdparty/'],
+
+        # FIXME: Figure out how to store these patterns in a variable.
+        ['exclude', '(android|brew|cairo|chromium|curl|efl|freetype|fftw|gstreamer|gtk|haiku|linux|mkl|openvg|pango|qt|skia|soup|symbian|texmap|iphone|v8|win|wince|wx)/'],
+        ['exclude', '(Android|Brew|Cairo|Curl|Chromium|Efl|Haiku|Gtk|Linux|OpenType|Qt|Safari|Soup|Symbian|V8|Win|WinCE|Wx)\\.(cpp|mm?)$'],
+        ['exclude', 'Chromium[^/]*\\.(cpp|mm?)$'],
+
+        ['exclude', 'platform/image-decoders/'],
+        ['exclude', 'platform/image-encoders/'],
+
+        ['exclude', 'bridge/testbindings\\.cpp$'], # Remove from GYPI?
+        ['exclude', 'bridge/testbindings\\.mm$'], # Remove from GYPI?
+        ['exclude', 'bridge/testqtbindings\\.cpp$'], # Remove from GYPI?
+        ['exclude', 'platform/KillRingNone\\.cpp$'],
+        ['exclude', 'platform/graphics/cg/FontPlatformData\\.h$'],
+        ['exclude', 'platform/graphics/gpu/LoopBlinnPathProcessor\\.(cpp|h)$'],
+        ['exclude', 'platform/graphics/gpu/LoopBlinnLocalTriangulator\\.(cpp|h)$'],
+        ['exclude', 'platform/graphics/gpu/LoopBlinnPathCache\\.(cpp|h)$'],
+        ['exclude', 'platform/graphics/gpu/LoopBlinnShader\\.(cpp|h)$'],
+        ['exclude', 'platform/graphics/gpu/LoopBlinnSolidFillShader\\.(cpp|h)$'],
+        # FIXME: Consider excluding GL as a suffix.
+        ['exclude', 'platform/graphics/ImageSource\\.cpp$'],
+        ['exclude', 'platform/graphics/opengl/TextureMapperGL\\.cpp$'],
+        ['exclude', 'platform/graphics/opentype/OpenTypeUtilities\\.(cpp|h)$'],
+        ['exclude', 'platform/posix/SharedBufferPOSIX\\.cpp$'],
+        ['exclude', 'platform/text/Hyphenation\\.cpp$'],
+        ['exclude', 'platform/text/LocalizedNumberICU\\.cpp$'],
+        ['exclude', 'platform/text/LocalizedNumberNone\\.cpp$'],
+        ['exclude', 'platform/text/TextEncodingDetectorNone\\.cpp$'],
+        ['exclude', 'plugins/PluginDataNone\\.cpp$'],
+        ['exclude', 'plugins/PluginDatabase\\.cpp$'],
+        ['exclude', 'plugins/PluginPackageNone\\.cpp$'],
+        ['exclude', 'plugins/PluginPackage\\.cpp$'],
+        ['exclude', 'plugins/PluginStream\\.cpp$'],
+        ['exclude', 'plugins/PluginView\\.cpp$'],
+        ['exclude', 'plugins/mac/PluginPackageMac\\.cpp$'],
+        ['exclude', 'plugins/mac/PluginViewMac\\.mm$'],
+        ['exclude', 'plugins/npapi\\.cpp$'],
+
+        # FIXME: Check whether we need to build these derived source files.
+        ['exclude', 'JSAbstractView\\.(cpp|h)'],
+        ['exclude', 'JSElementTimeControl\\.(cpp|h)'],
+        ['exclude', 'JSMathMLElementWrapperFactory\\.(cpp|h)'],
+        ['exclude', 'JSSVGExternalResourcesRequired\\.(cpp|h)'],
+        ['exclude', 'JSSVGFilterPrimitiveStandardAttributes\\.(cpp|h)'],
+        ['exclude', 'JSSVGFitToViewBox\\.(cpp|h)'],
+        ['exclude', 'JSSVGLangSpace\\.(cpp|h)'],
+        ['exclude', 'JSSVGLocatable\\.(cpp|h)'],
+        ['exclude', 'JSSVGStylable\\.(cpp|h)'],
+        ['exclude', 'JSSVGTests\\.(cpp|h)'],
+        ['exclude', 'JSSVGTransformable\\.(cpp|h)'],
+        ['exclude', 'JSSVGURIReference\\.(cpp|h)'],
+        ['exclude', 'JSSVGZoomAndPan\\.(cpp|h)'],
+        ['exclude', 'tokenizer\\.cpp'],
+
+        ['exclude', 'AllInOne\\.cpp$'],
+
+        ['exclude', 'rendering/svg/[^/]+\\.cpp'],
+        ['include', 'rendering/svg/RenderSVGAllInOne\\.cpp$'],
       ],
       'mac_framework_private_headers': [
         '<@(webcore_privateheader_files)',
       ],
-      'xcode_config_file': '../Configurations/WebCore.xcconfig',
+      'mac_bundle_resources': [
+        '<@(webcore_resource_files)',
+      ],
+      'xcode_config_file': '<(project_dir)/Configurations/WebCore.xcconfig',
       # FIXME: A number of these actions aren't supposed to run if "${ACTION}" = "installhdrs"
       'postbuilds': [
         {
           'postbuild_name': 'Check For Global Initializers',
           'action': [
-            'sh', '<(DEPTH)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-global-initializers'
+            'sh', '<(project_dir)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-global-initializers'
           ],
         },
         {
           'postbuild_name': 'Check For Exit Time Destructors',
           'action': [
-            'sh', '<(DEPTH)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-exit-time-destructors'
+            'sh', '<(project_dir)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-exit-time-destructors'
           ],
         },
         {
           'postbuild_name': 'Check For Weak VTables and Externals',
           'action': [
-            'sh', '<(DEPTH)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-weak-vtables-and-externals'
+            'sh', '<(project_dir)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-weak-vtables-and-externals'
+          ],
+        },
+        {
+          'postbuild_name': 'Copy Forwarding and ICU Headers',
+          'action': [
+            'sh', '<(project_dir)/gyp/copy-forwarding-and-icu-headers.sh'
+          ],
+        },
+        {
+          'postbuild_name': 'Copy Inspector Resources',
+          'action': [
+            'sh', '<(project_dir)/gyp/copy-inspector-resources.sh'
+          ],
+        },
+        {
+          'postbuild_name': 'Streamline Inspector Source',
+          'action': [
+            'sh', '<(project_dir)/gyp/streamline-inspector-source.sh'
           ],
         },
         {
           'postbuild_name': 'Check For Inappropriate Files in Framework',
           'action': [
-            'sh', '<(DEPTH)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-inappropriate-files-in-framework'
+            'sh', '<(project_dir)/gyp/run-if-exists.sh', '<(DEPTH)/../Tools/Scripts/check-for-inappropriate-files-in-framework'
           ],
         },
       ],
@@ -152,8 +189,9 @@
           'xcode_settings': {
             # FIXME: Remove these overrides once WebCore.xcconfig is
             # used only by this project.
-            'GCC_PREFIX_HEADER': '<(DEPTH)/WebCore/WebCorePrefix.h',
-            'INFOPLIST_FILE': '<(DEPTH)/WebCore/Info.plist',
+            'GCC_PREFIX_HEADER': '<(project_dir)/WebCorePrefix.h',
+            'INFOPLIST_FILE': '<(project_dir)/Info.plist',
+            'ALWAYS_SEARCH_USER_PATHS': 'NO',
           },
         }],
       ],
@@ -161,6 +199,10 @@
     {
       'target_name': 'Derived Sources',
       'type': 'none',
+      'dependencies': [
+        'WebCoreExportFileGenerator',
+      ],
+      'xcode_config_file': '<(project_dir)/Configurations/WebCore.xcconfig',
       'actions': [{
         'action_name': 'Generate Derived Sources',
         'inputs': [],
@@ -178,10 +220,76 @@
         'inputs': [],
          'outputs': [],
          'action': [
-           'sh', '<(DEPTH)/gyp/update-info-plist.sh', '<(DEPTH)/WebCore/Info.plist'
+           'sh', '<(project_dir)/gyp/update-info-plist.sh', '<(project_dir)/Info.plist'
           ]
       }],
     },
-    # FIXME: Add WebCoreExportFileGenerator
+    {
+      'target_name': 'WebCoreExportFileGenerator Generator',
+      'type': 'none',
+      'actions': [{
+        'action_name': 'Generate Export File Generator',
+        'inputs': [
+          '<(project_dir)/WebCore.exp.in',
+        ],
+        'outputs': [
+          '<@(export_file_generator_files)',
+        ],
+        'action': [
+          'sh', '<(project_dir)/gyp/generate-webcore-export-file-generator.sh',
+        ],
+      }],
+    },
+    {
+      'target_name': 'WebCoreExportFileGenerator',
+      'type': 'executable',
+      'dependencies': [
+        'WebCoreExportFileGenerator Generator',
+      ],
+      'include_dirs': [
+        '<(project_dir)/ForwardingHeaders',
+      ],
+      'xcode_config_file': '<(project_dir)/Configurations/WebCore.xcconfig',
+      'configurations': {
+        'Production': {
+            'EXPORTED_SYMBOLS_FILE': '',
+            'GCC_OPTIMIZATION_LEVEL': '0',
+            'INSTALL_PATH': '/usr/local/bin',
+            'OTHER_LDFLAGS': '',
+            'SKIP_INSTALL': 'YES',
+        },
+        'Release': {
+          'xcode_settings': {
+            'EXPORTED_SYMBOLS_FILE': '',
+            'GCC_OPTIMIZATION_LEVEL': '0',
+            'INSTALL_PATH': '/usr/local/bin',
+            'OTHER_LDFLAGS': '',
+            'SKIP_INSTALL': 'YES',
+          },
+        },
+        'Debug': {
+          'xcode_settings': {
+            'EXPORTED_SYMBOLS_FILE': '',
+            'GCC_OPTIMIZATION_LEVEL': '0',
+            'INSTALL_PATH': '/usr/local/bin',
+            'OTHER_LDFLAGS': '',
+            'SKIP_INSTALL': 'YES',
+          },
+        },
+      },
+      'sources': [
+        '<@(export_file_generator_files)',
+      ],
+      'conditions': [
+        ['OS=="mac"', {
+          'xcode_settings': {
+            # FIXME: Remove these overrides once WebCore.xcconfig is
+            # used only by this project.
+            'GCC_PREFIX_HEADER': '<(project_dir)/WebCorePrefix.h',
+            'INFOPLIST_FILE': '<(project_dir)/Info.plist',
+          },
+        }],
+      ],
+    },
   ], # targets
 }
diff --git a/Source/WebCore/gyp/copy-forwarding-and-icu-headers.sh b/Source/WebCore/gyp/copy-forwarding-and-icu-headers.sh
new file mode 100755
index 0000000..8f19f09
--- /dev/null
+++ b/Source/WebCore/gyp/copy-forwarding-and-icu-headers.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+rsync -aq --exclude ".svn" --exclude ".DS_Store" "$SRCROOT/../ForwardingHeaders" "$BUILT_PRODUCTS_DIR/$PRIVATE_HEADERS_FOLDER_PATH"
+rsync -aq --exclude ".svn" --exclude ".DS_Store" "$SRCROOT/../icu" "$BUILT_PRODUCTS_DIR/$PRIVATE_HEADERS_FOLDER_PATH"
diff --git a/Source/WebCore/gyp/copy-inspector-resources.sh b/Source/WebCore/gyp/copy-inspector-resources.sh
new file mode 100755
index 0000000..9795624
--- /dev/null
+++ b/Source/WebCore/gyp/copy-inspector-resources.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+# Copy all the Inspector front-end resources.
+ditto "${SRCROOT}/../inspector/front-end" "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector"
+ditto "${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore/InspectorBackendStub.js" "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector"
+
+# Remove the WebKit.qrc file since it is not used on the Mac (this file is for Qt).
+rm -f "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector/WebKit.qrc"
+
+# Remove *.re2js files, they are only used to generate some .js files.
+rm -f "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector/"*.re2js
+
+# Remove any .svn directories that may have been copied over.
+find "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector" -name ".svn" -type d | xargs rm -rf
diff --git a/Source/WebCore/gyp/generate-webcore-export-file-generator.sh b/Source/WebCore/gyp/generate-webcore-export-file-generator.sh
new file mode 100755
index 0000000..f93f916
--- /dev/null
+++ b/Source/WebCore/gyp/generate-webcore-export-file-generator.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+OUTPUT_DIR="${BUILT_PRODUCTS_DIR}/DerivedSources/${PROJECT_NAME}"
+mkdir -p "${OUTPUT_DIR}"
+"${SRCROOT}"/../make-export-file-generator "${SRCROOT}/../WebCore.exp.in" "${OUTPUT_DIR}/ExportFileGenerator.cpp"
diff --git a/Source/WebCore/gyp/run-if-exists.sh b/Source/WebCore/gyp/run-if-exists.sh
new file mode 100755
index 0000000..242ffc8
--- /dev/null
+++ b/Source/WebCore/gyp/run-if-exists.sh
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+if [ -f $1 ]; then
+    $1 || exit $?;
+fi
diff --git a/Source/WebCore/gyp/streamline-inspector-source.sh b/Source/WebCore/gyp/streamline-inspector-source.sh
new file mode 100755
index 0000000..330d6ed
--- /dev/null
+++ b/Source/WebCore/gyp/streamline-inspector-source.sh
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+# Don't do anything for Debug builds, so the Inspector is easier to debug.
+if [[ ${CONFIGURATION:=Debug} == "Debug" ]]; then
+    exit
+fi
+
+# Combine all script resources in the inspector.html file.
+"$SRCROOT/../combine-javascript-resources" --input-html "${SRCROOT}/../inspector/front-end/inspector.html" --generated-scripts-dir ${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore --output-dir "${DERIVED_FILE_DIR}/WebCore" --output-script-name inspector.js
+
+if [ -d "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector" ]; then
+    # Remove any JavaScript files, since they will be replaced with the combined file.
+    cd "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector"
+    rm *.js
+
+    # Copy the modified HTML file and the combined script.
+    cp "${DERIVED_FILE_DIR}/WebCore/inspector.html" inspector.html
+    cp "${DERIVED_FILE_DIR}/WebCore/inspector.js" inspector.js
+fi
diff --git a/Source/WebCore/gyp/update-info-plist.sh b/Source/WebCore/gyp/update-info-plist.sh
new file mode 100755
index 0000000..d02ecce
--- /dev/null
+++ b/Source/WebCore/gyp/update-info-plist.sh
@@ -0,0 +1,4 @@
+# Touch Info.plist to let Xcode know it needs to copy it into the built product
+if [[ "${CONFIGURATION}" != "Production" ]]; then
+    touch "$1";
+fi
diff --git a/Source/WebCore/history/CachedFrame.cpp b/Source/WebCore/history/CachedFrame.cpp
index 558a191..215bfaf 100644
--- a/Source/WebCore/history/CachedFrame.cpp
+++ b/Source/WebCore/history/CachedFrame.cpp
@@ -83,8 +83,6 @@ void CachedFrameBase::restore()
 {
     ASSERT(m_document->view() == m_view);
 
-    m_view->setIsRestoringFromBackForward(true);
-
     Frame* frame = m_view->frame();
     m_cachedFrameScriptData->restore(frame);
 
diff --git a/Source/WebCore/history/HistoryItem.cpp b/Source/WebCore/history/HistoryItem.cpp
index c31aa86..363e1aa 100644
--- a/Source/WebCore/history/HistoryItem.cpp
+++ b/Source/WebCore/history/HistoryItem.cpp
@@ -31,6 +31,7 @@
 #include "IconDatabase.h"
 #include "PageCache.h"
 #include "ResourceRequest.h"
+#include "SharedBuffer.h"
 #include <stdio.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/Decoder.h>
@@ -230,12 +231,6 @@ const String& HistoryItem::alternateTitle() const
     return m_displayTitle;
 }
 
-Image* HistoryItem::icon() const
-{
-    Image* result = iconDatabase().iconForPageURL(m_urlString, IntSize(16, 16));
-    return result ? result : iconDatabase().defaultIcon(IntSize(16, 16));
-}
-
 double HistoryItem::lastVisitedTime() const
 {
     return m_lastVisitedTime;
diff --git a/Source/WebCore/history/HistoryItem.h b/Source/WebCore/history/HistoryItem.h
index 235f756..b9c9983 100644
--- a/Source/WebCore/history/HistoryItem.h
+++ b/Source/WebCore/history/HistoryItem.h
@@ -105,8 +105,6 @@ public:
     void setAlternateTitle(const String& alternateTitle);
     const String& alternateTitle() const;
     
-    Image* icon() const;
-    
     const String& parent() const;
     KURL url() const;
     KURL originalURL() const;
diff --git a/Source/WebCore/html/CollectionCache.h b/Source/WebCore/html/CollectionCache.h
index 8e4a066..d160db2 100644
--- a/Source/WebCore/html/CollectionCache.h
+++ b/Source/WebCore/html/CollectionCache.h
@@ -49,7 +49,7 @@ public:
 
     typedef HashMap<AtomicStringImpl*, Vector<Element*>*> NodeCacheMap;
 
-    unsigned version;
+    uint64_t version;
     Element* current;
     unsigned position;
     unsigned length;
diff --git a/Source/WebCore/html/FormAssociatedElement.cpp b/Source/WebCore/html/FormAssociatedElement.cpp
index 3571744..ea36b2a 100644
--- a/Source/WebCore/html/FormAssociatedElement.cpp
+++ b/Source/WebCore/html/FormAssociatedElement.cpp
@@ -132,7 +132,7 @@ void FormAssociatedElement::resetFormOwner(HTMLFormElement* form)
         m_form->removeFormElement(this);
     }
     m_form = 0;
-    if (!formId.isNull()) {
+    if (!formId.isNull() && element->inDocument()) {
         // The HTML5 spec says that the element should be associated with
         // the first element in the document to have an ID that equal to
         // the value of form attribute, so we put the result of
diff --git a/Source/WebCore/html/HTMLAnchorElement.cpp b/Source/WebCore/html/HTMLAnchorElement.cpp
index 0c10022..60f5b4a 100644
--- a/Source/WebCore/html/HTMLAnchorElement.cpp
+++ b/Source/WebCore/html/HTMLAnchorElement.cpp
@@ -72,7 +72,7 @@ static unsigned parsePortFromStringPosition(const String& value, unsigned portSt
 
 bool HTMLAnchorElement::supportsFocus() const
 {
-    if (isContentEditable())
+    if (rendererIsEditable())
         return HTMLElement::supportsFocus();
     // If not a link we should still be able to focus the element if it has tabIndex.
     return isLink() || HTMLElement::supportsFocus();
@@ -154,7 +154,7 @@ void HTMLAnchorElement::defaultEventHandler(Event* event)
             return;
         }
 
-        if (isContentEditable()) {
+        if (rendererIsEditable()) {
             // This keeps track of the editable block that the selection was in (if it was in one) just before the link was clicked
             // for the LiveWhenNotFocused editable link behavior
             if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() != RightButton && document()->frame() && document()->frame()->selection()) {
@@ -174,7 +174,7 @@ void HTMLAnchorElement::defaultEventHandler(Event* event)
 
 void HTMLAnchorElement::setActive(bool down, bool pause)
 {
-    if (isContentEditable()) {
+    if (rendererIsEditable()) {
         EditableLinkBehavior editableLinkBehavior = EditableLinkDefaultBehavior;
         if (Settings* settings = document()->settings())
             editableLinkBehavior = settings->editableLinkBehavior();
@@ -247,7 +247,7 @@ bool HTMLAnchorElement::canStartSelection() const
     // FIXME: We probably want this same behavior in SVGAElement too
     if (!isLink())
         return HTMLElement::canStartSelection();
-    return isContentEditable();
+    return rendererIsEditable();
 }
 
 bool HTMLAnchorElement::draggable() const
@@ -501,7 +501,7 @@ HTMLAnchorElement::EventType HTMLAnchorElement::eventType(Event* event)
 
 bool HTMLAnchorElement::treatLinkAsLiveForEventType(EventType eventType) const
 {
-    if (!isContentEditable())
+    if (!rendererIsEditable())
         return true;
 
     Settings* settings = document()->settings();
diff --git a/Source/WebCore/html/HTMLAnchorElement.idl b/Source/WebCore/html/HTMLAnchorElement.idl
index 432df69..8f09e41 100644
--- a/Source/WebCore/html/HTMLAnchorElement.idl
+++ b/Source/WebCore/html/HTMLAnchorElement.idl
@@ -27,6 +27,7 @@ module html {
         attribute [Reflect, URL] DOMString href;
         attribute [Reflect] DOMString hreflang;
         attribute [Reflect] DOMString name;
+        attribute [Reflect] DOMString ping;
         attribute [Reflect] DOMString rel;
         attribute [Reflect] DOMString rev;
         attribute [Reflect] DOMString shape;
diff --git a/Source/WebCore/html/HTMLAreaElement.cpp b/Source/WebCore/html/HTMLAreaElement.cpp
index 9832d06..4cb2748 100644
--- a/Source/WebCore/html/HTMLAreaElement.cpp
+++ b/Source/WebCore/html/HTMLAreaElement.cpp
@@ -175,7 +175,7 @@ Path HTMLAreaElement::getRegion(const IntSize& size) const
 HTMLImageElement* HTMLAreaElement::imageElement() const
 {
     Node* mapElement = parentNode();
-    if (!mapElement->hasTagName(mapTag))
+    if (!mapElement || !mapElement->hasTagName(mapTag))
         return 0;
     
     return static_cast<HTMLMapElement*>(mapElement)->imageElement();
diff --git a/Source/WebCore/html/HTMLAreaElement.idl b/Source/WebCore/html/HTMLAreaElement.idl
index a77e615..3358c05 100644
--- a/Source/WebCore/html/HTMLAreaElement.idl
+++ b/Source/WebCore/html/HTMLAreaElement.idl
@@ -26,6 +26,7 @@ module html {
         attribute [Reflect] DOMString coords;
         attribute [Reflect, URL] DOMString href;
         attribute [Reflect] boolean noHref;
+        attribute [Reflect] DOMString ping;
         attribute [Reflect] DOMString shape;
         attribute [Reflect] DOMString target;
 
diff --git a/Source/WebCore/html/HTMLAttributeNames.in b/Source/WebCore/html/HTMLAttributeNames.in
index 956812d..3a6fea4 100644
--- a/Source/WebCore/html/HTMLAttributeNames.in
+++ b/Source/WebCore/html/HTMLAttributeNames.in
@@ -298,6 +298,7 @@ version
 viewsource
 vlink
 vspace
+webkitallowfullscreen
 webkitdirectory
 width
 wrap
diff --git a/Source/WebCore/html/HTMLBodyElement.cpp b/Source/WebCore/html/HTMLBodyElement.cpp
index 3cc4cd8..9cf8730 100644
--- a/Source/WebCore/html/HTMLBodyElement.cpp
+++ b/Source/WebCore/html/HTMLBodyElement.cpp
@@ -233,7 +233,7 @@ bool HTMLBodyElement::isURLAttribute(Attribute *attr) const
 
 bool HTMLBodyElement::supportsFocus() const
 {
-    return isContentEditable() || HTMLElement::supportsFocus();
+    return rendererIsEditable() || HTMLElement::supportsFocus();
 }
 
 String HTMLBodyElement::aLink() const
diff --git a/Source/WebCore/html/HTMLCanvasElement.cpp b/Source/WebCore/html/HTMLCanvasElement.cpp
index 79ebdad..fbedbf2 100644
--- a/Source/WebCore/html/HTMLCanvasElement.cpp
+++ b/Source/WebCore/html/HTMLCanvasElement.cpp
@@ -41,6 +41,7 @@
 #include "GraphicsContext.h"
 #include "HTMLNames.h"
 #include "ImageBuffer.h"
+#include "ImageData.h"
 #include "MIMETypeRegistry.h"
 #include "Page.h"
 #include "RenderHTMLCanvas.h"
@@ -76,6 +77,7 @@ static const float MaxSkiaDim = 32767.0F; // Maximum width/height in CSS pixels.
 HTMLCanvasElement::HTMLCanvasElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document)
     , m_size(DefaultWidth, DefaultHeight)
+    , m_rendererIsCanvas(false)
     , m_ignoreReset(false)
     , m_pageScaleFactor(document->frame() ? document->frame()->page()->chrome()->scaleFactor() : 1)
     , m_originClean(true)
@@ -173,7 +175,7 @@ CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type, Canvas
 #if ENABLE(WEBGL)    
     Settings* settings = document()->settings();
     if (settings && settings->webGLEnabled()
-#if !PLATFORM(CHROMIUM) && !PLATFORM(QT)
+#if !PLATFORM(CHROMIUM)
         && settings->acceleratedCompositingEnabled()
 #endif
         ) {
@@ -275,15 +277,22 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const IntRect& r)
     if (hasCreatedImageBuffer()) {
         ImageBuffer* imageBuffer = buffer();
         if (imageBuffer) {
-            if (imageBuffer->drawsUsingCopy())
+            if (m_presentedImage)
+                context->drawImage(m_presentedImage.get(), ColorSpaceDeviceRGB, r);
+            else if (imageBuffer->drawsUsingCopy())
                 context->drawImage(copiedImage(), ColorSpaceDeviceRGB, r);
             else
                 context->drawImageBuffer(imageBuffer, ColorSpaceDeviceRGB, r);
         }
     }
-}
 
 #if ENABLE(WEBGL)    
+    if (is3D())
+        static_cast<WebGLRenderingContext*>(m_context.get())->markLayerComposited();
+#endif
+}
+
+#if ENABLE(WEBGL)
 bool HTMLCanvasElement::is3D() const
 {
     return m_context && m_context->is3d();
@@ -296,6 +305,19 @@ void HTMLCanvasElement::makeRenderingResultsAvailable()
         m_context->paintRenderingResultsToCanvas();
 }
 
+void HTMLCanvasElement::makePresentationCopy()
+{
+    if (!m_presentedImage) {
+        // The buffer contains the last presented data, so save a copy of it.
+        m_presentedImage = buffer()->copyImage();
+    }
+}
+
+void HTMLCanvasElement::clearPresentationCopy()
+{
+    m_presentedImage.clear();
+}
+
 void HTMLCanvasElement::attach()
 {
     HTMLElement::attach();
@@ -337,15 +359,37 @@ String HTMLCanvasElement::toDataURL(const String& mimeType, const double* qualit
 
     String lowercaseMimeType = mimeType.lower();
 
-    makeRenderingResultsAvailable();
-
     // FIXME: Make isSupportedImageMIMETypeForEncoding threadsafe (to allow this method to be used on a worker thread).
     if (mimeType.isNull() || !MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(lowercaseMimeType))
-        return buffer()->toDataURL("image/png");
+        lowercaseMimeType = "image/png";
 
+#if PLATFORM(CG) || USE(SKIA)
+    // Try to get ImageData first, as that may avoid lossy conversions.
+    RefPtr<ImageData> imageData = getImageData();
+
+    if (imageData)
+        return ImageDataToDataURL(*imageData, lowercaseMimeType, quality);
+#endif
+
+    makeRenderingResultsAvailable();
+      
     return buffer()->toDataURL(lowercaseMimeType, quality);
 }
 
+PassRefPtr<ImageData> HTMLCanvasElement::getImageData()
+{
+    if (!m_context || !m_context->is3d())
+       return 0;
+
+#if ENABLE(WEBGL)    
+    WebGLRenderingContext* ctx = static_cast<WebGLRenderingContext*>(m_context.get());
+
+    return ctx->paintRenderingResultsToImageData();
+#else
+    return 0;
+#endif
+}
+
 IntRect HTMLCanvasElement::convertLogicalToDevice(const FloatRect& logicalRect) const
 {
     float left = floorf(logicalRect.x() * m_pageScaleFactor);
@@ -399,7 +443,10 @@ void HTMLCanvasElement::createImageBuffer() const
         return;
 
 #if USE(IOSURFACE_CANVAS_BACKING_STORE)
-    m_imageBuffer = ImageBuffer::create(size, ColorSpaceDeviceRGB, Accelerated);
+    if (document()->settings()->canvasUsesAcceleratedDrawing())
+        m_imageBuffer = ImageBuffer::create(size, ColorSpaceDeviceRGB, Accelerated);
+    else
+        m_imageBuffer = ImageBuffer::create(size, ColorSpaceDeviceRGB, Unaccelerated);
 #else
     m_imageBuffer = ImageBuffer::create(size);
 #endif
@@ -434,11 +481,8 @@ ImageBuffer* HTMLCanvasElement::buffer() const
 Image* HTMLCanvasElement::copiedImage() const
 {
     if (!m_copiedImage && buffer()) {
-        if (m_context) {
-            // If we're not rendering to the ImageBuffer, copy the rendering results to it.
-            if (!m_context->paintsIntoCanvasBuffer())
-                m_context->paintRenderingResultsToCanvas();
-        }
+        if (m_context)
+            m_context->paintRenderingResultsToCanvas();
         m_copiedImage = buffer()->copyImage();
     }
     return m_copiedImage.get();
diff --git a/Source/WebCore/html/HTMLCanvasElement.h b/Source/WebCore/html/HTMLCanvasElement.h
index 5c8ac9a..6fdd222 100644
--- a/Source/WebCore/html/HTMLCanvasElement.h
+++ b/Source/WebCore/html/HTMLCanvasElement.h
@@ -47,6 +47,7 @@ class CanvasRenderingContext;
 class GraphicsContext;
 class HTMLCanvasElement;
 class Image;
+class ImageData;
 class ImageBuffer;
 class IntSize;
 
@@ -105,6 +106,9 @@ public:
     ImageBuffer* buffer() const;
     Image* copiedImage() const;
     void clearCopiedImage();
+    PassRefPtr<ImageData> getImageData();
+    void makePresentationCopy();
+    void clearPresentationCopy();
 
     IntRect convertLogicalToDevice(const FloatRect&) const;
     IntSize convertLogicalToDevice(const FloatSize&) const;
@@ -175,6 +179,7 @@ private:
     mutable bool m_hasCreatedImageBuffer;
     mutable OwnPtr<ImageBuffer> m_imageBuffer;
     
+    mutable RefPtr<Image> m_presentedImage;
     mutable RefPtr<Image> m_copiedImage; // FIXME: This is temporary for platforms that have to copy the image buffer to render (and for CSSCanvasValue).
 };
 
diff --git a/Source/WebCore/html/HTMLCollection.cpp b/Source/WebCore/html/HTMLCollection.cpp
index 7d776d1..2782e50 100644
--- a/Source/WebCore/html/HTMLCollection.cpp
+++ b/Source/WebCore/html/HTMLCollection.cpp
@@ -67,7 +67,7 @@ HTMLCollection::~HTMLCollection()
 
 void HTMLCollection::resetCollectionInfo() const
 {
-    unsigned docversion = static_cast<HTMLDocument*>(m_base->document())->domTreeVersion();
+    uint64_t docversion = static_cast<HTMLDocument*>(m_base->document())->domTreeVersion();
 
     if (!m_info) {
         m_info = new CollectionCache;
diff --git a/Source/WebCore/html/HTMLDetailsElement.cpp b/Source/WebCore/html/HTMLDetailsElement.cpp
index 0bcae0b..f9c2f6c 100644
--- a/Source/WebCore/html/HTMLDetailsElement.cpp
+++ b/Source/WebCore/html/HTMLDetailsElement.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,7 +21,10 @@
 #include "config.h"
 #include "HTMLDetailsElement.h"
 
+#include "Frame.h"
 #include "HTMLNames.h"
+#include "MouseEvent.h"
+#include "PlatformMouseEvent.h"
 #include "RenderDetails.h"
 
 namespace WebCore {
@@ -35,6 +38,8 @@ PassRefPtr<HTMLDetailsElement> HTMLDetailsElement::create(const QualifiedName& t
 
 HTMLDetailsElement::HTMLDetailsElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document)
+    , m_mainSummary(0)
+    , m_isOpen(false)
 {
     ASSERT(hasTagName(detailsTag));
 }
@@ -44,4 +49,88 @@ RenderObject* HTMLDetailsElement::createRenderer(RenderArena* arena, RenderStyle
     return new (arena) RenderDetails(this);
 }
 
+void HTMLDetailsElement::findMainSummary()
+{
+    m_mainSummary = 0;
+
+    for (Node* child = firstChild(); child; child = child->nextSibling()) {
+        if (child->hasTagName(summaryTag)) {
+            m_mainSummary = child;
+            break;
+        }
+    }
+}
+
+void HTMLDetailsElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+{
+    HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    if (!changedByParser) {
+        Node* oldSummary = m_mainSummary;
+        findMainSummary();
+
+        if (oldSummary != m_mainSummary && !m_isOpen && attached()) {
+            if (oldSummary && oldSummary->attached())
+                oldSummary->detach();
+            if (m_mainSummary && childCountDelta < 0 && !m_mainSummary->renderer()) {
+                // If childCountDelta is less then zero and the main summary has changed it must be because previous main
+                // summary was removed. The new main summary was then inside the unrevealed content and needs to be
+                // reattached to create its renderer. If childCountDelta is not less then zero then a new <summary> element
+                // has been added and it will be attached without our help.
+                m_mainSummary->detach();
+                m_mainSummary->attach();
+            }
+        }
+    }
+}
+
+void HTMLDetailsElement::finishParsingChildren()
+{
+    HTMLElement::finishParsingChildren();
+    findMainSummary();
+    if (attached() && m_mainSummary && !m_mainSummary->renderer()) {
+        m_mainSummary->detach();
+        m_mainSummary->attach();
+    }
+}
+
+void HTMLDetailsElement::parseMappedAttribute(Attribute* attr)
+{
+    if (attr->name() == openAttr) {
+        bool oldValue = m_isOpen;
+        m_isOpen =  !attr->value().isNull();
+        if (attached() && oldValue != m_isOpen) {
+            detach();
+            attach();
+        }
+    } else
+        HTMLElement::parseMappedAttribute(attr);
+}
+
+bool HTMLDetailsElement::childShouldCreateRenderer(Node* child) const
+{
+    return m_isOpen || child == m_mainSummary;
+}
+
+void HTMLDetailsElement::defaultEventHandler(Event* event)
+{
+    HTMLElement::defaultEventHandler(event);
+
+    if (!renderer() || !renderer()->isDetails() || !event->isMouseEvent() || event->type() != eventNames().clickEvent || event->defaultHandled())
+        return;
+
+    MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+    if (mouseEvent->button() != LeftButton)
+        return;
+
+    RenderDetails* renderDetails = static_cast<RenderDetails*>(renderer());
+
+    float factor = document() && document()->frame() ? document()->frame()->pageZoomFactor() : 1.0f;
+    FloatPoint pos = renderDetails->absoluteToLocal(FloatPoint(mouseEvent->pageX() * factor, mouseEvent->pageY() * factor));
+
+    if (renderDetails->interactiveArea().contains(pos.x(), pos.y())) {
+        setAttribute(openAttr, m_isOpen ? String() : String(""));
+        event->setDefaultHandled();
+    }
+}
+
 }
diff --git a/Source/WebCore/html/HTMLDetailsElement.h b/Source/WebCore/html/HTMLDetailsElement.h
index 16427ef..45a9035 100644
--- a/Source/WebCore/html/HTMLDetailsElement.h
+++ b/Source/WebCore/html/HTMLDetailsElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,11 +28,23 @@ namespace WebCore {
 class HTMLDetailsElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLDetailsElement> create(const QualifiedName& tagName, Document* document);
+    Node* mainSummary() const { return m_mainSummary; }
 
 private:
     HTMLDetailsElement(const QualifiedName&, Document*);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    virtual void childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta);
+    virtual void finishParsingChildren();
+
+    void parseMappedAttribute(Attribute*);
+    bool childShouldCreateRenderer(Node*) const;
+    void defaultEventHandler(Event*);
+
+    void findMainSummary();
+
+    Node* m_mainSummary;
+    bool m_isOpen;
 
 };
 
diff --git a/Source/WebCore/html/HTMLElement.cpp b/Source/WebCore/html/HTMLElement.cpp
index b3981c8..e3b5043 100644
--- a/Source/WebCore/html/HTMLElement.cpp
+++ b/Source/WebCore/html/HTMLElement.cpp
@@ -654,44 +654,15 @@ void HTMLElement::addHTMLAlignmentToStyledElement(StyledElement* element, Attrib
 
 bool HTMLElement::supportsFocus() const
 {
-    return Element::supportsFocus() || (isContentEditable() && parentNode() && !parentNode()->isContentEditable());
+    return Element::supportsFocus() || (rendererIsEditable() && parentNode() && !parentNode()->rendererIsEditable());
 }
 
-bool HTMLElement::isContentEditable() const 
+bool HTMLElement::isContentEditable() const
 {
-    if (document()->inDesignMode())
-        return true;
-
-    // Ideally we'd call ASSERT!needsStyleRecalc()) here, but
-    // ContainerNode::setFocus() calls setNeedsStyleRecalc(), so the assertion
-    // would fire in the middle of Document::setFocusedNode().
-
-    if (!renderer()) {
-        if (parentNode())
-            return parentNode()->isContentEditable();
-        else
-            return false;
-    }
-    
-    return renderer()->style()->userModify() == READ_WRITE || renderer()->style()->userModify() == READ_WRITE_PLAINTEXT_ONLY;
-}
-
-bool HTMLElement::isContentRichlyEditable() const
-{
-    if (document()->inDesignMode())
-        return true;
-
-    if (!renderer()) {
-        if (parentNode())
-            return parentNode()->isContentEditable();
-        else
-            return false;
-    }
-    
-    return renderer()->style()->userModify() == READ_WRITE;
+    return rendererIsEditable();
 }
 
-String HTMLElement::contentEditable() const 
+String HTMLElement::contentEditable() const
 {
     const AtomicString& value = fastGetAttribute(contenteditableAttr);
 
diff --git a/Source/WebCore/html/HTMLElement.h b/Source/WebCore/html/HTMLElement.h
index 73517df..077b1c3 100644
--- a/Source/WebCore/html/HTMLElement.h
+++ b/Source/WebCore/html/HTMLElement.h
@@ -56,9 +56,8 @@ public:
     void insertAdjacentText(const String& where, const String& text, ExceptionCode&);
 
     virtual bool supportsFocus() const;
-    
-    virtual bool isContentEditable() const;
-    virtual bool isContentRichlyEditable() const;
+
+    bool isContentEditable() const;
 
     String contentEditable() const;
     void setContentEditable(const String&, ExceptionCode&);
diff --git a/Source/WebCore/html/HTMLEmbedElement.cpp b/Source/WebCore/html/HTMLEmbedElement.cpp
index f419e2a..851deb8 100644
--- a/Source/WebCore/html/HTMLEmbedElement.cpp
+++ b/Source/WebCore/html/HTMLEmbedElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
- * Copyright (C) 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2008, 2009, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
@@ -46,7 +46,7 @@ namespace WebCore {
 using namespace HTMLNames;
 
 inline HTMLEmbedElement::HTMLEmbedElement(const QualifiedName& tagName, Document* document, bool createdByParser)
-    : HTMLPlugInImageElement(tagName, document, createdByParser)
+    : HTMLPlugInImageElement(tagName, document, createdByParser, ShouldPreferPlugInsForImages)
 {
     ASSERT(hasTagName(embedTag));
 }
@@ -217,6 +217,10 @@ bool HTMLEmbedElement::rendererIsNeeded(RenderStyle* style)
 
 void HTMLEmbedElement::insertedIntoDocument()
 {
+    HTMLPlugInImageElement::insertedIntoDocument();
+    if (!inDocument())
+        return;
+
     if (document()->isHTMLDocument())
         static_cast<HTMLDocument*>(document())->addNamedItem(m_name);
 
@@ -233,8 +237,6 @@ void HTMLEmbedElement::insertedIntoDocument()
                 static_cast<HTMLObjectElement*>(n)->setAttribute(heightAttr, height);
         }
     }
-
-    HTMLPlugInImageElement::insertedIntoDocument();
 }
 
 void HTMLEmbedElement::removedFromDocument()
diff --git a/Source/WebCore/html/HTMLFormControlElement.cpp b/Source/WebCore/html/HTMLFormControlElement.cpp
index 4b3c48a..af061fe 100644
--- a/Source/WebCore/html/HTMLFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLFormControlElement.cpp
@@ -141,7 +141,7 @@ void HTMLFormControlElement::attach()
 
     if (autofocus() && renderer() && !document()->ignoreAutofocus() && !isReadOnlyFormControl() &&
             ((hasTagName(inputTag) && !isInputTypeHidden) || hasTagName(selectTag) ||
-              hasTagName(buttonTag) || hasTagName(textareaTag)))
+              hasTagName(keygenTag) || hasTagName(buttonTag) || hasTagName(textareaTag)))
          focus();
 }
 
@@ -547,6 +547,12 @@ HTMLTextFormControlElement::~HTMLTextFormControlElement()
 {
 }
 
+void HTMLTextFormControlElement::insertedIntoDocument()
+{
+    HTMLFormControlElement::insertedIntoDocument();
+    setTextAsOfLastFormControlChangeEvent(value());
+}
+
 void HTMLTextFormControlElement::dispatchFocusEvent()
 {
     if (supportsPlaceholder())
@@ -629,6 +635,15 @@ void HTMLTextFormControlElement::select()
     setSelectionRange(0, numeric_limits<int>::max());
 }
 
+void HTMLTextFormControlElement::dispatchFormControlChangeEvent()
+{
+    if (m_textAsOfLastFormControlChangeEvent != value()) {
+        HTMLElement::dispatchChangeEvents();
+        setTextAsOfLastFormControlChangeEvent(value());
+    }
+    setChangedSinceLastFormControlChangeEvent(false);
+}
+
 void HTMLTextFormControlElement::setSelectionRange(int start, int end)
 {
     WebCore::setSelectionRange(this, start, end);
diff --git a/Source/WebCore/html/HTMLFormControlElement.h b/Source/WebCore/html/HTMLFormControlElement.h
index 120313d..ede3299 100644
--- a/Source/WebCore/html/HTMLFormControlElement.h
+++ b/Source/WebCore/html/HTMLFormControlElement.h
@@ -194,6 +194,8 @@ public:
 
     virtual ~HTMLTextFormControlElement();
 
+    virtual void insertedIntoDocument();
+
     // The derived class should return true if placeholder processing is needed.
     virtual bool supportsPlaceholder() const = 0;
     String strippedPlaceholder() const;
@@ -207,6 +209,8 @@ public:
     void setSelectionRange(int start, int end);
     PassRefPtr<Range> selection() const;
 
+    virtual void dispatchFormControlChangeEvent();
+
     virtual int maxLength() const = 0;
     virtual String value() const = 0;
 
@@ -216,6 +220,7 @@ protected:
     void updatePlaceholderVisibility(bool);
 
     virtual void parseMappedAttribute(Attribute*);
+    virtual void setTextAsOfLastFormControlChangeEvent(String text) { m_textAsOfLastFormControlChangeEvent = text; }
 
 private:
     virtual void dispatchFocusEvent();
@@ -236,6 +241,8 @@ private:
     virtual void handleBlurEvent() { }
 
     RenderTextControl* textRendererAfterUpdateLayout();
+
+    String m_textAsOfLastFormControlChangeEvent;
 };
 
 } // namespace
diff --git a/Source/WebCore/html/HTMLFormElement.cpp b/Source/WebCore/html/HTMLFormElement.cpp
index 8535027..f051ea1 100644
--- a/Source/WebCore/html/HTMLFormElement.cpp
+++ b/Source/WebCore/html/HTMLFormElement.cpp
@@ -223,7 +223,12 @@ bool HTMLFormElement::validateInteractively(Event* event)
     Vector<RefPtr<FormAssociatedElement> > unhandledInvalidControls;
     if (!checkInvalidControlsAndCollectUnhandled(unhandledInvalidControls))
         return true;
-    // If the form has invalid controls, abort submission.
+    // Because the form has invalid controls, we abort the form submission and
+    // show a validation message on a focusable form control.
+
+    // Needs to update layout now because we'd like to call isFocusable(), which
+    // has !renderer()->needsLayout() assertion.
+    document()->updateLayoutIgnorePendingStylesheets();
 
     RefPtr<HTMLFormElement> protector(this);
     // Focus on the first focusable control and show a validation message.
diff --git a/Source/WebCore/html/HTMLFrameElementBase.cpp b/Source/WebCore/html/HTMLFrameElementBase.cpp
index cf079ea..08b6a64 100644
--- a/Source/WebCore/html/HTMLFrameElementBase.cpp
+++ b/Source/WebCore/html/HTMLFrameElementBase.cpp
@@ -283,4 +283,11 @@ void HTMLFrameElementBase::willRemove()
     HTMLFrameOwnerElement::willRemove();
 }
 
+#if ENABLE(FULLSCREEN_API)
+bool HTMLFrameElementBase::allowFullScreen() const
+{
+    return hasAttribute(webkitallowfullscreenAttr);
+}
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLFrameElementBase.h b/Source/WebCore/html/HTMLFrameElementBase.h
index e5f9c46..9922fd1 100644
--- a/Source/WebCore/html/HTMLFrameElementBase.h
+++ b/Source/WebCore/html/HTMLFrameElementBase.h
@@ -43,6 +43,9 @@ public:
     int height() const;
 
     void setRemainsAliveOnRemovalFromTree(bool);
+#if ENABLE(FULLSCREEN_API)
+    virtual bool allowFullScreen() const;
+#endif
 
 protected:
     HTMLFrameElementBase(const QualifiedName&, Document*);
diff --git a/Source/WebCore/html/HTMLFrameSetElement.cpp b/Source/WebCore/html/HTMLFrameSetElement.cpp
index 50f921b..0affef6 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.cpp
+++ b/Source/WebCore/html/HTMLFrameSetElement.cpp
@@ -49,9 +49,9 @@ HTMLFrameSetElement::HTMLFrameSetElement(const QualifiedName& tagName, Document*
     , m_border(6)
     , m_borderSet(false)
     , m_borderColorSet(false)
-    , frameborder(true)
-    , frameBorderSet(false)
-    , noresize(false)
+    , m_frameborder(true)
+    , m_frameborderSet(false)
+    , m_noresize(false)
 {
     ASSERT(hasTagName(framesetTag));
 }
@@ -87,21 +87,21 @@ void HTMLFrameSetElement::parseMappedAttribute(Attribute* attr)
         if (!attr->isNull()) {
             // false or "no" or "0"..
             if (attr->value().toInt() == 0) {
-                frameborder = false;
+                m_frameborder = false;
                 m_border = 0;
             }
-            frameBorderSet = true;
+            m_frameborderSet = true;
         } else {
-            frameborder = false;
-            frameBorderSet = false;
+            m_frameborder = false;
+            m_frameborderSet = false;
         }
     } else if (attr->name() == noresizeAttr) {
-        noresize = true;
+        m_noresize = true;
     } else if (attr->name() == borderAttr) {
         if (!attr->isNull()) {
             m_border = attr->value().toInt();
             if (!m_border)
-                frameborder = false;
+                m_frameborder = false;
             m_borderSet = true;
         } else
             m_borderSet = false;
@@ -169,16 +169,16 @@ void HTMLFrameSetElement::attach()
     for (ContainerNode* node = parentNode(); node; node = node->parentNode()) {
         if (node->hasTagName(framesetTag)) {
             HTMLFrameSetElement* frameset = static_cast<HTMLFrameSetElement*>(node);
-            if (!frameBorderSet)
-                frameborder = frameset->hasFrameBorder();
-            if (frameborder) {
+            if (!m_frameborderSet)
+                m_frameborder = frameset->hasFrameBorder();
+            if (m_frameborder) {
                 if (!m_borderSet)
                     m_border = frameset->border();
                 if (!m_borderColorSet)
                     m_borderColorSet = frameset->hasBorderColor();
             }
-            if (!noresize)
-                noresize = frameset->noResize();
+            if (!m_noresize)
+                m_noresize = frameset->noResize();
             break;
         }
     }
@@ -188,7 +188,7 @@ void HTMLFrameSetElement::attach()
 
 void HTMLFrameSetElement::defaultEventHandler(Event* evt)
 {
-    if (evt->isMouseEvent() && !noresize && renderer() && renderer()->isFrameSet()) {
+    if (evt->isMouseEvent() && !m_noresize && renderer() && renderer()->isFrameSet()) {
         if (toRenderFrameSet(renderer())->userResize(static_cast<MouseEvent*>(evt))) {
             evt->setDefaultHandled();
             return;
diff --git a/Source/WebCore/html/HTMLFrameSetElement.h b/Source/WebCore/html/HTMLFrameSetElement.h
index bdbec6a..f2f8439 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.h
+++ b/Source/WebCore/html/HTMLFrameSetElement.h
@@ -33,8 +33,8 @@ class HTMLFrameSetElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLFrameSetElement> create(const QualifiedName&, Document*);
 
-    bool hasFrameBorder() const { return frameborder; }
-    bool noResize() const { return noresize; }
+    bool hasFrameBorder() const { return m_frameborder; }
+    bool noResize() const { return m_noresize; }
 
     int totalRows() const { return m_totalRows; }
     int totalCols() const { return m_totalCols; }
@@ -92,9 +92,9 @@ private:
     
     bool m_borderColorSet;
 
-    bool frameborder;
-    bool frameBorderSet;
-    bool noresize;
+    bool m_frameborder;
+    bool m_frameborderSet;
+    bool m_noresize;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
index c5f1ebc..7ae6ad9 100644
--- a/Source/WebCore/html/HTMLInputElement.cpp
+++ b/Source/WebCore/html/HTMLInputElement.cpp
@@ -154,6 +154,17 @@ void HTMLInputElement::updateCheckedRadioButtons()
         renderer()->theme()->stateChanged(renderer(), CheckedState);
 }
 
+bool HTMLInputElement::lastChangeWasUserEdit() const
+{
+    if (!isTextField())
+        return false;
+    
+    if (!renderer())
+        return false;
+
+    return toRenderTextControl(renderer())->lastChangeWasUserEdit();
+}
+
 bool HTMLInputElement::isValidValue(const String& value) const
 {
     if (!m_inputType->canSetStringValue()) {
@@ -751,6 +762,7 @@ void HTMLInputElement::reset()
     if (m_inputType->storesValueSeparateFromAttribute())
         setValue(String());
 
+    setAutofilled(false);
     setChecked(hasAttribute(checkedAttr));
     m_reflectsCheckedAttribute = true;
 }
@@ -790,8 +802,10 @@ void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
     // unchecked to match other browsers. DOM is not a useful standard for this
     // because it says only to fire change events at "lose focus" time, which is
     // definitely wrong in practice for these types of elements.
-    if (sendChangeEvent && inDocument() && m_inputType->shouldSendChangeEventAfterCheckedChanged())
+    if (sendChangeEvent && inDocument() && m_inputType->shouldSendChangeEventAfterCheckedChanged()) {
+        setTextAsOfLastFormControlChangeEvent(String());
         dispatchFormControlChangeEvent();
+    }
 }
 
 void HTMLInputElement::setIndeterminate(bool newValue)
@@ -916,6 +930,9 @@ void HTMLInputElement::setValue(const String& value, bool sendChangeEvent)
             dispatchFormControlChangeEvent();
     }
 
+    if (isText() && (!focused() || !sendChangeEvent))
+        setTextAsOfLastFormControlChangeEvent(value);
+
     InputElement::notifyFormStateChanged(this);
 }
 
diff --git a/Source/WebCore/html/HTMLInputElement.h b/Source/WebCore/html/HTMLInputElement.h
index 27d556b..f2c2625 100644
--- a/Source/WebCore/html/HTMLInputElement.h
+++ b/Source/WebCore/html/HTMLInputElement.h
@@ -42,6 +42,8 @@ public:
 
     DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitspeechchange);
 
+    virtual InputElement* toInputElement() { return this; }
+
     bool autoComplete() const;
 
     // For ValidityState
@@ -197,6 +199,8 @@ public:
     void handleBeforeTextInsertedEvent(Event*);
     void updateCheckedRadioButtons();
 
+    bool lastChangeWasUserEdit() const;
+    
 protected:
     HTMLInputElement(const QualifiedName&, Document*, HTMLFormElement*, bool createdByParser);
 
diff --git a/Source/WebCore/html/HTMLLinkElement.cpp b/Source/WebCore/html/HTMLLinkElement.cpp
index 04cfda4..67262d9 100644
--- a/Source/WebCore/html/HTMLLinkElement.cpp
+++ b/Source/WebCore/html/HTMLLinkElement.cpp
@@ -145,6 +145,8 @@ void HTMLLinkElement::parseMappedAttribute(Attribute* attr)
 #if ENABLE(LINK_PREFETCH)
     else if (attr->name() == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onerrorAttr)
+        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attr));
 #endif
     else {
         if (attr->name() == titleAttr && m_sheet)
@@ -203,6 +205,17 @@ void HTMLLinkElement::tokenizeRelAttribute(const AtomicString& rel, RelAttribute
     }
 }
 
+bool HTMLLinkElement::checkBeforeLoadEvent()
+{
+    RefPtr<Document> originalDocument = document();
+    if (!dispatchBeforeLoadEvent(m_url))
+        return false;
+    // A beforeload handler might have removed us from the document or changed the document.
+    if (!inDocument() || document() != originalDocument)
+        return false;
+    return true;
+}
+
 void HTMLLinkElement::process()
 {
     if (!inDocument() || m_isInShadowTree) {
@@ -214,8 +227,11 @@ void HTMLLinkElement::process()
 
     // IE extension: location of small icon for locationbar / bookmarks
     // We'll record this URL per document, even if we later only use it in top level frames
-    if (m_relAttribute.m_isIcon && m_url.isValid() && !m_url.isEmpty())
+    if (m_relAttribute.m_isIcon && m_url.isValid() && !m_url.isEmpty()) {
+        if (!checkBeforeLoadEvent()) 
+            return;
         document()->setIconURL(m_url.string(), type);
+    }
 
 #ifdef ANDROID_APPLE_TOUCH_ICON
     if ((m_relAttribute.m_isTouchIcon || m_relAttribute.m_isPrecomposedTouchIcon) && m_url.isValid()
@@ -235,6 +251,8 @@ void HTMLLinkElement::process()
 
 #if ENABLE(LINK_PREFETCH)
     if (m_relAttribute.m_isLinkPrefetch && m_url.isValid() && document()->frame()) {
+        if (!checkBeforeLoadEvent())
+            return;
         m_cachedLinkPrefetch = document()->cachedResourceLoader()->requestLinkPrefetch(m_url);
         if (m_cachedLinkPrefetch)
             m_cachedLinkPrefetch->addClient(this);
@@ -256,11 +274,7 @@ void HTMLLinkElement::process()
             m_cachedSheet = 0;
         }
 
-        RefPtr<Document> originalDocument = document();
-        if (!dispatchBeforeLoadEvent(m_url))
-            return;
-        // A beforeload handler might have removed us from the document or changed the document.
-        if (!inDocument() || document() != originalDocument)
+        if (!checkBeforeLoadEvent())
             return;
 
         m_loading = true;
@@ -413,16 +427,19 @@ bool HTMLLinkElement::isLoading() const
 void HTMLLinkElement::onloadTimerFired(Timer<HTMLLinkElement>* timer)
 {
     ASSERT_UNUSED(timer, timer == &m_onloadTimer);
-    dispatchEvent(Event::create(eventNames().loadEvent, false, false));
+    if (m_cachedLinkPrefetch->errorOccurred())
+        dispatchEvent(Event::create(eventNames().errorEvent, false, false));
+    else
+        dispatchEvent(Event::create(eventNames().loadEvent, false, false));
+
+    m_cachedLinkPrefetch->removeClient(this);
+    m_cachedLinkPrefetch = 0;
 }
 
 void HTMLLinkElement::notifyFinished(CachedResource* resource)
 {
     m_onloadTimer.startOneShot(0);
-    if (m_cachedLinkPrefetch.get() == resource) {
-        m_cachedLinkPrefetch->removeClient(this);
-        m_cachedLinkPrefetch = 0;
-    }
+    ASSERT(m_cachedLinkPrefetch.get() == resource);
 }
 #endif
 
diff --git a/Source/WebCore/html/HTMLLinkElement.h b/Source/WebCore/html/HTMLLinkElement.h
index 3798c33..d31feeb 100644
--- a/Source/WebCore/html/HTMLLinkElement.h
+++ b/Source/WebCore/html/HTMLLinkElement.h
@@ -86,6 +86,7 @@ private:
 #if ENABLE(LINK_PREFETCH)
     void onloadTimerFired(Timer<HTMLLinkElement>*);
 #endif
+    bool checkBeforeLoadEvent();
     void process();
     static void processCallback(Node*);
 
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index ad0fdef..29c0cb8 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -227,8 +227,8 @@ void HTMLMediaElement::attributeChanged(Attribute* attr, bool preserveDecls)
             detach();
             attach();
         }
-        if (renderer())
-            renderer()->updateFromElement();
+        if (hasMediaControls())
+            mediaControls()->reset();
 #else
         if (m_player)
             m_player->setControls(controls());
@@ -907,6 +907,7 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
         if (m_networkState > NETWORK_IDLE) {
             m_progressEventTimer.stop();
             scheduleEvent(eventNames().suspendEvent);
+            setShouldDelayLoadEvent(false);
         }
         m_networkState = NETWORK_IDLE;
     }
@@ -1038,6 +1039,7 @@ void HTMLMediaElement::progressEventTimerFired(Timer<HTMLMediaElement>*)
         if (timedelta > 3.0 && !m_sentStalledEvent) {
             scheduleEvent(eventNames().stalledEvent);
             m_sentStalledEvent = true;
+            setShouldDelayLoadEvent(false);
         }
     } else {
         scheduleEvent(eventNames().progressEvent);
@@ -1311,7 +1313,7 @@ void HTMLMediaElement::setDefaultPlaybackRate(float rate)
 
 float HTMLMediaElement::playbackRate() const
 {
-    return m_player ? m_player->rate() : 0;
+    return m_playbackRate;
 }
 
 void HTMLMediaElement::setPlaybackRate(float rate)
@@ -1421,8 +1423,6 @@ void HTMLMediaElement::playInternal()
         seek(0, unused);
     }
     
-    setPlaybackRate(defaultPlaybackRate());
-    
     if (m_paused) {
         m_paused = false;
         invalidateCachedTime();
@@ -1536,8 +1536,8 @@ void HTMLMediaElement::setMuted(bool muted)
         if (!processingMediaPlayerCallback()) {
             if (m_player) {
                 m_player->setMuted(m_muted);
-                if (renderer())
-                    renderer()->updateFromElement();
+                if (hasMediaControls())
+                    mediaControls()->changedMute();
             }
         }
         scheduleEvent(eventNames().volumechangeEvent);
@@ -1550,9 +1550,10 @@ void HTMLMediaElement::togglePlayState()
 
     // We can safely call the internal play/pause methods, which don't check restrictions, because
     // this method is only called from the built-in media controller
-    if (canPlay())
+    if (canPlay()) {
+        setPlaybackRate(defaultPlaybackRate());
         playInternal();
-    else 
+    } else 
         pauseInternal();
 }
 
@@ -1604,7 +1605,9 @@ void HTMLMediaElement::playbackProgressTimerFired(Timer<HTMLMediaElement>*)
         return;
 
     scheduleTimeupdateEvent(true);
-    
+    if (hasMediaControls())
+        mediaControls()->playbackProgressed();
+
     // FIXME: deal with cue ranges here
 }
 
@@ -1929,7 +1932,7 @@ void HTMLMediaElement::mediaPlayerPlaybackStateChanged(MediaPlayer*)
 {
     LOG(Media, "HTMLMediaElement::mediaPlayerPlaybackStateChanged");
 
-    if (!m_player)
+    if (!m_player || m_pausedInternal)
         return;
 
     beginProcessingMediaPlayerCallback();
@@ -2111,9 +2114,9 @@ void HTMLMediaElement::updateVolume()
         m_player->setMuted(m_muted);
         m_player->setVolume(m_volume * volumeMultiplier);
     }
-    
-    if (renderer())
-        renderer()->updateFromElement();
+
+    if (hasMediaControls())
+        mediaControls()->changedVolume();
 }
 
 void HTMLMediaElement::updatePlayState()
@@ -2126,6 +2129,8 @@ void HTMLMediaElement::updatePlayState()
             m_player->pause();
         refreshCachedTime();
         m_playbackProgressTimer.stop();
+        if (hasMediaControls())
+            mediaControls()->playbackStopped();
         return;
     }
     
@@ -2149,6 +2154,8 @@ void HTMLMediaElement::updatePlayState()
             m_player->play();
         }
 
+        if (hasMediaControls())
+            mediaControls()->playbackStarted();
         startPlaybackProgressTimer();
         m_playing = true;
 
@@ -2165,6 +2172,9 @@ void HTMLMediaElement::updatePlayState()
 
         if (couldPlayIfEnoughData())
             m_player->prepareToPlay();
+
+        if (hasMediaControls())
+            mediaControls()->playbackStopped();
     }
     
     if (renderer())
@@ -2313,8 +2323,8 @@ void HTMLMediaElement::defaultEventHandler(Event* event)
     if (widget)
         widget->handleEvent(event);
 #else
-    if (renderer() && renderer()->isMedia())
-        toRenderMedia(renderer())->controls()->forwardEvent(event);
+    if (hasMediaControls())
+        mediaControls()->forwardEvent(event);
     if (event->defaultHandled())
         return;
     HTMLElement::defaultEventHandler(event);
@@ -2433,6 +2443,19 @@ void HTMLMediaElement::updateWidget(PluginCreationOption)
 
 #endif // ENABLE(PLUGIN_PROXY_FOR_VIDEO)
 
+bool HTMLMediaElement::isFullscreen() const
+{
+    if (m_isFullscreen)
+        return true;
+    
+#if ENABLE(FULLSCREEN_API)
+    if (document()->webkitIsFullScreen() && document()->webkitCurrentFullScreenElement() == this)
+        return true;
+#endif
+    
+    return false;
+}
+
 void HTMLMediaElement::enterFullscreen()
 {
     LOG(Media, "HTMLMediaElement::enterFullscreen");
@@ -2490,8 +2513,8 @@ void HTMLMediaElement::setClosedCaptionsVisible(bool closedCaptionVisible)
 
     m_closedCaptionsVisible = closedCaptionVisible;
     m_player->setClosedCaptionsVisible(closedCaptionVisible);
-    if (renderer())
-        renderer()->updateFromElement();
+    if (hasMediaControls())
+        mediaControls()->changedClosedCaptionsVisibility();
 }
 
 void HTMLMediaElement::setWebkitClosedCaptionsVisible(bool visible)
@@ -2581,6 +2604,17 @@ void HTMLMediaElement::privateBrowsingStateDidChange()
     m_player->setPrivateBrowsingMode(privateMode);
 }
 
+MediaControls* HTMLMediaElement::mediaControls()
+{
+    ASSERT(renderer());
+    return toRenderMedia(renderer())->controls();
+}
+
+bool HTMLMediaElement::hasMediaControls() const
+{
+    return renderer() && renderer()->isMedia();
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/html/HTMLMediaElement.h b/Source/WebCore/html/HTMLMediaElement.h
index f870586..ea958fa 100644
--- a/Source/WebCore/html/HTMLMediaElement.h
+++ b/Source/WebCore/html/HTMLMediaElement.h
@@ -41,6 +41,7 @@ namespace WebCore {
 
 class Event;
 class HTMLSourceElement;
+class MediaControls;
 class MediaError;
 class KURL;
 class TimeRanges;
@@ -163,7 +164,7 @@ public:
 
     bool hasSingleSecurityOrigin() const { return !m_player || m_player->hasSingleSecurityOrigin(); }
     
-    bool isFullscreen() const { return m_isFullscreen; }
+    bool isFullscreen() const;
     void enterFullscreen();
     void exitFullscreen();
 
@@ -171,6 +172,8 @@ public:
     bool closedCaptionsVisible() const;
     void setClosedCaptionsVisible(bool);
 
+    MediaControls* mediaControls();
+
     bool processingUserGesture() const;
 
     void sourceWillBeRemoved(HTMLSourceElement*);
@@ -179,13 +182,14 @@ public:
     void privateBrowsingStateDidChange();
 
     // Restrictions to change default behaviors.
-    enum BehaviorRestrictions {
+    enum BehaviorRestrictionFlags {
         NoRestrictions = 0,
         RequireUserGestureForLoadRestriction = 1 << 0,
         RequireUserGestureForRateChangeRestriction = 1 << 1,
         RequireUserGestureForFullScreenRestriction = 1 << 2
     };
-
+    typedef unsigned BehaviorRestrictions;
+    
     bool requireUserGestureForLoad() const { return m_restrictions & RequireUserGestureForLoadRestriction; }
     bool requireUserGestureForRateChange() const { return m_restrictions & RequireUserGestureForRateChangeRestriction; }
     bool requireUserGestureForFullScreen() const { return m_restrictions & RequireUserGestureForFullScreenRestriction; }
@@ -319,6 +323,8 @@ private:
     void invalidateCachedTime();
     void refreshCachedTime() const;
 
+    bool hasMediaControls() const;
+
     Timer<HTMLMediaElement> m_loadTimer;
     Timer<HTMLMediaElement> m_asyncEventTimer;
     Timer<HTMLMediaElement> m_progressEventTimer;
diff --git a/Source/WebCore/html/HTMLObjectElement.cpp b/Source/WebCore/html/HTMLObjectElement.cpp
index 0f05a3a..4f4d0a1 100644
--- a/Source/WebCore/html/HTMLObjectElement.cpp
+++ b/Source/WebCore/html/HTMLObjectElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
@@ -48,7 +48,7 @@ namespace WebCore {
 using namespace HTMLNames;
 
 inline HTMLObjectElement::HTMLObjectElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form, bool createdByParser) 
-    : HTMLPlugInImageElement(tagName, document, createdByParser)
+    : HTMLPlugInImageElement(tagName, document, createdByParser, ShouldNotPreferPlugInsForImages)
     , FormAssociatedElement(form)
     , m_docNamedItem(true)
     , m_useFallbackContent(false)
@@ -217,7 +217,7 @@ void HTMLObjectElement::parametersForPlugin(Vector<String>& paramNames, Vector<S
     // if we know that resource points to a plug-in.
     if (url.isEmpty() && !urlParameter.isEmpty()) {
         SubframeLoader* loader = document()->frame()->loader()->subframeLoader();
-        if (loader->resourceWillUsePlugin(urlParameter, serviceType))
+        if (loader->resourceWillUsePlugin(urlParameter, serviceType, shouldPreferPlugInsForImages()))
             url = urlParameter;
     }
 }
@@ -311,13 +311,16 @@ bool HTMLObjectElement::rendererIsNeeded(RenderStyle* style)
 
 void HTMLObjectElement::insertedIntoDocument()
 {
+    HTMLPlugInImageElement::insertedIntoDocument();
+    if (!inDocument())
+        return;
+
     if (isDocNamedItem() && document()->isHTMLDocument()) {
         HTMLDocument* document = static_cast<HTMLDocument*>(this->document());
         document->addNamedItem(m_name);
         document->addExtraNamedItem(m_id);
     }
 
-    HTMLPlugInImageElement::insertedIntoDocument();
     FormAssociatedElement::insertedIntoDocument();
 }
 
diff --git a/Source/WebCore/html/HTMLPlugInElement.cpp b/Source/WebCore/html/HTMLPlugInElement.cpp
index bf2722b..9d724d5 100644
--- a/Source/WebCore/html/HTMLPlugInElement.cpp
+++ b/Source/WebCore/html/HTMLPlugInElement.cpp
@@ -166,7 +166,7 @@ void HTMLPlugInElement::defaultEventHandler(Event* event)
 
     if (!r || !r->isWidget())
         return;
-    Widget* widget = toRenderWidget(r)->widget();
+    RefPtr<Widget> widget = toRenderWidget(r)->widget();
     if (!widget)
         return;
     widget->handleEvent(event);
diff --git a/Source/WebCore/html/HTMLPlugInImageElement.cpp b/Source/WebCore/html/HTMLPlugInImageElement.cpp
index db07334..f3a99dd 100644
--- a/Source/WebCore/html/HTMLPlugInImageElement.cpp
+++ b/Source/WebCore/html/HTMLPlugInImageElement.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,6 +25,7 @@
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "HTMLImageLoader.h"
+#include "HTMLNames.h"
 #include "Image.h"
 #include "Page.h"
 #include "RenderEmbeddedObject.h"
@@ -32,13 +33,14 @@
 
 namespace WebCore {
 
-HTMLPlugInImageElement::HTMLPlugInImageElement(const QualifiedName& tagName, Document* document, bool createdByParser)
+HTMLPlugInImageElement::HTMLPlugInImageElement(const QualifiedName& tagName, Document* document, bool createdByParser, PreferPlugInsForImagesOption preferPlugInsForImagesOption)
     : HTMLPlugInElement(tagName, document)
     // m_needsWidgetUpdate(!createdByParser) allows HTMLObjectElement to delay
     // widget updates until after all children are parsed.  For HTMLEmbedElement
     // this delay is unnecessary, but it is simpler to make both classes share
     // the same codepath in this class.
     , m_needsWidgetUpdate(!createdByParser)
+    , m_shouldPreferPlugInsForImages(preferPlugInsForImagesOption == ShouldPreferPlugInsForImages)
 {
 }
 
@@ -58,7 +60,7 @@ bool HTMLPlugInImageElement::isImageType()
 
     if (Frame* frame = document()->frame()) {
         KURL completedURL = frame->loader()->completeURL(m_url);
-        return frame->loader()->client()->objectContentType(completedURL, m_serviceType) == ObjectContentImage;
+        return frame->loader()->client()->objectContentType(completedURL, m_serviceType, shouldPreferPlugInsForImages()) == ObjectContentImage;
     }
 
     return Image::supportsType(m_serviceType);
@@ -99,7 +101,7 @@ bool HTMLPlugInImageElement::wouldLoadAsNetscapePlugin(const String& url, const
     if (!url.isEmpty())
         completedURL = frameLoader->completeURL(url);
 
-    if (frameLoader->client()->objectContentType(completedURL, serviceType) == ObjectContentNetscapePlugin)
+    if (frameLoader->client()->objectContentType(completedURL, serviceType, shouldPreferPlugInsForImages()) == ObjectContentNetscapePlugin)
         return true;
     return false;
 }
diff --git a/Source/WebCore/html/HTMLPlugInImageElement.h b/Source/WebCore/html/HTMLPlugInImageElement.h
index 364262b..c27c0f8 100644
--- a/Source/WebCore/html/HTMLPlugInImageElement.h
+++ b/Source/WebCore/html/HTMLPlugInImageElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -33,6 +33,11 @@ enum PluginCreationOption {
     CreateAnyWidgetType,
     CreateOnlyNonNetscapePlugins,
 };
+    
+enum PreferPlugInsForImagesOption {
+    ShouldPreferPlugInsForImages,
+    ShouldNotPreferPlugInsForImages
+};
 
 // Base class for HTMLObjectElement and HTMLEmbedElement
 class HTMLPlugInImageElement : public HTMLPlugInElement {
@@ -43,9 +48,10 @@ public:
 
     const String& serviceType() const { return m_serviceType; }
     const String& url() const { return m_url; }
+    bool shouldPreferPlugInsForImages() const { return m_shouldPreferPlugInsForImages; }
 
 protected:
-    HTMLPlugInImageElement(const QualifiedName& tagName, Document*, bool createdByParser);
+    HTMLPlugInImageElement(const QualifiedName& tagName, Document*, bool createdByParser, PreferPlugInsForImagesOption);
 
     bool isImageType();
 
@@ -75,6 +81,7 @@ private:
     virtual bool useFallbackContent() const { return false; }
     
     bool m_needsWidgetUpdate;
+    bool m_shouldPreferPlugInsForImages;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLScriptElement.cpp b/Source/WebCore/html/HTMLScriptElement.cpp
index 8e708d1..b56b375 100644
--- a/Source/WebCore/html/HTMLScriptElement.cpp
+++ b/Source/WebCore/html/HTMLScriptElement.cpp
@@ -58,6 +58,13 @@ void HTMLScriptElement::childrenChanged(bool changedByParser, Node* beforeChange
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
 
+void HTMLScriptElement::attributeChanged(Attribute* attr, bool preserveDecls)
+{
+    if (attr->name() == asyncAttr)
+        handleAsyncAttribute();
+    HTMLElement::attributeChanged(attr, preserveDecls);
+}
+
 void HTMLScriptElement::parseMappedAttribute(Attribute* attr)
 {
     const QualifiedName& attrName = attr->name();
@@ -102,6 +109,17 @@ void HTMLScriptElement::setText(const String &value)
     appendChild(document()->createTextNode(value.impl()), ec);
 }
 
+void HTMLScriptElement::setAsync(bool async)
+{
+    setBooleanAttribute(asyncAttr, async);
+    handleAsyncAttribute();
+}
+
+bool HTMLScriptElement::async() const
+{
+    return fastHasAttribute(asyncAttr) || forceAsync();
+}
+
 KURL HTMLScriptElement::src() const
 {
     return document()->completeURL(sourceAttributeValue());
diff --git a/Source/WebCore/html/HTMLScriptElement.h b/Source/WebCore/html/HTMLScriptElement.h
index efe6a6a..cbe7258 100644
--- a/Source/WebCore/html/HTMLScriptElement.h
+++ b/Source/WebCore/html/HTMLScriptElement.h
@@ -38,6 +38,9 @@ public:
 
     KURL src() const;
 
+    void setAsync(bool);
+    bool async() const;
+
 private:
     HTMLScriptElement(const QualifiedName&, Document*, bool wasInsertedByParser, bool alreadyStarted);
 
@@ -45,6 +48,7 @@ private:
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
+    virtual void attributeChanged(Attribute*, bool preserveDecls = false);
 
     virtual bool isURLAttribute(Attribute*) const;
 
diff --git a/Source/WebCore/html/HTMLScriptElement.idl b/Source/WebCore/html/HTMLScriptElement.idl
index 20b7331..fa799cb 100644
--- a/Source/WebCore/html/HTMLScriptElement.idl
+++ b/Source/WebCore/html/HTMLScriptElement.idl
@@ -24,7 +24,7 @@ module html {
         attribute [Reflect=for] DOMString htmlFor;
         attribute [Reflect] DOMString event;
         attribute [Reflect] DOMString charset;
-        attribute [Reflect] boolean async;
+        attribute boolean async;
         attribute [Reflect] boolean defer;
         attribute [Reflect, URL] DOMString src;
         attribute [Reflect] DOMString type;
diff --git a/Source/WebCore/html/HTMLSelectElement.cpp b/Source/WebCore/html/HTMLSelectElement.cpp
index d23e56a..69d3ffe 100644
--- a/Source/WebCore/html/HTMLSelectElement.cpp
+++ b/Source/WebCore/html/HTMLSelectElement.cpp
@@ -434,7 +434,12 @@ void HTMLSelectElement::accessKeySetSelectedIndex(int index)
     
 void HTMLSelectElement::setMultiple(bool multiple)
 {
+    int oldSelectedIndex = selectedIndex();
     setAttribute(multipleAttr, multiple ? "" : 0);
+
+    // Restore selectedIndex after changing the multiple flag to preserve
+    // selection as single-line and multi-line has different defaults.
+    setSelectedIndex(oldSelectedIndex);
 }
 
 void HTMLSelectElement::setSize(int size)
diff --git a/Source/WebCore/html/HTMLSummaryElement.cpp b/Source/WebCore/html/HTMLSummaryElement.cpp
index 96e3d74..9c2222a 100644
--- a/Source/WebCore/html/HTMLSummaryElement.cpp
+++ b/Source/WebCore/html/HTMLSummaryElement.cpp
@@ -21,7 +21,9 @@
 #include "config.h"
 #include "HTMLSummaryElement.h"
 
+#include "HTMLDetailsElement.h"
 #include "HTMLNames.h"
+#include "RenderSummary.h"
 
 namespace WebCore {
 
@@ -38,4 +40,9 @@ HTMLSummaryElement::HTMLSummaryElement(const QualifiedName& tagName, Document* d
     ASSERT(hasTagName(summaryTag));
 }
 
+RenderObject* HTMLSummaryElement::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    return new (arena) RenderSummary(this);
+}
+
 }
diff --git a/Source/WebCore/html/HTMLSummaryElement.h b/Source/WebCore/html/HTMLSummaryElement.h
index 1b24c67..1a93ee9 100644
--- a/Source/WebCore/html/HTMLSummaryElement.h
+++ b/Source/WebCore/html/HTMLSummaryElement.h
@@ -31,6 +31,8 @@ public:
 
 private:
     HTMLSummaryElement(const QualifiedName&, Document*);
+
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 };
 
 }
diff --git a/Source/WebCore/html/HTMLTextAreaElement.cpp b/Source/WebCore/html/HTMLTextAreaElement.cpp
index b8b04de..c8ec9ab 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.cpp
+++ b/Source/WebCore/html/HTMLTextAreaElement.cpp
@@ -295,6 +295,7 @@ void HTMLTextAreaElement::setValue(const String& value)
     setValueCommon(value);
     m_isDirty = true;
     setNeedsValidityCheck();
+    setTextAsOfLastFormControlChangeEvent(value);
 }
 
 void HTMLTextAreaElement::setNonDirtyValue(const String& value)
@@ -302,6 +303,7 @@ void HTMLTextAreaElement::setNonDirtyValue(const String& value)
     setValueCommon(value);
     m_isDirty = false;
     setNeedsValidityCheck();
+    setTextAsOfLastFormControlChangeEvent(value);
 }
 
 void HTMLTextAreaElement::setValueCommon(const String& value)
@@ -429,6 +431,13 @@ void HTMLTextAreaElement::setRows(int rows)
     setAttribute(rowsAttr, String::number(rows));
 }
 
+bool HTMLTextAreaElement::lastChangeWasUserEdit() const
+{
+    if (!renderer())
+        return false;
+    return toRenderTextControl(renderer())->lastChangeWasUserEdit();
+}
+
 bool HTMLTextAreaElement::shouldUseInputMethod() const
 {
     return true;
diff --git a/Source/WebCore/html/HTMLTextAreaElement.h b/Source/WebCore/html/HTMLTextAreaElement.h
index 21b5880..40193a0 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.h
+++ b/Source/WebCore/html/HTMLTextAreaElement.h
@@ -55,7 +55,9 @@ public:
     
     void setCols(int);
     void setRows(int);
-    
+
+    bool lastChangeWasUserEdit() const;
+
     void cacheSelection(int s, int e) { m_cachedSelectionStart = s; m_cachedSelectionEnd = e; };
 
 private:
diff --git a/Source/WebCore/html/HTMLTitleElement.cpp b/Source/WebCore/html/HTMLTitleElement.cpp
index 776c37c..78c8b6a 100644
--- a/Source/WebCore/html/HTMLTitleElement.cpp
+++ b/Source/WebCore/html/HTMLTitleElement.cpp
@@ -46,7 +46,7 @@ PassRefPtr<HTMLTitleElement> HTMLTitleElement::create(const QualifiedName& tagNa
 void HTMLTitleElement::insertedIntoDocument()
 {
     HTMLElement::insertedIntoDocument();
-    document()->setTitle(m_title, this);
+    document()->setTitleElement(m_title, this);
 }
 
 void HTMLTitleElement::removedFromDocument()
@@ -57,12 +57,9 @@ void HTMLTitleElement::removedFromDocument()
 
 void HTMLTitleElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    m_title = "";
-    for (Node* c = firstChild(); c != 0; c = c->nextSibling())
-        if (c->nodeType() == TEXT_NODE || c->nodeType() == CDATA_SECTION_NODE)
-            m_title += c->nodeValue();
+    m_title = text();
     if (inDocument())
-        document()->setTitle(m_title, this);
+        document()->setTitleElement(m_title, this);
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
 
diff --git a/Source/WebCore/html/NumberInputType.cpp b/Source/WebCore/html/NumberInputType.cpp
index 3397248..af30345 100644
--- a/Source/WebCore/html/NumberInputType.cpp
+++ b/Source/WebCore/html/NumberInputType.cpp
@@ -223,8 +223,9 @@ String NumberInputType::visibleValue() const
     if (currentValue.isEmpty())
         return currentValue;
     double doubleValue = numeric_limits<double>::quiet_NaN();
-    parseToDoubleForNumberType(currentValue, &doubleValue);
-    String localized = formatLocalizedNumber(doubleValue);
+    unsigned decimalPlace;
+    parseToDoubleForNumberTypeWithDecimalPlaces(currentValue, &doubleValue, &decimalPlace);
+    String localized = formatLocalizedNumber(doubleValue, decimalPlace);
     return localized.isEmpty() ? currentValue : localized;
 }
 
diff --git a/Source/WebCore/html/RangeInputType.cpp b/Source/WebCore/html/RangeInputType.cpp
index be7e0c6..cbec740 100644
--- a/Source/WebCore/html/RangeInputType.cpp
+++ b/Source/WebCore/html/RangeInputType.cpp
@@ -261,7 +261,7 @@ void RangeInputType::minOrMaxAttributeChanged()
 
 void RangeInputType::valueChanged()
 {
-    element()->shadowRoot()->setNeedsStyleRecalc();
+    toSliderThumbElement(element()->shadowRoot())->setPositionFromValue();
 }
 
 String RangeInputType::fallbackValue()
diff --git a/Source/WebCore/html/ValidationMessage.cpp b/Source/WebCore/html/ValidationMessage.cpp
index 70aa02d..59a1467 100644
--- a/Source/WebCore/html/ValidationMessage.cpp
+++ b/Source/WebCore/html/ValidationMessage.cpp
@@ -31,11 +31,15 @@
 #include "config.h"
 #include "ValidationMessage.h"
 
+#include "CSSPropertyNames.h"
 #include "CSSStyleSelector.h"
+#include "CSSValueKeywords.h"
 #include "FormAssociatedElement.h"
 #include "HTMLBRElement.h"
 #include "HTMLNames.h"
+#include "Page.h"
 #include "RenderObject.h"
+#include "Settings.h"
 #include "Text.h"
 #include <wtf/PassOwnPtr.h>
 
@@ -90,8 +94,13 @@ void ValidationMessage::setMessageDOMAndStartTimer(Timer<ValidationMessage>*)
         }
     }
 
-    m_timer.set(new Timer<ValidationMessage>(this, &ValidationMessage::deleteBubbleTree));
-    m_timer->startOneShot(max(5.0, m_message.length() / 20.0));
+    int magnification = doc->page() ? doc->page()->settings()->validationMessageTimerMaginification() : -1;
+    if (magnification <= 0)
+        m_timer.clear();
+    else {
+        m_timer.set(new Timer<ValidationMessage>(this, &ValidationMessage::deleteBubbleTree));
+        m_timer->startOneShot(max(5.0, static_cast<double>(m_message.length()) * magnification / 1000));
+    }
 }
 
 class ElementWithPseudoId : public HTMLElement {
@@ -116,6 +125,9 @@ void ValidationMessage::buildBubbleTree(Timer<ValidationMessage>*)
     HTMLElement* host = toHTMLElement(m_element);
     Document* doc = host->document();
     m_bubble = ElementWithPseudoId::create(doc, "-webkit-validation-bubble");
+    // Need to force position:absolute because RenderMenuList doesn't assume it
+    // contains non-absolute or non-fixed renderers as children.
+    m_bubble->getInlineStyleDecl()->setProperty(CSSPropertyPosition, CSSValueAbsolute);
     ExceptionCode ec = 0;
     // FIXME: We need a way to host multiple shadow roots in a single node, or
     // to inherit an existing shadow tree.
@@ -124,8 +136,9 @@ void ValidationMessage::buildBubbleTree(Timer<ValidationMessage>*)
     else
         host->setShadowRoot(m_bubble);
 
-    m_bubble->appendChild(ElementWithPseudoId::create(doc, "-webkit-validation-bubble-top-outer-arrow"), ec);
-    m_bubble->appendChild(ElementWithPseudoId::create(doc, "-webkit-validation-bubble-top-inner-arrow"), ec);
+    RefPtr<HTMLElement> clipper = ElementWithPseudoId::create(doc, "-webkit-validation-bubble-arrow-clipper");
+    clipper->appendChild(ElementWithPseudoId::create(doc, "-webkit-validation-bubble-arrow"), ec);
+    m_bubble->appendChild(clipper.release(), ec);
     m_bubbleMessage = ElementWithPseudoId::create(doc, "-webkit-validation-bubble-message");
     m_bubble->appendChild(m_bubbleMessage, ec);
 
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index a549782..f5ff078 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -146,7 +146,7 @@ CanvasRenderingContext2D::~CanvasRenderingContext2D()
 bool CanvasRenderingContext2D::isAccelerated() const
 {
 #if USE(IOSURFACE_CANVAS_BACKING_STORE)
-    return true;
+    return canvas()->document()->page()->settings()->canvasUsesAcceleratedDrawing();
 #elif ENABLE(ACCELERATED_2D_CANVAS)
     return m_context3D;
 #else
diff --git a/Source/WebCore/html/canvas/WebGLContextAttributes.cpp b/Source/WebCore/html/canvas/WebGLContextAttributes.cpp
index 6a47ea9..e36e04e 100644
--- a/Source/WebCore/html/canvas/WebGLContextAttributes.cpp
+++ b/Source/WebCore/html/canvas/WebGLContextAttributes.cpp
@@ -107,6 +107,16 @@ void WebGLContextAttributes::setPremultipliedAlpha(bool premultipliedAlpha)
     m_attrs.premultipliedAlpha = premultipliedAlpha;
 }
 
+bool WebGLContextAttributes::preserveDrawingBuffer() const
+{
+    return m_attrs.preserveDrawingBuffer;
+}
+
+void WebGLContextAttributes::setPreserveDrawingBuffer(bool preserveDrawingBuffer)
+{
+    m_attrs.preserveDrawingBuffer = preserveDrawingBuffer;
+}
+
 GraphicsContext3D::Attributes WebGLContextAttributes::attributes() const
 {
     return m_attrs;
diff --git a/Source/WebCore/html/canvas/WebGLContextAttributes.h b/Source/WebCore/html/canvas/WebGLContextAttributes.h
index a108605..5391a2b 100644
--- a/Source/WebCore/html/canvas/WebGLContextAttributes.h
+++ b/Source/WebCore/html/canvas/WebGLContextAttributes.h
@@ -65,6 +65,11 @@ class WebGLContextAttributes : public CanvasContextAttributes {
     bool premultipliedAlpha() const;
     void setPremultipliedAlpha(bool premultipliedAlpha);
 
+    // Whether or not to preserve the drawing buffer after presentation to the
+    // screen; default=false
+    bool preserveDrawingBuffer() const;
+    void setPreserveDrawingBuffer(bool);
+
     // Fetches a copy of the attributes stored in this object in a
     // form that can be used to initialize a GraphicsContext3D.
     GraphicsContext3D::Attributes attributes() const;
diff --git a/Source/WebCore/html/canvas/WebGLContextAttributes.idl b/Source/WebCore/html/canvas/WebGLContextAttributes.idl
index 0fa0c2c..56da1c6 100644
--- a/Source/WebCore/html/canvas/WebGLContextAttributes.idl
+++ b/Source/WebCore/html/canvas/WebGLContextAttributes.idl
@@ -34,5 +34,6 @@ module html {
         attribute boolean stencil;
         attribute boolean antialias;
         attribute boolean premultipliedAlpha;
+        attribute boolean preserveDrawingBuffer;
     };
 }
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
index cc7a23b..aa40a64 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -412,6 +412,13 @@ void WebGLRenderingContext::initializeNewContext()
     m_stencilFuncRefBack = 0;
     m_stencilFuncMask = 0xFFFFFFFF;
     m_stencilFuncMaskBack = 0xFFFFFFFF;
+    m_layerCleared = false;
+    
+    m_clearColor[0] = m_clearColor[1] = m_clearColor[2] = m_clearColor[3] = 0;
+    m_scissorEnabled = false;
+    m_clearDepth = 1;
+    m_clearStencil = 0;
+    m_colorMask[0] = m_colorMask[1] = m_colorMask[2] = m_colorMask[3] = true;
 
     GC3Dint numCombinedTextureImageUnits = 0;
     m_context->getIntegerv(GraphicsContext3D::MAX_COMBINED_TEXTURE_IMAGE_UNITS, &numCombinedTextureImageUnits);
@@ -472,6 +479,10 @@ WebGLRenderingContext::~WebGLRenderingContext()
 
 void WebGLRenderingContext::markContextChanged()
 {
+    if (m_framebufferBinding)
+        return;
+    m_context->markContextChanged();
+    m_layerCleared = false;
 #if USE(ACCELERATED_COMPOSITING)
     RenderBox* renderBox = canvas()->renderBox();
     if (renderBox && renderBox->hasLayer() && renderBox->layer()->hasAcceleratedCompositing())
@@ -486,15 +497,81 @@ void WebGLRenderingContext::markContextChanged()
     m_markedCanvasDirty = true;
 }
 
+bool WebGLRenderingContext::clearIfComposited(GC3Dbitfield mask)
+{
+    if (isContextLost()) 
+        return false;
+
+    RefPtr<WebGLContextAttributes> contextAttributes = getContextAttributes();
+
+    if (!m_context->layerComposited() || m_layerCleared
+        || m_attributes.preserveDrawingBuffer || m_framebufferBinding)
+        return false;
+
+    // Determine if it's possible to combine the clear the user asked for and this clear.
+    bool combinedClear = mask && !m_scissorEnabled;
+
+    m_context->disable(GraphicsContext3D::SCISSOR_TEST);
+    if (combinedClear && (mask & GraphicsContext3D::COLOR_BUFFER_BIT))
+        m_context->clearColor(m_colorMask[0] ? m_clearColor[0] : 0,
+                              m_colorMask[1] ? m_clearColor[1] : 0,
+                              m_colorMask[2] ? m_clearColor[2] : 0,
+                              m_colorMask[3] ? m_clearColor[3] : 0);
+    else
+        m_context->clearColor(0, 0, 0, 0);
+    m_context->colorMask(true, true, true, true);
+    if (contextAttributes->depth() && (!combinedClear || !(mask & GraphicsContext3D::DEPTH_BUFFER_BIT)))
+        m_context->clearDepth(1.0f);
+    if (contextAttributes->stencil() && (!combinedClear || !(mask & GraphicsContext3D::STENCIL_BUFFER_BIT)))
+        m_context->clearStencil(0);
+    GC3Dbitfield clearMask = GraphicsContext3D::COLOR_BUFFER_BIT;
+    if (contextAttributes->depth())
+        clearMask |= GraphicsContext3D::DEPTH_BUFFER_BIT;
+    if (contextAttributes->stencil())
+        clearMask |= GraphicsContext3D::STENCIL_BUFFER_BIT;
+    m_context->clear(clearMask);
+
+    // Restore the state that the context set.
+    if (m_scissorEnabled)
+        m_context->enable(GraphicsContext3D::SCISSOR_TEST);
+    m_context->clearColor(m_clearColor[0], m_clearColor[1],
+                          m_clearColor[2], m_clearColor[3]);
+    m_context->colorMask(m_colorMask[0], m_colorMask[1],
+                         m_colorMask[2], m_colorMask[3]);
+    m_context->clearDepth(m_clearDepth);
+    m_context->clearStencil(m_clearStencil);
+    m_layerCleared = true;
+
+    return combinedClear;
+}
+
+void WebGLRenderingContext::markLayerComposited()
+{
+    m_context->markLayerComposited();
+}
+
 void WebGLRenderingContext::paintRenderingResultsToCanvas()
 {
-    if (!m_markedCanvasDirty)
+    // Until the canvas is written to by the application, the clear that
+    // happened after it was composited should be ignored by the compositor.
+    if (m_context->layerComposited() && !m_attributes.preserveDrawingBuffer)
+        canvas()->makePresentationCopy();
+    else
+        canvas()->clearPresentationCopy();
+    clearIfComposited();
+    if (!m_markedCanvasDirty && !m_layerCleared)
         return;
     canvas()->clearCopiedImage();
     m_markedCanvasDirty = false;
     m_context->paintRenderingResultsToCanvas(this);
 }
 
+PassRefPtr<ImageData> WebGLRenderingContext::paintRenderingResultsToImageData()
+{
+    clearIfComposited();
+    return m_context->paintRenderingResultsToImageData();
+}
+
 bool WebGLRenderingContext::paintsIntoCanvasBuffer() const
 {
     return m_context->paintsIntoCanvasBuffer();
@@ -885,7 +962,8 @@ void WebGLRenderingContext::clear(GC3Dbitfield mask)
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION);
         return;
     }
-    m_context->clear(mask);
+    if (!clearIfComposited(mask))
+        m_context->clear(mask);
     cleanupAfterGraphicsCall(true);
 }
 
@@ -901,6 +979,10 @@ void WebGLRenderingContext::clearColor(GC3Dfloat r, GC3Dfloat g, GC3Dfloat b, GC
         b = 0;
     if (isnan(a))
         a = 1;
+    m_clearColor[0] = r;
+    m_clearColor[1] = g;
+    m_clearColor[2] = b;
+    m_clearColor[3] = a;
     m_context->clearColor(r, g, b, a);
     cleanupAfterGraphicsCall(false);
 }
@@ -909,6 +991,7 @@ void WebGLRenderingContext::clearDepth(GC3Dfloat depth)
 {
     if (isContextLost())
         return;
+    m_clearDepth = depth;
     m_context->clearDepth(depth);
     cleanupAfterGraphicsCall(false);
 }
@@ -917,6 +1000,7 @@ void WebGLRenderingContext::clearStencil(GC3Dint s)
 {
     if (isContextLost())
         return;
+    m_clearStencil = s;
     m_context->clearStencil(s);
     cleanupAfterGraphicsCall(false);
 }
@@ -925,6 +1009,10 @@ void WebGLRenderingContext::colorMask(GC3Dboolean red, GC3Dboolean green, GC3Dbo
 {
     if (isContextLost())
         return;
+    m_colorMask[0] = red;
+    m_colorMask[1] = green;
+    m_colorMask[2] = blue;
+    m_colorMask[3] = alpha;
     m_context->colorMask(red, green, blue, alpha);
     cleanupAfterGraphicsCall(false);
 }
@@ -959,6 +1047,7 @@ void WebGLRenderingContext::copyTexImage2D(GC3Denum target, GC3Dint level, GC3De
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION);
         return;
     }
+    clearIfComposited();
     if (isResourceSafe())
         m_context->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
     else {
@@ -1002,6 +1091,7 @@ void WebGLRenderingContext::copyTexSubImage2D(GC3Denum target, GC3Dint level, GC
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION);
         return;
     }
+    clearIfComposited();
     if (isResourceSafe())
         m_context->copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
     else {
@@ -1234,6 +1324,8 @@ void WebGLRenderingContext::disable(GC3Denum cap)
 {
     if (isContextLost() || !validateCapability(cap))
         return;
+    if (cap == GraphicsContext3D::SCISSOR_TEST)
+        m_scissorEnabled = false;
     m_context->disable(cap);
     cleanupAfterGraphicsCall(false);
 }
@@ -1479,6 +1571,8 @@ void WebGLRenderingContext::drawArrays(GC3Denum mode, GC3Dint first, GC3Dsizei c
         return;
     }
 
+    clearIfComposited();
+
     bool vertexAttrib0Simulated = false;
     if (!isGLES2Compliant())
         vertexAttrib0Simulated = simulateVertexAttrib0(first + count - 1);
@@ -1550,6 +1644,7 @@ void WebGLRenderingContext::drawElements(GC3Denum mode, GC3Dsizei count, GC3Denu
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_FRAMEBUFFER_OPERATION);
         return;
     }
+    clearIfComposited();
 
     bool vertexAttrib0Simulated = false;
     if (!isGLES2Compliant()) {
@@ -1571,6 +1666,8 @@ void WebGLRenderingContext::enable(GC3Denum cap)
 {
     if (isContextLost() || !validateCapability(cap))
         return;
+    if (cap == GraphicsContext3D::SCISSOR_TEST)
+        m_scissorEnabled = true;
     m_context->enable(cap);
     cleanupAfterGraphicsCall(false);
 }
@@ -1597,7 +1694,7 @@ void WebGLRenderingContext::finish()
     if (isContextLost())
         return;
     m_context->finish();
-    cleanupAfterGraphicsCall(true);
+    cleanupAfterGraphicsCall(false);
 }
 
 void WebGLRenderingContext::flush()
@@ -1605,7 +1702,7 @@ void WebGLRenderingContext::flush()
     if (isContextLost())
         return;
     m_context->flush();
-    cleanupAfterGraphicsCall(true);
+    cleanupAfterGraphicsCall(false);
 }
 
 void WebGLRenderingContext::framebufferRenderbuffer(GC3Denum target, GC3Denum attachment, GC3Denum renderbuffertarget, WebGLRenderbuffer* buffer, ExceptionCode& ec)
@@ -2752,6 +2849,7 @@ void WebGLRenderingContext::readPixels(GC3Dint x, GC3Dint y, GC3Dsizei width, GC
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
         return;
     }
+    clearIfComposited();
     void* data = pixels->baseAddress();
     m_context->readPixels(x, y, width, height, format, type, data);
 #if OS(DARWIN)
@@ -3062,8 +3160,12 @@ void WebGLRenderingContext::texImage2D(GC3Denum target, GC3Dint level, GC3Denum
         return;
     }
     checkOrigin(canvas);
-    texImage2DImpl(target, level, internalformat, format, type, canvas->copiedImage(),
-                   m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
+    RefPtr<ImageData> imageData = canvas->getImageData();
+    if (imageData)
+        texImage2D(target, level, internalformat, format, type, imageData.get(), ec);
+    else
+        texImage2DImpl(target, level, internalformat, format, type, canvas->copiedImage(),
+                       m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
 }
 
 #if ENABLE(VIDEO)
@@ -3252,8 +3354,12 @@ void WebGLRenderingContext::texSubImage2D(GC3Denum target, GC3Dint level, GC3Din
         return;
     }
     checkOrigin(canvas);
-    texSubImage2DImpl(target, level, xoffset, yoffset, format, type, canvas->copiedImage(),
-                      m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
+    RefPtr<ImageData> imageData = canvas->getImageData();
+    if (imageData)
+        texSubImage2D(target, level, xoffset, yoffset, format, type, imageData.get(), ec);
+    else
+        texSubImage2DImpl(target, level, xoffset, yoffset, format, type, canvas->copiedImage(),
+                          m_unpackFlipY, m_unpackPremultiplyAlpha, ec);
 }
 
 #if ENABLE(VIDEO)
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.h b/Source/WebCore/html/canvas/WebGLRenderingContext.h
index 13145c8..f716efb 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.h
@@ -285,7 +285,9 @@ public:
 
     void reshape(int width, int height);
 
+    void markLayerComposited();
     virtual void paintRenderingResultsToCanvas();
+    virtual PassRefPtr<ImageData> paintRenderingResultsToImageData();
 
     void removeObject(WebGLObject*);
     
@@ -443,6 +445,13 @@ public:
     bool m_contextLost;
     GraphicsContext3D::Attributes m_attributes;
 
+    bool m_layerCleared;
+    GC3Dfloat m_clearColor[4];
+    bool m_scissorEnabled;
+    GC3Dfloat m_clearDepth;
+    GC3Dint m_clearStencil;
+    GC3Dboolean m_colorMask[4];
+
     long m_stencilBits;
     GC3Duint m_stencilMask, m_stencilMaskBack;
     GC3Dint m_stencilFuncRef, m_stencilFuncRefBack; // Note that these are the user specified values, not the internal clamped value.
@@ -469,6 +478,11 @@ public:
     WebGLGetInfo getWebGLFloatArrayParameter(GC3Denum);
     WebGLGetInfo getWebGLIntArrayParameter(GC3Denum);
 
+    // Clear the backbuffer if it was composited since the last operation.
+    // clearMask is set to the bitfield of any clear that would happen anyway at this time
+    // and the function returns true if that clear is now unnecessary.
+    bool clearIfComposited(GC3Dbitfield clearMask = 0);
+
     void texImage2DBase(GC3Denum target, GC3Dint level, GC3Denum internalformat,
                         GC3Dsizei width, GC3Dsizei height, GC3Dint border,
                         GC3Denum format, GC3Denum type, void* pixels, ExceptionCode&);
diff --git a/Source/WebCore/html/parser/HTMLDocumentParser.cpp b/Source/WebCore/html/parser/HTMLDocumentParser.cpp
index e79a97a..88db3c2 100644
--- a/Source/WebCore/html/parser/HTMLDocumentParser.cpp
+++ b/Source/WebCore/html/parser/HTMLDocumentParser.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "HTMLDocumentParser.h"
 
+#include "ContentSecurityPolicy.h"
 #include "DocumentFragment.h"
 #include "Element.h"
 #include "Frame.h"
@@ -216,6 +217,13 @@ bool HTMLDocumentParser::canTakeNextToken(SynchronousMode mode, PumpSession& ses
 
     // The parser will pause itself when waiting on a script to load or run.
     if (m_treeBuilder->isPaused()) {
+        if (mode == AllowYield)
+            m_parserScheduler->checkForYieldBeforeScript(session);
+
+        // If we don't run the script, we cannot allow the next token to be taken.
+        if (session.needsYield)
+            return false;
+
         // If we're paused waiting for a script, we try to execute scripts before continuing.
         bool shouldContinueParsing = runScriptsForPausedTreeBuilder();
         m_treeBuilder->setPaused(!shouldContinueParsing);
@@ -242,7 +250,6 @@ bool HTMLDocumentParser::canTakeNextToken(SynchronousMode mode, PumpSession& ses
 void HTMLDocumentParser::pumpTokenizer(SynchronousMode mode)
 {
     ASSERT(!isStopped());
-    ASSERT(!m_treeBuilder->isPaused());
     ASSERT(!isScheduledForResume());
     // ASSERT that this object is both attached to the Document and protected.
     ASSERT(refCount() >= 2);
@@ -485,11 +492,6 @@ void HTMLDocumentParser::stopWatchingForLoad(CachedResource* cachedScript)
     cachedScript->removeClient(this);
 }
 
-bool HTMLDocumentParser::shouldLoadExternalScriptFromSrc(const AtomicString& srcValue)
-{
-    return document()->contentSecurityPolicy()->canLoadExternalScriptFromSrc(srcValue);
-}
-
 void HTMLDocumentParser::notifyFinished(CachedResource* cachedResource)
 {
     // pumpTokenizer can cause this parser to be detached from the Document,
diff --git a/Source/WebCore/html/parser/HTMLDocumentParser.h b/Source/WebCore/html/parser/HTMLDocumentParser.h
index 4bc33e4..a016cf3 100644
--- a/Source/WebCore/html/parser/HTMLDocumentParser.h
+++ b/Source/WebCore/html/parser/HTMLDocumentParser.h
@@ -108,7 +108,6 @@ private:
     // HTMLScriptRunnerHost
     virtual void watchForLoad(CachedResource*);
     virtual void stopWatchingForLoad(CachedResource*);
-    virtual bool shouldLoadExternalScriptFromSrc(const AtomicString&);
     virtual HTMLInputStream& inputStream() { return m_input; }
 
     // CachedResourceClient
diff --git a/Source/WebCore/html/parser/HTMLElementStack.cpp b/Source/WebCore/html/parser/HTMLElementStack.cpp
index 6f5f9ed..a4a7383 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.cpp
+++ b/Source/WebCore/html/parser/HTMLElementStack.cpp
@@ -50,7 +50,7 @@ inline bool isNumberedHeaderElement(ContainerNode* node)
         || node->hasTagName(h6Tag);
 }
     
-inline bool isRootMarker(ContainerNode* node)
+inline bool isRootNode(ContainerNode* node)
 {
     return node->nodeType() == Node::DOCUMENT_FRAGMENT_NODE
         || node->hasTagName(htmlTag);
@@ -74,7 +74,7 @@ inline bool isScopeMarker(ContainerNode* node)
         || node->hasTagName(SVGNames::foreignObjectTag)
         || node->hasTagName(SVGNames::descTag)
         || node->hasTagName(SVGNames::titleTag)
-        || isRootMarker(node);
+        || isRootNode(node);
 }
 
 inline bool isListItemScopeMarker(ContainerNode* node)
@@ -87,7 +87,7 @@ inline bool isListItemScopeMarker(ContainerNode* node)
 inline bool isTableScopeMarker(ContainerNode* node)
 {
     return node->hasTagName(tableTag)
-        || isRootMarker(node);
+        || isRootNode(node);
 }
 
 inline bool isTableBodyScopeMarker(ContainerNode* node)
@@ -95,26 +95,26 @@ inline bool isTableBodyScopeMarker(ContainerNode* node)
     return node->hasTagName(tbodyTag)
         || node->hasTagName(tfootTag)
         || node->hasTagName(theadTag)
-        || isRootMarker(node);
+        || isRootNode(node);
 }
 
 inline bool isTableRowScopeMarker(ContainerNode* node)
 {
     return node->hasTagName(trTag)
-        || isRootMarker(node);
+        || isRootNode(node);
 }
 
-inline bool isForeignContentScopeMarker(Element* element)
+inline bool isForeignContentScopeMarker(ContainerNode* node)
 {
-    return element->hasTagName(MathMLNames::miTag)
-        || element->hasTagName(MathMLNames::moTag)
-        || element->hasTagName(MathMLNames::mnTag)
-        || element->hasTagName(MathMLNames::msTag)
-        || element->hasTagName(MathMLNames::mtextTag)
-        || element->hasTagName(SVGNames::foreignObjectTag)
-        || element->hasTagName(SVGNames::descTag)
-        || element->hasTagName(SVGNames::titleTag)
-        || element->namespaceURI() == HTMLNames::xhtmlNamespaceURI;
+    return node->hasTagName(MathMLNames::miTag)
+        || node->hasTagName(MathMLNames::moTag)
+        || node->hasTagName(MathMLNames::mnTag)
+        || node->hasTagName(MathMLNames::msTag)
+        || node->hasTagName(MathMLNames::mtextTag)
+        || node->hasTagName(SVGNames::foreignObjectTag)
+        || node->hasTagName(SVGNames::descTag)
+        || node->hasTagName(SVGNames::titleTag)
+        || isInHTMLNamespace(node);
 }
 
 inline bool isButtonScopeMarker(ContainerNode* node)
@@ -275,7 +275,7 @@ void HTMLElementStack::popUntilTableRowScopeMarker()
 
 void HTMLElementStack::popUntilForeignContentScopeMarker()
 {
-    while (!isForeignContentScopeMarker(top()))
+    while (!isForeignContentScopeMarker(topNode()))
         pop();
 }
     
@@ -434,10 +434,10 @@ bool inScopeCommon(HTMLElementStack::ElementRecord* top, const AtomicString& tar
 bool HTMLElementStack::hasOnlyHTMLElementsInScope() const
 {
     for (ElementRecord* record = m_top.get(); record; record = record->next()) {
-        Element* element = record->element();
-        if (element->namespaceURI() != xhtmlNamespaceURI)
+        ContainerNode* node = record->node();
+        if (!isInHTMLNamespace(node))
             return false;
-        if (isScopeMarker(element))
+        if (isScopeMarker(node))
             return true;
     }
     ASSERT_NOT_REACHED(); // <html> is always on the stack and is a scope marker.
@@ -460,10 +460,10 @@ bool HTMLElementStack::hasNumberedHeaderElementInScope() const
 bool HTMLElementStack::inScope(Element* targetElement) const
 {
     for (ElementRecord* pos = m_top.get(); pos; pos = pos->next()) {
-        Element* element = pos->element();
-        if (element == targetElement)
+        ContainerNode* node = pos->node();
+        if (node == targetElement)
             return true;
-        if (isScopeMarker(element))
+        if (isScopeMarker(node))
             return false;
     }
     ASSERT_NOT_REACHED(); // <html> is always on the stack and is a scope marker.
diff --git a/Source/WebCore/html/parser/HTMLElementStack.h b/Source/WebCore/html/parser/HTMLElementStack.h
index a710932..fd0e494 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.h
+++ b/Source/WebCore/html/parser/HTMLElementStack.h
@@ -28,6 +28,7 @@
 #define HTMLElementStack_h
 
 #include "Element.h"
+#include "HTMLNames.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
@@ -167,6 +168,15 @@ private:
     Element* m_headElement;
     Element* m_bodyElement;
 };
+    
+inline bool isInHTMLNamespace(Node* node)
+{
+    // A DocumentFragment takes the place of the document element when parsing
+    // fragments and should be considered in the HTML namespace.
+    return node->namespaceURI() == HTMLNames::xhtmlNamespaceURI
+        || node->nodeType() == Node::DOCUMENT_FRAGMENT_NODE;
+}
+
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/html/parser/HTMLParserScheduler.cpp b/Source/WebCore/html/parser/HTMLParserScheduler.cpp
index c4525c8..393c4be 100644
--- a/Source/WebCore/html/parser/HTMLParserScheduler.cpp
+++ b/Source/WebCore/html/parser/HTMLParserScheduler.cpp
@@ -86,6 +86,16 @@ void HTMLParserScheduler::continueNextChunkTimerFired(Timer<HTMLParserScheduler>
     m_parser->resumeParsingAfterYield();
 }
 
+void HTMLParserScheduler::checkForYieldBeforeScript(PumpSession& session)
+{
+    // If we've never painted before and a layout is pending, yield prior to running
+    // scripts to give the page a chance to paint earlier.
+    Document* document = m_parser->document();
+    bool needsFirstPaint = document->view() && !document->view()->hasEverPainted();
+    if (needsFirstPaint && document->isLayoutTimerActive())
+        session.needsYield = true;
+}
+
 void HTMLParserScheduler::scheduleForResume()
 {
     m_continueNextChunkTimer.startOneShot(0);
diff --git a/Source/WebCore/html/parser/HTMLParserScheduler.h b/Source/WebCore/html/parser/HTMLParserScheduler.h
index 9aa12eb..730b52b 100644
--- a/Source/WebCore/html/parser/HTMLParserScheduler.h
+++ b/Source/WebCore/html/parser/HTMLParserScheduler.h
@@ -70,6 +70,7 @@ public:
         }
         ++session.processedTokens;
     }
+    void checkForYieldBeforeScript(PumpSession&);
 
     void scheduleForResume();
     bool isScheduledForResume() const { return m_isSuspendedWithActiveTimer || m_continueNextChunkTimer.isActive(); }
diff --git a/Source/WebCore/html/parser/HTMLPreloadScanner.cpp b/Source/WebCore/html/parser/HTMLPreloadScanner.cpp
index d23542f..5514597 100644
--- a/Source/WebCore/html/parser/HTMLPreloadScanner.cpp
+++ b/Source/WebCore/html/parser/HTMLPreloadScanner.cpp
@@ -30,6 +30,7 @@
 
 #include "CachedResourceLoader.h"
 #include "Document.h"
+#include "InputType.h"
 #include "HTMLDocumentParser.h"
 #include "HTMLTokenizer.h"
 #include "HTMLLinkElement.h"
@@ -50,13 +51,17 @@ public:
         : m_tagName(token.name().data(), token.name().size())
         , m_linkIsStyleSheet(false)
         , m_linkMediaAttributeIsScreen(true)
+        , m_inputIsImage(false)
     {
         processAttributes(token.attributes());
     }
 
     void processAttributes(const HTMLToken::AttributeList& attributes)
     {
-        if (m_tagName != scriptTag && m_tagName != imgTag && m_tagName != linkTag)
+        if (m_tagName != imgTag
+            && m_tagName != inputTag
+            && m_tagName != linkTag
+            && m_tagName != scriptTag)
             return;
 
         for (HTMLToken::AttributeList::const_iterator iter = attributes.begin();
@@ -77,6 +82,11 @@ public:
                     m_linkIsStyleSheet = relAttributeIsStyleSheet(attributeValue);
                 else if (attributeName == mediaAttr)
                     m_linkMediaAttributeIsScreen = linkMediaAttributeIsScreen(attributeValue);
+            } else if (m_tagName == inputTag) {
+                if (attributeName == srcAttr)
+                    setUrlToLoad(attributeValue);
+                else if (attributeName == typeAttr)
+                    m_inputIsImage = equalIgnoringCase(attributeValue, InputTypeNames::image());
             }
         }
     }
@@ -87,7 +97,7 @@ public:
         HTMLLinkElement::tokenizeRelAttribute(attributeValue, rel);
         return rel.m_isStyleSheet && !rel.m_isAlternate && !rel.m_isIcon && !rel.m_isDNSPrefetch;
     }
-    
+
     static bool linkMediaAttributeIsScreen(const String& attributeValue)
     {
         if (attributeValue.isEmpty())
@@ -118,7 +128,7 @@ public:
         CachedResourceLoader* cachedResourceLoader = document->cachedResourceLoader();
         if (m_tagName == scriptTag)
             cachedResourceLoader->preload(CachedResource::Script, m_urlToLoad, m_charset, scanningBody);
-        else if (m_tagName == imgTag) 
+        else if (m_tagName == imgTag || (m_tagName == inputTag && m_inputIsImage))
             cachedResourceLoader->preload(CachedResource::ImageResource, m_urlToLoad, String(), scanningBody);
         else if (m_tagName == linkTag && m_linkIsStyleSheet && m_linkMediaAttributeIsScreen) 
             cachedResourceLoader->preload(CachedResource::CSSStyleSheet, m_urlToLoad, m_charset, scanningBody);
@@ -132,6 +142,7 @@ private:
     String m_charset;
     bool m_linkIsStyleSheet;
     bool m_linkMediaAttributeIsScreen;
+    bool m_inputIsImage;
 };
 
 } // namespace
diff --git a/Source/WebCore/html/parser/HTMLScriptRunnerHost.h b/Source/WebCore/html/parser/HTMLScriptRunnerHost.h
index 5b40a931..454bc6f 100644
--- a/Source/WebCore/html/parser/HTMLScriptRunnerHost.h
+++ b/Source/WebCore/html/parser/HTMLScriptRunnerHost.h
@@ -44,8 +44,6 @@ public:
     // Implementors must call cachedResource->removeClient() immediately.
     virtual void stopWatchingForLoad(CachedResource*) = 0;
 
-    // Implementors can block certain script loads (for XSSAuditor, etc.)
-    virtual bool shouldLoadExternalScriptFromSrc(const AtomicString&) = 0;
     virtual HTMLInputStream& inputStream() = 0;
 };
 
diff --git a/Source/WebCore/html/parser/HTMLToken.h b/Source/WebCore/html/parser/HTMLToken.h
index aa16ab2..49ec312 100644
--- a/Source/WebCore/html/parser/HTMLToken.h
+++ b/Source/WebCore/html/parser/HTMLToken.h
@@ -398,27 +398,7 @@ public:
         case HTMLToken::EndTag: {
             m_selfClosing = token.selfClosing();
             m_name = AtomicString(token.name().data(), token.name().size());
-            const HTMLToken::AttributeList& attributes = token.attributes();
-            for (HTMLToken::AttributeList::const_iterator iter = attributes.begin();
-                 iter != attributes.end(); ++iter) {
-                if (!iter->m_name.isEmpty()) {
-                    String name(iter->m_name.data(), iter->m_name.size());
-                    String value(iter->m_value.data(), iter->m_value.size());
-                    ASSERT(iter->m_nameRange.m_start);
-                    ASSERT(iter->m_nameRange.m_end);
-                    ASSERT(iter->m_valueRange.m_start);
-                    ASSERT(iter->m_valueRange.m_end);
-                    RefPtr<Attribute> mappedAttribute = Attribute::createMapped(name, value);
-                    if (!m_attributes) {
-                        m_attributes = NamedNodeMap::create();
-                        // Reserving capacity here improves the parser
-                        // benchmark.  It might be worth experimenting with
-                        // the constant to see where the optimal point is.
-                        m_attributes->reserveInitialCapacity(10);
-                    }
-                    m_attributes->insertAttribute(mappedAttribute.release(), false);
-                }
-            }
+            initializeAttributes(token.attributes());
             break;
         }
         case HTMLToken::Comment:
@@ -513,6 +493,8 @@ public:
 private:
     HTMLToken::Type m_type;
 
+    void initializeAttributes(const HTMLToken::AttributeList& attributes);
+    
     bool usesName() const
     {
         return m_type == HTMLToken::StartTag || m_type == HTMLToken::EndTag || m_type == HTMLToken::DOCTYPE;
@@ -548,6 +530,30 @@ private:
     RefPtr<NamedNodeMap> m_attributes;
 };
 
+inline void AtomicHTMLToken::initializeAttributes(const HTMLToken::AttributeList& attributes)
+{
+    size_t size = attributes.size();
+    if (!size)
+        return;
+
+    m_attributes = NamedNodeMap::create();
+    m_attributes->reserveInitialCapacity(size);
+    for (size_t i = 0; i < size; ++i) {
+        const HTMLToken::Attribute& attribute = attributes[i];
+        if (attribute.m_name.isEmpty())
+            continue;
+
+        ASSERT(attribute.m_nameRange.m_start);
+        ASSERT(attribute.m_nameRange.m_end);
+        ASSERT(attribute.m_valueRange.m_start);
+        ASSERT(attribute.m_valueRange.m_end);
+
+        String name(attribute.m_name.data(), attribute.m_name.size());
+        String value(attribute.m_value.data(), attribute.m_value.size());
+        m_attributes->insertAttribute(Attribute::createMapped(name, value), false);
+    }
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
index 8f9e3e1..6db09de 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -125,7 +125,7 @@ bool isSpecialNode(Node* node)
         return true;
     if (node->nodeType() == Node::DOCUMENT_FRAGMENT_NODE)
         return true;
-    if (node->namespaceURI() != xhtmlNamespaceURI)
+    if (!isInHTMLNamespace(node))
         return false;
     const AtomicString& tagName = node->localName();
     return tagName == addressTag
@@ -445,7 +445,7 @@ void HTMLTreeBuilder::constructTreeFromAtomicToken(AtomicHTMLToken& token)
     // the U+0000 characters into replacement characters has compatibility
     // problems.
     m_parser->tokenizer()->setForceNullCharacterReplacement(m_insertionMode == TextMode || m_insertionMode == InForeignContentMode);
-    m_parser->tokenizer()->setShouldAllowCDATA(m_insertionMode == InForeignContentMode && m_tree.currentNode()->namespaceURI() != xhtmlNamespaceURI);
+    m_parser->tokenizer()->setShouldAllowCDATA(m_insertionMode == InForeignContentMode && !isInHTMLNamespace(m_tree.currentNode()));
 }
 
 void HTMLTreeBuilder::processToken(AtomicHTMLToken& token)
@@ -984,7 +984,7 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         adjustMathMLAttributes(token);
         adjustForeignAttributes(token);
         m_tree.insertForeignElement(token, MathMLNames::mathmlNamespaceURI);
-        if (m_insertionMode != InForeignContentMode)
+        if (m_insertionMode != InForeignContentMode && !token.selfClosing())
             setInsertionMode(InForeignContentMode);
         return;
     }
@@ -993,7 +993,7 @@ void HTMLTreeBuilder::processStartTagForInBody(AtomicHTMLToken& token)
         adjustSVGAttributes(token);
         adjustForeignAttributes(token);
         m_tree.insertForeignElement(token, SVGNames::svgNamespaceURI);
-        if (m_insertionMode != InForeignContentMode)
+        if (m_insertionMode != InForeignContentMode && !token.selfClosing())
             setInsertionMode(InForeignContentMode);
         return;
     }
@@ -1125,7 +1125,7 @@ bool shouldProcessForeignContentUsingInBodyInsertionMode(AtomicHTMLToken& token,
         || currentElement->hasTagName(SVGNames::descTag)
         || currentElement->hasTagName(SVGNames::titleTag))
         return true;
-    return currentElement->namespaceURI() == HTMLNames::xhtmlNamespaceURI;
+    return isInHTMLNamespace(currentElement);
 }
 
 }
@@ -1451,7 +1451,7 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
         processStartTag(token);
         break;
     case InForeignContentMode: {
-        if (shouldProcessForeignContentUsingInBodyInsertionMode(token, m_tree.currentElement())) {
+        if (shouldProcessForeignContentUsingInBodyInsertionMode(token, m_tree.currentNode())) {
             processForeignContentUsingInBodyModeAndResetMode(token);
             return;
         }
@@ -2297,7 +2297,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
             notImplemented();
             return;
         }
-        if (m_tree.currentNode()->namespaceURI() != xhtmlNamespaceURI) {
+        if (!isInHTMLNamespace(m_tree.currentNode())) {
             // FIXME: This code just wants an Element* iterator, instead of an ElementRecord*
             HTMLElementStack::ElementRecord* nodeRecord = m_tree.openElements()->topRecord();
             if (!nodeRecord->node()->hasLocalName(token.name()))
@@ -2310,12 +2310,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
                 }
                 nodeRecord = nodeRecord->next();
                 
-                if (nodeRecord->node()->nodeType() == Node::DOCUMENT_FRAGMENT_NODE) {
-                    ASSERT(isParsingFragment());
-                    break;
-                }
-                
-                if (nodeRecord->node()->namespaceURI() == xhtmlNamespaceURI)
+                if (isInHTMLNamespace(nodeRecord->node()))
                     break;
             }
         }
diff --git a/Source/WebCore/html/shadow/MediaControls.cpp b/Source/WebCore/html/shadow/MediaControls.cpp
index 61a3684..20f1abb 100644
--- a/Source/WebCore/html/shadow/MediaControls.cpp
+++ b/Source/WebCore/html/shadow/MediaControls.cpp
@@ -52,12 +52,10 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-static const double cTimeUpdateRepeatDelay = 0.2;
 static const double cOpacityAnimationRepeatDelay = 0.05;
 
 MediaControls::MediaControls(HTMLMediaElement* mediaElement)
     : m_mediaElement(mediaElement)
-    , m_timeUpdateTimer(this, &MediaControls::timeUpdateTimerFired)
     , m_opacityAnimationTimer(this, &MediaControls::opacityAnimationTimerFired)
     , m_opacityAnimationStartTime(0)
     , m_opacityAnimationDuration(0)
@@ -70,6 +68,137 @@ MediaControls::MediaControls(HTMLMediaElement* mediaElement)
 {
 }
 
+// FIXME: This will turn into the standard element factory method once shadow DOM conversion is complete.
+// (see https://bugs.webkit.org/show_bug.cgi?id=53020)
+PassRefPtr<MediaControlShadowRootElement> MediaControls::create(HTMLMediaElement* mediaElement)
+{
+    ASSERT(!m_panel);
+    ASSERT(!m_muteButton);
+    ASSERT(!m_playButton);
+    ASSERT(!m_returnToRealtimeButton);
+    ASSERT(!m_statusDisplay);
+    ASSERT(!m_timelineContainer);
+    ASSERT(!m_currentTimeDisplay);
+    ASSERT(!m_timeline);
+    ASSERT(!m_timeRemainingDisplay);
+    ASSERT(!m_seekBackButton);
+    ASSERT(!m_seekForwardButton);
+    ASSERT(!m_toggleClosedCaptionsButton);
+    ASSERT(!m_fullscreenButton);
+    ASSERT(!m_muteButton);
+    ASSERT(!m_volumeSliderContainer);
+    ASSERT(!m_volumeSlider);
+    ASSERT(!m_volumeSliderMuteButton);
+    ASSERT(!m_fullScreenMinVolumeButton);
+    ASSERT(!m_fullScreenMaxVolumeButton);
+    ASSERT(!m_fullScreenVolumeSlider);
+
+    RefPtr<MediaControlShadowRootElement> controls = MediaControlShadowRootElement::create(mediaElement);
+
+    m_panel = MediaControlPanelElement::create(mediaElement);
+
+    m_rewindButton = MediaControlRewindButtonElement::create(mediaElement);
+    m_rewindButton->attachToParent(m_panel.get());
+
+    m_playButton = MediaControlPlayButtonElement::create(mediaElement);
+    m_playButton->attachToParent(m_panel.get());
+
+    m_returnToRealtimeButton = MediaControlReturnToRealtimeButtonElement::create(mediaElement);
+    m_returnToRealtimeButton->attachToParent(m_panel.get());
+
+    m_statusDisplay = MediaControlStatusDisplayElement::create(mediaElement);
+    m_statusDisplay->attachToParent(m_panel.get());
+
+    m_timelineContainer = MediaControlTimelineContainerElement::create(mediaElement);
+
+    m_currentTimeDisplay = MediaControlCurrentTimeDisplayElement::create(mediaElement);
+    m_currentTimeDisplay->attachToParent(m_timelineContainer.get());
+
+    m_timeline = MediaControlTimelineElement::create(mediaElement);
+    m_timeline->attachToParent(m_timelineContainer.get());
+
+    m_timeRemainingDisplay = MediaControlTimeRemainingDisplayElement::create(mediaElement);
+    m_timeRemainingDisplay->attachToParent(m_timelineContainer.get());
+
+    m_timelineContainer->attachToParent(m_panel.get());
+
+    m_seekBackButton = MediaControlSeekBackButtonElement::create(mediaElement);
+    m_seekBackButton->attachToParent(m_panel.get());
+
+    m_seekForwardButton = MediaControlSeekForwardButtonElement::create(mediaElement);
+    m_seekForwardButton->attachToParent(m_panel.get());
+
+    m_toggleClosedCaptionsButton = MediaControlToggleClosedCaptionsButtonElement::create(mediaElement);
+    m_toggleClosedCaptionsButton->attachToParent(m_panel.get());
+
+    m_fullscreenButton = MediaControlFullscreenButtonElement::create(mediaElement);
+    m_fullscreenButton->attachToParent(m_panel.get());
+
+    m_muteButton = MediaControlPanelMuteButtonElement::create(mediaElement);
+    m_muteButton->attachToParent(m_panel.get());
+
+    m_volumeSliderContainer = MediaControlVolumeSliderContainerElement::create(mediaElement);
+
+    m_volumeSlider = MediaControlVolumeSliderElement::create(mediaElement);
+    m_volumeSlider->attachToParent(m_volumeSliderContainer.get());
+
+    m_volumeSliderMuteButton = MediaControlVolumeSliderMuteButtonElement::create(mediaElement);
+    m_volumeSliderMuteButton->attachToParent(m_volumeSliderContainer.get());
+
+    m_volumeSliderContainer->attachToParent(m_panel.get());
+    
+    // FIXME: These controls, and others, should be created dynamically when needed, instead of 
+    // always created.  <http://webkit.org/b/57163>
+    m_fullScreenMinVolumeButton = MediaControlFullscreenVolumeMinButtonElement::create(mediaElement);
+    m_fullScreenMinVolumeButton->attachToParent(m_panel.get());
+    
+    m_fullScreenVolumeSlider = MediaControlFullscreenVolumeSliderElement::create(mediaElement);
+    m_fullScreenVolumeSlider->attachToParent(m_panel.get());
+    
+    m_fullScreenMaxVolumeButton = MediaControlFullscreenVolumeMaxButtonElement::create(mediaElement);
+    m_fullScreenMaxVolumeButton->attachToParent(m_panel.get());
+    
+    m_panel->attachToParent(controls.get());
+    return controls.release();
+}
+
+void MediaControls::reset()
+{
+    update();
+}
+
+void MediaControls::playbackProgressed()
+{
+    if (m_timeline)
+        m_timeline->update(false);
+    updateTimeDisplay();
+}
+
+void MediaControls::playbackStarted()
+{
+    playbackProgressed();
+}
+
+void MediaControls::playbackStopped()
+{
+    playbackProgressed();
+}
+
+void MediaControls::changedMute()
+{
+    update();
+}
+
+void MediaControls::changedVolume()
+{
+    update();
+}
+
+void MediaControls::changedClosedCaptionsVisibility()
+{
+    update();
+}
+
 void MediaControls::updateStyle()
 {
     if (!m_controlsShadowRoot)
@@ -109,6 +238,12 @@ void MediaControls::updateStyle()
         m_volumeSliderMuteButton->updateStyle();
     if (m_volumeSlider)
         m_volumeSlider->updateStyle();
+    if (m_fullScreenMinVolumeButton)
+        m_fullScreenMinVolumeButton->updateStyle();
+    if (m_fullScreenVolumeSlider)
+        m_fullScreenVolumeSlider->updateStyle();
+    if (m_fullScreenMaxVolumeButton)
+        m_fullScreenMaxVolumeButton->updateStyle();
 }
 
 void MediaControls::destroy()
@@ -151,46 +286,19 @@ void MediaControls::update()
             m_volumeSliderMuteButton = 0;
             m_controlsShadowRoot = 0;
             m_toggleClosedCaptionsButton = 0;
+            m_fullScreenMinVolumeButton = 0;
+            m_fullScreenVolumeSlider = 0;
+            m_fullScreenMaxVolumeButton = 0;
         }
         m_opacityAnimationTo = 1.0f;
         m_opacityAnimationTimer.stop();
-        m_timeUpdateTimer.stop();
         return;
     }
 
     if (!m_controlsShadowRoot) {
-        createControlsShadowRoot();
-        createPanel();
-        if (m_panel) {
-            createRewindButton();
-            createPlayButton();
-            createReturnToRealtimeButton();
-            createStatusDisplay();
-            createTimelineContainer();
-            if (m_timelineContainer) {
-                createCurrentTimeDisplay();
-                createTimeline();
-                createTimeRemainingDisplay();
-            }
-            createSeekBackButton();
-            createSeekForwardButton();
-            createToggleClosedCaptionsButton();
-            createFullscreenButton();
-            createMuteButton();
-            createVolumeSliderContainer();
-            if (m_volumeSliderContainer) {
-                createVolumeSlider();
-                createVolumeSliderMuteButton();
-            }
-            m_panel->attach();
-        }
-    }
-
-    if (media->canPlay()) {
-        if (m_timeUpdateTimer.isActive())
-            m_timeUpdateTimer.stop();
-    } else if (media->renderer()->style()->visibility() == VISIBLE && m_timeline && m_timeline->renderer() && m_timeline->renderer()->style()->display() != NONE) {
-        m_timeUpdateTimer.startRepeating(cTimeUpdateRepeatDelay);
+        m_controlsShadowRoot = create(m_mediaElement);
+        m_mediaElement->renderer()->addChild(m_controlsShadowRoot->renderer());
+        m_panel->attach();
     }
 
     if (m_panel) {
@@ -232,148 +340,16 @@ void MediaControls::update()
         m_volumeSlider->update();
     if (m_volumeSliderMuteButton)
         m_volumeSliderMuteButton->update();
-
+    if (m_fullScreenMinVolumeButton)
+        m_fullScreenMinVolumeButton->update();
+    if (m_fullScreenVolumeSlider)
+        m_fullScreenVolumeSlider->update();
+    if (m_fullScreenMaxVolumeButton)
+        m_fullScreenMaxVolumeButton->update();
     updateTimeDisplay();
     updateControlVisibility();
 }
 
-void MediaControls::createControlsShadowRoot()
-{
-    ASSERT(!m_controlsShadowRoot);
-    m_controlsShadowRoot = MediaControlShadowRootElement::create(m_mediaElement);
-    m_mediaElement->renderer()->addChild(m_controlsShadowRoot->renderer());
-}
-
-void MediaControls::createPanel()
-{
-    ASSERT(!m_panel);
-    m_panel = MediaControlPanelElement::create(m_mediaElement);
-    m_panel->attachToParent(m_controlsShadowRoot.get());
-}
-
-void MediaControls::createMuteButton()
-{
-    ASSERT(!m_muteButton);
-    m_muteButton = MediaControlPanelMuteButtonElement::create(m_mediaElement);
-    m_muteButton->attachToParent(m_panel.get());
-}
-
-void MediaControls::createPlayButton()
-{
-    ASSERT(!m_playButton);
-    m_playButton = MediaControlPlayButtonElement::create(m_mediaElement);
-    m_playButton->attachToParent(m_panel.get());
-}
-
-void MediaControls::createSeekBackButton()
-{
-    ASSERT(!m_seekBackButton);
-    m_seekBackButton = MediaControlSeekBackButtonElement::create(m_mediaElement);
-    m_seekBackButton->attachToParent(m_panel.get());
-}
-
-void MediaControls::createSeekForwardButton()
-{
-    ASSERT(!m_seekForwardButton);
-    m_seekForwardButton = MediaControlSeekForwardButtonElement::create(m_mediaElement);
-    m_seekForwardButton->attachToParent(m_panel.get());
-}
-
-void MediaControls::createRewindButton()
-{
-    ASSERT(!m_rewindButton);
-    m_rewindButton = MediaControlRewindButtonElement::create(m_mediaElement);
-    m_rewindButton->attachToParent(m_panel.get());
-}
-
-void MediaControls::createReturnToRealtimeButton()
-{
-    ASSERT(!m_returnToRealtimeButton);
-    m_returnToRealtimeButton = MediaControlReturnToRealtimeButtonElement::create(m_mediaElement);
-    m_returnToRealtimeButton->attachToParent(m_panel.get());
-}
-
-void MediaControls::createToggleClosedCaptionsButton()
-{
-    ASSERT(!m_toggleClosedCaptionsButton);
-    m_toggleClosedCaptionsButton = MediaControlToggleClosedCaptionsButtonElement::create(m_mediaElement);
-    m_toggleClosedCaptionsButton->attachToParent(m_panel.get());
-}
-
-void MediaControls::createStatusDisplay()
-{
-    ASSERT(!m_statusDisplay);
-    m_statusDisplay = MediaControlStatusDisplayElement::create(m_mediaElement);
-    m_statusDisplay->attachToParent(m_panel.get());
-}
-
-void MediaControls::createTimelineContainer()
-{
-    ASSERT(!m_timelineContainer);
-    m_timelineContainer = MediaControlTimelineContainerElement::create(m_mediaElement);
-    m_timelineContainer->attachToParent(m_panel.get());
-}
-
-void MediaControls::createTimeline()
-{
-    ASSERT(!m_timeline);
-    m_timeline = MediaControlTimelineElement::create(m_mediaElement);
-    m_timeline->setAttribute(precisionAttr, "float");
-    m_timeline->attachToParent(m_timelineContainer.get());
-}
-
-void MediaControls::createVolumeSliderContainer()
-{
-    ASSERT(!m_volumeSliderContainer);
-    m_volumeSliderContainer = MediaControlVolumeSliderContainerElement::create(m_mediaElement);
-    m_volumeSliderContainer->attachToParent(m_panel.get());
-}
-
-void MediaControls::createVolumeSlider()
-{
-    ASSERT(!m_volumeSlider);
-    m_volumeSlider = MediaControlVolumeSliderElement::create(m_mediaElement);
-    m_volumeSlider->setAttribute(precisionAttr, "float");
-    m_volumeSlider->setAttribute(maxAttr, "1");
-    m_volumeSlider->setAttribute(valueAttr, String::number(m_mediaElement->volume()));
-    m_volumeSlider->attachToParent(m_volumeSliderContainer.get());
-}
-
-void MediaControls::createVolumeSliderMuteButton()
-{
-    ASSERT(!m_volumeSliderMuteButton);
-    m_volumeSliderMuteButton = MediaControlVolumeSliderMuteButtonElement::create(m_mediaElement);
-    m_volumeSliderMuteButton->attachToParent(m_volumeSliderContainer.get());
-}
-
-void MediaControls::createCurrentTimeDisplay()
-{
-    ASSERT(!m_currentTimeDisplay);
-    m_currentTimeDisplay = MediaControlCurrentTimeDisplayElement::create(m_mediaElement);
-    m_currentTimeDisplay->attachToParent(m_timelineContainer.get());
-}
-
-void MediaControls::createTimeRemainingDisplay()
-{
-    ASSERT(!m_timeRemainingDisplay);
-    m_timeRemainingDisplay = MediaControlTimeRemainingDisplayElement::create(m_mediaElement);
-    m_timeRemainingDisplay->attachToParent(m_timelineContainer.get());
-}
-
-void MediaControls::createFullscreenButton()
-{
-    ASSERT(!m_fullscreenButton);
-    m_fullscreenButton = MediaControlFullscreenButtonElement::create(m_mediaElement);
-    m_fullscreenButton->attachToParent(m_panel.get());
-}
-
-void MediaControls::timeUpdateTimerFired(Timer<MediaControls>*)
-{
-    if (m_timeline)
-        m_timeline->update(false);
-    updateTimeDisplay();
-}
-
 void MediaControls::updateTimeDisplay()
 {
     ASSERT(m_mediaElement->renderer());
@@ -480,13 +456,6 @@ void MediaControls::updateVolumeSliderContainer(bool visible)
             return;
 
         RefPtr<RenderStyle> s = m_volumeSliderContainer->styleForElement();
-        int height = s->height().isPercent() ? 0 : s->height().value();
-        int width = s->width().isPercent() ? 0 : s->width().value();
-        IntPoint offset = m_mediaElement->document()->page()->theme()->volumeSliderOffsetFromMuteButton(m_muteButton->renderBox(), IntSize(width, height));
-        int x = offset.x() + m_muteButton->renderBox()->offsetLeft();
-        int y = offset.y() + m_muteButton->renderBox()->offsetTop();
-
-        m_volumeSliderContainer->setPosition(x, y);
         m_volumeSliderContainer->setVisible(true);
         m_volumeSliderContainer->update();
         m_volumeSlider->update();
@@ -588,6 +557,7 @@ void MediaControls::forwardEvent(Event* event)
 #endif
 }
 
+<<<<<<< HEAD
 // We want the timeline slider to be at least 100 pixels wide.
 static const int minWidthToDisplayTimeDisplays = 16 + 16 + 45 + 100 + 45 + 16 + 1;
 
@@ -612,6 +582,8 @@ void MediaControls::updateLastTouch()
 }
 #endif
 
+=======
+>>>>>>> webkit.org at r82507
 }
 
 #endif
diff --git a/Source/WebCore/html/shadow/MediaControls.h b/Source/WebCore/html/shadow/MediaControls.h
index a4fbbd6..726573e 100644
--- a/Source/WebCore/html/shadow/MediaControls.h
+++ b/Source/WebCore/html/shadow/MediaControls.h
@@ -53,6 +53,9 @@ class MediaControlStatusDisplayElement;
 class MediaControlTimelineContainerElement;
 class MediaControlVolumeSliderContainerElement;
 class MediaControlElement;
+class MediaControlFullscreenVolumeMinButtonElement;
+class MediaControlFullscreenVolumeSliderElement;
+class MediaControlFullscreenVolumeMaxButtonElement;
 class MediaPlayer;
 
 class RenderBox;
@@ -62,12 +65,21 @@ class MediaControls {
 public:
     MediaControls(HTMLMediaElement*);
 
+    void reset();
+
+    void playbackProgressed();
+    void playbackStarted();
+    void playbackStopped();
+
+    void changedMute();
+    void changedVolume();
+    void changedClosedCaptionsVisibility();
+
     void destroy();
     void update();
     void updateStyle();
     void forwardEvent(Event*);
     void updateTimeDisplay();
-    void updateTimeDisplayVisibility();
 
     // FIXME: This is temporary to allow RenderMedia::layout tweak the position of controls.
     // Once shadow DOM refactoring is complete, the tweaking will be in MediaControlsShadowRoot and this accessor will no longer be necessary.
@@ -78,27 +90,7 @@ public:
 #endif
 
 private:
-    void createControlsShadowRoot();
-    void destroyControlsShadowRoot();
-    void createPanel();
-    void createMuteButton();
-    void createPlayButton();
-    void createSeekBackButton();
-    void createSeekForwardButton();
-    void createRewindButton();
-    void createReturnToRealtimeButton();
-    void createToggleClosedCaptionsButton();
-    void createStatusDisplay();
-    void createTimelineContainer();
-    void createTimeline();
-    void createVolumeSliderContainer();
-    void createVolumeSlider();
-    void createVolumeSliderMuteButton();
-    void createCurrentTimeDisplay();
-    void createTimeRemainingDisplay();
-    void createFullscreenButton();
-
-    void timeUpdateTimerFired(Timer<MediaControls>*);
+    PassRefPtr<MediaControlShadowRootElement> create(HTMLMediaElement*);
 
     void updateControlVisibility();
     void changeOpacity(HTMLElement*, float opacity);
@@ -125,9 +117,11 @@ private:
     RefPtr<MediaControlTimeDisplayElement> m_currentTimeDisplay;
     RefPtr<MediaControlTimeDisplayElement> m_timeRemainingDisplay;
     RefPtr<MediaControlStatusDisplayElement> m_statusDisplay;
+    RefPtr<MediaControlFullscreenVolumeMinButtonElement> m_fullScreenMinVolumeButton;
+    RefPtr<MediaControlFullscreenVolumeSliderElement> m_fullScreenVolumeSlider;
+    RefPtr<MediaControlFullscreenVolumeMaxButtonElement> m_fullScreenMaxVolumeButton;
 
     HTMLMediaElement* m_mediaElement;
-    Timer<MediaControls> m_timeUpdateTimer;
     Timer<MediaControls> m_opacityAnimationTimer;
 
     double m_opacityAnimationStartTime;
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.cpp b/Source/WebCore/html/shadow/SliderThumbElement.cpp
index 2c049cb..d1aa15e 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.cpp
+++ b/Source/WebCore/html/shadow/SliderThumbElement.cpp
@@ -56,6 +56,8 @@ namespace WebCore {
 class RenderSliderThumb : public RenderBlock {
 public:
     RenderSliderThumb(Node*);
+
+private:
     virtual void layout();
 };
 
@@ -85,6 +87,16 @@ void RenderSliderThumb::layout()
     RenderBlock::layout();
 }
 
+void SliderThumbElement::setPositionFromValue()
+{
+    // Since today the code to calculate position is in the RenderSlider layout
+    // path, we don't actually update the value here. Instead, we poke at the
+    // renderer directly to trigger layout.
+    // FIXME: Move the logic of positioning the thumb here.
+    if (renderer())
+        renderer()->setNeedsLayout(true);
+}
+
 RenderObject* SliderThumbElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     return new (arena) RenderSliderThumb(this);
@@ -92,11 +104,11 @@ RenderObject* SliderThumbElement::createRenderer(RenderArena* arena, RenderStyle
 
 void SliderThumbElement::dragFrom(const IntPoint& point)
 {
-    setPosition(point);
+    setPositionFromPoint(point);
     startDragging();
 }
 
-void SliderThumbElement::setPosition(const IntPoint& point)
+void SliderThumbElement::setPositionFromPoint(const IntPoint& point)
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowHost());
     ASSERT(input);
@@ -212,6 +224,7 @@ void SliderThumbElement::defaultEventHandler(Event* event)
 #endif
             ) {
         if (m_inDragMode)
+<<<<<<< HEAD
 #if PLATFORM(ANDROID) && ENABLE(TOUCH_EVENTS)
         {
             if (event->isMouseEvent()) {
@@ -233,6 +246,9 @@ void SliderThumbElement::defaultEventHandler(Event* event)
 
         }
 #endif
+=======
+            setPositionFromPoint(mouseEvent->absoluteLocation());
+>>>>>>> webkit.org at r82507
         return;
     }
 
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.h b/Source/WebCore/html/shadow/SliderThumbElement.h
index 7c4c179..9414ac4 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.h
+++ b/Source/WebCore/html/shadow/SliderThumbElement.h
@@ -49,6 +49,7 @@ public:
     static PassRefPtr<SliderThumbElement> create(Document*);
 
     bool inDragMode() const { return m_inDragMode; }
+    void setPositionFromValue();
 
     void dragFrom(const IntPoint&);
     virtual void defaultEventHandler(Event*);
@@ -60,7 +61,7 @@ private:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     void startDragging();
     void stopDragging();
-    void setPosition(const IntPoint&);
+    void setPositionFromPoint(const IntPoint&);
 
     FloatPoint m_offsetToThumb;
     bool m_inDragMode;
diff --git a/Source/WebCore/inspector/CodeGeneratorInspector.pm b/Source/WebCore/inspector/CodeGeneratorInspector.pm
index 70eb61d..ea65f2e 100644
--- a/Source/WebCore/inspector/CodeGeneratorInspector.pm
+++ b/Source/WebCore/inspector/CodeGeneratorInspector.pm
@@ -13,71 +13,77 @@ my %typeTransform;
 $typeTransform{"ApplicationCache"} = {
     "forward" => "InspectorApplicationCacheAgent",
     "header" => "InspectorApplicationCacheAgent.h",
-    "domainAccessor" => "m_inspectorAgent->applicationCacheAgent()",
+    "domainAccessor" => "m_applicationCacheAgent",
 };
 $typeTransform{"CSS"} = {
     "forward" => "InspectorCSSAgent",
     "header" => "InspectorCSSAgent.h",
-    "domainAccessor" => "m_inspectorAgent->cssAgent()",
+    "domainAccessor" => "m_cssAgent",
 };
 $typeTransform{"Console"} = {
     "forward" => "InspectorConsoleAgent",
     "header" => "InspectorConsoleAgent.h",
-    "domainAccessor" => "m_inspectorAgent->consoleAgent()",
+    "domainAccessor" => "m_consoleAgent",
+};
+$typeTransform{"Page"} = {
+    "forward" => "InspectorPageAgent",
+    "header" => "InspectorPageAgent.h",
+    "domainAccessor" => "m_pageAgent",
 };
 $typeTransform{"Debugger"} = {
     "forward" => "InspectorDebuggerAgent",
     "header" => "InspectorDebuggerAgent.h",
-    "domainAccessor" => "m_inspectorAgent->debuggerAgent()",
+    "domainAccessor" => "m_debuggerAgent",
 };
 $typeTransform{"BrowserDebugger"} = {
     "forward" => "InspectorBrowserDebuggerAgent",
     "header" => "InspectorBrowserDebuggerAgent.h",
-    "domainAccessor" => "m_inspectorAgent->browserDebuggerAgent()",
+    "domainAccessor" => "m_browserDebuggerAgent",
 };
 $typeTransform{"Database"} = {
     "forward" => "InspectorDatabaseAgent",
     "header" => "InspectorDatabaseAgent.h",
-    "domainAccessor" => "m_inspectorAgent->databaseAgent()",
+    "domainAccessor" => "m_databaseAgent",
 };
 $typeTransform{"DOM"} = {
     "forward" => "InspectorDOMAgent",
     "header" => "InspectorDOMAgent.h",
-    "domainAccessor" => "m_inspectorAgent->domAgent()",
+    "domainAccessor" => "m_domAgent",
 };
 $typeTransform{"DOMStorage"} = {
     "forward" => "InspectorDOMStorageAgent",
     "header" => "InspectorDOMStorageAgent.h",
-    "domainAccessor" => "m_inspectorAgent->domStorageAgent()",
+    "domainAccessor" => "m_domStorageAgent",
 };
 $typeTransform{"FileSystem"} = {
     "forward" => "InspectorFileSystemAgent",
     "header" => "InspectorFileSystemAgent.h",
-    "domainAccessor" => "m_inspectorAgent->fileSystemAgent()",
+    "domainAccessor" => "m_fileSystemAgent",
 };
 $typeTransform{"Inspector"} = {
-    "forwardHeader" => "InspectorAgent.h",
+    "forward" => "InspectorAgent",
+    "header" => "InspectorAgent.h",
     "domainAccessor" => "m_inspectorAgent",
 };
 $typeTransform{"Network"} = {
     "forward" => "InspectorResourceAgent",
     "header" => "InspectorResourceAgent.h",
-    "domainAccessor" => "m_inspectorAgent->resourceAgent()",
+    "domainAccessor" => "m_resourceAgent",
 };
 $typeTransform{"Profiler"} = {
     "forward" => "InspectorProfilerAgent",
     "header" => "InspectorProfilerAgent.h",
-    "domainAccessor" => "m_inspectorAgent->profilerAgent()",
+    "domainAccessor" => "m_profilerAgent",
 };
 $typeTransform{"Runtime"} = {
     "forward" => "InspectorRuntimeAgent",
     "header" => "InspectorRuntimeAgent.h",
-    "domainAccessor" => "m_inspectorAgent->runtimeAgent()",
+    "domainAccessor" => "m_runtimeAgent",
 };
 $typeTransform{"Timeline"} = {
     "forward" => "InspectorTimelineAgent",
     "header" => "InspectorTimelineAgent.h",
-    "domainAccessor" => "m_inspectorAgent->timelineAgent()",
+    "domainAccessor" => "m_timelineAgent",
 };
 
 $typeTransform{"Frontend"} = {
@@ -215,8 +221,9 @@ my %backendMethodSignatures;
 my $backendConstructor;
 my @backendConstantDeclarations;
 my @backendConstantDefinitions;
-my $backendFooter;
+my @backendFooter;
 my @backendJSStubs;
+my %backendDomains;
 
 my $frontendClassName;
 my %frontendTypes;
@@ -269,13 +276,6 @@ sub GenerateModule
 
     $backendClassName = "InspectorBackendDispatcher";
     $backendJSStubName = "InspectorBackendStub";
-    my @backendHead;
-    push(@backendHead, "    ${backendClassName}(InspectorAgent* inspectorAgent) : m_inspectorAgent(inspectorAgent) { }");
-    push(@backendHead, "    void reportProtocolError(const long callId, const String& errorText) const;");
-    push(@backendHead, "    void dispatch(const String& message);");
-    push(@backendHead, "    static bool getCommandName(const String& message, String* result);");
-    $backendConstructor = join("\n", @backendHead);
-    $backendFooter = "    InspectorAgent* m_inspectorAgent;";
     $backendTypes{"Inspector"} = 1;
     $backendTypes{"InspectorClient"} = 1;
     $backendTypes{"PassRefPtr"} = 1;
@@ -418,7 +418,6 @@ sub generateDocumentationEvent
 
     push(@lines, "<pre style='background: lightGrey; padding: 10px'>");
     push(@lines, "{");
-    push(@lines, "    seq: &lt;number&gt;,");
     push(@lines, "    type: \"event\",");
     push(@lines, "    domain: \"$domain\",");
     if (scalar(@argsFiltered)) {
@@ -476,12 +475,16 @@ sub generateBackendFunction
     my $domain = $interface->name;
     my $domainAccessor = typeTraits($domain, "domainAccessor");
     $backendTypes{$domain} = 1;
+    $backendDomains{$domain} = 1;
     push(@function, "    if (!$domainAccessor)");
     push(@function, "        protocolErrors->pushString(\"Protocol Error: $domain handler is not available.\");");
     push(@function, "");
 
     # declare local variables for out arguments.
     push(@function, map("    " . typeTraits($_->type, "variable") . " " . $_->name . " = " . typeTraits($_->type, "defaultValue") . ";", @outArgs));
+    push(@function, "");
+    push(@function, "    ErrorString error;");
+    push(@function, "");
 
     my $indent = "";
     if (scalar(@inArgs)) {
@@ -497,12 +500,9 @@ sub generateBackendFunction
         $indent = "    ";
     }
 
-    push(@function, "$indent    ErrorString error;");
     my $args = join(", ", ("&error", map($_->name, @inArgs), map("&" . $_->name, @outArgs)));
     push(@function, "$indent    if (!protocolErrors->length())");
     push(@function, "$indent        $domainAccessor->$functionName($args);");
-    push(@function, "$indent    if (error.length())");
-    push(@function, "$indent        protocolErrors->pushString(error);");
     if (scalar(@inArgs)) {
         push(@function, "    } else {");
         push(@function, "        protocolErrors->pushString(\"Protocol Error: 'arguments' property with type 'object' was not found.\");");
@@ -510,20 +510,22 @@ sub generateBackendFunction
     }
 
     push(@function, "    // use InspectorFrontend as a marker of WebInspector availability");
-    push(@function, "    if ((callId || protocolErrors->length()) && m_inspectorAgent->hasFrontend()) {");
+    push(@function, "    if (callId || protocolErrors->length()) {");
     push(@function, "        RefPtr<InspectorObject> responseMessage = InspectorObject::create();");
-    push(@function, "        responseMessage->setNumber(\"seq\", callId);");
+    push(@function, "        responseMessage->setNumber(\"requestId\", callId);");
     push(@function, "");
     push(@function, "        if (protocolErrors->length())");
-    push(@function, "            responseMessage->setArray(\"errors\", protocolErrors);");
+    push(@function, "            responseMessage->setArray(\"protocolErrors\", protocolErrors);");
     if (scalar(@outArgs)) {
         push(@function, "        else {");
+        push(@function, "            if (error.length())");
+        push(@function, "                responseMessage->setString(\"error\", error);");
         push(@function, "            RefPtr<InspectorObject> responseBody = InspectorObject::create();");
         push(@function, map("            responseBody->set" . typeTraits($_->type, "JSONType") . "(\"" . $_->name . "\", " . $_->name . ");", @outArgs));
         push(@function, "            responseMessage->setObject(\"body\", responseBody);");
         push(@function, "        }");
     }
-    push(@function, "        m_inspectorAgent->inspectorClient()->sendMessageToFrontend(responseMessage->toJSONString());");
+    push(@function, "        m_inspectorClient->sendMessageToFrontend(responseMessage->toJSONString());");
     push(@function, "    }");
 
 
@@ -551,7 +553,7 @@ sub generateDocumentationCommand
     my @inArgs = grep($_->direction eq "in" && !($_->name eq "callId") , @{$function->parameters});
     push(@lines, "<pre style='background: lightGrey; padding: 10px'>");
     push(@lines, "request: {");
-    push(@lines, "    seq: &lt;number&gt;,");
+    push(@lines, "    id: &lt;number&gt;,");
     push(@lines, "    type: \"request\",");
     push(@lines, "    domain: \"" . $interface->name . "\",");
     if (scalar(@inArgs)) {
@@ -571,7 +573,7 @@ sub generateDocumentationCommand
     my @outArgs = grep($_->direction eq "out", @{$function->parameters});    
     push(@lines, "");
     push(@lines, "response: {");
-    push(@lines, "    seq: &lt;number&gt;,");
+    push(@lines, "    requestId: &lt;number&gt;,");
     if (scalar(@outArgs)) {
         push(@lines, "    type: \"response\",");
         push(@lines, "    body: {");
@@ -597,11 +599,11 @@ sub generateBackendReportProtocolError
 void ${backendClassName}::reportProtocolError(const long callId, const String& errorText) const
 {
     RefPtr<InspectorObject> message = InspectorObject::create();
-    message->setNumber("seq", callId);
+    message->setNumber("requestId", callId);
     RefPtr<InspectorArray> errors = InspectorArray::create();
     errors->pushString(errorText);
-    message->setArray("errors", errors);
-    m_inspectorAgent->inspectorClient()->sendMessageToFrontend(message->toJSONString());
+    message->setArray("protocolErrors", errors);
+    m_inspectorClient->sendMessageToFrontend(message->toJSONString());
 }
 EOF
     return split("\n", $reportProtocolError);
@@ -700,14 +702,14 @@ $mapEntries
         return;
     }
 
-    RefPtr<InspectorValue> callIdValue = messageObject->get("seq");
+    RefPtr<InspectorValue> callIdValue = messageObject->get("id");
     if (!callIdValue) {
-        reportProtocolError(callId, "Protocol Error: Invalid message format. 'seq' property was not found in the request.");
+        reportProtocolError(callId, "Protocol Error: Invalid message format. 'id' property was not found in the request.");
         return;
     }
 
     if (!callIdValue->asNumber(&callId)) {
-        reportProtocolError(callId, "Protocol Error: Invalid message format. The type of 'seq' property should be number.");
+        reportProtocolError(callId, "Protocol Error: Invalid message format. The type of 'id' property should be number.");
         return;
     }
 
@@ -761,7 +763,7 @@ sub collectBackendJSStubFunctions
         my $name = $function->signature->name;
         my $argumentNames = join(",", map("\"" . $_->name . "\": \"" . typeTraits($_->type, "JSType") . "\"", grep($_->direction eq "in", @{$function->parameters})));
         push(@backendJSStubs, "    this._registerDelegate('{" .
-            "\"seq\": 0, " .
+            "\"id\": 0, " .
             "\"domain\": \"$domain\", " .
             "\"command\": \"$name\", " .
             "\"arguments\": {$argumentNames}" .
@@ -827,7 +829,7 @@ InspectorBackendStub.prototype = {
             }
             callback = args[0];
         }
-        request.seq = this._wrap(callback || function() {});
+        request.id = this._wrap(callback || function() {});
 
         if (window.dumpInspectorProtocolMessages)
             console.log("frontend: " + JSON.stringify(request));
@@ -855,14 +857,19 @@ InspectorBackendStub.prototype = {
             for (var key in messageObject.body)
                 arguments.push(messageObject.body[key]);
 
-        if ("seq" in messageObject) { // just a response for some request
-            if (!messageObject.errors)
-                this._callbacks[messageObject.seq].apply(null, arguments);
-            else
+        if ("requestId" in messageObject) { // just a response for some request
+            if (messageObject.protocolErrors)
                 this.reportProtocolError(messageObject);
 
-            --this._pendingResponsesCount;
-            delete this._callbacks[messageObject.seq];
+            var callback = this._callbacks[messageObject.requestId];
+            if (callback) {
+                if (!messageObject.protocolErrors) {
+                    arguments.unshift(messageObject.error);
+                    callback.apply(null, arguments);
+                }
+                --this._pendingResponsesCount;
+                delete this._callbacks[messageObject.requestId];
+            }
 
             if (this._scripts && !this._pendingResponsesCount)
                 this.runAfterPendingDispatches();
@@ -880,15 +887,16 @@ InspectorBackendStub.prototype = {
                 console.error("Protocol Error: Attempted to dispatch an unimplemented method '" + messageObject.domain + "." + messageObject.event + "'");
                 return;
             }
+
             dispatcher[messageObject.event].apply(dispatcher, arguments);
         }
     },
 
     reportProtocolError: function(messageObject)
     {
-        console.error("Protocol Error: InspectorBackend request with seq = " + messageObject.seq + " failed.");
-        for (var i = 0; i < messageObject.errors.length; ++i)
-            console.error("    " + messageObject.errors[i]);
+        console.error("Protocol Error: InspectorBackend request with id = " + messageObject.requestId + " failed.");
+        for (var i = 0; i < messageObject.protocolErrors.length; ++i)
+            console.error("    " + messageObject.protocolErrors[i]);
     },
 
     runAfterPendingDispatches: function(script)
@@ -1032,6 +1040,39 @@ sub parameterDocLine
     return $result;
 }
 
+sub generateBackendAgentFieldsAndConstructor
+{
+    my @arguments;
+    my @fieldInitializers;
+
+    push(@arguments, "InspectorClient* inspectorClient");
+    push(@fieldInitializers, "        : m_inspectorClient(inspectorClient)");
+    push(@backendFooter, "    InspectorClient* m_inspectorClient;");
+
+    foreach my $domain (sort keys %backendDomains) {
+        # Add agent field declaration to the footer.
+        my $agentClassName = typeTraits($domain, "forward");
+        my $field = typeTraits($domain, "domainAccessor");
+        push(@backendFooter, "    ${agentClassName}* ${field};");
+
+        # Add agent parameter and initializer.
+        my $arg = substr($field, 2);
+        push(@fieldInitializers, "        , ${field}(${arg})");
+        push(@arguments, "${agentClassName}* ${arg}");
+    }
+
+    my $argumentString = join(", ", @arguments);
+
+    my @backendHead;
+    push(@backendHead, "    ${backendClassName}(${argumentString})");
+    push(@backendHead, @fieldInitializers);
+    push(@backendHead, "    { }");
+    push(@backendHead, "    void reportProtocolError(const long callId, const String& errorText) const;");
+    push(@backendHead, "    void dispatch(const String& message);");
+    push(@backendHead, "    static bool getCommandName(const String& message, String* result);");
+    $backendConstructor = join("\n", @backendHead);
+}
+
 sub finish
 {
     my $object = shift;
@@ -1059,6 +1100,7 @@ sub finish
             push(@backendMethodsImpl, generateArgumentGetters($type));
         }
     }
+    generateBackendAgentFieldsAndConstructor();
 
     push(@backendMethodsImpl, generateBackendMessageParser());
     push(@backendMethodsImpl, "");
@@ -1071,7 +1113,7 @@ sub finish
     undef($SOURCE);
 
     open($HEADER, ">$outputHeadersDir/$backendClassName.h") || die "Couldn't open file $outputHeadersDir/$backendClassName.h";
-    print $HEADER join("\n", generateHeader($backendClassName, \%backendTypes, $backendConstructor, \@backendConstantDeclarations, \@backendMethods, $backendFooter));
+    print $HEADER join("\n", generateHeader($backendClassName, \%backendTypes, $backendConstructor, \@backendConstantDeclarations, \@backendMethods, join("\n", @backendFooter)));
     close($HEADER);
     undef($HEADER);
 
diff --git a/Source/WebCore/inspector/ConsoleMessage.cpp b/Source/WebCore/inspector/ConsoleMessage.cpp
index 63fb020..de61ef8 100644
--- a/Source/WebCore/inspector/ConsoleMessage.cpp
+++ b/Source/WebCore/inspector/ConsoleMessage.cpp
@@ -35,7 +35,7 @@
 
 #include "Console.h"
 #include "InjectedScript.h"
-#include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
 #include "InspectorFrontend.h"
 #include "InspectorValues.h"
 #include "ScriptArguments.h"
@@ -86,7 +86,7 @@ ConsoleMessage::~ConsoleMessage()
 {
 }
 
-void ConsoleMessage::addToFrontend(InspectorFrontend::Console* frontend, InjectedScriptHost* injectedScriptHost)
+void ConsoleMessage::addToFrontend(InspectorFrontend::Console* frontend, InjectedScriptManager* injectedScriptManager)
 {
     RefPtr<InspectorObject> jsonObj = InspectorObject::create();
     jsonObj->setNumber("source", static_cast<int>(m_source));
@@ -99,7 +99,7 @@ void ConsoleMessage::addToFrontend(InspectorFrontend::Console* frontend, Injecte
     if (m_type == NetworkErrorMessageType) 
         jsonObj->setNumber("requestId", m_requestId);
     if (m_arguments && m_arguments->argumentCount()) {
-        InjectedScript injectedScript = injectedScriptHost->injectedScriptFor(m_arguments->globalState());
+        InjectedScript injectedScript = injectedScriptManager->injectedScriptFor(m_arguments->globalState());
         if (!injectedScript.hasNoValue()) {
             RefPtr<InspectorArray> jsonArgs = InspectorArray::create();
             for (unsigned i = 0; i < m_arguments->argumentCount(); ++i) {
@@ -114,13 +114,13 @@ void ConsoleMessage::addToFrontend(InspectorFrontend::Console* frontend, Injecte
         }
     }
     if (m_callStack)
-        jsonObj->setArray("stackTrace", m_callStack->buildInspectorObject());
-    frontend->addConsoleMessage(jsonObj);
+        jsonObj->setArray("stackTrace", m_callStack->buildInspectorArray());
+    frontend->consoleMessage(jsonObj);
 }
 
 void ConsoleMessage::updateRepeatCountInConsole(InspectorFrontend::Console* frontend)
 {
-    frontend->updateConsoleMessageRepeatCount(m_repeatCount);
+    frontend->consoleMessageRepeatCountUpdated(m_repeatCount);
 }
 
 bool ConsoleMessage::isEqual(ConsoleMessage* msg) const
diff --git a/Source/WebCore/inspector/ConsoleMessage.h b/Source/WebCore/inspector/ConsoleMessage.h
index 26e5675..4e6f115 100644
--- a/Source/WebCore/inspector/ConsoleMessage.h
+++ b/Source/WebCore/inspector/ConsoleMessage.h
@@ -39,7 +39,7 @@
 #include <wtf/Vector.h>
 
 namespace WebCore {
-class InjectedScriptHost;
+class InjectedScriptManager;
 class InspectorFrontend;
 class InspectorObject;
 class ScriptArguments;
@@ -55,13 +55,14 @@ public:
     ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& m, const String& responseUrl, unsigned long identifier);
     ~ConsoleMessage();
 
-    void addToFrontend(InspectorFrontend::Console*, InjectedScriptHost*);
+    void addToFrontend(InspectorFrontend::Console*, InjectedScriptManager*);
     void updateRepeatCountInConsole(InspectorFrontend::Console*);
     void incrementCount() { ++m_repeatCount; }
     bool isEqual(ConsoleMessage* msg) const;
 
     MessageSource source() const { return m_source; }
     const String& message() const { return m_message; }
+    MessageType type() const { return m_type; }
 
 private:
     MessageSource m_source;
diff --git a/Source/WebCore/inspector/DOMNodeHighlighter.cpp b/Source/WebCore/inspector/DOMNodeHighlighter.cpp
new file mode 100644
index 0000000..c87649b
--- /dev/null
+++ b/Source/WebCore/inspector/DOMNodeHighlighter.cpp
@@ -0,0 +1,292 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMNodeHighlighter.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "Element.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "Page.h"
+#include "Range.h"
+#include "RenderInline.h"
+#include "Settings.h"
+#include "StyledElement.h"
+#include "TextRun.h"
+
+namespace WebCore {
+
+namespace {
+
+Path quadToPath(const FloatQuad& quad)
+{
+    Path quadPath;
+    quadPath.moveTo(quad.p1());
+    quadPath.addLineTo(quad.p2());
+    quadPath.addLineTo(quad.p3());
+    quadPath.addLineTo(quad.p4());
+    quadPath.closeSubpath();
+    return quadPath;
+}
+
+void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, const Color& fillColor)
+{
+    static const int outlineThickness = 2;
+    static const Color outlineColor(62, 86, 180, 228);
+
+    Path quadPath = quadToPath(quad);
+
+    // Clip out the quad, then draw with a 2px stroke to get a pixel
+    // of outline (because inflating a quad is hard)
+    {
+        context.save();
+        context.clipOut(quadPath);
+
+        context.setStrokeThickness(outlineThickness);
+        context.setStrokeColor(outlineColor, ColorSpaceDeviceRGB);
+        context.strokePath(quadPath);
+
+        context.restore();
+    }
+
+    // Now do the fill
+    context.setFillColor(fillColor, ColorSpaceDeviceRGB);
+    context.fillPath(quadPath);
+}
+
+void drawOutlinedQuadWithClip(GraphicsContext& context, const FloatQuad& quad, const FloatQuad& clipQuad, const Color& fillColor)
+{
+    context.save();
+    Path clipQuadPath = quadToPath(clipQuad);
+    context.clipOut(clipQuadPath);
+    drawOutlinedQuad(context, quad, fillColor);
+    context.restore();
+}
+
+void drawHighlightForBox(GraphicsContext& context, const FloatQuad& contentQuad, const FloatQuad& paddingQuad, const FloatQuad& borderQuad, const FloatQuad& marginQuad)
+{
+    static const Color contentBoxColor(125, 173, 217, 128);
+    static const Color paddingBoxColor(125, 173, 217, 160);
+    static const Color borderBoxColor(125, 173, 217, 192);
+    static const Color marginBoxColor(125, 173, 217, 228);
+
+    if (marginQuad != borderQuad)
+        drawOutlinedQuadWithClip(context, marginQuad, borderQuad, marginBoxColor);
+    if (borderQuad != paddingQuad)
+        drawOutlinedQuadWithClip(context, borderQuad, paddingQuad, borderBoxColor);
+    if (paddingQuad != contentQuad)
+        drawOutlinedQuadWithClip(context, paddingQuad, contentQuad, paddingBoxColor);
+
+    drawOutlinedQuad(context, contentQuad, contentBoxColor);
+}
+
+void drawHighlightForLineBoxesOrSVGRenderer(GraphicsContext& context, const Vector<FloatQuad>& lineBoxQuads)
+{
+    static const Color lineBoxColor(125, 173, 217, 128);
+
+    for (size_t i = 0; i < lineBoxQuads.size(); ++i)
+        drawOutlinedQuad(context, lineBoxQuads[i], lineBoxColor);
+}
+
+inline IntSize frameToMainFrameOffset(Frame* frame)
+{
+    IntPoint mainFramePoint = frame->page()->mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(IntPoint()));
+    return mainFramePoint - IntPoint();
+}
+
+void drawElementTitle(GraphicsContext& context, Node* node, const IntRect& boundingBox, const IntRect& anchorBox, const FloatRect& overlayRect, WebCore::Settings* settings)
+{
+    static const int rectInflatePx = 4;
+    static const int fontHeightPx = 12;
+    static const int borderWidthPx = 1;
+    static const Color tooltipBackgroundColor(255, 255, 194, 255);
+    static const Color tooltipBorderColor(Color::black);
+    static const Color tooltipFontColor(Color::black);
+
+    Element* element = static_cast<Element*>(node);
+    bool isXHTML = element->document()->isXHTMLDocument();
+    String nodeTitle = isXHTML ? element->nodeName() : element->nodeName().lower();
+    const AtomicString& idValue = element->getIdAttribute();
+    if (!idValue.isNull() && !idValue.isEmpty()) {
+        nodeTitle += "#";
+        nodeTitle += idValue;
+    }
+    if (element->hasClass() && element->isStyledElement()) {
+        const SpaceSplitString& classNamesString = static_cast<StyledElement*>(element)->classNames();
+        size_t classNameCount = classNamesString.size();
+        if (classNameCount) {
+            HashSet<AtomicString> usedClassNames;
+            for (size_t i = 0; i < classNameCount; ++i) {
+                const AtomicString& className = classNamesString[i];
+                if (usedClassNames.contains(className))
+                    continue;
+                usedClassNames.add(className);
+                nodeTitle += ".";
+                nodeTitle += className;
+            }
+        }
+    }
+
+    nodeTitle += " [";
+    nodeTitle += String::number(boundingBox.width());
+    nodeTitle.append(static_cast<UChar>(0x00D7)); // &times;
+    nodeTitle += String::number(boundingBox.height());
+    nodeTitle += "]";
+
+    FontDescription desc;
+    FontFamily family;
+    family.setFamily(settings->fixedFontFamily());
+    desc.setFamily(family);
+    desc.setComputedSize(fontHeightPx);
+    Font font = Font(desc, 0, 0);
+    font.update(0);
+
+    TextRun nodeTitleRun(nodeTitle);
+    IntPoint titleBasePoint = IntPoint(anchorBox.x(), anchorBox.maxY() - 1);
+    titleBasePoint.move(rectInflatePx, rectInflatePx);
+    IntRect titleRect = enclosingIntRect(font.selectionRectForText(nodeTitleRun, titleBasePoint, fontHeightPx));
+    titleRect.inflate(rectInflatePx);
+
+    // The initial offsets needed to compensate for a 1px-thick border stroke (which is not a part of the rectangle).
+    int dx = -borderWidthPx;
+    int dy = borderWidthPx;
+
+    // If the tip sticks beyond the right of overlayRect, right-align the tip with the said boundary.
+    if (titleRect.maxX() > overlayRect.maxX())
+        dx = overlayRect.maxX() - titleRect.maxX();
+
+    // If the tip sticks beyond the left of overlayRect, left-align the tip with the said boundary.
+    if (titleRect.x() + dx < overlayRect.x())
+        dx = overlayRect.x() - titleRect.x() - borderWidthPx;
+
+    // If the tip sticks beyond the bottom of overlayRect, show the tip at top of bounding box.
+    if (titleRect.maxY() > overlayRect.maxY()) {
+        dy = anchorBox.y() - titleRect.maxY() - borderWidthPx;
+        // If the tip still sticks beyond the bottom of overlayRect, bottom-align the tip with the said boundary.
+        if (titleRect.maxY() + dy > overlayRect.maxY())
+            dy = overlayRect.maxY() - titleRect.maxY();
+    }
+
+    // If the tip sticks beyond the top of overlayRect, show the tip at top of overlayRect.
+    if (titleRect.y() + dy < overlayRect.y())
+        dy = overlayRect.y() - titleRect.y() + borderWidthPx;
+
+    titleRect.move(dx, dy);
+    context.setStrokeColor(tooltipBorderColor, ColorSpaceDeviceRGB);
+    context.setStrokeThickness(borderWidthPx);
+    context.setFillColor(tooltipBackgroundColor, ColorSpaceDeviceRGB);
+    context.drawRect(titleRect);
+    context.setFillColor(tooltipFontColor, ColorSpaceDeviceRGB);
+    context.drawText(font, nodeTitleRun, IntPoint(titleRect.x() + rectInflatePx, titleRect.y() + font.fontMetrics().height()));
+}
+
+} // anonymous namespace
+
+namespace DOMNodeHighlighter {
+
+void DrawNodeHighlight(GraphicsContext& context, Node* node)
+{
+    RenderObject* renderer = node->renderer();
+    Frame* containingFrame = node->document()->frame();
+
+    if (!renderer || !containingFrame)
+        return;
+
+    IntSize mainFrameOffset = frameToMainFrameOffset(containingFrame);
+    IntRect boundingBox = renderer->absoluteBoundingBoxRect(true);
+
+    boundingBox.move(mainFrameOffset);
+
+    IntRect titleAnchorBox = boundingBox;
+
+    FrameView* view = containingFrame->page()->mainFrame()->view();
+    FloatRect overlayRect = view->visibleContentRect();
+    if (!overlayRect.contains(boundingBox) && !boundingBox.contains(enclosingIntRect(overlayRect)))
+        overlayRect = view->visibleContentRect();
+    context.translate(-overlayRect.x(), -overlayRect.y());
+
+    // RenderSVGRoot should be highlighted through the isBox() code path, all other SVG elements should just dump their absoluteQuads().
+#if ENABLE(SVG)
+    bool isSVGRenderer = renderer->node() && renderer->node()->isSVGElement() && !renderer->isSVGRoot();
+#else
+    bool isSVGRenderer = false;
+#endif
+
+    if (renderer->isBox() && !isSVGRenderer) {
+        RenderBox* renderBox = toRenderBox(renderer);
+
+        IntRect contentBox = renderBox->contentBoxRect();
+
+        IntRect paddingBox(contentBox.x() - renderBox->paddingLeft(), contentBox.y() - renderBox->paddingTop(),
+                           contentBox.width() + renderBox->paddingLeft() + renderBox->paddingRight(), contentBox.height() + renderBox->paddingTop() + renderBox->paddingBottom());
+        IntRect borderBox(paddingBox.x() - renderBox->borderLeft(), paddingBox.y() - renderBox->borderTop(),
+                          paddingBox.width() + renderBox->borderLeft() + renderBox->borderRight(), paddingBox.height() + renderBox->borderTop() + renderBox->borderBottom());
+        IntRect marginBox(borderBox.x() - renderBox->marginLeft(), borderBox.y() - renderBox->marginTop(),
+                          borderBox.width() + renderBox->marginLeft() + renderBox->marginRight(), borderBox.height() + renderBox->marginTop() + renderBox->marginBottom());
+
+
+        FloatQuad absContentQuad = renderBox->localToAbsoluteQuad(FloatRect(contentBox));
+        FloatQuad absPaddingQuad = renderBox->localToAbsoluteQuad(FloatRect(paddingBox));
+        FloatQuad absBorderQuad = renderBox->localToAbsoluteQuad(FloatRect(borderBox));
+        FloatQuad absMarginQuad = renderBox->localToAbsoluteQuad(FloatRect(marginBox));
+
+        absContentQuad.move(mainFrameOffset);
+        absPaddingQuad.move(mainFrameOffset);
+        absBorderQuad.move(mainFrameOffset);
+        absMarginQuad.move(mainFrameOffset);
+
+        titleAnchorBox = absMarginQuad.enclosingBoundingBox();
+
+        drawHighlightForBox(context, absContentQuad, absPaddingQuad, absBorderQuad, absMarginQuad);
+    } else if (renderer->isRenderInline() || isSVGRenderer) {
+        // FIXME: We should show margins/padding/border for inlines.
+        Vector<FloatQuad> lineBoxQuads;
+        renderer->absoluteQuads(lineBoxQuads);
+        for (unsigned i = 0; i < lineBoxQuads.size(); ++i)
+            lineBoxQuads[i] += mainFrameOffset;
+
+        drawHighlightForLineBoxesOrSVGRenderer(context, lineBoxQuads);
+    }
+
+    // Draw node title if necessary.
+
+    if (!node->isElementNode())
+        return;
+
+    WebCore::Settings* settings = containingFrame->settings();
+    drawElementTitle(context, node, boundingBox, titleAnchorBox, overlayRect, settings);
+}
+
+} // namespace DOMNodeHighlighter
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/DOMNodeHighlighter.h b/Source/WebCore/inspector/DOMNodeHighlighter.h
new file mode 100644
index 0000000..1de1eec
--- /dev/null
+++ b/Source/WebCore/inspector/DOMNodeHighlighter.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DOMNodeHighlighter_h
+#define DOMNodeHighlighter_h
+
+namespace WebCore {
+
+class GraphicsContext;
+class Node;
+
+namespace DOMNodeHighlighter {
+
+void DrawNodeHighlight(GraphicsContext&, Node*);
+
+} // namespace DOMNodeHighlighter
+
+} // namespace WebCore
+
+
+#endif // DOMNodeHighlighter_h
diff --git a/Source/WebCore/inspector/InjectedScript.cpp b/Source/WebCore/inspector/InjectedScript.cpp
index 6c115d0..ee2e35a 100644
--- a/Source/WebCore/inspector/InjectedScript.cpp
+++ b/Source/WebCore/inspector/InjectedScript.cpp
@@ -35,6 +35,7 @@
 
 #include "Frame.h"
 #include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
 #include "InspectorValues.h"
 #include "Node.h"
 #include "PlatformString.h"
@@ -47,50 +48,56 @@ InjectedScript::InjectedScript(ScriptObject injectedScriptObject)
 {
 }
 
-void InjectedScript::evaluate(const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result)
+void InjectedScript::evaluate(ErrorString* errorString, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "evaluate");
     function.appendArgument(expression);
     function.appendArgument(objectGroup);
     function.appendArgument(includeCommandLineAPI);
-    makeCall(function, result);
+    makeObjectCall(errorString, function, result);
 }
 
-void InjectedScript::evaluateOn(PassRefPtr<InspectorObject> objectId, const String& expression, RefPtr<InspectorValue>* result)
+void InjectedScript::evaluateOn(ErrorString* errorString, const String& objectId, const String& expression, RefPtr<InspectorObject>* result)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "evaluateOn");
-    function.appendArgument(objectId->toJSONString());
+    function.appendArgument(objectId);
     function.appendArgument(expression);
-    makeCall(function, result);
+    makeObjectCall(errorString, function, result);
 }
 
-void InjectedScript::evaluateOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result)
+void InjectedScript::evaluateOnCallFrame(ErrorString* errorString, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "evaluateOnCallFrame");
-    function.appendArgument(callFrameId->toJSONString());
+    function.appendArgument(callFrameId);
     function.appendArgument(expression);
     function.appendArgument(objectGroup);
     function.appendArgument(includeCommandLineAPI);
-    makeCall(function, result);
+    makeObjectCall(errorString, function, result);
 }
 
-void InjectedScript::getProperties(PassRefPtr<InspectorObject> objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorValue>* result)
+void InjectedScript::getProperties(ErrorString* errorString, const String& objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorArray>* properties)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "getProperties");
-    String objectIdString = objectId->toJSONString();
-    function.appendArgument(objectIdString);
+    function.appendArgument(objectId);
     function.appendArgument(ignoreHasOwnProperty);
     function.appendArgument(abbreviate);
-    makeCall(function, result);
+
+    RefPtr<InspectorValue> result; 
+    makeCall(function, &result);
+    if (!result || result->type() != InspectorValue::TypeArray) {
+        *errorString = "Internal error.";
+        return;
+    }
+    *properties = result->asArray();
 }
 
-Node* InjectedScript::nodeForObjectId(PassRefPtr<InspectorObject> objectId)
+Node* InjectedScript::nodeForObjectId(const String& objectId)
 {
     if (hasNoValue() || !canAccessInspectedWindow())
         return 0;
 
     ScriptFunctionCall function(m_injectedScriptObject, "nodeForObjectId");
-    function.appendArgument(objectId->toJSONString());
+    function.appendArgument(objectId);
 
     bool hadException = false;
     ScriptValue resultValue = function.call(hadException);
@@ -99,37 +106,35 @@ Node* InjectedScript::nodeForObjectId(PassRefPtr<InspectorObject> objectId)
     return InjectedScriptHost::scriptValueAsNode(resultValue);
 }
 
-void InjectedScript::resolveNode(long nodeId, RefPtr<InspectorValue>* result)
-{
-    ScriptFunctionCall function(m_injectedScriptObject, "resolveNode");
-    function.appendArgument(nodeId);
-    makeCall(function, result);
-}
-
-void InjectedScript::setPropertyValue(PassRefPtr<InspectorObject> objectId, const String& propertyName, const String& expression, RefPtr<InspectorValue>* result)
+void InjectedScript::setPropertyValue(ErrorString* errorString, const String& objectId, const String& propertyName, const String& expression)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "setPropertyValue");
-    function.appendArgument(objectId->toJSONString());
+    function.appendArgument(objectId);
     function.appendArgument(propertyName);
     function.appendArgument(expression);
-    makeCall(function, result);
+    RefPtr<InspectorValue> result;
+    makeCall(function, &result);
+    result->asString(errorString);
 }
 
-void InjectedScript::releaseObject(PassRefPtr<InspectorObject> objectId)
+void InjectedScript::releaseObject(const String& objectId)
 {
     ScriptFunctionCall function(m_injectedScriptObject, "releaseObject");
-    function.appendArgument(objectId->toJSONString());
+    function.appendArgument(objectId);
     RefPtr<InspectorValue> result;
     makeCall(function, &result);
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-PassRefPtr<InspectorValue> InjectedScript::callFrames()
+PassRefPtr<InspectorArray> InjectedScript::callFrames()
 {
     ASSERT(!hasNoValue());
     ScriptFunctionCall function(m_injectedScriptObject, "callFrames");
     ScriptValue callFramesValue = function.call();
-    return callFramesValue.toInspectorValue(m_injectedScriptObject.scriptState());
+    RefPtr<InspectorValue> result = callFramesValue.toInspectorValue(m_injectedScriptObject.scriptState());
+    if (result->type() == InspectorValue::TypeArray)
+        return result->asArray();
+    return InspectorArray::create();
 }
 #endif
 
@@ -150,9 +155,9 @@ PassRefPtr<InspectorObject> InjectedScript::wrapObject(ScriptValue value, const
     return r.toInspectorValue(m_injectedScriptObject.scriptState())->asObject();
 }
 
-PassRefPtr<InspectorObject> InjectedScript::wrapNode(Node* node, const String& groupName)
+PassRefPtr<InspectorObject> InjectedScript::wrapNode(Node* node)
 {
-    return wrapObject(nodeAsScriptValue(node), groupName);
+    return wrapObject(nodeAsScriptValue(node), "");
 }
 
 void InjectedScript::inspectNode(Node* node)
@@ -174,7 +179,7 @@ void InjectedScript::releaseObjectGroup(const String& objectGroup)
 
 bool InjectedScript::canAccessInspectedWindow()
 {
-    return InjectedScriptHost::canAccessInspectedWindow(m_injectedScriptObject.scriptState());
+    return InjectedScriptManager::canAccessInspectedWindow(m_injectedScriptObject.scriptState());
 }
 
 void InjectedScript::makeCall(ScriptFunctionCall& function, RefPtr<InspectorValue>* result)
@@ -191,7 +196,23 @@ void InjectedScript::makeCall(ScriptFunctionCall& function, RefPtr<InspectorValu
     if (!hadException)
         *result = resultValue.toInspectorValue(m_injectedScriptObject.scriptState());
     else
-        *result = InspectorValue::null();
+        *result = InspectorString::create("Exception while making a call.");
+}
+
+void InjectedScript::makeObjectCall(ErrorString* errorString, ScriptFunctionCall& function, RefPtr<InspectorObject>* objectResult)
+{
+    RefPtr<InspectorValue> result;
+    makeCall(function, &result);
+    if (result && result->type() == InspectorValue::TypeString) {
+        result->asString(errorString);
+        return;
+    }
+
+    if (!result || result->type() != InspectorValue::TypeObject) {
+        *errorString = "Internal error.";
+        return;
+    }
+    *objectResult = result->asObject();
 }
 
 ScriptValue InjectedScript::nodeAsScriptValue(Node* node)
diff --git a/Source/WebCore/inspector/InjectedScript.h b/Source/WebCore/inspector/InjectedScript.h
index 33d5411..e165e9c 100644
--- a/Source/WebCore/inspector/InjectedScript.h
+++ b/Source/WebCore/inspector/InjectedScript.h
@@ -31,7 +31,7 @@
 #ifndef InjectedScript_h
 #define InjectedScript_h
 
-#include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
 #include "ScriptObject.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
@@ -40,10 +40,14 @@
 
 namespace WebCore {
 
+class InspectorArray;
+class InspectorObject;
 class InspectorValue;
 class Node;
 class ScriptFunctionCall;
 
+typedef String ErrorString;
+
 class InjectedScript {
 public:
     InjectedScript() { }
@@ -51,31 +55,31 @@ public:
 
     bool hasNoValue() const { return m_injectedScriptObject.hasNoValue(); }
 
-    void evaluate(const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result);
-    void evaluateOn(PassRefPtr<InspectorObject> objectId, const String& expression, RefPtr<InspectorValue>* result);
-    void evaluateOnCallFrame(PassRefPtr<InspectorObject> callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result);
-    void getProperties(PassRefPtr<InspectorObject> objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorValue>* result);
-    Node* nodeForObjectId(PassRefPtr<InspectorObject> objectId);
-    void resolveNode(long nodeId, RefPtr<InspectorValue>* result);
-    void setPropertyValue(PassRefPtr<InspectorObject> objectId, const String& propertyName, const String& expression, RefPtr<InspectorValue>* result);
-    void releaseObject(PassRefPtr<InspectorObject> objectId);
-    
+    void evaluate(ErrorString*, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result);
+    void evaluateOn(ErrorString*, const String& objectId, const String& expression, RefPtr<InspectorObject>* result);
+    void evaluateOnCallFrame(ErrorString*, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result);
+    void getProperties(ErrorString*, const String& objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorArray>* result);
+    Node* nodeForObjectId(const String& objectId);
+    void setPropertyValue(ErrorString*, const String& objectId, const String& propertyName, const String& expression);
+    void releaseObject(const String& objectId);
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    PassRefPtr<InspectorValue> callFrames();
+    PassRefPtr<InspectorArray> callFrames();
 #endif
 
     PassRefPtr<InspectorObject> wrapObject(ScriptValue, const String& groupName);
-    PassRefPtr<InspectorObject> wrapNode(Node*, const String& groupName);
+    PassRefPtr<InspectorObject> wrapNode(Node*);
     void inspectNode(Node*);
     void releaseObjectGroup(const String&);
     ScriptState* scriptState() const { return m_injectedScriptObject.scriptState(); }
 
 private:
-    friend InjectedScript InjectedScriptHost::injectedScriptFor(ScriptState*);
+    friend InjectedScript InjectedScriptManager::injectedScriptFor(ScriptState*);
     explicit InjectedScript(ScriptObject);
 
     bool canAccessInspectedWindow();
     void makeCall(ScriptFunctionCall&, RefPtr<InspectorValue>* result);
+    void makeObjectCall(ErrorString*, ScriptFunctionCall&, RefPtr<InspectorObject>* result);
     ScriptValue nodeAsScriptValue(Node*);
 
     ScriptObject m_injectedScriptObject;
diff --git a/Source/WebCore/inspector/InjectedScriptHost.cpp b/Source/WebCore/inspector/InjectedScriptHost.cpp
index ad4df45..a0bafdf 100644
--- a/Source/WebCore/inspector/InjectedScriptHost.cpp
+++ b/Source/WebCore/inspector/InjectedScriptHost.cpp
@@ -38,7 +38,6 @@
 #include "FrameLoader.h"
 #include "HTMLFrameOwnerElement.h"
 #include "InjectedScript.h"
-#include "InjectedScriptSource.h"
 #include "InspectorAgent.h"
 #include "InspectorClient.h"
 #include "InspectorConsoleAgent.h"
@@ -69,29 +68,40 @@ using namespace std;
 
 namespace WebCore {
 
-InjectedScriptHost::InjectedScriptHost(InspectorAgent* inspectorAgent)
-    : m_inspectorAgent(inspectorAgent)
-    , m_nextInjectedScriptId(1)
-    , m_lastWorkerId(1 << 31) // Distinguish ids of fake workers from real ones, to minimize the chances they overlap.
+PassRefPtr<InjectedScriptHost> InjectedScriptHost::create()
 {
+    return adoptRef(new InjectedScriptHost());
 }
 
-InjectedScriptHost::~InjectedScriptHost()
+InjectedScriptHost::InjectedScriptHost()
+    : m_inspectorAgent(0)
+    , m_consoleAgent(0)
+#if ENABLE(DATABASE)
+    , m_databaseAgent(0)
+#endif
+#if ENABLE(DOM_STORAGE)
+    , m_domStorageAgent(0)
+#endif
+    , m_frontend(0)
+    , m_lastWorkerId(1 << 31) // Distinguish ids of fake workers from real ones, to minimize the chances they overlap.
 {
 }
 
-void InjectedScriptHost::inspectImpl(PassRefPtr<InspectorValue> objectId, PassRefPtr<InspectorValue> hints)
+InjectedScriptHost::~InjectedScriptHost()
 {
-    if (InspectorFrontend* fe = frontend())
-        fe->inspector()->inspect(objectId->asObject(), hints->asObject());
 }
 
-void InjectedScriptHost::clearConsoleMessages()
+void InjectedScriptHost::disconnect()
 {
-    if (m_inspectorAgent) {
-        ErrorString error;
-        m_inspectorAgent->consoleAgent()->clearConsoleMessages(&error);
-    }
+    m_inspectorAgent = 0;
+    m_consoleAgent = 0;
+#if ENABLE(DATABASE)
+    m_databaseAgent = 0;
+#endif
+#if ENABLE(DOM_STORAGE)
+    m_domStorageAgent = 0;
+#endif
+    m_frontend = 0;
 }
 
 void InjectedScriptHost::addInspectedNode(Node* node)
@@ -106,12 +116,26 @@ void InjectedScriptHost::clearInspectedNodes()
     m_inspectedNodes.clear();
 }
 
+void InjectedScriptHost::inspectImpl(PassRefPtr<InspectorValue> object, PassRefPtr<InspectorValue> hints)
+{
+    if (m_frontend)
+        m_frontend->inspector()->inspect(object->asObject(), hints->asObject());
+}
+
+void InjectedScriptHost::clearConsoleMessages()
+{
+    if (m_consoleAgent) {
+        ErrorString error;
+        m_consoleAgent->clearConsoleMessages(&error);
+    }
+}
+
 void InjectedScriptHost::copyText(const String& text)
 {
     Pasteboard::generalPasteboard()->writePlainText(text);
 }
 
-Node* InjectedScriptHost::inspectedNode(unsigned long num)
+Node* InjectedScriptHost::inspectedNode(unsigned int num)
 {
     if (num < m_inspectedNodes.size())
         return m_inspectedNodes[num].get();
@@ -119,81 +143,23 @@ Node* InjectedScriptHost::inspectedNode(unsigned long num)
 }
 
 #if ENABLE(DATABASE)
-long InjectedScriptHost::databaseIdImpl(Database* database)
+int InjectedScriptHost::databaseIdImpl(Database* database)
 {
-    if (m_inspectorAgent && m_inspectorAgent->databaseAgent())
-        return m_inspectorAgent->databaseAgent()->databaseId(database);
+    if (m_databaseAgent)
+        return m_databaseAgent->databaseId(database);
     return 0;
 }
 #endif
 
 #if ENABLE(DOM_STORAGE)
-long InjectedScriptHost::storageIdImpl(Storage* storage)
+int InjectedScriptHost::storageIdImpl(Storage* storage)
 {
-    if (m_inspectorAgent && m_inspectorAgent->domStorageAgent())
-        return m_inspectorAgent->domStorageAgent()->storageId(storage);
+    if (m_domStorageAgent)
+        return m_domStorageAgent->storageId(storage);
     return 0;
 }
 #endif
 
-InjectedScript InjectedScriptHost::injectedScriptForId(long id)
-{
-    return m_idToInjectedScript.get(id);
-}
-
-InjectedScript InjectedScriptHost::injectedScriptForObjectId(InspectorObject* objectId)
-{
-    long injectedScriptId = 0;
-    bool success = objectId->getNumber("injectedScriptId", &injectedScriptId);
-    if (success)
-        return injectedScriptForId(injectedScriptId);
-    return InjectedScript();
-}
-
-InjectedScript InjectedScriptHost::injectedScriptForMainFrame()
-{
-    return injectedScriptFor(mainWorldScriptState(m_inspectorAgent->inspectedPage()->mainFrame()));
-}
-
-void InjectedScriptHost::discardInjectedScripts()
-{
-    IdToInjectedScriptMap::iterator end = m_idToInjectedScript.end();
-    for (IdToInjectedScriptMap::iterator it = m_idToInjectedScript.begin(); it != end; ++it)
-        discardInjectedScript(it->second.scriptState());
-    m_idToInjectedScript.clear();
-}
-
-void InjectedScriptHost::releaseObjectGroup(long injectedScriptId, const String& objectGroup)
-{
-    if (injectedScriptId) {
-         InjectedScript injectedScript = m_idToInjectedScript.get(injectedScriptId);
-         if (!injectedScript.hasNoValue())
-             injectedScript.releaseObjectGroup(objectGroup);
-    } else {
-         // Iterate over all injected scripts if injectedScriptId is not specified.
-         for (IdToInjectedScriptMap::iterator it = m_idToInjectedScript.begin(); it != m_idToInjectedScript.end(); ++it)
-              it->second.releaseObjectGroup(objectGroup);
-    }
-}
-
-InspectorFrontend* InjectedScriptHost::frontend()
-{
-    if (!m_inspectorAgent)
-        return 0;
-    return m_inspectorAgent->frontend();
-}
-
-String InjectedScriptHost::injectedScriptSource()
-{
-    return String(reinterpret_cast<char*>(InjectedScriptSource_js), sizeof(InjectedScriptSource_js));
-}
-
-pair<long, ScriptObject> InjectedScriptHost::injectScript(const String& source, ScriptState* scriptState)
-{
-    long id = m_nextInjectedScriptId++;
-    return std::make_pair(id, createInjectedScript(source, scriptState, id));
-}
-
 #if ENABLE(WORKERS)
 long InjectedScriptHost::nextWorkerId()
 {
@@ -203,13 +169,13 @@ long InjectedScriptHost::nextWorkerId()
 void InjectedScriptHost::didCreateWorker(long id, const String& url, bool isSharedWorker)
 {
     if (m_inspectorAgent)
-        m_inspectorAgent->didCreateWorker(id, url, isSharedWorker);
+        m_inspectorAgent->didCreateWorker(static_cast<int>(id), url, isSharedWorker);
 }
 
 void InjectedScriptHost::didDestroyWorker(long id)
 {
     if (m_inspectorAgent)
-        m_inspectorAgent->didDestroyWorker(id);
+        m_inspectorAgent->didDestroyWorker(static_cast<int>(id));
 }
 #endif // ENABLE(WORKERS)
 
diff --git a/Source/WebCore/inspector/InjectedScriptHost.h b/Source/WebCore/inspector/InjectedScriptHost.h
index cdb1e64..89a5031 100644
--- a/Source/WebCore/inspector/InjectedScriptHost.h
+++ b/Source/WebCore/inspector/InjectedScriptHost.h
@@ -43,6 +43,11 @@ namespace WebCore {
 
 class Database;
 class InjectedScript;
+class InspectorAgent;
+class InspectorConsoleAgent;
+class InspectorDOMStorageAgent;
+class InspectorDatabaseAgent;
+class InspectorDebuggerAgent;
 class InspectorFrontend;
 class InspectorObject;
 class Node;
@@ -53,62 +58,80 @@ class Storage;
 class InjectedScriptHost : public RefCounted<InjectedScriptHost>
 {
 public:
-    static PassRefPtr<InjectedScriptHost> create(InspectorAgent* inspectorAgent)
+    static PassRefPtr<InjectedScriptHost> create();
+    ~InjectedScriptHost();
+
+    void init(InspectorAgent* inspectorAgent
+            , InspectorConsoleAgent* consoleAgent
+#if ENABLE(DATABASE)
+            , InspectorDatabaseAgent* databaseAgent
+#endif
+#if ENABLE(DOM_STORAGE)
+            , InspectorDOMStorageAgent* domStorageAgent
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+            , InspectorDebuggerAgent* debuggerAgent
+#endif
+        )
     {
-        return adoptRef(new InjectedScriptHost(inspectorAgent));
+        m_inspectorAgent = inspectorAgent;
+        m_consoleAgent = consoleAgent;
+#if ENABLE(DATABASE)
+        m_databaseAgent = databaseAgent;
+#endif
+#if ENABLE(DOM_STORAGE)
+        m_domStorageAgent = domStorageAgent;
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        m_debuggerAgent = debuggerAgent;
+#endif
     }
+    void setFrontend(InspectorFrontend* frontend) { m_frontend = frontend; }
+    void clearFrontend() { m_frontend = 0; }
 
     static Node* scriptValueAsNode(ScriptValue);
     static ScriptValue nodeAsScriptValue(ScriptState*, Node*);
 
-    ~InjectedScriptHost();
-
-    InspectorAgent* inspectorAgent() { return m_inspectorAgent; }
-    void disconnectController() { m_inspectorAgent = 0; }
-
-    void inspectImpl(PassRefPtr<InspectorValue> objectId, PassRefPtr<InspectorValue> hints);
-    void clearConsoleMessages();
+    void disconnect();
 
     void addInspectedNode(Node*);
     void clearInspectedNodes();
 
+    void inspectImpl(PassRefPtr<InspectorValue> objectToInspect, PassRefPtr<InspectorValue> hints);
+    void clearConsoleMessages();
     void copyText(const String& text);
-    Node* inspectedNode(unsigned long num);
-
+    Node* inspectedNode(unsigned int num);
 #if ENABLE(DATABASE)
-    long databaseIdImpl(Database*);
+    int databaseIdImpl(Database*);
 #endif
 #if ENABLE(DOM_STORAGE)
-    long storageIdImpl(Storage*);
+    int storageIdImpl(Storage*);
 #endif
 #if ENABLE(WORKERS)
     long nextWorkerId();
     void didCreateWorker(long id, const String& url, bool isSharedWorker);
     void didDestroyWorker(long id);
 #endif
-
-    pair<long, ScriptObject> injectScript(const String& source, ScriptState*);
-    InjectedScript injectedScriptFor(ScriptState*);
-    InjectedScript injectedScriptForId(long);
-    InjectedScript injectedScriptForObjectId(InspectorObject* objectId);
-    InjectedScript injectedScriptForMainFrame();
-    void discardInjectedScripts();
-    void releaseObjectGroup(long injectedScriptId, const String& objectGroup);
-
-    static bool canAccessInspectedWindow(ScriptState*);
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    InspectorDebuggerAgent* debuggerAgent() { return m_debuggerAgent; }
+#endif
 
 private:
-    InjectedScriptHost(InspectorAgent*);
-    InspectorFrontend* frontend();
-    String injectedScriptSource();
-    ScriptObject createInjectedScript(const String& source, ScriptState* scriptState, long id);
-    void discardInjectedScript(ScriptState*);
+    InjectedScriptHost();
 
     InspectorAgent* m_inspectorAgent;
-    long m_nextInjectedScriptId;
+    InspectorConsoleAgent* m_consoleAgent;
+#if ENABLE(DATABASE)
+    InspectorDatabaseAgent* m_databaseAgent;
+#endif
+#if ENABLE(DOM_STORAGE)
+    InspectorDOMStorageAgent* m_domStorageAgent;
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    InspectorDebuggerAgent* m_debuggerAgent;
+#endif
+    InspectorFrontend* m_frontend;
     long m_lastWorkerId;
-    typedef HashMap<long, InjectedScript> IdToInjectedScriptMap;
-    IdToInjectedScriptMap m_idToInjectedScript;
     Vector<RefPtr<Node> > m_inspectedNodes;
 };
 
diff --git a/Source/WebCore/inspector/InjectedScriptHost.idl b/Source/WebCore/inspector/InjectedScriptHost.idl
index 0d5c500..fc60813 100644
--- a/Source/WebCore/inspector/InjectedScriptHost.idl
+++ b/Source/WebCore/inspector/InjectedScriptHost.idl
@@ -36,12 +36,12 @@ module core {
 
         void copyText(in DOMString text);
         [Custom] void inspect(in DOMObject objectId, in DOMObject hints);
-        [Custom] DOMObject inspectedNode(in unsigned long num);
+        [Custom] DOMObject inspectedNode(in int num);
         [Custom] DOMObject internalConstructorName(in DOMObject object);
 
         [Custom] DOMObject currentCallFrame();
-        [Custom] long databaseId(in DOMObject database);
-        [Custom] long storageId(in DOMObject storage);
+        [Custom] int databaseId(in DOMObject database);
+        [Custom] int storageId(in DOMObject storage);
 
 #if defined(ENABLE_WORKERS) && ENABLE_WORKERS
         void didCreateWorker(in long id, in DOMString url, in boolean isFakeWorker);
diff --git a/Source/WebCore/inspector/InjectedScriptManager.cpp b/Source/WebCore/inspector/InjectedScriptManager.cpp
new file mode 100644
index 0000000..5c21802
--- /dev/null
+++ b/Source/WebCore/inspector/InjectedScriptManager.cpp
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InjectedScriptManager.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "InjectedScript.h"
+#include "InjectedScriptHost.h"
+#include "InjectedScriptSource.h"
+#include "InspectorValues.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace std;
+
+namespace WebCore {
+
+PassOwnPtr<InjectedScriptManager> InjectedScriptManager::create()
+{
+    return adoptPtr(new InjectedScriptManager());
+}
+
+InjectedScriptManager::InjectedScriptManager()
+    : m_nextInjectedScriptId(1)
+    , m_injectedScriptHost(InjectedScriptHost::create())
+{
+}
+
+InjectedScriptManager::~InjectedScriptManager()
+{
+}
+
+void InjectedScriptManager::disconnect()
+{
+    m_injectedScriptHost->disconnect();
+    m_injectedScriptHost.clear();
+}
+
+InjectedScriptHost* InjectedScriptManager::injectedScriptHost()
+{
+    return m_injectedScriptHost.get();
+}
+
+InjectedScript InjectedScriptManager::injectedScriptForId(long id)
+{
+    return m_idToInjectedScript.get(id);
+}
+
+InjectedScript InjectedScriptManager::injectedScriptForObjectId(const String& objectId)
+{
+    RefPtr<InspectorValue> parsedObjectId = InspectorValue::parseJSON(objectId);
+    if (parsedObjectId && parsedObjectId->type() == InspectorValue::TypeObject) {
+        long injectedScriptId = 0;
+        bool success = parsedObjectId->asObject()->getNumber("injectedScriptId", &injectedScriptId);
+        if (success)
+            return injectedScriptForId(injectedScriptId);
+    }
+    return InjectedScript();
+}
+
+void InjectedScriptManager::discardInjectedScripts()
+{
+    IdToInjectedScriptMap::iterator end = m_idToInjectedScript.end();
+    for (IdToInjectedScriptMap::iterator it = m_idToInjectedScript.begin(); it != end; ++it)
+        discardInjectedScript(it->second.scriptState());
+    m_idToInjectedScript.clear();
+}
+
+void InjectedScriptManager::releaseObjectGroup(const String& objectGroup)
+{
+    for (IdToInjectedScriptMap::iterator it = m_idToInjectedScript.begin(); it != m_idToInjectedScript.end(); ++it)
+        it->second.releaseObjectGroup(objectGroup);
+}
+
+String InjectedScriptManager::injectedScriptSource()
+{
+    return String(reinterpret_cast<const char*>(InjectedScriptSource_js), sizeof(InjectedScriptSource_js));
+}
+
+pair<long, ScriptObject> InjectedScriptManager::injectScript(const String& source, ScriptState* scriptState)
+{
+    long id = m_nextInjectedScriptId++;
+    return std::make_pair(id, createInjectedScript(source, scriptState, id));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InjectedScriptManager.h b/Source/WebCore/inspector/InjectedScriptManager.h
new file mode 100644
index 0000000..2896e8f
--- /dev/null
+++ b/Source/WebCore/inspector/InjectedScriptManager.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2009-2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InjectedScriptManager_h
+#define InjectedScriptManager_h
+
+#include "PlatformString.h"
+#include "ScriptState.h"
+
+#include <wtf/Forward.h>
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+
+class InjectedScript;
+class InjectedScriptHost;
+class InspectorObject;
+class ScriptObject;
+
+class InjectedScriptManager {
+    WTF_MAKE_NONCOPYABLE(InjectedScriptManager);
+public:
+    static PassOwnPtr<InjectedScriptManager> create();
+    ~InjectedScriptManager();
+
+    void disconnect();
+
+    InjectedScriptHost* injectedScriptHost();
+
+    pair<long, ScriptObject> injectScript(const String& source, ScriptState*);
+    InjectedScript injectedScriptFor(ScriptState*);
+    InjectedScript injectedScriptForId(long);
+    InjectedScript injectedScriptForObjectId(const String& objectId);
+    void discardInjectedScripts();
+    void releaseObjectGroup(const String& objectGroup);
+
+    static bool canAccessInspectedWindow(ScriptState*);
+
+private:
+    InjectedScriptManager();
+
+    String injectedScriptSource();
+    ScriptObject createInjectedScript(const String& source, ScriptState*, long id);
+    void discardInjectedScript(ScriptState*);
+
+    long m_nextInjectedScriptId;
+    typedef HashMap<long, InjectedScript> IdToInjectedScriptMap;
+    IdToInjectedScriptMap m_idToInjectedScript;
+    RefPtr<InjectedScriptHost> m_injectedScriptHost;
+};
+
+} // namespace WebCore
+
+#endif // !defined(InjectedScriptManager_h)
diff --git a/Source/WebCore/inspector/InjectedScriptSource.js b/Source/WebCore/inspector/InjectedScriptSource.js
index 9c662e8..f499a17 100644
--- a/Source/WebCore/inspector/InjectedScriptSource.js
+++ b/Source/WebCore/inspector/InjectedScriptSource.js
@@ -46,6 +46,7 @@ var InjectedScript = function()
 {
     this._lastBoundObjectId = 1;
     this._idToWrappedObject = {};
+    this._idToObjectGroupName = {};
     this._objectGroups = {};
 }
 
@@ -95,8 +96,7 @@ InjectedScript.prototype = {
             if (typeof object === "object" || typeof object === "function" || this._isHTMLAllCollection(object)) {
                 var id = this._lastBoundObjectId++;
                 this._idToWrappedObject[id] = object;
-                var objectId = { injectedScriptId: injectedScriptId, id: id };
-    
+                var objectId = "{\"injectedScriptId\":" + injectedScriptId + ",\"id\":" + id + "}";    
                 if (objectGroupName) {
                     var group = this._objectGroups[objectGroupName];
                     if (!group) {
@@ -104,7 +104,7 @@ InjectedScript.prototype = {
                         this._objectGroups[objectGroupName] = group;
                     }
                     group.push(id);
-                    objectId.groupName = objectGroupName;
+                    this._idToObjectGroupName[id] = objectGroupName;
                 }
             }
             return InjectedScript.RemoteObject.fromObject(object, objectId, abbreviate);
@@ -124,7 +124,7 @@ InjectedScript.prototype = {
         if (!group)
             return;
         for (var i = 0; i < group.length; i++)
-            delete this._idToWrappedObject[group[i]];
+            this._releaseObject(group[i]);
         delete this._objectGroups[objectGroupName];
     },
 
@@ -143,6 +143,7 @@ InjectedScript.prototype = {
     {
         var parsedObjectId = this._parseObjectId(objectId);
         var object = this._objectForId(parsedObjectId);
+        var objectGroupName = this._idToObjectGroupName[parsedObjectId.id];
 
         if (!this._isDefined(object))
             return false;
@@ -161,7 +162,7 @@ InjectedScript.prototype = {
             var isGetter = object["__lookupGetter__"] && object.__lookupGetter__(propertyName);
             if (!isGetter) {
                 try {
-                    property.value = this._wrapObject(object[propertyName], parsedObjectId.groupName, abbreviate);
+                    property.value = this._wrapObject(object[propertyName], objectGroupName, abbreviate);
                 } catch(e) {
                     property.value = new InjectedScript.RemoteObject.fromException(e);
                 }
@@ -180,12 +181,12 @@ InjectedScript.prototype = {
         var parsedObjectId = this._parseObjectId(objectId);
         var object = this._objectForId(parsedObjectId);
         if (!this._isDefined(object))
-            return false;
+            return "Object with given id not found";
     
         var expressionLength = expression.length;
         if (!expressionLength) {
             delete object[propertyName];
-            return !(propertyName in object);
+            return propertyName in object ? "Cound not delete property." : undefined;
         }
     
         try {
@@ -198,14 +199,12 @@ InjectedScript.prototype = {
             var result = inspectedWindow.eval("(" + expression + ")");
             // Store the result in the property.
             object[propertyName] = result;
-            return true;
         } catch(e) {
             try {
                 var result = inspectedWindow.eval("\"" + expression.replace(/"/g, "\\\"") + "\"");
                 object[propertyName] = result;
-                return true;
             } catch(e) {
-                return false;
+                return e.toString();
             }
         }
     },
@@ -213,7 +212,13 @@ InjectedScript.prototype = {
     releaseObject: function(objectId)
     {
         var parsedObjectId = this._parseObjectId(objectId);
-        delete this._idToWrappedObject[parsedObjectId.id];
+        this._releaseObject(parsedObjectId.id);
+    },
+
+    _releaseObject: function(id)
+    {
+        delete this._idToWrappedObject[id];
+        delete this._idToObjectGroupName[id];
     },
 
     _populatePropertyNames: function(object, resultSet)
@@ -245,7 +250,7 @@ InjectedScript.prototype = {
         var parsedObjectId = this._parseObjectId(objectId);
         var object = this._objectForId(parsedObjectId);
         if (!object)
-            return false;
+            return "Could not find object with given id";
         try {
             inspectedWindow.console._objectToEvaluateOn = object;
             return this._evaluateAndWrap(inspectedWindow.eval, inspectedWindow, "(function() {" + expression + "}).call(window.console._objectToEvaluateOn)", parsedObjectId.objectGroup, false, false);
@@ -308,7 +313,7 @@ InjectedScript.prototype = {
     {
         var callFrame = this._callFrameForId(callFrameId);
         if (!callFrame)
-            return false;
+            return "Could not find call frame with given id";
         return this._evaluateAndWrap(callFrame.evaluate, callFrame, expression, objectGroup, true, injectCommandLineAPI);
     },
 
@@ -336,11 +341,6 @@ InjectedScript.prototype = {
         return object;
     },
 
-    resolveNode: function(node)
-    {
-        return this._wrapObject(node);
-    },
-
     _isDefined: function(object)
     {
         return object || this._isHTMLAllCollection(object);
@@ -385,10 +385,14 @@ InjectedScript.prototype = {
         if (obj instanceof inspectedWindow.RegExp)
             return "regexp";
         // FireBug's array detection.
-        if (isFinite(obj.length) && typeof obj.splice === "function")
-            return "array";
-        if (isFinite(obj.length) && typeof obj.callee === "function") // arguments.
-            return "array";
+        try {
+            if (isFinite(obj.length) && typeof obj.splice === "function")
+                return "array";
+            if (isFinite(obj.length) && typeof obj.callee === "function") // arguments.
+                return "array";
+        } catch (e) {
+            return type;
+        }
         if (obj instanceof inspectedWindow.NodeList)
             return "array";
         if (obj instanceof inspectedWindow.HTMLCollection)
@@ -420,11 +424,9 @@ InjectedScript.prototype = {
                 className += "[" + obj.length + "]";
             return className;
         case "string":
-            if (!abbreviated)
-                return obj;
-            if (obj.length > 100)
-                return "\"" + obj.substring(0, 100) + "\u2026\"";
-            return "\"" + obj + "\"";
+            if (abbreviated && obj.length > 100)
+                return obj.substring(0, 100) + "\u2026";
+            return obj;
         case "function":
             var objectText = this._toString(obj);
             if (abbreviated)
@@ -446,10 +448,12 @@ var injectedScript = new InjectedScript();
 
 InjectedScript.RemoteObject = function(objectId, type, description, hasChildren)
 {
-    this.objectId = objectId;
+    if (objectId) {
+        this.objectId = objectId;
+        this.hasChildren = hasChildren;
+    }
     this.type = type;
     this.description = description;
-    this.hasChildren = hasChildren;
 }
 
 InjectedScript.RemoteObject.fromException = function(e)
@@ -473,7 +477,7 @@ InjectedScript.RemoteObject.fromObject = function(object, objectId, abbreviate)
 
 InjectedScript.CallFrameProxy = function(ordinal, callFrame)
 {
-    this.id = { ordinal: ordinal, injectedScriptId: injectedScriptId };
+    this.id = "{\"ordinal\":" + ordinal + ",\"injectedScriptId\":" + injectedScriptId + "}";
     this.type = callFrame.type;
     this.functionName = (this.type === "function" ? callFrame.functionName : "");
     this.sourceID = callFrame.sourceID;
diff --git a/Source/WebCore/inspector/Inspector.idl b/Source/WebCore/inspector/Inspector.idl
deleted file mode 100644
index 216d4b1..0000000
--- a/Source/WebCore/inspector/Inspector.idl
+++ /dev/null
@@ -1,275 +0,0 @@
-/*
- * Copyright (C) 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2011 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-module core {
-    interface [Conditional=INSPECTOR] Inspector {
-        void addScriptToEvaluateOnLoad(in String scriptSource);
-        void removeAllScriptsToEvaluateOnLoad();
-        void reloadPage(in boolean ignoreCache);
-        void populateScriptObjects();
-
-        void openInInspectedWindow(in String url);
-        void setSearchingForNode(in boolean enabled, out boolean newState);
-        [event] void frontendReused();
-        [event] void bringToFront();
-        [event] void disconnectFromBackend();
-        [event] void inspectedURLChanged(out String url);
-        [event] void domContentEventFired(out double time);
-        [event] void loadEventFired(out double time);
-        [event] void reset();
-        [event] void showPanel(out String panel);
-
-        [event] void evaluateForTestInFrontend(out long testCallId, out String script);
-        void didEvaluateForTestInFrontend(in long testCallId, in String jsonResult);
-
-        void highlightDOMNode(in long nodeId);
-        void hideDOMNodeHighlight();
-        void highlightFrame(in unsigned long frameId);
-        void hideFrameHighlight();
-
-        void setUserAgentOverride(in String userAgent);
-
-        void getCookies(out Array cookies, out String cookiesString);
-        void deleteCookie(in String cookieName, in String domain);
-
-        [event] void inspect(out Object objectId, out Object hints);
-
-        // FIXME: dispatch on agents.
-#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
-        void enableProfiler();
-        void disableProfiler();
-        void startProfiling();
-        void stopProfiling();
-#endif // ENABLE_JAVASCRIPT_DEBUGGER
-    };
-
-    interface [Conditional=INSPECTOR] Runtime {
-        void evaluate(in String expression, in String objectGroup, in boolean includeCommandLineAPI, out Value result);
-        void evaluateOn(in Object objectId, in String expression, out Value result);
-        void getProperties(in Object objectId, in boolean ignoreHasOwnProperty, in boolean abbreviate, out Value result);
-        void setPropertyValue(in Object objectId, in String propertyName, in String expression, out Value result);
-        void releaseObject(in Object objectId);
-        void releaseObjectGroup(in long injectedScriptId, in String objectGroup);
-    };
-
-    interface [Conditional=INSPECTOR] Console {
-        void setConsoleMessagesEnabled(in boolean enabled, out boolean newState);
-        [event] void addConsoleMessage(out Object messageObj);
-        [event] void updateConsoleMessageExpiredCount(out unsigned long count);
-        [event] void updateConsoleMessageRepeatCount(out unsigned long count);
-        void clearConsoleMessages();
-        [event] void consoleMessagesCleared();
-        void setMonitoringXHREnabled(in boolean enabled);
-    };
-
-    interface [Conditional=INSPECTOR] Network {
-        void enable(out Object resources);
-        void disable();
-        void resourceContent(in unsigned long frameId, in String url, in boolean base64Encode, out boolean success, out String content);
-        void setExtraHeaders(in Object headers);
-
-        [event] void frameDetachedFromParent(out unsigned long frameId);
-        [event] void identifierForInitialRequest(out long identifier, out String url, out Object loader, out Value callStack);
-        [event] void willSendRequest(out long identifier, out double time, out Object request, out Object redirectResponse);
-        [event] void markResourceAsCached(out long identifier);
-        [event] void didReceiveResponse(out long identifier, out double time, out String resourceType, out Object response);
-        [event] void didReceiveContentLength(out long identifier, out double time, out long lengthReceived);
-        [event] void didFinishLoading(out long identifier, out double finishTime);
-        [event] void didFailLoading(out long identifier, out double time, out String localizedDescription);
-        [event] void didLoadResourceFromMemoryCache(out double time, out Object resource);
-        [event] void setInitialContent(out long identifier, out String sourceString, out String type);
-        [event] void didCommitLoadForFrame(out Object frame, out Object loader);
-        [event] void didCreateWebSocket(out unsigned long identifier, out String requestURL);
-        [event] void willSendWebSocketHandshakeRequest(out unsigned long identifier, out double time, out Object request);
-        [event] void didReceiveWebSocketHandshakeResponse(out unsigned long identifier, out double time, out Object response);
-        [event] void didCloseWebSocket(out unsigned long identifier, out double time);
-    };
-
-#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
-    interface [Conditional=INSPECTOR] Database {
-        void getDatabaseTableNames(in long databaseId, out Array tableNames);
-        void executeSQL(in long databaseId, in String query, out boolean success, out long transactionId);
-
-        [event] void addDatabase(out Object database);
-        [event] void sqlTransactionSucceeded(out long transactionId, out Value columnNames, out Value values);
-        [event] void sqlTransactionFailed(out long transactionId, out Value sqlError);
-    };
-#endif
-
-#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
-    interface [Conditional=INSPECTOR] DOMStorage {
-        void getDOMStorageEntries(in long storageId, out Array entries);
-        void setDOMStorageItem(in long storageId, in String key, in String value, out boolean success);
-        void removeDOMStorageItem(in long storageId, in String key, out boolean success);
-        [event] void addDOMStorage(out Object storage);
-        [event] void updateDOMStorage(out int storageId);
-    };
-#endif
-
-#if defined(ENABLE_OFFLINE_WEB_APPLICATIONS) && ENABLE_OFFLINE_WEB_APPLICATIONS
-    interface [Conditional=INSPECTOR] ApplicationCache {
-        void getApplicationCaches(out Value applicationCaches);
-        [event] void updateApplicationCacheStatus(out int status);
-        [event] void updateNetworkState(out boolean isNowOnline);
-    };
-#endif
-
-    interface [Conditional=INSPECTOR] DOM {
-        void getDocument(out Object root);
-        void getChildNodes(in long nodeId);
-        void querySelector(in long nodeId, in String selectors, in boolean documentWide, out long elementId);
-        void querySelectorAll(in long nodeId, in String selectors, in boolean documentWide, out Array result);
-        void setAttribute(in long elementId, in String name, in String value, out boolean success);
-        void removeAttribute(in long elementId, in String name, out boolean success);
-        void setTextNodeValue(in long nodeId, in String value, out boolean success);
-        void getEventListenersForNode(in long nodeId, out long outNodeId, out Array listenersArray);
-        void copyNode(in long nodeId);
-        void removeNode(in long nodeId, out long outNodeId);
-        void changeTagName(in long nodeId, in String newTagName, out long outNodeId);
-        void getOuterHTML(in long nodeId, out String outerHTML);
-        void setOuterHTML(in long nodeId, in String outerHTML, out long outNodeId);
-        void addInspectedNode(in long nodeId);
-        void performSearch(in String query, in boolean runSynchronously);
-        void searchCanceled();
-        void pushNodeByPathToFrontend(in String path, out long nodeId);
-        void resolveNode(in long nodeId, in String objectGroup, out Value result);
-        void pushNodeToFrontend(in Object objectId, out long nodeId);
-
-        [event] void addNodesToSearchResult(out Array nodeIds);
-        [event] void documentUpdated();
-        [event] void setChildNodes(out long parentId, out Array nodes);
-        [event] void attributesUpdated(out long id, out Array attributes);
-        [event] void characterDataModified(out long id, out String newValue);
-        [event] void setDetachedRoot(out Object root);
-        [event] void childNodeCountUpdated(out long id, out int newValue);
-        [event] void childNodeInserted(out long parentId, out long prevId, out Object node);
-        [event] void childNodeRemoved(out long parentId, out long id);
-    };
-
-    interface [Conditional=INSPECTOR] CSS {
-        void getStylesForNode(in long nodeId, out Value styles);
-        void getComputedStyleForNode(in long nodeId, out Value style);
-        void getInlineStyleForNode(in long nodeId, out Value style);
-        void getAllStyles(out Array styleSheetIds);
-        void getStyleSheet(in String styleSheetId, out Value styleSheet);
-        void getStyleSheetText(in String styleSheetId, out String url, out String text);
-        void setStyleSheetText(in String styleSheetId, in String text, out boolean success);
-        void setPropertyText(in Object styleId, in long propertyIndex, in String text, in boolean overwrite, out Value style);
-        void toggleProperty(in Object styleId, in long propertyIndex, in boolean disable, out Value style);
-        void setRuleSelector(in Object ruleId, in String selector, out Value rule);
-        void addRule(in long contextNodeId, in String selector, out Value rule);
-        void getSupportedCSSProperties(out Array cssProperties);
-    };
-
-    interface [Conditional=INSPECTOR] Timeline {
-        void start();
-        void stop();
-        [event] void timelineProfilerWasStarted();
-        [event] void timelineProfilerWasStopped();
-        [event] void addRecordToTimeline(out Object record);
-    };
-
-#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
-    interface [Conditional=INSPECTOR] Debugger {
-        void enable();
-        void disable();
-        [event] void debuggerWasEnabled();
-        [event] void debuggerWasDisabled();
-
-        [event] void parsedScriptSource(out String sourceID, out String url, out int lineOffset, out int columnOffset, out int length, out int scriptWorldType);
-        [event] void failedToParseScriptSource(out String url, out String data, out int firstLine, out int errorLine, out String errorMessage);
-
-        void activateBreakpoints();
-        void deactivateBreakpoints();
-
-        void setJavaScriptBreakpoint(in String url, in int lineNumber, in int columnNumber, in String condition, in boolean enabled, out String breakpointId, out Array locations);
-        void setJavaScriptBreakpointBySourceId(in String sourceId, in int lineNumber, in int columnNumber, in String condition, in boolean enabled, out String breakpointId, out int actualLineNumber, out int actualColumnNumber);
-        void removeJavaScriptBreakpoint(in String breakpointId);
-        [event] void breakpointResolved(out String breakpointId, out String sourceId, out int lineNumber, out int columnNumber);
-        void continueToLocation(in String sourceId, in int lineNumber, in int columnNumber);
-
-        void stepOver();
-        void stepInto();
-        void stepOut();
-        void pause();
-        [event] void pausedScript(out Object details);
-        void resume();
-        [event] void resumedScript(); // FIXME: Make this out parameter of resume if possible.
-
-        void editScriptSource(in String sourceID, in String newContent, out boolean success, out String result, out Value newCallFrames);
-        void getScriptSource(in String sourceID, out String scriptSource);
-
-        void setPauseOnExceptionsState(in long pauseOnExceptionsState, out long newState);
-
-        void evaluateOnCallFrame(in Object callFrameId, in String expression, in String objectGroup, in boolean includeCommandLineAPI, out Value result);
-
-#if defined(ENABLE_WORKERS) && ENABLE_WORKERS
-        [event] void didCreateWorker(out long id, out String url, out boolean isShared);
-        [event] void didDestroyWorker(out long id);
-#endif // ENABLE_WORKERS
-
-    };
-#endif // ENABLE_JAVASCRIPT_DEBUGGER
-
-#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
-    interface [Conditional=INSPECTOR] BrowserDebugger {
-        void setAllBrowserBreakpoints(in Object breakpoints);
-        void setDOMBreakpoint(in long nodeId, in long type);
-        void removeDOMBreakpoint(in long nodeId, in long type);
-        void setEventListenerBreakpoint(in String eventName);
-        void removeEventListenerBreakpoint(in String eventName);
-        void setXHRBreakpoint(in String url);
-        void removeXHRBreakpoint(in String url);
-    };
-#endif // ENABLE_JAVASCRIPT_DEBUGGER
-
-#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
-    interface [Conditional=INSPECTOR] Profiler {
-        [event] void profilerWasEnabled();
-        [event] void profilerWasDisabled();
-
-        void getProfileHeaders(out Array headers);
-        void getProfile(in String type, in unsigned long uid, out Object profile);
-        void removeProfile(in String type, in unsigned long uid);
-        void clearProfiles();
-
-        // FIXME: split into Profiler and HeapProfiler.
-        void takeHeapSnapshot(in boolean detailed);
-        void getExactHeapSnapshotNodeRetainedSize(in unsigned long uid, in unsigned long nodeId, out long size);
-        [event] void addProfileHeader(out Object header);
-        [event] void addHeapSnapshotChunk(out unsigned long uid, out String chunk);
-        [event] void finishHeapSnapshot(out unsigned long uid);
-        [event] void setRecordingProfile(out boolean isProfiling);
-        [event] void resetProfiles();
-        [event] void reportHeapSnapshotProgress(out int done, out int total);
-    };
-#endif // ENABLE_JAVASCRIPT_DEBUGGER
-}
diff --git a/Source/WebCore/inspector/Inspector.json b/Source/WebCore/inspector/Inspector.json
new file mode 100644
index 0000000..ed5929e
--- /dev/null
+++ b/Source/WebCore/inspector/Inspector.json
@@ -0,0 +1,1445 @@
+[
+    {
+        "domain": "Inspector",
+        "types": [],
+        "commands": [
+            {
+                "name": "didEvaluateForTestInFrontend",
+                "parameters": [
+                    { "name": "testCallId", "type": "integer" },
+                    { "name": "jsonResult", "type": "string" }
+                ]
+            }
+        ],
+        "events": [
+            {
+                "name": "frontendReused"
+            },
+            {
+                "name": "bringToFront"
+            },
+            {
+                "name": "disconnectFromBackend"
+            },
+            {
+                "name": "reset"
+            },
+            {
+                "name": "showPanel",
+                "parameters": [
+                    { "name": "panel", "type": "string" }
+                ]
+            },
+            {
+                "name": "startUserInitiatedDebugging"
+            },
+            {
+                "name": "evaluateForTestInFrontend",
+                "parameters": [
+                    { "name": "testCallId", "type": "integer" },
+                    { "name": "script", "type": "string" }
+                ]
+            },
+            {
+                "name": "inspect",
+                "parameters": [
+                    { "name": "object", "$ref": "RemoteObject" },
+                    { "name": "hints", "type": "object" }
+                ]
+            },
+            {
+                "name": "didCreateWorker",
+                "parameters": [
+                    { "name": "id", "type": "integer" },
+                    { "name": "url", "type": "string" },
+                    { "name": "isShared", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "didDestroyWorker",
+                "parameters": [
+                    { "name": "id", "type": "integer" }
+                ]
+            }
+        ]
+    },
+    {
+        "domain": "Page",
+        "types": [],
+        "commands": [
+            {
+                "name": "addScriptToEvaluateOnLoad",
+                "parameters": [
+                    { "name": "scriptSource", "type": "string" }
+                ]
+            },
+            {
+                "name": "removeAllScriptsToEvaluateOnLoad"
+            },
+            {
+                "name": "reloadPage",
+                "parameters": [
+                    { "name": "ignoreCache", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "openInInspectedWindow",
+                "parameters": [
+                    { "name": "url", "type": "string" }
+                ]
+            },
+            {
+                "name": "setUserAgentOverride",
+                "parameters": [
+                    { "name": "userAgent", "type": "string" }
+                ]
+            },
+            {
+                "name": "getCookies",
+                "returns": [
+                    { "name": "cookies", "type": "array", "items": { "$ref" : "Cookie"} },
+                    { "name": "cookiesString", "type": "string" }
+                ]
+            },
+            {
+                "name": "deleteCookie",
+                "parameters": [
+                    { "name": "cookieName", "type": "string" },
+                    { "name": "domain", "type": "string" }
+                ]
+            }
+        ],
+        "events": [
+            {
+                "name": "inspectedURLChanged",
+                "parameters": [
+                    { "name": "url", "type": "string" }
+                ]
+            },
+            {
+                "name": "domContentEventFired",
+                "parameters": [
+                    { "name": "time", "type": "number" }
+                ]
+            },
+            {
+                "name": "loadEventFired",
+                "parameters": [
+                    { "name": "time", "type": "number" }
+                ]
+            }
+        ]
+    },
+    {
+        "domain": "Runtime",
+        "types": [],
+        "commands": [
+            {
+                "name": "evaluate",
+                "parameters": [
+                    { "name": "expression", "type": "string" },
+                    { "name": "objectGroup", "type": "string" },
+                    { "name": "includeCommandLineAPI", "type": "boolean" }
+                ],
+                "returns": [
+                    { "name": "result", "$ref": "RuntimeObject" }
+                ]
+            },
+            {
+                "name": "evaluateOn",
+                "parameters": [
+                    { "name": "objectId", "type": "string" },
+                    { "name": "expression", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "result", "$ref": "RuntimeObject" }
+                ]
+            },
+            {
+                "name": "getProperties",
+                "parameters": [
+                    { "name": "objectId", "type": "string" },
+                    { "name": "ignoreHasOwnProperty", "type": "boolean" },
+                    { "name": "abbreviate", "type": "boolean" }
+                ],
+                "returns": [
+                    { "name": "result", "type": "array", "items": { "$ref" : "RuntimeProperty"} }
+                ]
+            },
+            {
+                "name": "setPropertyValue",
+                "parameters": [
+                    { "name": "objectId", "type": "string" },
+                    { "name": "propertyName", "type": "string" },
+                    { "name": "expression", "type": "string" }
+                ]
+            },
+            {
+                "name": "releaseObject",
+                "parameters": [
+                    { "name": "objectId", "type": "string" }
+                ]
+            },
+            {
+                "name": "releaseObjectGroup",
+                "parameters": [
+                    { "name": "objectGroup", "type": "string" }
+                ]
+            }
+        ]
+    },
+    {
+        "domain": "Console",
+        "types": [],
+        "commands": [
+            {
+                "name": "enable",
+                "returns": [
+                   { "name": "expiredMessagesCount", "type": "integer" }
+                ]
+            },
+            {
+                "name": "disable"
+           },
+            {
+                "name": "clearConsoleMessages"
+            },
+            {
+                "name": "setMonitoringXHREnabled",
+                "parameters": [
+                    { "name": "enabled", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "addInspectedNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer" }
+                ]
+            }
+        ],
+        "events": [
+            {
+                "name": "consoleMessage",
+                "parameters": [
+                    { "name": "messageObj", "$ref": "ConsoleMessage" }
+                ]
+            },
+           {
+                "name": "consoleMessageRepeatCountUpdated",
+                "parameters": [
+                    { "name": "count", "type": "integer" }
+                ]
+            },
+            {
+                "name": "consoleMessagesCleared"
+            }
+        ]
+    },
+    {
+        "domain": "Network",
+        "description": "Network domain allows tracking network activities of the page. It exposes information about HTTP and WebSocket requests and responses, their headers, bodies, timing, etc. It also allows getting the tree of the Frames on the page along with information about their resources.",
+        "types": [
+            {
+                "id": "ResourceTiming",
+                "type": "object",
+                "description": "Timing information for the request.",
+                "properties": {
+                    "requestTime": { "type": "number", "description": "Timing's requestTime is a baseline in seconds, while the other numbers are ticks in milliseconds relatively to this requestTime." },
+                    "proxyStart": { "type": "number", "description": "Started resolving proxy." },
+                    "proxyEnd": { "type": "number", "description": "Finished resolving proxy." },
+                    "dnsStart": { "type": "number", "description": "Started DNS address resolve." },
+                    "dnsEnd": { "type": "number", "description": "Finished DNS address resolve." },
+                    "connectStart": { "type": "number", "description": "Started connecting to the remote host." },
+                    "connectEnd": { "type": "number", "description": "Connected to the remote host." },
+                    "sslStart": { "type": "number", "description": "Started SSL handshake." },
+                    "sslEnd": { "type": "number", "description": "Finished SSL handshake." },
+                    "sendStart": { "type": "number", "description": "Started sending request." },
+                    "sendEnd": { "type": "number", "description": "Finished sending request." },
+                    "receiveHeadersEnd": { "type": "number", "description": "Finished receiving response headers." }
+                }
+            },
+            {
+                "id": "ResourceRequest",
+                "type": "object",
+                "description": "HTTP request data.",
+                "properties": {
+                    "url": { "type": "string", "description": "Request URL." },
+                    "method": { "type": "string", "description": "HTTP request method." },
+                    "headers": { "type": "object", "description": "HTTP request headers." },
+                    "postData": { "type": "string", "optional": true, "description": "HTTP POST request data." }
+                }
+            },
+            {
+                "id": "ResourceResponse",
+                "type": "object",
+                "description": "HTTP response data.",
+                "properties": {
+                    "status": { "type": "number", "description": "HTTP response status code." },
+                    "statusText": { "type": "string", "description": "HTTP response status text." },
+                    "headers": { "type": "object", "description": "HTTP response headers." },
+                    "mimeType": { "type": "string", "description": "Resource mimeType as determined by the browser." },
+                    "requestHeaders": { "type": "object", "optional": true, "description": "Refined HTTP request headers that were actually transmitted over the network." },
+                    "connectionReused": { "type": "boolean", "description": "Specifies whether physical connection was actually reused for this request." },
+                    "connectionID": { "type": "number", "description": "Physical connection id that was actually used for this request." },
+                    "fromDiskCache": { "type": "boolean", "optional": true, "description": "Specifies that the resource was loaded from the disk cache." },
+                    "timing": { "$ref": "ResourceTiming", "optional": true, "description": "Timing information for the given request." }
+                }
+            },
+            {
+                "id": "CachedResource",
+                "type": "object",
+                "description": "Information about the cached resource.",
+                "properties": {
+                    "url": { "type": "string", "description": "Resource URL." },
+                    "type": { "type": "string", "description": "Type of this resource. // FIXME" },
+                    "response": { "$ref": "ResourceResponse", "description": "Cached response data." },
+                    "bodySize": { "type": "number", "description": "Cached response body size." }
+                }
+            },
+            {
+                "id": "Frame",
+                "type": "object",
+                "description": "Information about the Frame on the page.",
+                "properties": {
+                    "id": { "type": "string", "description": "Frame unique identifier." },
+                    "parentId": { "type": "string", "description": "Parent frame identifier." },
+                    "loaderId": { "type": "string", "description": "Identifier of the loader associated with this frame." },
+                    "name": { "type": "string", "optional": true, "description": "Frame's name as specified in the tag." },
+                    "url": { "type": "string", "description": "Frame document's URL." }
+                }
+            },
+            {
+                "id": "FrameResourceTree",
+                "type": "object",
+                "description": "Information about the Frame hierarchy along with their cached resources.",
+                "properties": {
+                    "frame": { "$ref": "Frame", "description": "Frame information for this tree item." },
+                    "childFrames": { "type": "array", "optional": true, "items": { "$ref": "FrameResourceTree" }, "description": "Child frames." },
+                    "resources": { "type": "array",
+                        "items": {
+                            "type": "object",
+                            "properties": {
+                                "url": { "type": "string", "description": "Resource URL." },
+                                "type": { "type": "string", "description": "Type of this resource. // FIXME" }
+                            }
+                        },
+                        "description": "Information about frame resources."
+                    }
+                }
+            }
+        ],
+        "commands": [
+            {
+                "name": "enable",
+                "description": "Enables network tracking, network events will now be delivered to the client."
+            },
+            {
+                "name": "disable",
+                "description": "Disables network tracking, prevents network events from being sent to the client."
+            },
+            {
+                "name": "getCachedResources",
+                "description": "Returns present frame / resource tree structure.",
+                "returns": [
+                    { "name": "frameTree", "$ref": "FrameResourceTree", "description": "Present frame / resource tree structure." }
+                ]
+            },
+            {
+                "name": "getResourceContent",
+                "description": "Returns content of the given resource.",
+                "parameters": [
+                    { "name": "frameId", "type": "string", "description": "Frame id to get resource for."  },
+                    { "name": "url", "type": "string", "description": "URL of the resource to get content for."  },
+                    { "name": "base64Encode", "type": "boolean", "optional": true, "description": "Requests that resource content is served as base64."  }
+                ],
+                "returns": [
+                    { "name": "content", "type": "string", "description": "Resource content." }
+                ]
+            },
+            {
+                "name": "setExtraHeaders",
+                "description": "Allows sending extra HTTP headers with the requests from this page.",
+                "parameters": [
+                    { "name": "headers", "type": "object", "description": "Map with extra HTTP headers." }
+                ]
+            }
+        ],
+        "events": [
+            {
+                "name": "frameDetached",
+                "description": "Fired when frame has been detached from its parent.",
+                "parameters": [
+                    { "name": "frameId", "type": "string", "description": "If of the frame that has been detached." }
+                ]
+            },
+            {
+                "name": "requestWillBeSent",
+                "description": "Fired when page is about to send HTTP request.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "frameId", "type": "string", "description": "Frame identifier." },
+                    { "name": "loaderId", "type": "string", "description": "Loader identifier." },
+                    { "name": "documentURL", "type": "string", "description": "URL of the document this resource is loaded for." },
+                    { "name": "request", "$ref": "ResourceRequest", "description": "Request data." },
+                    { "name": "redirectResponse", "$ref": "ResourceResponse", "description": "Redirect response data." },
+                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "callStack", "type": "array", "items": { "$ref" : "DebuggerStackFrame"}, "description": "JavaScript stack trace upon issuing this request." }
+                ]
+            },
+            {
+                "name": "resourceMarkedAsCached",
+                "description": "Fired when request is known to be served from memory cache.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." }
+                ]
+            },
+            {
+                "name": "responseReceived",
+                "description": "Fired when HTTP response is available.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "resourceType", "type": "string", "description": "Resource type. // FIXME" },
+                    { "name": "response", "$ref": "ResourceResponse", "description": "Response data." }
+                ]
+            },
+            {
+                "name": "dataReceived",
+                "description": "Fired when data chunk was received over the network.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "dataLength", "type": "integer", "description": "Data chunk length." },
+                    { "name": "lengthReceived", "type": "integer", "description": "Actual bytes received (might be less than dataLength for compressed encodings)." }
+                ]
+            },
+            {
+                "name": "loadingFinished",
+                "description": "Fired when HTTP request has finished loading.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "finishTime", "type": "number", "description": "Timestamp." }
+                ]
+            },
+            {
+                "name": "loadingFailed",
+                "description": "Fired when HTTP request has failed to load.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "errorText", "type": "string", "description": "User friendly error message." }
+                ]
+            },
+            {
+                "name": "resourceLoadedFromMemoryCache",
+                "description": "Fired when HTTP request has been served from memory cache.",
+                "parameters": [
+                    { "name": "frameId", "type": "string", "description": "Frame identifier." },
+                    { "name": "loaderId", "type": "string", "description": "Loader identifier." },
+                    { "name": "documentURL", "type": "string", "description": "URL of the document this resource is loaded for." },
+                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "resource", "$ref": "CachedResource", "description": "Cached resource data." }
+                ]
+            },
+            {
+                "name": "initialContentSet",
+                "description": "Fired for XMLHttpRequests when their content becomes available.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "content", "type": "string", "description": "Resource content." },
+                    { "name": "type", "type": "string", "description": "Resource type. // FIXME" }
+                ]
+            },
+            {
+                "name": "frameNavigated",
+                "description": "Fired once navigation of the frame has completed. Frame is now associated with the new loader.",
+                "parameters": [
+                    { "name": "frame", "$ref": "Frame", "description": "Frame identifier." },
+                    { "name": "loaderId", "type": "string", "description": "Loader identifier." }
+                ]
+            },
+            {
+                "name": "webSocketWillSendHandshakeRequest",
+                "description": "Fired when WebSocket is about to initiate handshake.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "request", "type": "object", "description": "WebSocket request data." }
+                ]
+            },
+            {
+                "name": "webSocketHandshakeResponseReceived",
+                "description": "Fired when WebSocket handshake response becomes available.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "time", "type": "number", "description": "Timestamp." },
+                    { "name": "response", "type": "object", "description": "WebSocket response data." }
+                ]
+            },
+            {
+                "name": "webSocketCreated",
+                "description": "Fired upon WebSocket creation.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "url", "type": "string", "description": "WebSocket request URL." }
+                ]
+            },
+            {
+                "name": "webSocketClosed",
+                "description": "Fired when WebSocket is closed.",
+                "parameters": [
+                    { "name": "identifier", "type": "integer", "description": "Request identifier." },
+                    { "name": "time", "type": "number", "description": "Timestamp." }
+                ]
+            }
+        ]
+    },
+    {
+        "domain": "Database",
+        "types": [],
+        "commands": [
+            {
+                "name": "getDatabaseTableNames",
+                "parameters": [
+                    { "name": "databaseId", "type": "integer" }
+                ],
+                "returns": [
+                    { "name": "tableNames", "type": "array", "items": { "type": "string" } }
+                ]
+            },
+            {
+                "name": "executeSQL",
+                "parameters": [
+                    { "name": "databaseId", "type": "integer" },
+                    { "name": "query", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "success", "type": "boolean" },
+                    { "name": "transactionId", "type": "integer" }
+                ]
+            }
+        ],
+        "events": [
+            {
+                "name": "addDatabase",
+                "parameters": [
+                    { "name": "database", "$ref": "DatabaseDatabase" }
+                ]
+            },
+            {
+                "name": "sqlTransactionSucceeded",
+                "parameters": [
+                    { "name": "transactionId", "type": "integer" },
+                    { "name": "columnNames", "type": "array", "items": { "type": "string" } },
+                    { "name": "values", "type": "array", "items": { "type": "string or number" }}
+                ]
+            },
+            {
+                "name": "sqlTransactionFailed",
+                "parameters": [
+                    { "name": "transactionId", "type": "integer" },
+                    { "name": "sqlError", "$ref": "DatabaseError" }
+                ]
+            }
+        ]
+    },
+    {
+        "domain": "DOMStorage",
+        "types": [],
+        "commands": [
+            {
+                "name": "getDOMStorageEntries",
+                "parameters": [
+                    { "name": "storageId", "type": "integer" }
+                ],
+                "returns": [
+                    { "name": "entries", "type": "array", "items": { "$ref" : "DOMStorageEntry"} }
+                ]
+            },
+            {
+                "name": "setDOMStorageItem",
+                "parameters": [
+                    { "name": "storageId", "type": "integer" },
+                    { "name": "key", "type": "string" },
+                    { "name": "value", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "success", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "removeDOMStorageItem",
+                "parameters": [
+                    { "name": "storageId", "type": "integer" },
+                    { "name": "key", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "success", "type": "boolean" }
+                ]
+            }
+        ],
+        "events": [
+            {
+                "name": "addDOMStorage",
+                "parameters": [
+                    { "name": "storage", "$ref": "DOMStorageStorage" }
+                ]
+            },
+            {
+                "name": "updateDOMStorage",
+                "parameters": [
+                    { "name": "storageId", "type": "integer" }
+                ]
+            }
+        ]
+    },
+    {
+        "domain": "ApplicationCache",
+        "types": [],
+        "commands": [
+            {
+                "name": "getApplicationCaches",
+                "returns": [
+                    { "name": "applicationCaches", "$ref": "AppCache" }
+                ]
+            }
+        ],
+        "events": [
+            {
+                "name": "updateApplicationCacheStatus",
+                "parameters": [
+                    { "name": "status", "type": "integer" }
+                ]
+            },
+            {
+                "name": "updateNetworkState",
+                "parameters": [
+                    { "name": "isNowOnline", "type": "boolean" }
+                ]
+            }
+        ]
+    },
+    {
+        "domain": "DOM",
+        "description": "This domain exposes DOM read/write operations. Each DOM Node is represented with its mirror object that has an <code>id</code>. This <code>id</code> can be used to get additional information on the Node, convert it into the JavaScript object, etc. It is important that client receives DOM events only for the nodes that are known to the client. Backend keeps track of the nodes that were sent to the client and never sends the same node twice. It is client's responsibility to collect information about the nodes that were sent to the client.",
+        "types": [
+            {
+                "id": "DOMNode",
+                "type": "object",
+                "properties": {
+                    "id": { "type": "integer", "description": "Node identifier that is passed into the rest of the DOM messages as the <code>nodeId</code>. Backend will only push node with given <code>id</code> once. It is aware of all requested nodes and will only fire DOM events for nodes known to the client." },
+                    "nodeType": { "type": "integer",  "description": "<code>Node</code>'s nodeType." },
+                    "nodeName": { "type": "string", "description": "<code>Node</code>'s nodeName." },
+                    "localName": { "type": "string", "description": "<code>Node</code>'s localName." },
+                    "nodeValue": { "type": "string", "description": "<code>Node</code>'s nodeValue." },
+                    "childNodeCount": { "type": "integer", "optional": true, "description": "Child count for <code>Container</code> nodes." },
+                    "children": { "type": "array", "optional": true, "items": { "$ref" : "DOMNode" }, "description": "Child nodes of this node when requested with children." },
+                    "attributes": { "type": "array", "optional": true, "items": { "type" : "string" }, "description": "Attributes of the <code>Element</code> node in the form of flat array <code>[name1, value1, name2, value2]</code>." },
+                    "documentURL": { "type": "string", "optional": true, "description": "Document URL that <code>Document</code> or <code>FrameOwner</code> node points to." },
+                    "publicId": { "type": "string", "optional": true, "description": "<code>DocumentType</code>'s publicId. // FIXME" },
+                    "systemId": { "type": "string", "optional": true, "description": "<code>DocumentType</code>'s systemId. // FIXME" },
+                    "internalSubset": { "type": "string", "optional": true, "description": "<code>DocumentType</code>'s internalSubset. // FIXME" },
+                    "name": { "type": "string", "optional": true, "description": "<code>Attr</code>'s name. // FIXME" },
+                    "value": { "type": "string", "optional": true, "description": "<code>Attr</code>'s value. // FIXME" }
+                },
+                "description": "DOM interaction is implemented in terms of mirror objects that represent the actual DOM nodes. DOMNode is a base node mirror type."
+            },
+            {
+                "id": "DOMEventListener",
+                "type": "object",
+                "properties": {
+                    "type": { "type": "string", "description": "<code>EventListener</code>'s type." },
+                    "useCapture": { "type": "boolean", "description": "<code>EventListener</code>'s useCapture." },
+                    "isAttribute": { "type": "boolean", "description": "<code>EventListener</code>'s isAttribute." },
+                    "nodeId": { "type": "integer",  "description": "Target <code>DOMNode</code> id." },
+                    "listenerBody": { "type": "string", "description": "Listener function body." },
+                    "sourceName": { "type": "string", "optional" : true, "description": "Handler location source name." },
+                    "lineNumber": { "type": "number", "optional" : true, "description": "Handler location line number." }
+                },
+                "description": "DOM interaction is implemented in terms of mirror objects that represent the actual DOM nodes. DOMNode is a base node mirror type."
+            }
+        ],
+        "commands": [
+            {
+                "name": "getDocument",
+                "returns": [
+                    { "name": "root", "$ref": "DOMNode", "description": "Resulting node." }
+                ],
+                "description": "Returns the root DOM node to the caller."
+            },
+            {
+                "name": "getChildNodes",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to get children for." }
+                ],
+                "description": "Requests that children of the node with given id are returned to the caller in form of <code>setChildNodes</code> events."
+            },
+            {
+                "name": "querySelector",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to query upon." },
+                    { "name": "selectors", "type": "string", "description": "Selector string." },
+                    { "name": "documentWide", "type": "boolean", "description": "Set to true to start querying from the node's document." }
+                ],
+                "returns": [
+                    { "name": "elementId", "type": "integer", "description": "Query selector result." }
+                ],
+                "description": "Executes <code>querySelector</code> on a given node. Setting <code>documentWide</code> to true starts selecting from the document node."
+            },
+            {
+                "name": "querySelectorAll",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to query upon." },
+                    { "name": "selectors", "type": "string", "description": "Selector string." },
+                    { "name": "documentWide", "type": "boolean", "description": "Set to true to start querying from the node's document." }
+                ],
+                "returns": [
+                    { "name": "nodeIds", "type": "array", "items": { "type": "integer" }, "description": "Query selector result."  }
+                ],
+                "description": "Executes <code>querySelectorAll</code> on a given node. Setting <code>documentWide</code> to true starts selecting from the document node."
+            },
+            {
+                "name": "setNodeName",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to set name for."  },
+                    { "name": "name", "type": "string", "description": "New node's name." }
+                ],
+                "returns": [
+                    { "name": "outNodeId", "type": "integer", "description": "New node's id." }
+                ],
+                "description": "Sets node name for a node with given id."
+            },
+            {
+                "name": "setNodeValue",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to set value for." },
+                    { "name": "value", "type": "string", "description": "New node's value." }
+                ],
+                "description": "Sets node value for a node with given id."
+            },
+            {
+                "name": "removeNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to remove." }
+                ],
+                "description": "Removes node with given id."
+            },
+            {
+                "name": "setAttribute",
+                "parameters": [
+                    { "name": "elementId", "type": "integer", "description": "Id of the element to set attribute for." },
+                    { "name": "name", "type": "string", "description": "Attribute name." },
+                    { "name": "value", "type": "string", "description": "Attribute value." }
+                ],
+                "description": "Sets attribute for an element with given id."
+            },
+            {
+                "name": "removeAttribute",
+                "parameters": [
+                    { "name": "elementId", "type": "integer", "description": "Id of the element to remove attribute from." },
+                    { "name": "name", "type": "string", "description": "Name of the attribute to remove." }
+                ],
+                "description": "Removes attribute with given name from an element with given id."
+            },
+            {
+                "name": "getEventListenersForNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to get listeners for." }
+                ],
+                "returns": [
+                    { "name": "listenersArray", "type": "array", "items": { "$ref" : "DOMEventListener"}, "description": "Array of relevant listeners." }
+                ],
+                "description": "Returns event listeners relevant to the node."
+            },
+            {
+                "name": "copyNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to copy." }
+                ],
+                "description": "Copies node's HTML markup into the clipboard."
+            },
+            {
+                "name": "getOuterHTML",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to get markup for." }
+                ],
+                "returns": [
+                    { "name": "outerHTML", "type": "string", "description": "Outer HTML markup." }
+                ],
+                "description": "Returns node's HTML markup."
+            },
+            {
+                "name": "setOuterHTML",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to set markup for." },
+                    { "name": "outerHTML", "type": "string", "description": "Outer HTML markup to set." }
+                ],
+                "returns": [
+                    { "name": "outNodeId", "type": "integer", "description": "Setting outer HTML can change node's id." }
+                ],
+                "description": "Sets node HTML markup, returns new node id."
+            },
+            {
+                "name": "performSearch",
+                "parameters": [
+                    { "name": "query", "type": "string", "description": "Plain text or query selector or XPath search query." },
+                    { "name": "runSynchronously", "type": "boolean", "description": "When set to true, performing search synchronously (can block user interaction)." }
+                ],
+                "description": "Starts asynchronous search for a given string in the DOM tree. Use <code>cancelSearch</code> to stop given asynchronous search task."
+            },
+            {
+                "name": "cancelSearch",
+                "description": "Cancels asynchronous search started with <code>performSearch</code>."
+            },
+            {
+                "name": "pushNodeToFrontend",
+                "parameters": [
+                    { "name": "objectId", "type": "string", "description": "JavaScript object id to convert into node." }
+                ],
+                "returns": [
+                    { "name": "nodeId", "type": "integer", "description": "Node id for given object." }
+                ],
+                "description": "Requests that the node is sent to the caller given the JavaScript node object reference."
+            },
+            {
+                "name": "setSearchingForNode",
+                "parameters": [
+                    { "name": "enabled", "type": "boolean" }
+                ],
+                "returns": [
+                    { "name": "newState", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "highlightDOMNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer" }
+                ]
+            },
+            {
+                "name": "hideDOMNodeHighlight"
+            },
+            {
+                "name": "highlightFrame",
+                "parameters": [
+                    { "name": "frameId", "type": "string" }
+                ]
+            },
+            {
+                "name": "hideFrameHighlight"
+            },
+
+            {
+                "name": "pushNodeByPathToFrontend",
+                "parameters": [
+                    { "name": "path", "type": "string", "description": "Path to node in the proprietary format." }
+                ],
+                "returns": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node for given path." }
+                ],
+                "description": "Requests that the node is sent to the caller given its path. // FIXME, use XPath"
+            },
+            {
+                "name": "resolveNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Id of the node to resolve." }
+                ],
+                "returns": [
+                    { "name": "object", "$ref": "Object", "description": "JavaScript object wrapper for given node." }
+                ],
+                "description": "Resolves JavaScript node object for given node id."
+            }
+        ],
+        "events": [
+            {
+                "name": "documentUpdated",
+                "description": "Fired when <code>Document</code> has been totally updated. Node ids are no longer valid."
+            },
+            {
+                "name": "setChildNodes",
+                "parameters": [
+                    { "name": "parentId", "type": "integer", "description": "Parent node id to populate with children." },
+                    { "name": "nodes", "type": "array", "items": { "$ref" : "DOMNode"}, "description": "Child nodes array." }
+                ],
+                "description": "Fired when backend wants to provide client with the missing DOM structure. This happens upon most of the calls requesting node ids."
+            },
+            {
+                "name": "attributesUpdated",
+                "parameters": [
+                    { "name": "id", "type": "integer", "description": "Id of the node that has changed." },
+                    { "name": "attributes", "type": "array", "items": { "$ref" : "DOMAttribute"}, "description": "New attributes value." }
+                ],
+                "description": "Fired when <code>Element</code>'s attributes are updated."
+            },
+            {
+                "name": "characterDataModified",
+                "parameters": [
+                    { "name": "id", "type": "integer", "description": "Id of the node that has changed." },
+                    { "name": "newValue", "type": "string", "description": "New text value." }
+                ],
+                "description": "Mirrors <code>DOMCharacterDataModified</code> event."
+            },
+            {
+                "name": "childNodeCountUpdated",
+                "parameters": [
+                    { "name": "id", "type": "integer", "description": "Id of the node that has changed." },
+                    { "name": "newValue", "type": "integer", "description": "New node count." }
+                ],
+                "description": "Fired when <code>Container</code>'s child node count has changed."
+            },
+            {
+                "name": "childNodeInserted",
+                "parameters": [
+                    { "name": "parentId", "type": "integer", "description": "Id of the node that has changed." },
+                    { "name": "prevId", "type": "integer", "description": "If of the previous siblint." },
+                    { "name": "node", "$ref": "DOMNode", "description": "Inserted node data." }
+                ],
+                "description": "Mirrors <code>DOMNodeInserted</code> event."
+            },
+            {
+                "name": "childNodeRemoved",
+                "parameters": [
+                    { "name": "parentId", "type": "integer", "description": "Parent id." },
+                    { "name": "id", "type": "integer", "description": "Id of the node that has been removed." }
+                ],
+                "description": "Mirrors <code>DOMNodeRemoved</code> event."
+            },
+            {
+                "name": "searchResults",
+                "parameters": [
+                    { "name": "nodeIds", "type": "array", "items": { "type": "integer" }, "description": "Ids of the search result nodes." }
+                ],
+                "description": "Pushes search results initiated using <code>performSearch</code> to the client."
+            }
+        ]
+    },
+    {
+        "domain": "CSS",
+        "types": [],
+        "commands": [
+            {
+                "name": "getStylesForNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer" }
+                ],
+                "returns": [
+                    { "name": "styles", "$ref": "CSSNodeStyles" }
+                ]
+            },
+            {
+                "name": "getComputedStyleForNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer" }
+                ],
+                "returns": [
+                    { "name": "style", "$ref": "CSSComputedStyle" }
+                ]
+            },
+            {
+                "name": "getInlineStyleForNode",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer" }
+                ],
+                "returns": [
+                    { "name": "style", "$ref": "CSSStyle" }
+                ]
+            },
+            {
+                "name": "getAllStyleSheets",
+                "returns": [
+                    { "name": "styleSheetInfos", "type": "array", "items": { "$ref": "CSSStyleSheetInfo" } }
+                ]
+            },
+            {
+                "name": "getStyleSheet",
+                "parameters": [
+                    { "name": "styleSheetId", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "styleSheet", "$ref": "CSSStyleSheet" }
+                ]
+            },
+            {
+                "name": "getStyleSheetText",
+                "parameters": [
+                    { "name": "styleSheetId", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "url", "type": "string" },
+                    { "name": "text", "type": "string" }
+                ]
+            },
+            {
+                "name": "setStyleSheetText",
+                "parameters": [
+                    { "name": "styleSheetId", "type": "string" },
+                    { "name": "text", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "success", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "setPropertyText",
+                "parameters": [
+                    { "name": "styleId", "$ref": "CSSStyleId" },
+                    { "name": "propertyIndex", "type": "integer" },
+                    { "name": "text", "type": "string" },
+                    { "name": "overwrite", "type": "boolean" }
+                ],
+                "returns": [
+                    { "name": "style", "$ref": "CSSStyle" }
+                ]
+            },
+            {
+                "name": "toggleProperty",
+                "parameters": [
+                    { "name": "styleId", "$ref": "CSSStyleId" },
+                    { "name": "propertyIndex", "type": "integer" },
+                    { "name": "disable", "type": "boolean" }
+                ],
+                "returns": [
+                    { "name": "style", "$ref": "CSSStyle" }
+                ]
+            },
+            {
+                "name": "setRuleSelector",
+                "parameters": [
+                    { "name": "ruleId", "$ref": "CSSRuleId" },
+                    { "name": "selector", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "rule", "$ref": "CSSRule" }
+                ]
+            },
+            {
+                "name": "addRule",
+                "parameters": [
+                    { "name": "contextNodeId", "type": "integer" },
+                    { "name": "selector", "type": "string" }
+                ],
+                "returns": [
+                    { "name": "rule", "$ref": "CSSRule" }
+                ]
+            },
+            {
+                "name": "getSupportedCSSProperties",
+                "returns": [
+                    { "name": "cssProperties", "type": "array", "items": { "type": "string" } }
+                ]
+            }
+        ]
+    },
+    {
+        "domain": "Timeline",
+        "description": "Timeline provides its clients with instrumentation records that are generated during the page runtime. Timeline instrumentation can be started and stopped using corresponding commands. While timeline is started, it is generating timeline event records.",
+        "types": [
+            {
+                "id": "TimelineRecord",
+                "type": "object",
+                "properties": {
+                    "type": { "type": "string", "description": "Event type." },
+                    "data": { "type": "object", "description": "Event data." },
+                    "children": { "type": "array", "optional" : true, "items": { "$ref": "TimelineRecord" }, "description": "Nested records." }
+                },
+                "description": "Timeline record contains information about the recorded activity."
+            }
+        ],
+        "commands": [
+            {
+                "name": "start",
+                "description": "Starts capturing instrumentation events."
+            },
+            {
+                "name": "stop",
+                "description": "Stops capturing instrumentation events."
+            }
+        ],
+        "events": [
+            {
+                "name": "started",
+                "description": "Fired when timeline has been started."
+            },
+            {
+                "name": "stopped",
+                "description": "Fired when timeline has been stopped."
+            },
+            {
+                "name": "eventRecorded",
+                "parameters": [
+                    { "name": "record", "$ref": "TimelineRecord", "description": "Timeline record data." }
+                ],
+                "description": "Fired for every instrumentation event while timeline is started."
+            }
+        ]
+    },
+    {
+        "domain": "Debugger",
+        "description": "Debugger domain exposes JavaScript debugging functions. It allows setting and removing breakpoints, stepping through execution, exploring stack traces, etc.",
+        "types": [
+            {
+                "id": "Location",
+                "type": "object",
+                "properties": {
+                    "sourceID": { "type": "string",  "description": "Script identifier as reported by the <code>scriptParsed</code>" },
+                    "lineNumber": { "type": "integer", "description": "Line number in the script." },
+                    "columnNumber": { "type": "integer", "description": "Column number in the script." }
+                },
+                "description": "Location in the source code."
+            },
+            {
+                "id": "CallFrame",
+                "type": "object",
+                "properties": {
+                    "id": { "type": "string",  "description": "Call frame identifier" },
+                    "type": { "type": "string", "description": "Call frame type. // FIXME" },
+                    "functionName": { "type": "string", "description": "Name of the function called on this frame." },
+                    "sourceID": { "type": "string", "description": "Script identifier." },
+                    "line": { "type": "integer", "description": "Line number in the script." },
+                    "column": { "type": "integer", "description": "Column number in the script." },
+                    "scopeChain": { "type": "array", "items": { "type": "object" }, "description": "Scope chain for given call frame. // FIXME" }
+                },
+                "description": "Debugger call frame. Array of call frames form call stack."
+            }
+        ],
+        "commands": [
+            {
+                "name": "enable",
+                "description": "Enables debugger for given page."
+            },
+            {
+                "name": "disable",
+                "description": "Disables debugger for given page."
+            },
+            {
+                "name": "setBreakpointsActive",
+                "parameters": [
+                    { "name": "active", "type": "boolean", "description": "New value for breakpoints active state." }
+                ],
+                "description": "Activates / deactivates all breakpoints on the page."
+            },
+            {
+                "name": "setBreakpointByUrl",
+                "parameters": [
+                    { "name": "url", "type": "string", "description": "URL of the resource to set breakpoint on." },
+                    { "name": "lineNumber", "type": "integer", "description": "Line number to set breakpoint at." },
+                    { "name": "columnNumber", "type": "integer", "optional": true, "description": "Offset in the line to set breakpoint at." },
+                    { "name": "condition", "type": "string", "optional": true, "description": "Expression to use as a breakpoint condition. When specified, debugger will only stop on the breakpoint if this expression evaluates to true." },
+                    { "name": "enabled", "type": "boolean", "optional": true, "description": "Determines initial state for the breakpoint." }
+                ],
+                "returns": [
+                    { "name": "breakpointId", "type": "string", "description": "Id of the created breakpoint for further manipulations." },
+                    { "name": "locations", "type": "array", "items": { "$ref" : "Location"}, "description": "List of the locations this breakpoint resolved into."  }
+                ],
+                "description": "Sets JavaScript breakpoint at a given location specified by URL. This breakpoint will survive page reload."
+            },
+            {
+                "name": "setBreakpoint",
+                "parameters": [
+                    { "name": "sourceId", "type": "string", "description": "Source ID of the resource to set breakpoint on (as reported by <code>scriptParsed</code>)." },
+                    { "name": "lineNumber", "type": "integer", "description": "Line number to set breakpoint at." },
+                    { "name": "columnNumber", "type": "integer", "optional": true, "description": "Offset in the line to set breakpoint at." },
+                    { "name": "condition", "type": "string", "optional": true, "description": "Expression to use as a breakpoint condition. When specified, debugger will only stop on the breakpoint if this expression evaluates to true." },
+                    { "name": "enabled", "type": "boolean", "optional": true, "description": "Determines initial state for the breakpoint." }
+                ],
+                "returns": [
+                    { "name": "breakpointId", "type": "string", "description": "Id of the created breakpoint for further manipulations." },
+                    { "name": "actualLineNumber", "type": "integer", "description": "Line number in the script." },
+                    { "name": "actualColumnNumber", "type": "integer", "description": "Column number in the script." }
+                ],
+                "description": "Sets JavaScript breakpoint at a given location."
+            },
+            {
+                "name": "removeBreakpoint",
+                "parameters": [
+                    { "name": "breakpointId", "type": "string" }
+                ],
+                "description": "Removes JavaScript breakpoint."
+            },
+            {
+                "name": "continueToLocation",
+                "parameters": [
+                    { "name": "sourceId", "type": "string", "description": "Source ID of the resource to continue to (as reported by <code>scriptParsed</code>)." },
+                    { "name": "lineNumber", "type": "integer", "description": "Line number to stop at." },
+                    { "name": "columnNumber", "type": "integer", "description": "Column number to stop at." }
+                ],
+                "description": "Continues execution until specific location is reached."
+            },
+            {
+                "name": "stepOver",
+                "description": "Steps over the statement."
+            },
+            {
+                "name": "stepInto",
+                "description": "Steps into the statement."
+            },
+            {
+                "name": "stepOut",
+                "description": "Steps out of the function."
+            },
+            {
+                "name": "pause",
+                "description": "Stops on the next JavaScript statement."
+            },
+            {
+                "name": "resume",
+                "description": "Resumes JavaScript execution."
+            },
+            {
+                "name": "editScriptSource",
+                "parameters": [
+                    { "name": "sourceID", "type": "string", "description": "Id of the script to edit." },
+                    { "name": "newContent", "type": "string", "description": "New content of the script." }
+                ],
+                "returns": [
+                    { "name": "result", "type": "string", "description": "New content of the script." },
+                    { "name": "stackFrames", "type": "array", "items": { "$ref" : "CallFrame"}, "description": "New stack trace in case editing has happened while VM was stopped." }
+                ],
+                "description": "Edits JavaScript script live."
+            },
+            {
+                "name": "getScriptSource",
+                "parameters": [
+                    { "name": "sourceID", "type": "string", "description": "Id of the script to get source for." }
+                ],
+                "returns": [
+                    { "name": "scriptSource", "type": "string", "description": "Script source." }
+                ],
+                "description": "Returns source for the script with given ID."
+            },
+            {
+                "name": "setPauseOnExceptionsState",
+                "parameters": [
+                    { "name": "pauseOnExceptionsState", "type": "integer", "description": "Pause on exceptions mode. // FIXME, make enumerable." }
+                ],
+                "description": "Defines pause on exceptions state. Can be set to stop on all exceptions, uncaught exceptions or no exceptions."
+            },
+            {
+                "name": "evaluateOnCallFrame",
+                "parameters": [
+                    { "name": "callFrameId", "type": "string", "description": "Call frame identifier to evaluate on. This identifier is a part of backtrace reported by the <code>pausedScript</code>." },
+                    { "name": "expression", "type": "string", "description": "Expression to evaluate." },
+                    { "name": "objectGroup", "type": "string", "description": "String object group name to put result into (allows rapid releasing resulting object handles using <code>releaseObjectGroup</code>)." },
+                    { "name": "includeCommandLineAPI", "type": "boolean", "optional": true, "description": "Specifies whether command line API should be available to the evaluated expression, defaults to false." }
+                ],
+                "returns": [
+                    { "name": "result", "$ref": "Object", "description": "Object wrapper for the evaluation result." }
+                ],
+                "description": "Evaluates expression on a given call frame."
+            }
+        ],
+        "events": [
+            {
+                "name": "debuggerWasEnabled",
+                "description": "Fired when debugger gets enabled."
+            },
+            {
+                "name": "debuggerWasDisabled",
+                "description": "Fired when debugger gets disabled."
+            },
+            {
+                "name": "scriptParsed",
+                "parameters": [
+                    { "name": "sourceID", "type": "string", "description": "Identifier of the script parsed." },
+                    { "name": "url", "type": "string", "description": "URL of the script parsed (if any)." },
+                    { "name": "lineOffset", "type": "integer", "description": "Line offset of the script within the resource with given URL (for script tags)." },
+                    { "name": "columnOffset", "type": "integer", "description": "Column offset of the script within the resource with given URL." },
+                    { "name": "length", "type": "integer", "description": "Length of the script" },
+                    { "name": "scriptWorldType", "type": "integer", "description": "Script type. // FIXME." }
+                ],
+                "description": "Fired when virtual machine parses script. This even is also fired for all known scripts upon enabling debugger."
+            },
+            {
+                "name": "scriptFailedToParse",
+                "parameters": [
+                    { "name": "url", "type": "string", "description": "URL of the script that failed to parse." },
+                    { "name": "data", "type": "string", "description": "Source text of the script that failed to parse." },
+                    { "name": "firstLine", "type": "integer", "description": "Line offset of the script within the resource." },
+                    { "name": "errorLine", "type": "integer", "description": "Line with error." },
+                    { "name": "errorMessage", "type": "string", "description": "Parse error message." }
+                ],
+                "description": "Fired when virtual machine fails to parse the script."
+            },
+            {
+                "name": "breakpointResolved",
+                "parameters": [
+                    { "name": "breakpointId", "type": "string", "description": "Breakpoint unique identifier." },
+                    { "name": "sourceId", "type": "string", "description": "Identifier of the script breakpoint is set in." },
+                    { "name": "lineNumber", "type": "integer", "description": "Line number of the statement breakpoint is set on." },
+                    { "name": "columnNumber", "type": "integer", "description": "Column offset of the statement breakpoint is set on." }
+                ],
+                "description": "Fired when breakpoint is resolved to an actual script and location."
+            },
+            {
+                "name": "paused",
+                "parameters": [
+                    { 
+                        "name": "details",
+                        "type": "object",
+                        "properties": {
+                            "callFrames": { "type": "array", "items": { "$ref": "CallFrame" }, "description": "Call stack the virtual machine stopped on." }
+                        },
+                        "description": "Call stack information."
+                    }
+                ],
+                "description": "Fired when the virtual machine stopped on breakpoint or exception or any other stop criteria."
+            },
+            {
+                "name": "resumed",
+                "description": "Fired when the virtual machine resumed execution."
+            }
+        ]
+    },
+    {
+        "domain": "BrowserDebugger",
+        "description": "Browser debugging allows setting breakpoints on particular DOM operations and events. JavaScript execution will stop on these operations as if there was a regular breakpoint set.",
+        "commands": [
+            {
+                "name": "setDOMBreakpoint",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Identifier of the node to set breakpoint on." },
+                    { "name": "type", "type": "integer", "description": "Type of the operation to stop upon." }
+                ],
+                "description": "Sets breakpoint on particular operation with DOM. "
+            },
+            {
+                "name": "removeDOMBreakpoint",
+                "parameters": [
+                    { "name": "nodeId", "type": "integer", "description": "Identifier of the node to remove breakpoint from." },
+                    { "name": "type", "type": "integer", "description": "Type of the breakpoint to remove." }
+                ],
+                "description": "Removes DOM breakpoint that was set using <code>setDOMBreakpoint</code>."
+            },
+            {
+                "name": "setEventListenerBreakpoint",
+                "parameters": [
+                    { "name": "eventName", "type": "string", "description": "Event name to stop on (any DOM event will do)." }
+                ],
+                "description": "Sets breakpoint on particular DOM event."
+            },
+            {
+                "name": "removeEventListenerBreakpoint",
+                "parameters": [
+                    { "name": "eventName", "type": "string", "description": "Event name." }
+                ],
+                "description": "Removes breakpoint on particular DOM event."
+            },
+            {
+                "name": "setXHRBreakpoint",
+                "parameters": [
+                    { "name": "url", "type": "string", "description": "Resource URL substring. All XHRs having this substring in the URL will get stopped upon." }
+                ],
+                "description": "Sets breakpoint on XMLHttpRequest."
+            },
+            {
+                "name": "removeXHRBreakpoint",
+                "parameters": [
+                    { "name": "url", "type": "string", "description": "Resource URL substring." }
+                ],
+                "description": "Removes breakpoint from XMLHttpRequest."
+            }
+        ]
+    },
+    {
+        "domain": "Profiler",
+        "types": [],
+        "commands": [
+            {
+                "name": "enable"
+            },
+            {
+                "name": "disable"
+            },
+            {
+                "name": "isEnabled",
+                "returns": [
+                    { "name": "state", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "start"
+            },
+            {
+                "name": "stop"
+            },
+            {
+                "name": "getProfileHeaders",
+                "returns": [
+                    { "name": "headers", "type": "array", "items": { "$ref" : "ProfileHeader"} }
+                ]
+            },
+            {
+                "name": "getProfile",
+                "parameters": [
+                    { "name": "type", "type": "string" },
+                    { "name": "uid", "type": "integer" }
+                ],
+                "returns": [
+                    { "name": "profile", "$ref": "Profile" }
+                ]
+            },
+            {
+                "name": "removeProfile",
+                "parameters": [
+                    { "name": "type", "type": "string" },
+                    { "name": "uid", "type": "integer" }
+                ]
+            },
+            {
+                "name": "clearProfiles"
+            },
+            {
+                "name": "takeHeapSnapshot",
+                "parameters": [
+                    { "name": "detailed", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "collectGarbage"
+            }
+        ],
+        "events": [
+            {
+                "name": "profilerWasEnabled"
+            },
+            {
+                "name": "profilerWasDisabled"
+            },
+            {
+                "name": "addProfileHeader",
+                "parameters": [
+                    { "name": "header", "$ref": "ProfileHeader" }
+                ]
+            },
+            {
+                "name": "addHeapSnapshotChunk",
+                "parameters": [
+                    { "name": "uid", "type": "integer" },
+                    { "name": "chunk", "type": "string" }
+                ]
+            },
+            {
+                "name": "finishHeapSnapshot",
+                "parameters": [
+                    { "name": "uid", "type": "integer" }
+                ]
+            },
+            {
+                "name": "setRecordingProfile",
+                "parameters": [
+                    { "name": "isProfiling", "type": "boolean" }
+                ]
+            },
+            {
+                "name": "resetProfiles"
+            },
+            {
+                "name": "reportHeapSnapshotProgress",
+                "parameters": [
+                    { "name": "done", "type": "integer" },
+                    { "name": "total", "type": "integer" }
+                ]
+            }
+        ]
+    }
+]
diff --git a/Source/WebCore/inspector/InspectorAgent.cpp b/Source/WebCore/inspector/InspectorAgent.cpp
index 15ceba0..beac507 100644
--- a/Source/WebCore/inspector/InspectorAgent.cpp
+++ b/Source/WebCore/inspector/InspectorAgent.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,40 +33,21 @@
 
 #if ENABLE(INSPECTOR)
 
-#include "CachedResource.h"
-#include "CachedResourceLoader.h"
-#include "Chrome.h"
-#include "Cookie.h"
-#include "CookieJar.h"
-#include "DOMWindow.h"
-#include "DOMWrapperWorld.h"
 #include "Document.h"
 #include "DocumentLoader.h"
-#include "Element.h"
-#include "FloatConversion.h"
-#include "FloatQuad.h"
-#include "FloatRect.h"
 #include "Frame.h"
-#include "FrameLoadRequest.h"
-#include "FrameLoader.h"
-#include "FrameTree.h"
-#include "FrameView.h"
 #include "GraphicsContext.h"
-#include "HTMLFrameOwnerElement.h"
-#include "HTTPHeaderMap.h"
-#include "HitTestResult.h"
-#include "InjectedScript.h"
 #include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
 #include "InspectorBrowserDebuggerAgent.h"
 #include "InspectorCSSAgent.h"
 #include "InspectorClient.h"
 #include "InspectorConsoleAgent.h"
 #include "InspectorController.h"
 #include "InspectorDOMAgent.h"
-#include "InspectorDebuggerAgent.h"
 #include "InspectorFrontend.h"
-#include "InspectorFrontendClient.h"
 #include "InspectorInstrumentation.h"
+#include "InspectorPageAgent.h"
 #include "InspectorProfilerAgent.h"
 #include "InspectorResourceAgent.h"
 #include "InspectorRuntimeAgent.h"
@@ -74,35 +56,13 @@
 #include "InspectorValues.h"
 #include "InspectorWorkerResource.h"
 #include "InstrumentingAgents.h"
-#include "IntRect.h"
 #include "Page.h"
-#include "ProgressTracker.h"
-#include "Range.h"
-#include "RenderInline.h"
+#include "PageDebuggerAgent.h"
 #include "ResourceRequest.h"
-#include "ResourceResponse.h"
-#include "ScriptArguments.h"
-#include "ScriptCallStack.h"
 #include "ScriptFunctionCall.h"
 #include "ScriptObject.h"
-#include "ScriptProfile.h"
-#include "ScriptProfiler.h"
-#include "ScriptSourceCode.h"
 #include "ScriptState.h"
-#include "SecurityOrigin.h"
 #include "Settings.h"
-#include "SharedBuffer.h"
-#include "TextEncoding.h"
-#include "TextIterator.h"
-#include "TextRun.h"
-#include "UserGestureIndicator.h"
-#include "WindowFeatures.h"
-#include <wtf/CurrentTime.h>
-#include <wtf/ListHashSet.h>
-#include <wtf/RefCounted.h>
-#include <wtf/StdLibExtras.h>
-#include <wtf/UnusedParam.h>
-#include <wtf/text/StringConcatenate.h>
 
 #if ENABLE(DATABASE)
 #include "InspectorDatabaseAgent.h"
@@ -121,25 +81,23 @@ using namespace std;
 namespace WebCore {
 
 namespace InspectorAgentState {
-static const char searchingForNode[] = "searchingForNode";
 static const char timelineProfilerEnabled[] = "timelineProfilerEnabled";
-static const char userInitiatedProfiling[] = "userInitiatedProfiling";
 static const char debuggerEnabled[] = "debuggerEnabled";
-static const char profilerEnabled[] = "profilerEnabled";
 }
 
 static const char scriptsPanelName[] = "scripts";
 static const char consolePanelName[] = "console";
 static const char profilesPanelName[] = "profiles";
 
-InspectorAgent::InspectorAgent(Page* page, InspectorClient* client)
+InspectorAgent::InspectorAgent(Page* page, InspectorClient* client, InjectedScriptManager* injectedScriptManager)
     : m_inspectedPage(page)
     , m_client(client)
     , m_frontend(0)
     , m_instrumentingAgents(new InstrumentingAgents())
-    , m_injectedScriptHost(InjectedScriptHost::create(this))
+    , m_injectedScriptManager(injectedScriptManager)
     , m_state(new InspectorState(client))
-    , m_domAgent(InspectorDOMAgent::create(m_instrumentingAgents.get(), m_state.get(), m_injectedScriptHost.get()))
+    , m_pageAgent(InspectorPageAgent::create(m_instrumentingAgents.get(), page, injectedScriptManager))
+    , m_domAgent(InspectorDOMAgent::create(m_instrumentingAgents.get(), page, m_client, m_state.get(), injectedScriptManager))
     , m_cssAgent(new InspectorCSSAgent(m_instrumentingAgents.get(), m_domAgent.get()))
 #if ENABLE(DATABASE)
     , m_databaseAgent(InspectorDatabaseAgent::create(m_instrumentingAgents.get()))
@@ -152,25 +110,40 @@ InspectorAgent::InspectorAgent(Page* page, InspectorClient* client)
     , m_applicationCacheAgent(new InspectorApplicationCacheAgent(m_instrumentingAgents.get(), page))
 #endif
     , m_resourceAgent(InspectorResourceAgent::create(m_instrumentingAgents.get(), page, m_state.get()))
-    , m_consoleAgent(new InspectorConsoleAgent(m_instrumentingAgents.get(), this, m_state.get(), m_injectedScriptHost.get(), m_domAgent.get()))
+    , m_consoleAgent(new InspectorConsoleAgent(m_instrumentingAgents.get(), this, m_state.get(), injectedScriptManager, m_domAgent.get()))
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    , m_debuggerAgent(InspectorDebuggerAgent::create(m_instrumentingAgents.get(), m_state.get(), page, m_injectedScriptHost.get()))
+    , m_debuggerAgent(PageDebuggerAgent::create(m_instrumentingAgents.get(), m_state.get(), page, injectedScriptManager))
     , m_browserDebuggerAgent(InspectorBrowserDebuggerAgent::create(m_instrumentingAgents.get(), m_state.get(), m_domAgent.get(), m_debuggerAgent.get(), this))
-    , m_profilerAgent(InspectorProfilerAgent::create(m_instrumentingAgents.get(), m_consoleAgent.get(), page))
+    , m_profilerAgent(InspectorProfilerAgent::create(m_instrumentingAgents.get(), m_consoleAgent.get(), page, m_state.get()))
 #endif
     , m_canIssueEvaluateForTestInFrontend(false)
 {
     ASSERT_ARG(page, page);
     ASSERT_ARG(client, client);
     InspectorInstrumentation::bindInspectorAgent(m_inspectedPage, this);
+    m_instrumentingAgents->setInspectorAgent(this);
+
+    m_injectedScriptManager->injectedScriptHost()->init(this
+        , m_consoleAgent.get()
+#if ENABLE(DATABASE)
+        , m_databaseAgent.get()
+#endif
+#if ENABLE(DOM_STORAGE)
+        , m_domStorageAgent.get()
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        , m_debuggerAgent.get()
+#endif
+    );
 }
 
 InspectorAgent::~InspectorAgent()
 {
+    m_instrumentingAgents->setInspectorAgent(0);
+
     // These should have been cleared in inspectedPageDestroyed().
     ASSERT(!m_client);
     ASSERT(!m_inspectedPage);
-    ASSERT(!m_highlightedNode);
 }
 
 void InspectorAgent::inspectedPageDestroyed()
@@ -180,9 +153,6 @@ void InspectorAgent::inspectedPageDestroyed()
         disconnectFrontend();
     }
 
-    ErrorString error;
-    hideHighlight(&error);
-
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_browserDebuggerAgent.clear();
     m_debuggerAgent.clear();
@@ -193,172 +163,36 @@ void InspectorAgent::inspectedPageDestroyed()
     m_inspectedPage = 0;
 
     releaseFrontendLifetimeAgents();
-    m_injectedScriptHost->disconnectController();
+    m_injectedScriptManager->disconnect();
 
     m_client->inspectorDestroyed();
     m_client = 0;
 }
 
-bool InspectorAgent::searchingForNodeInPage() const
-{
-    return m_state->getBoolean(InspectorAgentState::searchingForNode);
-}
-
 void InspectorAgent::restoreInspectorStateFromCookie(const String& inspectorStateCookie)
 {
     m_state->loadFromCookie(inspectorStateCookie);
 
     m_frontend->inspector()->frontendReused();
-    m_frontend->inspector()->inspectedURLChanged(inspectedURL().string());
-    pushDataCollectedOffline();
+    m_pageAgent->restore();
 
+    m_domAgent->restore();
     m_resourceAgent->restore();
     m_timelineAgent->restore();
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent->restore();
-    restoreProfiler(ProfilerRestoreResetAgent);
-    if (m_state->getBoolean(InspectorAgentState::userInitiatedProfiling))
-        startUserInitiatedProfiling();
+    m_profilerAgent->restore();
 #endif
 }
 
-void InspectorAgent::inspect(Node* node)
-{
-    if (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE)
-        node = node->parentNode();
-    m_nodeToFocus = node;
-
-    if (!m_frontend)
-        return;
-
-    focusNode();
-}
-
-void InspectorAgent::focusNode()
-{
-    if (!enabled())
-        return;
-
-    ASSERT(m_frontend);
-    ASSERT(m_nodeToFocus);
-
-    RefPtr<Node> node = m_nodeToFocus.get();
-    m_nodeToFocus = 0;
-
-    Document* document = node->ownerDocument();
-    if (!document)
-        return;
-    Frame* frame = document->frame();
-    if (!frame)
-        return;
-
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptFor(mainWorldScriptState(frame));
-    if (injectedScript.hasNoValue())
-        return;
-
-    injectedScript.inspectNode(node.get());
-}
-
-void InspectorAgent::highlight(ErrorString*, Node* node)
-{
-    if (!enabled())
-        return;
-    ASSERT_ARG(node, node);
-    m_highlightedNode = node;
-    m_client->highlight(node);
-}
-
-void InspectorAgent::highlightDOMNode(ErrorString* error, long nodeId)
-{
-    Node* node = 0;
-    if (m_domAgent && (node = m_domAgent->nodeForId(nodeId)))
-        highlight(error, node);
-}
-
-void InspectorAgent::highlightFrame(ErrorString* error, unsigned long frameId)
-{
-    Frame* mainFrame = m_inspectedPage->mainFrame();
-    for (Frame* frame = mainFrame; frame; frame = frame->tree()->traverseNext(mainFrame)) {
-        if (reinterpret_cast<uintptr_t>(frame) == frameId && frame->ownerElement()) {
-            highlight(error, frame->ownerElement());
-            return;
-        }
-    }
-}
-
-void InspectorAgent::hideHighlight(ErrorString*)
-{
-    if (!enabled())
-        return;
-    m_highlightedNode = 0;
-    m_client->hideHighlight();
-}
-
-void InspectorAgent::mouseDidMoveOverElement(const HitTestResult& result, unsigned)
-{
-    if (!enabled() || !searchingForNodeInPage())
-        return;
-
-    Node* node = result.innerNode();
-    while (node && node->nodeType() == Node::TEXT_NODE)
-        node = node->parentNode();
-    if (node) {
-        ErrorString error;
-        highlight(&error, node);
-    }
-}
-
-bool InspectorAgent::handleMousePress()
-{
-    if (!enabled() || !searchingForNodeInPage())
-        return false;
-
-    if (m_highlightedNode) {
-        RefPtr<Node> node = m_highlightedNode;
-        setSearchingForNode(false);
-        inspect(node.get());
-    }
-    return true;
-}
-
 void InspectorAgent::didClearWindowObjectInWorld(Frame* frame, DOMWrapperWorld* world)
 {
     if (world != mainThreadNormalWorld())
         return;
 
-    if (enabled()) {
-        if (m_frontend && frame == m_inspectedPage->mainFrame())
-            m_injectedScriptHost->discardInjectedScripts();
-
-        if (m_scriptsToEvaluateOnLoad.size()) {
-            ScriptState* scriptState = mainWorldScriptState(frame);
-            for (Vector<String>::iterator it = m_scriptsToEvaluateOnLoad.begin();
-                  it != m_scriptsToEvaluateOnLoad.end(); ++it) {
-                m_injectedScriptHost->injectScript(*it, scriptState);
-            }
-        }
-    }
-
     if (!m_inspectorExtensionAPI.isEmpty())
-        m_injectedScriptHost->injectScript(m_inspectorExtensionAPI, mainWorldScriptState(frame));
-}
-
-void InspectorAgent::setSearchingForNode(bool enabled)
-{
-    if (searchingForNodeInPage() == enabled)
-        return;
-    m_state->setBoolean(InspectorAgentState::searchingForNode, enabled);
-    if (!enabled) {
-        ErrorString error;
-        hideHighlight(&error);
-    }
-}
-
-void InspectorAgent::setSearchingForNode(ErrorString*, bool enabled, bool* newState)
-{
-    *newState = enabled;
-    setSearchingForNode(enabled);
+        m_injectedScriptManager->injectScript(m_inspectorExtensionAPI, mainWorldScriptState(frame));
 }
 
 void InspectorAgent::setFrontend(InspectorFrontend* inspectorFrontend)
@@ -372,13 +206,14 @@ void InspectorAgent::setFrontend(InspectorFrontend* inspectorFrontend)
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     m_applicationCacheAgent->setFrontend(m_frontend);
 #endif
+    m_pageAgent->setFrontend(m_frontend);
     m_domAgent->setFrontend(m_frontend);
     m_consoleAgent->setFrontend(m_frontend);
     m_timelineAgent->setFrontend(m_frontend);
     m_resourceAgent->setFrontend(m_frontend);
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent->setFrontend(m_frontend);
-    m_browserDebuggerAgent->setFrontend(m_frontend);
+    m_profilerAgent->setFrontend(m_frontend);
 #endif
 #if ENABLE(DATABASE)
     m_databaseAgent->setFrontend(m_frontend);
@@ -386,8 +221,20 @@ void InspectorAgent::setFrontend(InspectorFrontend* inspectorFrontend)
 #if ENABLE(DOM_STORAGE)
     m_domStorageAgent->setFrontend(m_frontend);
 #endif
-    // Initialize Web Inspector title.
-    m_frontend->inspector()->inspectedURLChanged(inspectedURL().string());
+
+    if (!m_showPanelAfterVisible.isEmpty()) {
+        m_frontend->inspector()->showPanel(m_showPanelAfterVisible);
+        m_showPanelAfterVisible = String();
+    }
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
+    WorkersMap::iterator workersEnd = m_workers.end();
+    for (WorkersMap::iterator it = m_workers.begin(); it != workersEnd; ++it) {
+        InspectorWorkerResource* worker = it->second.get();
+        m_frontend->inspector()->didCreateWorker(worker->id(), worker->url(), worker->isSharedWorker());
+    }
+#endif
+    // Dispatch pending frontend commands
+    issueEvaluateForTestCommands();
 }
 
 void InspectorAgent::disconnectFrontend()
@@ -404,19 +251,12 @@ void InspectorAgent::disconnectFrontend()
 
     m_frontend = 0;
 
-    ErrorString error;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent->clearFrontend();
     m_browserDebuggerAgent->clearFrontend();
-#endif
-    setSearchingForNode(false);
-
-    hideHighlight(&error);
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
     m_profilerAgent->clearFrontend();
-    m_profilerAgent->stopUserInitiatedProfiling(true);
 #endif
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     m_applicationCacheAgent->clearFrontend();
 #endif
@@ -431,14 +271,14 @@ void InspectorAgent::disconnectFrontend()
 #if ENABLE(DOM_STORAGE)
     m_domStorageAgent->clearFrontend();
 #endif
+    m_pageAgent->clearFrontend();
 
     releaseFrontendLifetimeAgents();
-    m_userAgentOverride = "";
 }
 
 void InspectorAgent::createFrontendLifetimeAgents()
 {
-    m_runtimeAgent = InspectorRuntimeAgent::create(m_injectedScriptHost.get());
+    m_runtimeAgent = InspectorRuntimeAgent::create(m_injectedScriptManager, m_inspectedPage);
 }
 
 void InspectorAgent::releaseFrontendLifetimeAgents()
@@ -446,103 +286,20 @@ void InspectorAgent::releaseFrontendLifetimeAgents()
     m_runtimeAgent.clear();
 }
 
-void InspectorAgent::populateScriptObjects(ErrorString*)
-{
-    ASSERT(m_frontend);
-    if (!m_frontend)
-        return;
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (m_profilerAgent->enabled())
-        m_frontend->profiler()->profilerWasEnabled();
-#endif
-
-    pushDataCollectedOffline();
-
-    if (m_nodeToFocus)
-        focusNode();
-
-    if (!m_showPanelAfterVisible.isEmpty()) {
-        m_frontend->inspector()->showPanel(m_showPanelAfterVisible);
-        m_showPanelAfterVisible = "";
-    }
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    m_debuggerAgent->enableDebuggerAfterShown();
-#endif
-    restoreProfiler(ProfilerRestoreNoAction);
-
-    // Dispatch pending frontend commands
-    issueEvaluateForTestCommands();
-}
-
-void InspectorAgent::pushDataCollectedOffline()
-{
-    m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
-
-#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(WORKERS)
-    WorkersMap::iterator workersEnd = m_workers.end();
-    for (WorkersMap::iterator it = m_workers.begin(); it != workersEnd; ++it) {
-        InspectorWorkerResource* worker = it->second.get();
-        m_frontend->debugger()->didCreateWorker(worker->id(), worker->url(), worker->isSharedWorker());
-    }
-#endif
-}
-
-void InspectorAgent::restoreProfiler(ProfilerRestoreAction action)
-{
-    ASSERT(m_frontend);
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    m_profilerAgent->setFrontend(m_frontend);
-    if (m_state->getBoolean(InspectorAgentState::profilerEnabled)) {
-        ErrorString error;
-        enableProfiler(&error);
-    }
-    if (action == ProfilerRestoreResetAgent)
-        m_profilerAgent->resetFrontendProfiles();
-#endif
-}
-
-void InspectorAgent::didCommitLoad(DocumentLoader* loader)
+void InspectorAgent::didCommitLoad()
 {
-    if (m_frontend) {
-        m_frontend->inspector()->inspectedURLChanged(loader->url().string());
+    if (m_frontend)
         m_frontend->inspector()->reset();
-    }
-    m_injectedScriptHost->discardInjectedScripts();
+
+    m_injectedScriptManager->discardInjectedScripts();
 #if ENABLE(WORKERS)
     m_workers.clear();
 #endif
 }
 
-void InspectorAgent::domContentLoadedEventFired(DocumentLoader* loader, const KURL& url)
+void InspectorAgent::domContentLoadedEventFired()
 {
-    if (!enabled() || !isMainResourceLoader(loader, url))
-        return;
-
-    if (InspectorDOMAgent* domAgent = m_instrumentingAgents->inspectorDOMAgent())
-        domAgent->mainFrameDOMContentLoaded();
-    if (InspectorTimelineAgent* timelineAgent = m_instrumentingAgents->inspectorTimelineAgent())
-        timelineAgent->didMarkDOMContentEvent();
-    if (m_frontend)
-        m_frontend->inspector()->domContentEventFired(currentTime());
-}
-
-void InspectorAgent::loadEventFired(DocumentLoader* loader, const KURL& url)
-{
-    if (!enabled())
-        return;
-
-    if (InspectorDOMAgent* domAgent = m_instrumentingAgents->inspectorDOMAgent())
-        domAgent->loadEventFired(loader->frame()->document());
-
-    if (!isMainResourceLoader(loader, url))
-        return;
-
-    if (InspectorTimelineAgent* timelineAgent = m_instrumentingAgents->inspectorTimelineAgent())
-        timelineAgent->didMarkLoadEvent();
-    if (m_frontend)
-        m_frontend->inspector()->loadEventFired(currentTime());
+    m_injectedScriptManager->injectedScriptHost()->clearInspectedNodes();
 }
 
 bool InspectorAgent::isMainResourceLoader(DocumentLoader* loader, const KURL& requestUrl)
@@ -550,17 +307,6 @@ bool InspectorAgent::isMainResourceLoader(DocumentLoader* loader, const KURL& re
     return loader->frame() == m_inspectedPage->mainFrame() && requestUrl == loader->requestURL();
 }
 
-void InspectorAgent::setUserAgentOverride(ErrorString*, const String& userAgent)
-{
-    m_userAgentOverride = userAgent;
-}
-
-void InspectorAgent::applyUserAgentOverride(String* userAgent) const
-{
-    if (!m_userAgentOverride.isEmpty())
-        *userAgent = m_userAgentOverride;
-}
-
 #if ENABLE(WORKERS)
 class PostWorkerNotificationToFrontendTask : public ScriptExecutionContext::Task {
 public:
@@ -596,10 +342,10 @@ void InspectorAgent::postWorkerNotificationToFrontend(const InspectorWorkerResou
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     switch (action) {
     case InspectorAgent::WorkerCreated:
-        m_frontend->debugger()->didCreateWorker(worker.id(), worker.url(), worker.isSharedWorker());
+        m_frontend->inspector()->didCreateWorker(worker.id(), worker.url(), worker.isSharedWorker());
         break;
     case InspectorAgent::WorkerDestroyed:
-        m_frontend->debugger()->didDestroyWorker(worker.id());
+        m_frontend->inspector()->didDestroyWorker(worker.id());
         break;
     }
 #endif
@@ -630,136 +376,11 @@ void InspectorAgent::didDestroyWorker(intptr_t id)
 }
 #endif // ENABLE(WORKERS)
 
-void InspectorAgent::getCookies(ErrorString*, RefPtr<InspectorArray>* cookies, WTF::String* cookiesString)
-{
-    // If we can get raw cookies.
-    ListHashSet<Cookie> rawCookiesList;
-
-    // If we can't get raw cookies - fall back to String representation
-    String stringCookiesList;
-
-    // Return value to getRawCookies should be the same for every call because
-    // the return value is platform/network backend specific, and the call will
-    // always return the same true/false value.
-    bool rawCookiesImplemented = false;
-
-    for (Frame* frame = m_inspectedPage->mainFrame(); frame; frame = frame->tree()->traverseNext(m_inspectedPage->mainFrame())) {
-        Document* document = frame->document();
-        const CachedResourceLoader::DocumentResourceMap& allResources = document->cachedResourceLoader()->allCachedResources();
-        CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
-        for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it) {
-            Vector<Cookie> docCookiesList;
-            rawCookiesImplemented = getRawCookies(document, KURL(ParsedURLString, it->second->url()), docCookiesList);
-
-            if (!rawCookiesImplemented) {
-                // FIXME: We need duplication checking for the String representation of cookies.
-                ExceptionCode ec = 0;
-                stringCookiesList += document->cookie(ec);
-                // Exceptions are thrown by cookie() in sandboxed frames. That won't happen here
-                // because "document" is the document of the main frame of the page.
-                ASSERT(!ec);
-            } else {
-                int cookiesSize = docCookiesList.size();
-                for (int i = 0; i < cookiesSize; i++) {
-                    if (!rawCookiesList.contains(docCookiesList[i]))
-                        rawCookiesList.add(docCookiesList[i]);
-                }
-            }
-        }
-    }
-
-    if (rawCookiesImplemented)
-        *cookies = buildArrayForCookies(rawCookiesList);
-    else
-        *cookiesString = stringCookiesList;
-}
-
-PassRefPtr<InspectorArray> InspectorAgent::buildArrayForCookies(ListHashSet<Cookie>& cookiesList)
-{
-    RefPtr<InspectorArray> cookies = InspectorArray::create();
-
-    ListHashSet<Cookie>::iterator end = cookiesList.end();
-    ListHashSet<Cookie>::iterator it = cookiesList.begin();
-    for (int i = 0; it != end; ++it, i++)
-        cookies->pushObject(buildObjectForCookie(*it));
-
-    return cookies;
-}
-
-PassRefPtr<InspectorObject> InspectorAgent::buildObjectForCookie(const Cookie& cookie)
-{
-    RefPtr<InspectorObject> value = InspectorObject::create();
-    value->setString("name", cookie.name);
-    value->setString("value", cookie.value);
-    value->setString("domain", cookie.domain);
-    value->setString("path", cookie.path);
-    value->setNumber("expires", cookie.expires);
-    value->setNumber("size", (cookie.name.length() + cookie.value.length()));
-    value->setBoolean("httpOnly", cookie.httpOnly);
-    value->setBoolean("secure", cookie.secure);
-    value->setBoolean("session", cookie.session);
-    return value;
-}
-
-void InspectorAgent::deleteCookie(ErrorString*, const String& cookieName, const String& domain)
-{
-    for (Frame* frame = m_inspectedPage->mainFrame(); frame; frame = frame->tree()->traverseNext(m_inspectedPage->mainFrame())) {
-        Document* document = frame->document();
-        if (document->url().host() != domain)
-            continue;
-        const CachedResourceLoader::DocumentResourceMap& allResources = document->cachedResourceLoader()->allCachedResources();
-        CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
-        for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it)
-            WebCore::deleteCookie(document, KURL(ParsedURLString, it->second->url()), cookieName);
-    }
-}
-
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-bool InspectorAgent::isRecordingUserInitiatedProfile() const
-{
-    return m_profilerAgent->isRecordingUserInitiatedProfile();
-}
-
-void InspectorAgent::startUserInitiatedProfiling()
+void InspectorAgent::showProfilesPanel()
 {
-    if (!enabled())
-        return;
-    m_profilerAgent->startUserInitiatedProfiling();
-    m_state->setBoolean(InspectorAgentState::userInitiatedProfiling, true);
-}
-
-void InspectorAgent::stopUserInitiatedProfiling()
-{
-    m_profilerAgent->stopUserInitiatedProfiling();
-    m_state->setBoolean(InspectorAgentState::userInitiatedProfiling, false);
     showPanel(profilesPanelName);
 }
-
-bool InspectorAgent::profilerEnabled() const
-{
-    return enabled() && m_profilerAgent->enabled();
-}
-
-void InspectorAgent::enableProfiler(ErrorString*)
-{
-    if (profilerEnabled())
-        return;
-    m_state->setBoolean(InspectorAgentState::profilerEnabled, true);
-    m_profilerAgent->enable(false);
-}
-
-void InspectorAgent::disableProfiler(ErrorString*)
-{
-    m_state->setBoolean(InspectorAgentState::profilerEnabled, false);
-    m_profilerAgent->disable();
-}
-#endif
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-void InspectorAgent::showScriptsPanel()
-{
-    showPanel(scriptsPanelName);
-}
 #endif
 
 void InspectorAgent::evaluateForTestInFrontend(long callId, const String& script)
@@ -780,277 +401,6 @@ void InspectorAgent::didEvaluateForTestInFrontend(ErrorString*, long callId, con
     function.call();
 }
 
-static Path quadToPath(const FloatQuad& quad)
-{
-    Path quadPath;
-    quadPath.moveTo(quad.p1());
-    quadPath.addLineTo(quad.p2());
-    quadPath.addLineTo(quad.p3());
-    quadPath.addLineTo(quad.p4());
-    quadPath.closeSubpath();
-    return quadPath;
-}
-
-static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, const Color& fillColor)
-{
-    static const int outlineThickness = 2;
-    static const Color outlineColor(62, 86, 180, 228);
-
-    Path quadPath = quadToPath(quad);
-
-    // Clip out the quad, then draw with a 2px stroke to get a pixel
-    // of outline (because inflating a quad is hard)
-    {
-        context.save();
-        context.clipOut(quadPath);
-
-        context.setStrokeThickness(outlineThickness);
-        context.setStrokeColor(outlineColor, ColorSpaceDeviceRGB);
-        context.strokePath(quadPath);
-
-        context.restore();
-    }
-
-    // Now do the fill
-    context.setFillColor(fillColor, ColorSpaceDeviceRGB);
-    context.fillPath(quadPath);
-}
-
-static void drawOutlinedQuadWithClip(GraphicsContext& context, const FloatQuad& quad, const FloatQuad& clipQuad, const Color& fillColor)
-{
-    context.save();
-    Path clipQuadPath = quadToPath(clipQuad);
-    context.clipOut(clipQuadPath);
-    drawOutlinedQuad(context, quad, fillColor);
-    context.restore();
-}
-
-static void drawHighlightForBox(GraphicsContext& context, const FloatQuad& contentQuad, const FloatQuad& paddingQuad, const FloatQuad& borderQuad, const FloatQuad& marginQuad)
-{
-    static const Color contentBoxColor(125, 173, 217, 128);
-    static const Color paddingBoxColor(125, 173, 217, 160);
-    static const Color borderBoxColor(125, 173, 217, 192);
-    static const Color marginBoxColor(125, 173, 217, 228);
-
-    if (marginQuad != borderQuad)
-        drawOutlinedQuadWithClip(context, marginQuad, borderQuad, marginBoxColor);
-    if (borderQuad != paddingQuad)
-        drawOutlinedQuadWithClip(context, borderQuad, paddingQuad, borderBoxColor);
-    if (paddingQuad != contentQuad)
-        drawOutlinedQuadWithClip(context, paddingQuad, contentQuad, paddingBoxColor);
-
-    drawOutlinedQuad(context, contentQuad, contentBoxColor);
-}
-
-static void drawHighlightForLineBoxesOrSVGRenderer(GraphicsContext& context, const Vector<FloatQuad>& lineBoxQuads)
-{
-    static const Color lineBoxColor(125, 173, 217, 128);
-
-    for (size_t i = 0; i < lineBoxQuads.size(); ++i)
-        drawOutlinedQuad(context, lineBoxQuads[i], lineBoxColor);
-}
-
-static inline void convertFromFrameToMainFrame(Frame* frame, IntRect& rect)
-{
-    rect = frame->page()->mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(rect));
-}
-
-static inline IntSize frameToMainFrameOffset(Frame* frame)
-{
-    IntPoint mainFramePoint = frame->page()->mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(IntPoint()));
-    return mainFramePoint - IntPoint();
-}
-
-void InspectorAgent::drawNodeHighlight(GraphicsContext& context) const
-{
-    if (!m_highlightedNode)
-        return;
-
-    RenderObject* renderer = m_highlightedNode->renderer();
-    Frame* containingFrame = m_highlightedNode->document()->frame();
-    if (!renderer || !containingFrame)
-        return;
-
-    IntSize mainFrameOffset = frameToMainFrameOffset(containingFrame);
-    IntRect boundingBox = renderer->absoluteBoundingBoxRect(true);
-    boundingBox.move(mainFrameOffset);
-
-    IntRect titleAnchorBox = boundingBox;
-
-    ASSERT(m_inspectedPage);
-
-    FrameView* view = m_inspectedPage->mainFrame()->view();
-    FloatRect overlayRect = view->visibleContentRect();
-    if (!overlayRect.contains(boundingBox) && !boundingBox.contains(enclosingIntRect(overlayRect)))
-        overlayRect = view->visibleContentRect();
-    context.translate(-overlayRect.x(), -overlayRect.y());
-
-    // RenderSVGRoot should be highlighted through the isBox() code path, all other SVG elements should just dump their absoluteQuads().
-#if ENABLE(SVG)
-    bool isSVGRenderer = renderer->node() && renderer->node()->isSVGElement() && !renderer->isSVGRoot();
-#else
-    bool isSVGRenderer = false;
-#endif
-
-    if (renderer->isBox() && !isSVGRenderer) {
-        RenderBox* renderBox = toRenderBox(renderer);
-
-        IntRect contentBox = renderBox->contentBoxRect();
-
-        IntRect paddingBox(contentBox.x() - renderBox->paddingLeft(), contentBox.y() - renderBox->paddingTop(),
-                           contentBox.width() + renderBox->paddingLeft() + renderBox->paddingRight(), contentBox.height() + renderBox->paddingTop() + renderBox->paddingBottom());
-        IntRect borderBox(paddingBox.x() - renderBox->borderLeft(), paddingBox.y() - renderBox->borderTop(),
-                          paddingBox.width() + renderBox->borderLeft() + renderBox->borderRight(), paddingBox.height() + renderBox->borderTop() + renderBox->borderBottom());
-        IntRect marginBox(borderBox.x() - renderBox->marginLeft(), borderBox.y() - renderBox->marginTop(),
-                          borderBox.width() + renderBox->marginLeft() + renderBox->marginRight(), borderBox.height() + renderBox->marginTop() + renderBox->marginBottom());
-
-
-        FloatQuad absContentQuad = renderBox->localToAbsoluteQuad(FloatRect(contentBox));
-        FloatQuad absPaddingQuad = renderBox->localToAbsoluteQuad(FloatRect(paddingBox));
-        FloatQuad absBorderQuad = renderBox->localToAbsoluteQuad(FloatRect(borderBox));
-        FloatQuad absMarginQuad = renderBox->localToAbsoluteQuad(FloatRect(marginBox));
-
-        absContentQuad.move(mainFrameOffset);
-        absPaddingQuad.move(mainFrameOffset);
-        absBorderQuad.move(mainFrameOffset);
-        absMarginQuad.move(mainFrameOffset);
-
-        titleAnchorBox = absMarginQuad.enclosingBoundingBox();
-
-        drawHighlightForBox(context, absContentQuad, absPaddingQuad, absBorderQuad, absMarginQuad);
-    } else if (renderer->isRenderInline() || isSVGRenderer) {
-        // FIXME: We should show margins/padding/border for inlines.
-        Vector<FloatQuad> lineBoxQuads;
-        renderer->absoluteQuads(lineBoxQuads);
-        for (unsigned i = 0; i < lineBoxQuads.size(); ++i)
-            lineBoxQuads[i] += mainFrameOffset;
-
-        drawHighlightForLineBoxesOrSVGRenderer(context, lineBoxQuads);
-    }
-
-    // Draw node title if necessary.
-
-    if (!m_highlightedNode->isElementNode())
-        return;
-
-    WebCore::Settings* settings = containingFrame->settings();
-    drawElementTitle(context, boundingBox, titleAnchorBox, overlayRect, settings);
-}
-
-void InspectorAgent::drawElementTitle(GraphicsContext& context, const IntRect& boundingBox, const IntRect& anchorBox, const FloatRect& overlayRect, WebCore::Settings* settings) const
-{
-    static const int rectInflatePx = 4;
-    static const int fontHeightPx = 12;
-    static const int borderWidthPx = 1;
-    static const Color tooltipBackgroundColor(255, 255, 194, 255);
-    static const Color tooltipBorderColor(Color::black);
-    static const Color tooltipFontColor(Color::black);
-
-    Element* element = static_cast<Element*>(m_highlightedNode.get());
-    bool isXHTML = element->document()->isXHTMLDocument();
-    String nodeTitle = isXHTML ? element->nodeName() : element->nodeName().lower();
-    const AtomicString& idValue = element->getIdAttribute();
-    if (!idValue.isNull() && !idValue.isEmpty()) {
-        nodeTitle += "#";
-        nodeTitle += idValue;
-    }
-    if (element->hasClass() && element->isStyledElement()) {
-        const SpaceSplitString& classNamesString = static_cast<StyledElement*>(element)->classNames();
-        size_t classNameCount = classNamesString.size();
-        if (classNameCount) {
-            HashSet<AtomicString> usedClassNames;
-            for (size_t i = 0; i < classNameCount; ++i) {
-                const AtomicString& className = classNamesString[i];
-                if (usedClassNames.contains(className))
-                    continue;
-                usedClassNames.add(className);
-                nodeTitle += ".";
-                nodeTitle += className;
-            }
-        }
-    }
-
-    nodeTitle += " [";
-    nodeTitle += String::number(boundingBox.width());
-    nodeTitle.append(static_cast<UChar>(0x00D7)); // &times;
-    nodeTitle += String::number(boundingBox.height());
-    nodeTitle += "]";
-
-    FontDescription desc;
-    FontFamily family;
-    family.setFamily(settings->fixedFontFamily());
-    desc.setFamily(family);
-    desc.setComputedSize(fontHeightPx);
-    Font font = Font(desc, 0, 0);
-    font.update(0);
-
-    TextRun nodeTitleRun(nodeTitle);
-    IntPoint titleBasePoint = IntPoint(anchorBox.x(), anchorBox.maxY() - 1);
-    titleBasePoint.move(rectInflatePx, rectInflatePx);
-    IntRect titleRect = enclosingIntRect(font.selectionRectForText(nodeTitleRun, titleBasePoint, fontHeightPx));
-    titleRect.inflate(rectInflatePx);
-
-    // The initial offsets needed to compensate for a 1px-thick border stroke (which is not a part of the rectangle).
-    int dx = -borderWidthPx;
-    int dy = borderWidthPx;
-
-    // If the tip sticks beyond the right of overlayRect, right-align the tip with the said boundary.
-    if (titleRect.maxX() > overlayRect.maxX())
-        dx = overlayRect.maxX() - titleRect.maxX();
-
-    // If the tip sticks beyond the left of overlayRect, left-align the tip with the said boundary.
-    if (titleRect.x() + dx < overlayRect.x())
-        dx = overlayRect.x() - titleRect.x() - borderWidthPx;
-
-    // If the tip sticks beyond the bottom of overlayRect, show the tip at top of bounding box.
-    if (titleRect.maxY() > overlayRect.maxY()) {
-        dy = anchorBox.y() - titleRect.maxY() - borderWidthPx;
-        // If the tip still sticks beyond the bottom of overlayRect, bottom-align the tip with the said boundary.
-        if (titleRect.maxY() + dy > overlayRect.maxY())
-            dy = overlayRect.maxY() - titleRect.maxY();
-    }
-
-    // If the tip sticks beyond the top of overlayRect, show the tip at top of overlayRect.
-    if (titleRect.y() + dy < overlayRect.y())
-        dy = overlayRect.y() - titleRect.y() + borderWidthPx;
-
-    titleRect.move(dx, dy);
-    context.setStrokeColor(tooltipBorderColor, ColorSpaceDeviceRGB);
-    context.setStrokeThickness(borderWidthPx);
-    context.setFillColor(tooltipBackgroundColor, ColorSpaceDeviceRGB);
-    context.drawRect(titleRect);
-    context.setFillColor(tooltipFontColor, ColorSpaceDeviceRGB);
-    context.drawText(font, nodeTitleRun, IntPoint(titleRect.x() + rectInflatePx, titleRect.y() + font.fontMetrics().height()));
-}
-
-void InspectorAgent::openInInspectedWindow(ErrorString*, const String& url)
-{
-    Frame* mainFrame = m_inspectedPage->mainFrame();
-
-    FrameLoadRequest request(mainFrame->document()->securityOrigin(), ResourceRequest(), "_blank");
-
-    bool created;
-    WindowFeatures windowFeatures;
-    Frame* newFrame = WebCore::createWindow(mainFrame, mainFrame, request, windowFeatures, created);
-    if (!newFrame)
-        return;
-
-    UserGestureIndicator indicator(DefinitelyProcessingUserGesture);
-    newFrame->loader()->setOpener(mainFrame);
-    newFrame->page()->setOpenedByDOM();
-    newFrame->loader()->changeLocation(mainFrame->document()->securityOrigin(), newFrame->loader()->completeURL(url), "", false, false);
-}
-
-void InspectorAgent::addScriptToEvaluateOnLoad(ErrorString*, const String& source)
-{
-    m_scriptsToEvaluateOnLoad.append(source);
-}
-
-void InspectorAgent::removeAllScriptsToEvaluateOnLoad(ErrorString*)
-{
-    m_scriptsToEvaluateOnLoad.clear();
-}
-
 void InspectorAgent::setInspectorExtensionAPI(const String& source)
 {
     m_inspectorExtensionAPI = source;
@@ -1068,11 +418,6 @@ KURL InspectorAgent::inspectedURLWithoutFragment() const
     return url;
 }
 
-void InspectorAgent::reloadPage(ErrorString*, bool ignoreCache)
-{
-    m_inspectedPage->mainFrame()->loader()->reload(ignoreCache);
-}
-
 bool InspectorAgent::enabled() const
 {
     if (!m_inspectedPage)
diff --git a/Source/WebCore/inspector/InspectorAgent.h b/Source/WebCore/inspector/InspectorAgent.h
index 151dba5..cda9137 100644
--- a/Source/WebCore/inspector/InspectorAgent.h
+++ b/Source/WebCore/inspector/InspectorAgent.h
@@ -31,30 +31,24 @@
 
 #include "CharacterData.h"
 #include "Console.h"
-#include "Cookie.h"
 #include "Page.h"
 #include "PlatformString.h"
 #include <wtf/HashMap.h>
-#include <wtf/HashSet.h>
-#include <wtf/ListHashSet.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 #include <wtf/text/StringHash.h>
 
 namespace WebCore {
 
-class CachedResource;
 class CharacterData;
 class Database;
 class DOMWrapperWorld;
 class Document;
 class DocumentLoader;
 class FloatRect;
-class GraphicsContext;
 class HTTPHeaderMap;
-class HitTestResult;
 class InjectedScript;
-class InjectedScriptHost;
+class InjectedScriptManager;
 class InspectorArray;
 class InspectorBrowserDebuggerAgent;
 class InspectorClient;
@@ -68,6 +62,7 @@ class InspectorDebuggerAgent;
 class InspectorFrontend;
 class InspectorFrontendClient;
 class InspectorObject;
+class InspectorPageAgent;
 class InspectorProfilerAgent;
 class InspectorResourceAgent;
 class InspectorRuntimeAgent;
@@ -100,11 +95,10 @@ class InspectorAgent {
     WTF_MAKE_NONCOPYABLE(InspectorAgent);
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    InspectorAgent(Page*, InspectorClient*);
+    InspectorAgent(Page*, InspectorClient*, InjectedScriptManager*);
     virtual ~InspectorAgent();
 
     InspectorClient* inspectorClient() { return m_client; }
-    InjectedScriptHost* injectedScriptHost() { return m_injectedScriptHost.get(); }
 
     void inspectedPageDestroyed();
 
@@ -113,27 +107,18 @@ public:
     Page* inspectedPage() const { return m_inspectedPage; }
     KURL inspectedURL() const;
     KURL inspectedURLWithoutFragment() const;
-    void reloadPage(ErrorString* error, bool ignoreCache);
+    void reloadPage(ErrorString*, bool ignoreCache);
     void showConsole();
 
     void restoreInspectorStateFromCookie(const String& inspectorCookie);
 
-    void highlight(ErrorString* error, Node*);
-    void hideHighlight(ErrorString* error);
-    void inspect(Node*);
-    void highlightDOMNode(ErrorString* error, long nodeId);
-    void hideDOMNodeHighlight(ErrorString* error) { hideHighlight(error); }
-
-    void highlightFrame(ErrorString* error, unsigned long frameId);
-    void hideFrameHighlight(ErrorString* error) { hideHighlight(error); }
-
     void setFrontend(InspectorFrontend*);
     InspectorFrontend* frontend() const { return m_frontend; }
     void disconnectFrontend();
 
     InstrumentingAgents* instrumentingAgents() const { return m_instrumentingAgents.get(); }
 
-    InspectorAgent* inspectorAgent() { return this; }
+    InspectorPageAgent* pageAgent() { return m_pageAgent.get(); }
     InspectorConsoleAgent* consoleAgent() { return m_consoleAgent.get(); }
     InspectorCSSAgent* cssAgent() { return m_cssAgent.get(); }
     InspectorDOMAgent* domAgent() { return m_domAgent.get(); }
@@ -155,19 +140,10 @@ public:
     InspectorApplicationCacheAgent* applicationCacheAgent() { return m_applicationCacheAgent.get(); }
 #endif
 
-    bool handleMousePress();
-    bool searchingForNodeInPage() const;
-    void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
-
     void didClearWindowObjectInWorld(Frame*, DOMWrapperWorld*);
 
-    void didCommitLoad(DocumentLoader*);
-
-    void getCookies(ErrorString* error, RefPtr<InspectorArray>* cookies, WTF::String* cookiesString);
-    void deleteCookie(ErrorString* error, const String& cookieName, const String& domain);
-
-    void domContentLoadedEventFired(DocumentLoader*, const KURL&);
-    void loadEventFired(DocumentLoader*, const KURL&);
+    void didCommitLoad();
+    void domContentLoadedEventFired();
 
 #if ENABLE(WORKERS)
     enum WorkerAction { WorkerCreated, WorkerDestroyed };
@@ -179,28 +155,14 @@ public:
 
     bool hasFrontend() const { return m_frontend; }
 
-    void drawNodeHighlight(GraphicsContext&) const;
-    void openInInspectedWindow(ErrorString* error, const String& url);
-    void drawElementTitle(GraphicsContext&, const IntRect& boundingBox, const IntRect& anchorBox, const FloatRect& overlayRect, WebCore::Settings*) const;
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    bool isRecordingUserInitiatedProfile() const;
-    void startProfiling(ErrorString*) { startUserInitiatedProfiling(); }
-    void startUserInitiatedProfiling();
-    void stopProfiling(ErrorString*) { stopUserInitiatedProfiling(); }
-    void stopUserInitiatedProfiling();
-    void enableProfiler(ErrorString* error);
-    void disableProfiler(ErrorString* error);
-    bool profilerEnabled() const;
-
-    void showScriptsPanel();
+    void showProfilesPanel();
 #endif
 
     // Generic code called from custom implementations.
     void evaluateForTestInFrontend(long testCallId, const String& script);
 
-    void addScriptToEvaluateOnLoad(ErrorString* error, const String& source);
-    void removeAllScriptsToEvaluateOnLoad(ErrorString* error);
     void setInspectorExtensionAPI(const String& source);
 
     InspectorState* state() { return m_state.get(); }
@@ -208,24 +170,12 @@ public:
     // InspectorAgent API
     void getInspectorState(RefPtr<InspectorObject>* state);
     void setMonitoringXHREnabled(bool enabled, bool* newState);
-    void populateScriptObjects(ErrorString* error);
     // Following are used from InspectorBackend and internally.
-    void setSearchingForNode(ErrorString* error, bool enabled, bool* newState);
-    void didEvaluateForTestInFrontend(ErrorString* error, long callId, const String& jsonResult);
-
-    void setUserAgentOverride(ErrorString* error, const String& userAgent);
-    void applyUserAgentOverride(String* userAgent) const;
+    void didEvaluateForTestInFrontend(ErrorString*, long callId, const String& jsonResult);
 
 private:
     void showPanel(const String& panel);
-    void pushDataCollectedOffline();
-    enum ProfilerRestoreAction {
-        ProfilerRestoreNoAction = 0,
-        ProfilerRestoreResetAgent = 1
-    };
-    void restoreProfiler(ProfilerRestoreAction);
     void unbindAllResources();
-    void setSearchingForNode(bool enabled);
 
     void releaseFrontendLifetimeAgents();
     void createFrontendLifetimeAgents();
@@ -234,10 +184,6 @@ private:
     void toggleRecordButton(bool);
 #endif
 
-    PassRefPtr<InspectorObject> buildObjectForCookie(const Cookie&);
-    PassRefPtr<InspectorArray> buildArrayForCookies(ListHashSet<Cookie>&);
-
-    void focusNode();
     bool isMainResourceLoader(DocumentLoader*, const KURL& requestUrl);
     void issueEvaluateForTestCommands();
 
@@ -245,8 +191,9 @@ private:
     InspectorClient* m_client;
     InspectorFrontend* m_frontend;
     OwnPtr<InstrumentingAgents> m_instrumentingAgents;
-    RefPtr<InjectedScriptHost> m_injectedScriptHost;
+    InjectedScriptManager* m_injectedScriptManager;
     OwnPtr<InspectorState> m_state;
+    OwnPtr<InspectorPageAgent> m_pageAgent;
     OwnPtr<InspectorDOMAgent> m_domAgent;
     OwnPtr<InspectorCSSAgent> m_cssAgent;
 
@@ -264,8 +211,6 @@ private:
     OwnPtr<InspectorApplicationCacheAgent> m_applicationCacheAgent;
 #endif
 
-    RefPtr<Node> m_highlightedNode;
-    RefPtr<Node> m_nodeToFocus;
     RefPtr<InspectorResourceAgent> m_resourceAgent;
     OwnPtr<InspectorRuntimeAgent> m_runtimeAgent;
 
@@ -273,14 +218,12 @@ private:
 
     Vector<pair<long, String> > m_pendingEvaluateTestCommands;
     String m_showPanelAfterVisible;
-    Vector<String> m_scriptsToEvaluateOnLoad;
     String m_inspectorExtensionAPI;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     OwnPtr<InspectorDebuggerAgent> m_debuggerAgent;
     OwnPtr<InspectorBrowserDebuggerAgent> m_browserDebuggerAgent;
     OwnPtr<InspectorProfilerAgent> m_profilerAgent;
 #endif
-    String m_userAgentOverride;
 #if ENABLE(WORKERS)
     typedef HashMap<intptr_t, RefPtr<InspectorWorkerResource> > WorkersMap;
     WorkersMap m_workers;
diff --git a/Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp b/Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp
index 625f53d..705a640 100644
--- a/Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp
+++ b/Source/WebCore/inspector/InspectorApplicationCacheAgent.cpp
@@ -73,7 +73,7 @@ void InspectorApplicationCacheAgent::networkStateChanged()
     m_frontend->updateNetworkState(isNowOnline);
 }
 
-void InspectorApplicationCacheAgent::getApplicationCaches(ErrorString*, RefPtr<InspectorValue>* applicationCaches)
+void InspectorApplicationCacheAgent::getApplicationCaches(ErrorString*, RefPtr<InspectorObject>* applicationCaches)
 {
     DocumentLoader* documentLoader = m_inspectedPage->mainFrame()->loader()->documentLoader();
     if (!documentLoader)
diff --git a/Source/WebCore/inspector/InspectorApplicationCacheAgent.h b/Source/WebCore/inspector/InspectorApplicationCacheAgent.h
index 34abf81..04b9533 100644
--- a/Source/WebCore/inspector/InspectorApplicationCacheAgent.h
+++ b/Source/WebCore/inspector/InspectorApplicationCacheAgent.h
@@ -60,7 +60,7 @@ public:
     void networkStateChanged();
 
     // From Frontend
-    void getApplicationCaches(ErrorString* error, RefPtr<InspectorValue>* applicationCaches);
+    void getApplicationCaches(ErrorString*, RefPtr<InspectorObject>* applicationCaches);
 
 private:
     PassRefPtr<InspectorObject> buildObjectForApplicationCache(const ApplicationCacheHost::ResourceInfoList&, const ApplicationCacheHost::CacheInfo&);
diff --git a/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.cpp b/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.cpp
index 0cba775..1cf2a25 100644
--- a/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.cpp
@@ -35,12 +35,13 @@
 #if ENABLE(INSPECTOR) && ENABLE(JAVASCRIPT_DEBUGGER)
 
 #include "HTMLElement.h"
+#include "InspectorAgent.h"
 #include "InspectorDOMAgent.h"
 #include "InspectorDebuggerAgent.h"
 #include "InspectorState.h"
 #include "InspectorValues.h"
 #include "InstrumentingAgents.h"
-#include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 namespace {
 
@@ -63,7 +64,9 @@ const int domBreakpointDerivedTypeShift = 16;
 namespace WebCore {
 
 namespace BrowserDebuggerAgentState {
-static const char browserBreakpoints[] = "browserBreakpoints";
+static const char eventListenerBreakpoints[] = "eventListenerBreakpoints";
+static const char pauseOnAllXHRs[] = "pauseOnAllXHRs";
+static const char xhrBreakpoints[] = "xhrBreakpoints";
 }
 
 PassOwnPtr<InspectorBrowserDebuggerAgent> InspectorBrowserDebuggerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, InspectorDOMAgent* domAgent, InspectorDebuggerAgent* debuggerAgent, InspectorAgent* inspectorAgent)
@@ -77,7 +80,6 @@ InspectorBrowserDebuggerAgent::InspectorBrowserDebuggerAgent(InstrumentingAgents
     , m_domAgent(domAgent)
     , m_debuggerAgent(debuggerAgent)
     , m_inspectorAgent(inspectorAgent)
-    , m_hasXHRBreakpointWithEmptyURL(false)
 {
     m_debuggerAgent->setListener(this);
 }
@@ -105,84 +107,38 @@ void InspectorBrowserDebuggerAgent::disable()
     clear();
 }
 
-void InspectorBrowserDebuggerAgent::setFrontend(InspectorFrontend*)
-{
-    // Erase sticky breakpoints. If we are restoring from a cookie setFrontend msut be called
-    // before the state is loaded from the cookie.
-    m_inspectorState->setObject(BrowserDebuggerAgentState::browserBreakpoints, InspectorObject::create());
-}
-
 void InspectorBrowserDebuggerAgent::clearFrontend()
 {
     disable();
 }
 
-void InspectorBrowserDebuggerAgent::setAllBrowserBreakpoints(ErrorString*, PassRefPtr<InspectorObject> breakpoints)
-{
-    m_inspectorState->setObject(BrowserDebuggerAgentState::browserBreakpoints, breakpoints);
-    // FIXME: remove this call to inspector agent and dependency on the inspector agent.
-    inspectedURLChanged(m_inspectorAgent->inspectedURLWithoutFragment());
-}
-
-void InspectorBrowserDebuggerAgent::inspectedURLChanged(const String& url)
+void InspectorBrowserDebuggerAgent::discardBindings()
 {
-    m_eventListenerBreakpoints.clear();
-    m_XHRBreakpoints.clear();
-    m_hasXHRBreakpointWithEmptyURL = false;
-
-    RefPtr<InspectorObject> allBreakpoints = m_inspectorState->getObject(BrowserDebuggerAgentState::browserBreakpoints);
-    RefPtr<InspectorArray> breakpoints = allBreakpoints->getArray(url);
-    if (!breakpoints)
-        return;
-    for (unsigned i = 0; i < breakpoints->length(); ++i)
-        restoreStickyBreakpoint(breakpoints->get(i)->asObject());
+    m_domBreakpoints.clear();
 }
 
-void InspectorBrowserDebuggerAgent::restoreStickyBreakpoint(PassRefPtr<InspectorObject> breakpoint)
+void InspectorBrowserDebuggerAgent::setEventListenerBreakpoint(ErrorString* error, const String& eventName)
 {
-    if (!breakpoint)
-        return;
-    String type;
-    if (!breakpoint->getString("type", &type))
-        return;
-    bool enabled;
-    if (!breakpoint->getBoolean("enabled", &enabled))
+    if (eventName.isEmpty()) {
+        *error = "Event name is empty";
         return;
-    RefPtr<InspectorObject> condition = breakpoint->getObject("condition");
-    if (!condition)
-        return;
-
-    ErrorString error;
-    if (type == eventListenerNativeBreakpointType) {
-        if (!enabled)
-            return;
-        String eventName;
-        if (!condition->getString("eventName", &eventName))
-            return;
-        setEventListenerBreakpoint(&error, eventName);
-    } else if (type == xhrNativeBreakpointType) {
-        if (!enabled)
-            return;
-        String url;
-        if (!condition->getString("url", &url))
-            return;
-        setXHRBreakpoint(&error, url);
     }
-}
 
-void InspectorBrowserDebuggerAgent::discardBindings()
-{
-    m_domBreakpoints.clear();
+    RefPtr<InspectorObject> eventListenerBreakpoints = m_inspectorState->getObject(BrowserDebuggerAgentState::eventListenerBreakpoints);
+    eventListenerBreakpoints->setBoolean(eventName, true);
+    m_inspectorState->setObject(BrowserDebuggerAgentState::eventListenerBreakpoints, eventListenerBreakpoints);
 }
 
-void InspectorBrowserDebuggerAgent::setEventListenerBreakpoint(ErrorString*, const String& eventName)
+void InspectorBrowserDebuggerAgent::removeEventListenerBreakpoint(ErrorString* error, const String& eventName)
 {
-    m_eventListenerBreakpoints.add(eventName);
-}
+    if (eventName.isEmpty()) {
+        *error = "Event name is empty";
+        return;
+    }
 
-void InspectorBrowserDebuggerAgent::removeEventListenerBreakpoint(ErrorString*, const String& eventName)
-{
-    m_eventListenerBreakpoints.remove(eventName);
+    RefPtr<InspectorObject> eventListenerBreakpoints = m_inspectorState->getObject(BrowserDebuggerAgentState::eventListenerBreakpoints);
+    eventListenerBreakpoints->remove(eventName);
+    m_inspectorState->setObject(BrowserDebuggerAgentState::eventListenerBreakpoints, eventListenerBreakpoints);
 }
 
 void InspectorBrowserDebuggerAgent::didInsertDOMNode(Node* node)
@@ -213,7 +169,7 @@ void InspectorBrowserDebuggerAgent::didRemoveDOMNode(Node* node)
     }
 }
 
-void InspectorBrowserDebuggerAgent::setDOMBreakpoint(ErrorString*, long nodeId, long type)
+void InspectorBrowserDebuggerAgent::setDOMBreakpoint(ErrorString*, int nodeId, int type)
 {
     Node* node = m_domAgent->nodeForId(nodeId);
     if (!node)
@@ -227,7 +183,7 @@ void InspectorBrowserDebuggerAgent::setDOMBreakpoint(ErrorString*, long nodeId,
     }
 }
 
-void InspectorBrowserDebuggerAgent::removeDOMBreakpoint(ErrorString*, long nodeId, long type)
+void InspectorBrowserDebuggerAgent::removeDOMBreakpoint(ErrorString*, int nodeId, int type)
 {
     Node* node = m_domAgent->nodeForId(nodeId);
     if (!node)
@@ -266,12 +222,13 @@ void InspectorBrowserDebuggerAgent::willRemoveDOMNode(Node* node)
     if (!debuggerAgent)
         return;
 
+    Node* parentNode = InspectorDOMAgent::innerParentNode(node);
     if (hasBreakpoint(node, NodeRemoved)) {
         RefPtr<InspectorObject> eventData = InspectorObject::create();
         descriptionForDOMEvent(node, NodeRemoved, false, eventData.get());
         eventData->setString("breakpointType", domNativeBreakpointType);
         debuggerAgent->breakProgram(NativeBreakpointDebuggerEventType, eventData.release());
-    } else if (hasBreakpoint(InspectorDOMAgent::innerParentNode(node), SubtreeModified)) {
+    } else if (parentNode && hasBreakpoint(parentNode, SubtreeModified)) {
         RefPtr<InspectorObject> eventData = InspectorObject::create();
         descriptionForDOMEvent(node, SubtreeModified, false, eventData.get());
         eventData->setString("breakpointType", domNativeBreakpointType);
@@ -293,7 +250,7 @@ void InspectorBrowserDebuggerAgent::willModifyDOMAttr(Element* element)
     }
 }
 
-void InspectorBrowserDebuggerAgent::descriptionForDOMEvent(Node* target, long breakpointType, bool insertion, InspectorObject* description)
+void InspectorBrowserDebuggerAgent::descriptionForDOMEvent(Node* target, int breakpointType, bool insertion, InspectorObject* description)
 {
     ASSERT(hasBreakpoint(target, breakpointType));
 
@@ -301,7 +258,7 @@ void InspectorBrowserDebuggerAgent::descriptionForDOMEvent(Node* target, long br
     if ((1 << breakpointType) & inheritableDOMBreakpointTypesMask) {
         // For inheritable breakpoint types, target node isn't always the same as the node that owns a breakpoint.
         // Target node may be unknown to frontend, so we need to push it first.
-        RefPtr<InspectorObject> targetNodeObject = m_domAgent->resolveNode(target, "");
+        RefPtr<InspectorObject> targetNodeObject = m_domAgent->resolveNode(target);
         description->setObject("targetNode", targetNodeObject);
 
         // Find breakpoint owner node.
@@ -317,13 +274,13 @@ void InspectorBrowserDebuggerAgent::descriptionForDOMEvent(Node* target, long br
             description->setBoolean("insertion", insertion);
     }
 
-    long breakpointOwnerNodeId = m_domAgent->boundNodeId(breakpointOwner);
+    int breakpointOwnerNodeId = m_domAgent->boundNodeId(breakpointOwner);
     ASSERT(breakpointOwnerNodeId);
     description->setNumber("nodeId", breakpointOwnerNodeId);
     description->setNumber("type", breakpointType);
 }
 
-bool InspectorBrowserDebuggerAgent::hasBreakpoint(Node* node, long type)
+bool InspectorBrowserDebuggerAgent::hasBreakpoint(Node* node, int type)
 {
     uint32_t rootBit = 1 << type;
     uint32_t derivedBit = rootBit << domBreakpointDerivedTypeShift;
@@ -354,8 +311,9 @@ void InspectorBrowserDebuggerAgent::pauseOnNativeEventIfNeeded(const String& cat
     if (!debuggerAgent)
         return;
 
-    String fullEventName = String::format("%s:%s", categoryType.utf8().data(), eventName.utf8().data());
-    if (!m_eventListenerBreakpoints.contains(fullEventName))
+    String fullEventName = makeString(categoryType, ":", eventName);
+    RefPtr<InspectorObject> eventListenerBreakpoints = m_inspectorState->getObject(BrowserDebuggerAgentState::eventListenerBreakpoints);
+    if (eventListenerBreakpoints->find(fullEventName) == eventListenerBreakpoints->end())
         return;
 
     RefPtr<InspectorObject> eventData = InspectorObject::create();
@@ -369,18 +327,26 @@ void InspectorBrowserDebuggerAgent::pauseOnNativeEventIfNeeded(const String& cat
 
 void InspectorBrowserDebuggerAgent::setXHRBreakpoint(ErrorString*, const String& url)
 {
-    if (url.isEmpty())
-        m_hasXHRBreakpointWithEmptyURL = true;
-    else
-        m_XHRBreakpoints.add(url);
+    if (url.isEmpty()) {
+        m_inspectorState->setBoolean(BrowserDebuggerAgentState::pauseOnAllXHRs, true);
+        return;
+    }
+
+    RefPtr<InspectorObject> xhrBreakpoints = m_inspectorState->getObject(BrowserDebuggerAgentState::xhrBreakpoints);
+    xhrBreakpoints->setBoolean(url, true);
+    m_inspectorState->setObject(BrowserDebuggerAgentState::xhrBreakpoints, xhrBreakpoints);
 }
 
 void InspectorBrowserDebuggerAgent::removeXHRBreakpoint(ErrorString*, const String& url)
 {
-    if (url.isEmpty())
-        m_hasXHRBreakpointWithEmptyURL = false;
-    else
-        m_XHRBreakpoints.remove(url);
+    if (url.isEmpty()) {
+        m_inspectorState->setBoolean(BrowserDebuggerAgentState::pauseOnAllXHRs, false);
+        return;
+    }
+
+    RefPtr<InspectorObject> xhrBreakpoints = m_inspectorState->getObject(BrowserDebuggerAgentState::xhrBreakpoints);
+    xhrBreakpoints->remove(url);
+    m_inspectorState->setObject(BrowserDebuggerAgentState::xhrBreakpoints, xhrBreakpoints);
 }
 
 void InspectorBrowserDebuggerAgent::willSendXMLHttpRequest(const String& url)
@@ -390,12 +356,13 @@ void InspectorBrowserDebuggerAgent::willSendXMLHttpRequest(const String& url)
         return;
 
     String breakpointURL;
-    if (m_hasXHRBreakpointWithEmptyURL)
+    if (m_inspectorState->getBoolean(BrowserDebuggerAgentState::pauseOnAllXHRs))
         breakpointURL = "";
     else {
-        for (HashSet<String>::iterator it = m_XHRBreakpoints.begin(); it != m_XHRBreakpoints.end(); ++it) {
-            if (url.contains(*it)) {
-                breakpointURL = *it;
+        RefPtr<InspectorObject> xhrBreakpoints = m_inspectorState->getObject(BrowserDebuggerAgentState::xhrBreakpoints);
+        for (InspectorObject::iterator it = xhrBreakpoints->begin(); it != xhrBreakpoints->end(); ++it) {
+            if (url.contains(it->first)) {
+                breakpointURL = it->first;
                 break;
             }
         }
@@ -414,9 +381,6 @@ void InspectorBrowserDebuggerAgent::willSendXMLHttpRequest(const String& url)
 void InspectorBrowserDebuggerAgent::clear()
 {
     m_domBreakpoints.clear();
-    m_eventListenerBreakpoints.clear();
-    m_XHRBreakpoints.clear();
-    m_hasXHRBreakpointWithEmptyURL = false;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.h b/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.h
index 7c0bc8d..add0c05 100644
--- a/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.h
+++ b/Source/WebCore/inspector/InspectorBrowserDebuggerAgent.h
@@ -36,10 +36,8 @@
 #include "InspectorDebuggerAgent.h"
 #include "PlatformString.h"
 #include <wtf/HashMap.h>
-#include <wtf/HashSet.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefCounted.h>
-#include <wtf/text/StringHash.h>
 
 namespace WebCore {
 
@@ -62,19 +60,15 @@ public:
 
     virtual ~InspectorBrowserDebuggerAgent();
 
-    void setFrontend(InspectorFrontend*);
     void clearFrontend();
 
-    void setAllBrowserBreakpoints(ErrorString* error, PassRefPtr<InspectorObject>);
-    void inspectedURLChanged(const String& url);
-
     // BrowserDebugger API for InspectorFrontend
-    void setXHRBreakpoint(ErrorString* error, const String& url);
-    void removeXHRBreakpoint(ErrorString* error, const String& url);
-    void setEventListenerBreakpoint(ErrorString* error, const String& eventName);
-    void removeEventListenerBreakpoint(ErrorString* error, const String& eventName);
-    void setDOMBreakpoint(ErrorString* error, long nodeId, long type);
-    void removeDOMBreakpoint(ErrorString* error, long nodeId, long type);
+    void setXHRBreakpoint(ErrorString*, const String& url);
+    void removeXHRBreakpoint(ErrorString*, const String& url);
+    void setEventListenerBreakpoint(ErrorString*, const String& eventName);
+    void removeEventListenerBreakpoint(ErrorString*, const String& eventName);
+    void setDOMBreakpoint(ErrorString*, int nodeId, int type);
+    void removeDOMBreakpoint(ErrorString*, int nodeId, int type);
 
     // InspectorInstrumentation API
     void willInsertDOMNode(Node*, Node* parent);
@@ -93,11 +87,9 @@ private:
     virtual void debuggerWasDisabled();
     void disable();
 
-    void restoreStickyBreakpoint(PassRefPtr<InspectorObject> breakpoint);
-
-    void descriptionForDOMEvent(Node* target, long breakpointType, bool insertion, InspectorObject* description);
+    void descriptionForDOMEvent(Node* target, int breakpointType, bool insertion, InspectorObject* description);
     void updateSubtreeBreakpoints(Node*, uint32_t rootMask, bool set);
-    bool hasBreakpoint(Node*, long type);
+    bool hasBreakpoint(Node*, int type);
     void discardBindings();
 
     void clear();
@@ -108,9 +100,6 @@ private:
     InspectorDebuggerAgent* m_debuggerAgent;
     InspectorAgent* m_inspectorAgent;
     HashMap<Node*, uint32_t> m_domBreakpoints;
-    HashSet<String> m_eventListenerBreakpoints;
-    HashSet<String> m_XHRBreakpoints;
-    bool m_hasXHRBreakpointWithEmptyURL;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.cpp b/Source/WebCore/inspector/InspectorCSSAgent.cpp
index b96071d..980fcf2 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.cpp
+++ b/Source/WebCore/inspector/InspectorCSSAgent.cpp
@@ -104,17 +104,21 @@
 //    selectorRange: { start: <number>, end: <number> } // Optional - for source-based rules only
 // }
 //
+// cssStyleSheetInfo = {
+//    styleSheetId : <number>
+//    sourceURL    : <string>
+//    title        : <string>
+//    disabled     : <boolean>
+// }
+//
 // cssStyleSheet = {
-//    styleSheetId   : <number>
-//    sourceURL      : <string>
-//    title          : <string>
-//    disabled       : <boolean>
-//    rules          : [
-//                         #cssRule,
-//                         ...
-//                         #cssRule
-//                     ]
-//    text           : <string> // Optional - whenever the text is available for a text-based stylesheet
+//    styleSheetId : <number>
+//    rules        : [
+//                       #cssRule,
+//                       ...
+//                       #cssRule
+//                   ]
+//    text         : <string> // Optional - whenever the text is available for a text-based stylesheet
 // }
 
 namespace WebCore {
@@ -171,9 +175,9 @@ void InspectorCSSAgent::reset()
     m_documentToInspectorStyleSheet.clear();
 }
 
-void InspectorCSSAgent::getStylesForNode(ErrorString*, long nodeId, RefPtr<InspectorValue>* result)
+void InspectorCSSAgent::getStylesForNode(ErrorString* errorString, int nodeId, RefPtr<InspectorObject>* result)
 {
-    Element* element = elementForId(nodeId);
+    Element* element = elementForId(errorString, nodeId);
     if (!element)
         return;
 
@@ -191,7 +195,7 @@ void InspectorCSSAgent::getStylesForNode(ErrorString*, long nodeId, RefPtr<Inspe
     RefPtr<CSSRuleList> matchedRules = selector->styleRulesForElement(element, false, true);
     resultObject->setArray("matchedCSSRules", buildArrayForRuleList(matchedRules.get()));
 
-    resultObject->setObject("styleAttributes", buildObjectForAttributeStyles(element));
+    resultObject->setArray("styleAttributes", buildArrayForAttributeStyles(element));
 
     RefPtr<InspectorArray> pseudoElements = InspectorArray::create();
     for (PseudoId pseudoId = FIRST_PUBLIC_PSEUDOID; pseudoId < AFTER_LAST_INTERNAL_PSEUDOID; pseudoId = static_cast<PseudoId>(pseudoId + 1)) {
@@ -226,9 +230,9 @@ void InspectorCSSAgent::getStylesForNode(ErrorString*, long nodeId, RefPtr<Inspe
     *result = resultObject.release();
 }
 
-void InspectorCSSAgent::getInlineStyleForNode(ErrorString*, long nodeId, RefPtr<InspectorValue>* style)
+void InspectorCSSAgent::getInlineStyleForNode(ErrorString* errorString, int nodeId, RefPtr<InspectorObject>* style)
 {
-    Element* element = elementForId(nodeId);
+    Element* element = elementForId(errorString, nodeId);
     if (!element)
         return;
 
@@ -239,9 +243,9 @@ void InspectorCSSAgent::getInlineStyleForNode(ErrorString*, long nodeId, RefPtr<
     *style = styleSheet->buildObjectForStyle(element->style());
 }
 
-void InspectorCSSAgent::getComputedStyleForNode(ErrorString*, long nodeId, RefPtr<InspectorValue>* style)
+void InspectorCSSAgent::getComputedStyleForNode(ErrorString* errorString, int nodeId, RefPtr<InspectorObject>* style)
 {
-    Element* element = elementForId(nodeId);
+    Element* element = elementForId(errorString, nodeId);
     if (!element)
         return;
 
@@ -250,7 +254,7 @@ void InspectorCSSAgent::getComputedStyleForNode(ErrorString*, long nodeId, RefPt
     *style = inspectorStyle->buildObjectForStyle();
 }
 
-void InspectorCSSAgent::getAllStyles(ErrorString*, RefPtr<InspectorArray>* styles)
+void InspectorCSSAgent::getAllStyleSheets(ErrorString*, RefPtr<InspectorArray>* styleInfos)
 {
     Vector<Document*> documents = m_domAgent->documents();
     for (Vector<Document*>::iterator it = documents.begin(); it != documents.end(); ++it) {
@@ -259,33 +263,33 @@ void InspectorCSSAgent::getAllStyles(ErrorString*, RefPtr<InspectorArray>* style
             StyleSheet* styleSheet = list->item(i);
             if (styleSheet->isCSSStyleSheet()) {
                 InspectorStyleSheet* inspectorStyleSheet = bindStyleSheet(static_cast<CSSStyleSheet*>(styleSheet));
-                (*styles)->pushString(inspectorStyleSheet->id());
+                (*styleInfos)->pushObject(inspectorStyleSheet->buildObjectForStyleSheetInfo());
             }
         }
     }
 }
 
-void InspectorCSSAgent::getStyleSheet(ErrorString*, const String& styleSheetId, RefPtr<InspectorValue>* styleSheetObject)
+void InspectorCSSAgent::getStyleSheet(ErrorString* errorString, const String& styleSheetId, RefPtr<InspectorObject>* styleSheetObject)
 {
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(styleSheetId);
+    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, styleSheetId);
     if (!inspectorStyleSheet)
         return;
 
     *styleSheetObject = inspectorStyleSheet->buildObjectForStyleSheet();
 }
 
-void InspectorCSSAgent::getStyleSheetText(ErrorString*, const String& styleSheetId, String* url, String* result)
+void InspectorCSSAgent::getStyleSheetText(ErrorString* errorString, const String& styleSheetId, String* url, String* result)
 {
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(styleSheetId);
+    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, styleSheetId);
     if (!inspectorStyleSheet)
         return;
     *url = inspectorStyleSheet->finalURL();
     inspectorStyleSheet->text(result);
 }
 
-void InspectorCSSAgent::setStyleSheetText(ErrorString*, const String& styleSheetId, const String& text, bool* success)
+void InspectorCSSAgent::setStyleSheetText(ErrorString* errorString, const String& styleSheetId, const String& text, bool* success)
 {
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(styleSheetId);
+    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, styleSheetId);
     if (!inspectorStyleSheet) {
         *success = false;
         return;
@@ -296,12 +300,12 @@ void InspectorCSSAgent::setStyleSheetText(ErrorString*, const String& styleSheet
         inspectorStyleSheet->reparseStyleSheet(text);
 }
 
-void InspectorCSSAgent::setPropertyText(ErrorString*, const RefPtr<InspectorObject>& fullStyleId, long propertyIndex, const String& text, bool overwrite, RefPtr<InspectorValue>* result)
+void InspectorCSSAgent::setPropertyText(ErrorString* errorString, const RefPtr<InspectorObject>& fullStyleId, int propertyIndex, const String& text, bool overwrite, RefPtr<InspectorObject>* result)
 {
     InspectorCSSId compoundId(fullStyleId);
     ASSERT(!compoundId.isEmpty());
 
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(compoundId.styleSheetId());
+    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, compoundId.styleSheetId());
     if (!inspectorStyleSheet)
         return;
 
@@ -310,12 +314,12 @@ void InspectorCSSAgent::setPropertyText(ErrorString*, const RefPtr<InspectorObje
         *result = inspectorStyleSheet->buildObjectForStyle(inspectorStyleSheet->styleForId(compoundId));
 }
 
-void InspectorCSSAgent::toggleProperty(ErrorString*, const RefPtr<InspectorObject>& fullStyleId, long propertyIndex, bool disable, RefPtr<InspectorValue>* result)
+void InspectorCSSAgent::toggleProperty(ErrorString* errorString, const RefPtr<InspectorObject>& fullStyleId, int propertyIndex, bool disable, RefPtr<InspectorObject>* result)
 {
     InspectorCSSId compoundId(fullStyleId);
     ASSERT(!compoundId.isEmpty());
 
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(compoundId.styleSheetId());
+    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, compoundId.styleSheetId());
     if (!inspectorStyleSheet)
         return;
 
@@ -324,12 +328,12 @@ void InspectorCSSAgent::toggleProperty(ErrorString*, const RefPtr<InspectorObjec
         *result = inspectorStyleSheet->buildObjectForStyle(inspectorStyleSheet->styleForId(compoundId));
 }
 
-void InspectorCSSAgent::setRuleSelector(ErrorString*, const RefPtr<InspectorObject>& fullRuleId, const String& selector, RefPtr<InspectorValue>* result)
+void InspectorCSSAgent::setRuleSelector(ErrorString* errorString, const RefPtr<InspectorObject>& fullRuleId, const String& selector, RefPtr<InspectorObject>* result)
 {
     InspectorCSSId compoundId(fullRuleId);
     ASSERT(!compoundId.isEmpty());
 
-    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(compoundId.styleSheetId());
+    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(errorString, compoundId.styleSheetId());
     if (!inspectorStyleSheet)
         return;
 
@@ -340,7 +344,7 @@ void InspectorCSSAgent::setRuleSelector(ErrorString*, const RefPtr<InspectorObje
     *result = inspectorStyleSheet->buildObjectForRule(inspectorStyleSheet->ruleForId(compoundId));
 }
 
-void InspectorCSSAgent::addRule(ErrorString*, const long contextNodeId, const String& selector, RefPtr<InspectorValue>* result)
+void InspectorCSSAgent::addRule(ErrorString*, const int contextNodeId, const String& selector, RefPtr<InspectorObject>* result)
 {
     Node* node = m_domAgent->nodeForId(contextNodeId);
     if (!node)
@@ -394,10 +398,18 @@ InspectorStyleSheetForInlineStyle* InspectorCSSAgent::asInspectorStyleSheet(Elem
     return it->second.get();
 }
 
-Element* InspectorCSSAgent::elementForId(long nodeId)
+Element* InspectorCSSAgent::elementForId(ErrorString* errorString, int nodeId)
 {
     Node* node = m_domAgent->nodeForId(nodeId);
-    return (!node || node->nodeType() != Node::ELEMENT_NODE) ? 0 : static_cast<Element*>(node);
+    if (!node) {
+        *errorString = "No node with given id found.";
+        return 0;
+    }
+    if (node->nodeType() != Node::ELEMENT_NODE) {
+        *errorString = "Not an element node.";
+        return 0;
+    }
+    return static_cast<Element*>(node);
 }
 
 InspectorStyleSheet* InspectorCSSAgent::bindStyleSheet(CSSStyleSheet* styleSheet)
@@ -453,10 +465,14 @@ InspectorStyleSheet* InspectorCSSAgent::viaInspectorStyleSheet(Document* documen
     return inspectorStyleSheet.get();
 }
 
-InspectorStyleSheet* InspectorCSSAgent::styleSheetForId(const String& styleSheetId)
+InspectorStyleSheet* InspectorCSSAgent::styleSheetForId(ErrorString* errorString, const String& styleSheetId)
 {
     IdToInspectorStyleSheet::iterator it = m_idToInspectorStyleSheet.find(styleSheetId);
-    return it == m_idToInspectorStyleSheet.end() ? 0 : it->second.get();
+    if (it == m_idToInspectorStyleSheet.end()) {
+        *errorString = "No style sheet with given id found.";
+        return 0;
+    }
+    return it->second.get();
 }
 
 String InspectorCSSAgent::detectOrigin(CSSStyleSheet* pageStyleSheet, Document* ownerDocument)
@@ -496,20 +512,23 @@ PassRefPtr<InspectorArray> InspectorCSSAgent::buildArrayForRuleList(CSSRuleList*
     return result.release();
 }
 
-PassRefPtr<InspectorObject> InspectorCSSAgent::buildObjectForAttributeStyles(Element* element)
+PassRefPtr<InspectorArray> InspectorCSSAgent::buildArrayForAttributeStyles(Element* element)
 {
-    RefPtr<InspectorObject> styleAttributes = InspectorObject::create();
+    RefPtr<InspectorArray> attrStyles = InspectorArray::create();
     NamedNodeMap* attributes = element->attributes();
     for (unsigned i = 0; attributes && i < attributes->length(); ++i) {
         Attribute* attribute = attributes->attributeItem(i);
         if (attribute->style()) {
+            RefPtr<InspectorObject> attrStyleObject = InspectorObject::create();
             String attributeName = attribute->localName();
             RefPtr<InspectorStyle> inspectorStyle = InspectorStyle::create(InspectorCSSId(), attribute->style(), 0);
-            styleAttributes->setObject(attributeName.utf8().data(), inspectorStyle->buildObjectForStyle());
+            attrStyleObject->setString("name", attributeName.utf8().data());
+            attrStyleObject->setObject("style", inspectorStyle->buildObjectForStyle());
+            attrStyles->pushObject(attrStyleObject.release());
         }
     }
 
-    return styleAttributes;
+    return attrStyles.release();
 }
 
 void InspectorCSSAgent::didRemoveDocument(Document* document)
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.h b/Source/WebCore/inspector/InspectorCSSAgent.h
index 4e3f57a..40bc2ab 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.h
+++ b/Source/WebCore/inspector/InspectorCSSAgent.h
@@ -61,18 +61,18 @@ public:
     ~InspectorCSSAgent();
 
     void reset();
-    void getStylesForNode(ErrorString* error, long nodeId, RefPtr<InspectorValue>* result);
-    void getInlineStyleForNode(ErrorString* error, long nodeId, RefPtr<InspectorValue>* style);
-    void getComputedStyleForNode(ErrorString* error, long nodeId, RefPtr<InspectorValue>* style);
-    void getAllStyles(ErrorString* error, RefPtr<InspectorArray>* styles);
-    void getStyleSheet(ErrorString* error, const String& styleSheetId, RefPtr<InspectorValue>* result);
-    void getStyleSheetText(ErrorString* error, const String& styleSheetId, String* url, String* result);
-    void setStyleSheetText(ErrorString* error, const String& styleSheetId, const String& text, bool* success);
-    void setPropertyText(ErrorString* error, const RefPtr<InspectorObject>& styleId, long propertyIndex, const String& text, bool overwrite, RefPtr<InspectorValue>* result);
-    void toggleProperty(ErrorString* error, const RefPtr<InspectorObject>& styleId, long propertyIndex, bool disable, RefPtr<InspectorValue>* result);
-    void setRuleSelector(ErrorString* error, const RefPtr<InspectorObject>& ruleId, const String& selector, RefPtr<InspectorValue>* result);
-    void addRule(ErrorString* error, const long contextNodeId, const String& selector, RefPtr<InspectorValue>* result);
-    void getSupportedCSSProperties(ErrorString* error, RefPtr<InspectorArray>* result);
+    void getStylesForNode(ErrorString*, int nodeId, RefPtr<InspectorObject>* result);
+    void getInlineStyleForNode(ErrorString*, int nodeId, RefPtr<InspectorObject>* style);
+    void getComputedStyleForNode(ErrorString*, int nodeId, RefPtr<InspectorObject>* style);
+    void getAllStyleSheets(ErrorString*, RefPtr<InspectorArray>* styleSheetInfos);
+    void getStyleSheet(ErrorString*, const String& styleSheetId, RefPtr<InspectorObject>* result);
+    void getStyleSheetText(ErrorString*, const String& styleSheetId, String* url, String* result);
+    void setStyleSheetText(ErrorString*, const String& styleSheetId, const String& text, bool* success);
+    void setPropertyText(ErrorString*, const RefPtr<InspectorObject>& styleId, int propertyIndex, const String& text, bool overwrite, RefPtr<InspectorObject>* result);
+    void toggleProperty(ErrorString*, const RefPtr<InspectorObject>& styleId, int propertyIndex, bool disable, RefPtr<InspectorObject>* result);
+    void setRuleSelector(ErrorString*, const RefPtr<InspectorObject>& ruleId, const String& selector, RefPtr<InspectorObject>* result);
+    void addRule(ErrorString*, const int contextNodeId, const String& selector, RefPtr<InspectorObject>* result);
+    void getSupportedCSSProperties(ErrorString*, RefPtr<InspectorArray>* result);
 
 private:
     typedef HashMap<String, RefPtr<InspectorStyleSheet> > IdToInspectorStyleSheet;
@@ -83,15 +83,15 @@ private:
     static Element* inlineStyleElement(CSSStyleDeclaration*);
 
     InspectorStyleSheetForInlineStyle* asInspectorStyleSheet(Element* element);
-    Element* elementForId(long nodeId);
+    Element* elementForId(ErrorString*, int nodeId);
 
     InspectorStyleSheet* bindStyleSheet(CSSStyleSheet*);
     InspectorStyleSheet* viaInspectorStyleSheet(Document*, bool createIfAbsent);
-    InspectorStyleSheet* styleSheetForId(const String&);
+    InspectorStyleSheet* styleSheetForId(ErrorString*, const String&);
     String detectOrigin(CSSStyleSheet* pageStyleSheet, Document* ownerDocument);
 
     PassRefPtr<InspectorArray> buildArrayForRuleList(CSSRuleList* ruleList);
-    PassRefPtr<InspectorObject> buildObjectForAttributeStyles(Element* element);
+    PassRefPtr<InspectorArray> buildArrayForAttributeStyles(Element*);
 
     // InspectorDOMAgent::DOMListener interface
     virtual void didRemoveDocument(Document*);
@@ -106,9 +106,9 @@ private:
     NodeToInspectorStyleSheet m_nodeToInspectorStyleSheet;
     DocumentToViaInspectorStyleSheet m_documentToInspectorStyleSheet;
 
-    long m_lastStyleSheetId;
-    long m_lastRuleId;
-    long m_lastStyleId;
+    int m_lastStyleSheetId;
+    int m_lastRuleId;
+    int m_lastStyleId;
 };
 
 #endif
diff --git a/Source/WebCore/inspector/InspectorConsoleAgent.cpp b/Source/WebCore/inspector/InspectorConsoleAgent.cpp
index 0379590..47cd2d5 100644
--- a/Source/WebCore/inspector/InspectorConsoleAgent.cpp
+++ b/Source/WebCore/inspector/InspectorConsoleAgent.cpp
@@ -31,6 +31,7 @@
 #include "Console.h"
 #include "ConsoleMessage.h"
 #include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
 #include "InspectorAgent.h"
 #include "InspectorDOMAgent.h"
 #include "InspectorFrontend.h"
@@ -48,18 +49,18 @@
 namespace WebCore {
 
 static const unsigned maximumConsoleMessages = 1000;
-static const unsigned expireConsoleMessagesStep = 100;
+static const int expireConsoleMessagesStep = 100;
 
 namespace ConsoleAgentState {
 static const char monitoringXHR[] = "monitoringXHR";
 static const char consoleMessagesEnabled[] = "consoleMessagesEnabled";
 }
 
-InspectorConsoleAgent::InspectorConsoleAgent(InstrumentingAgents* instrumentingAgents, InspectorAgent* inspectorAgent, InspectorState* state, InjectedScriptHost* injectedScriptHost, InspectorDOMAgent* domAgent)
+InspectorConsoleAgent::InspectorConsoleAgent(InstrumentingAgents* instrumentingAgents, InspectorAgent* inspectorAgent, InspectorState* state, InjectedScriptManager* injectedScriptManager, InspectorDOMAgent* domAgent)
     : m_instrumentingAgents(instrumentingAgents)
     , m_inspectorAgent(inspectorAgent)
     , m_inspectorState(state)
-    , m_injectedScriptHost(injectedScriptHost)
+    , m_injectedScriptManager(injectedScriptManager)
     , m_inspectorDOMAgent(domAgent)
     , m_frontend(0)
     , m_previousMessage(0)
@@ -74,14 +75,24 @@ InspectorConsoleAgent::~InspectorConsoleAgent()
     m_instrumentingAgents = 0;
     m_inspectorAgent = 0;
     m_inspectorState = 0;
-    m_injectedScriptHost = 0;
+    m_injectedScriptManager = 0;
     m_inspectorDOMAgent = 0;
 }
 
-void InspectorConsoleAgent::setConsoleMessagesEnabled(ErrorString*, bool enabled, bool* newState)
+void InspectorConsoleAgent::enable(ErrorString*, int* consoleMessageExpireCount)
 {
-    *newState = enabled;
-    setConsoleMessagesEnabled(enabled);
+    *consoleMessageExpireCount = m_expiredConsoleMessageCount;
+
+    m_inspectorState->setBoolean(ConsoleAgentState::consoleMessagesEnabled, true);
+
+    size_t messageCount = m_consoleMessages.size();
+    for (size_t i = 0; i < messageCount; ++i)
+        m_consoleMessages[i]->addToFrontend(m_frontend, m_injectedScriptManager);
+}
+
+void InspectorConsoleAgent::disable(ErrorString*)
+{
+    m_inspectorState->setBoolean(ConsoleAgentState::consoleMessagesEnabled, false);
 }
 
 void InspectorConsoleAgent::clearConsoleMessages(ErrorString*)
@@ -89,9 +100,8 @@ void InspectorConsoleAgent::clearConsoleMessages(ErrorString*)
     m_consoleMessages.clear();
     m_expiredConsoleMessageCount = 0;
     m_previousMessage = 0;
-    m_injectedScriptHost->releaseObjectGroup(0 /* release the group in all scripts */, "console");
-    if (InspectorDOMAgent* domAgent = m_inspectorAgent->domAgent())
-        domAgent->releaseDanglingNodes();
+    m_injectedScriptManager->releaseObjectGroup("console");
+    m_inspectorDOMAgent->releaseDanglingNodes();
     if (m_frontend)
         m_frontend->consoleMessagesCleared();
 }
@@ -205,7 +215,8 @@ void InspectorConsoleAgent::didFailLoading(unsigned long identifier, const Resou
 {
     if (!m_inspectorAgent->enabled())
         return;
-
+    if (error.isCancellation()) // Report failures only.
+        return;
     String message = "Failed to load resource";
     if (!error.localizedDescription().isEmpty())
         message += ": " + error.localizedDescription();
@@ -217,17 +228,12 @@ void InspectorConsoleAgent::setMonitoringXHREnabled(ErrorString*, bool enabled)
     m_inspectorState->setBoolean(ConsoleAgentState::monitoringXHR, enabled);
 }
 
-void InspectorConsoleAgent::setConsoleMessagesEnabled(bool enabled)
+void InspectorConsoleAgent::addInspectedNode(ErrorString*, int nodeId)
 {
-    m_inspectorState->setBoolean(ConsoleAgentState::consoleMessagesEnabled, enabled);
-    if (!enabled || !m_frontend)
+    Node* node = m_inspectorDOMAgent->nodeForId(nodeId);
+    if (!node)
         return;
-
-    if (m_expiredConsoleMessageCount)
-        m_frontend->updateConsoleMessageExpiredCount(m_expiredConsoleMessageCount);
-    unsigned messageCount = m_consoleMessages.size();
-    for (unsigned i = 0; i < messageCount; ++i)
-        m_consoleMessages[i]->addToFrontend(m_frontend, m_injectedScriptHost);
+    m_injectedScriptManager->injectedScriptHost()->addInspectedNode(node);
 }
 
 void InspectorConsoleAgent::addConsoleMessage(PassOwnPtr<ConsoleMessage> consoleMessage)
@@ -235,7 +241,7 @@ void InspectorConsoleAgent::addConsoleMessage(PassOwnPtr<ConsoleMessage> console
     ASSERT(m_inspectorAgent->enabled());
     ASSERT_ARG(consoleMessage, consoleMessage);
 
-    if (m_previousMessage && m_previousMessage->isEqual(consoleMessage.get())) {
+    if (m_previousMessage && m_previousMessage->type() != EndGroupMessageType && m_previousMessage->isEqual(consoleMessage.get())) {
         m_previousMessage->incrementCount();
         if (m_inspectorState->getBoolean(ConsoleAgentState::consoleMessagesEnabled) && m_frontend)
             m_previousMessage->updateRepeatCountInConsole(m_frontend);
@@ -243,7 +249,7 @@ void InspectorConsoleAgent::addConsoleMessage(PassOwnPtr<ConsoleMessage> console
         m_previousMessage = consoleMessage.get();
         m_consoleMessages.append(consoleMessage);
         if (m_inspectorState->getBoolean(ConsoleAgentState::consoleMessagesEnabled) && m_frontend)
-            m_previousMessage->addToFrontend(m_frontend, m_injectedScriptHost);
+            m_previousMessage->addToFrontend(m_frontend, m_injectedScriptManager);
     }
 
     if (!m_frontend && m_consoleMessages.size() >= maximumConsoleMessages) {
diff --git a/Source/WebCore/inspector/InspectorConsoleAgent.h b/Source/WebCore/inspector/InspectorConsoleAgent.h
index 8d3a570..2b753b5 100644
--- a/Source/WebCore/inspector/InspectorConsoleAgent.h
+++ b/Source/WebCore/inspector/InspectorConsoleAgent.h
@@ -42,7 +42,7 @@ class InspectorAgent;
 class InspectorDOMAgent;
 class InspectorFrontend;
 class InspectorState;
-class InjectedScriptHost;
+class InjectedScriptManager;
 class InstrumentingAgents;
 class ResourceError;
 class ResourceResponse;
@@ -55,10 +55,11 @@ typedef String ErrorString;
 class InspectorConsoleAgent {
     WTF_MAKE_NONCOPYABLE(InspectorConsoleAgent);
 public:
-    InspectorConsoleAgent(InstrumentingAgents*, InspectorAgent*, InspectorState*, InjectedScriptHost*, InspectorDOMAgent*);
+    InspectorConsoleAgent(InstrumentingAgents*, InspectorAgent*, InspectorState*, InjectedScriptManager*, InspectorDOMAgent*);
     ~InspectorConsoleAgent();
 
-    void setConsoleMessagesEnabled(ErrorString* error, bool enabled, bool* newState);
+    void enable(ErrorString*, int* consoleMessageExpireCount);
+    void disable(ErrorString*);
     void clearConsoleMessages(ErrorString* error);
     void reset();
     void setFrontend(InspectorFrontend*);
@@ -79,20 +80,20 @@ public:
     void addStartProfilingMessageToConsole(const String& title, unsigned lineNumber, const String& sourceURL);
 #endif
     void setMonitoringXHREnabled(ErrorString* error, bool enabled);
+    void addInspectedNode(ErrorString*, int nodeId);
 
 private:
-    void setConsoleMessagesEnabled(bool);
     void addConsoleMessage(PassOwnPtr<ConsoleMessage>);
 
     InstrumentingAgents* m_instrumentingAgents;
     InspectorAgent* m_inspectorAgent;
     InspectorState* m_inspectorState;
-    InjectedScriptHost* m_injectedScriptHost;
+    InjectedScriptManager* m_injectedScriptManager;
     InspectorDOMAgent* m_inspectorDOMAgent;
     InspectorFrontend::Console* m_frontend;
     ConsoleMessage* m_previousMessage;
     Vector<OwnPtr<ConsoleMessage> > m_consoleMessages;
-    unsigned m_expiredConsoleMessageCount;
+    int m_expiredConsoleMessageCount;
     HashMap<String, unsigned> m_counts;
     HashMap<String, double> m_times;
 };
diff --git a/Source/WebCore/inspector/InspectorController.cpp b/Source/WebCore/inspector/InspectorController.cpp
index 2f1bea2..62b22ee 100644
--- a/Source/WebCore/inspector/InspectorController.cpp
+++ b/Source/WebCore/inspector/InspectorController.cpp
@@ -36,14 +36,17 @@
 #include "Frame.h"
 #include "GraphicsContext.h"
 #include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
 #include "InspectorAgent.h"
 #include "InspectorBackendDispatcher.h"
 #include "InspectorBrowserDebuggerAgent.h"
 #include "InspectorDebuggerAgent.h"
 #include "InspectorClient.h"
+#include "InspectorDOMAgent.h"
 #include "InspectorFrontend.h"
 #include "InspectorFrontendClient.h"
 #include "InspectorInstrumentation.h"
+#include "InspectorProfilerAgent.h"
 #include "InspectorTimelineAgent.h"
 #include "Page.h"
 #include "ScriptObject.h"
@@ -52,10 +55,11 @@
 namespace WebCore {
 
 InspectorController::InspectorController(Page* page, InspectorClient* inspectorClient)
-    : m_inspectorAgent(new InspectorAgent(page, inspectorClient))
-    , m_inspectorBackendDispatcher(new InspectorBackendDispatcher(m_inspectorAgent.get()))
+    : m_injectedScriptManager(InjectedScriptManager::create())
+    , m_inspectorAgent(new InspectorAgent(page, inspectorClient, m_injectedScriptManager.get()))
     , m_inspectorClient(inspectorClient)
     , m_openingFrontend(false)
+    , m_startUserInitiatedDebuggingWhenFrontedIsConnected(false)
 {
 }
 
@@ -100,19 +104,57 @@ void InspectorController::connectFrontend()
 {
     m_openingFrontend = false;
     m_inspectorFrontend = new InspectorFrontend(m_inspectorClient);
+    m_injectedScriptManager->injectedScriptHost()->setFrontend(m_inspectorFrontend.get());
     m_inspectorAgent->setFrontend(m_inspectorFrontend.get());
 
     if (!InspectorInstrumentation::hasFrontends())
         ScriptController::setCaptureCallStackForUncaughtExceptions(true);
     InspectorInstrumentation::frontendCreated();
+
+    ASSERT(m_inspectorClient);
+    m_inspectorBackendDispatcher = new InspectorBackendDispatcher(
+        m_inspectorClient,
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+        m_inspectorAgent->applicationCacheAgent(),
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        m_inspectorAgent->browserDebuggerAgent(),
+#endif
+        m_inspectorAgent->cssAgent(),
+        m_inspectorAgent->consoleAgent(),
+        m_inspectorAgent->domAgent(),
+#if ENABLE(DOM_STORAGE)
+        m_inspectorAgent->domStorageAgent(),
+#endif
+#if ENABLE(DATABASE)
+        m_inspectorAgent->databaseAgent(),
+#endif
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        m_inspectorAgent->debuggerAgent(),
+#endif
+        m_inspectorAgent.get(),
+        m_inspectorAgent->resourceAgent(),
+        m_inspectorAgent->pageAgent(),
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        m_inspectorAgent->profilerAgent(),
+#endif
+        m_inspectorAgent->runtimeAgent(),
+        m_inspectorAgent->timelineAgent());
+
+    if (m_startUserInitiatedDebuggingWhenFrontedIsConnected) {
+        m_inspectorFrontend->inspector()->startUserInitiatedDebugging();
+        m_startUserInitiatedDebuggingWhenFrontedIsConnected = false;
+    }
 }
 
 void InspectorController::disconnectFrontend()
 {
     if (!m_inspectorFrontend)
         return;
+    m_inspectorBackendDispatcher.clear();
 
     m_inspectorAgent->disconnectFrontend();
+    m_injectedScriptManager->injectedScriptHost()->clearFrontend();
 
     m_inspectorFrontend.clear();
 
@@ -160,7 +202,7 @@ void InspectorController::evaluateForTestInFrontend(long callId, const String& s
 
 void InspectorController::drawNodeHighlight(GraphicsContext& context) const
 {
-    m_inspectorAgent->drawNodeHighlight(context);
+    m_inspectorAgent->domAgent()->drawNodeHighlight(context);
 }
 
 void InspectorController::showConsole()
@@ -178,7 +220,7 @@ void InspectorController::inspect(Node* node)
 
     show();
 
-    m_inspectorAgent->inspect(node);
+    m_inspectorAgent->domAgent()->inspect(node);
 }
 
 bool InspectorController::enabled() const
@@ -203,31 +245,32 @@ void InspectorController::setInspectorExtensionAPI(const String& source)
 
 void InspectorController::dispatchMessageFromFrontend(const String& message)
 {
-    m_inspectorBackendDispatcher->dispatch(message);
+    if (m_inspectorBackendDispatcher)
+        m_inspectorBackendDispatcher->dispatch(message);
 }
 
 void InspectorController::hideHighlight()
 {
     ErrorString error;
-    m_inspectorAgent->hideHighlight(&error);
+    m_inspectorAgent->domAgent()->hideHighlight(&error);
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 void InspectorController::enableProfiler()
 {
     ErrorString error;
-    m_inspectorAgent->enableProfiler(&error);
+    m_inspectorAgent->profilerAgent()->enable(&error);
 }
 
 void InspectorController::disableProfiler()
 {
     ErrorString error;
-    m_inspectorAgent->disableProfiler(&error);
+    m_inspectorAgent->profilerAgent()->disable(&error);
 }
 
 bool InspectorController::profilerEnabled()
 {
-    return m_inspectorAgent->profilerEnabled();
+    return m_inspectorAgent->profilerAgent()->enabled();
 }
 
 bool InspectorController::debuggerEnabled()
@@ -240,8 +283,11 @@ void InspectorController::showAndEnableDebugger()
     if (!enabled())
         return;
     show();
-    m_inspectorAgent->showScriptsPanel();
-    m_inspectorAgent->debuggerAgent()->startUserInitiatedDebugging();
+
+    if (m_inspectorFrontend)
+        m_inspectorFrontend->inspector()->startUserInitiatedDebugging();
+    else
+        m_startUserInitiatedDebuggingWhenFrontedIsConnected = true;
 }
 
 void InspectorController::disableDebugger()
@@ -251,7 +297,7 @@ void InspectorController::disableDebugger()
 
 void InspectorController::startUserInitiatedProfiling()
 {
-    m_inspectorAgent->startUserInitiatedProfiling();
+    m_inspectorAgent->profilerAgent()->startUserInitiatedProfiling();
 }
 
 void InspectorController::stopUserInitiatedProfiling()
@@ -259,12 +305,13 @@ void InspectorController::stopUserInitiatedProfiling()
     if (!enabled())
         return;
     show();
-    m_inspectorAgent->stopUserInitiatedProfiling();
+    m_inspectorAgent->profilerAgent()->stopUserInitiatedProfiling();
+    m_inspectorAgent->showProfilesPanel();
 }
 
 bool InspectorController::isRecordingUserInitiatedProfile() const
 {
-    return m_inspectorAgent->isRecordingUserInitiatedProfile();
+    return m_inspectorAgent->profilerAgent()->isRecordingUserInitiatedProfile();
 }
 
 void InspectorController::resume()
diff --git a/Source/WebCore/inspector/InspectorController.h b/Source/WebCore/inspector/InspectorController.h
index 7db024c..f38eb3d 100644
--- a/Source/WebCore/inspector/InspectorController.h
+++ b/Source/WebCore/inspector/InspectorController.h
@@ -41,6 +41,7 @@ namespace WebCore {
 class DOMWrapperWorld;
 class Frame;
 class GraphicsContext;
+class InjectedScriptManager;
 class InspectorAgent;
 class InspectorBackendDispatcher;
 class InspectorClient;
@@ -102,12 +103,14 @@ public:
 private:
     friend class PostWorkerNotificationToFrontendTask;
 
+    OwnPtr<InjectedScriptManager> m_injectedScriptManager;
     OwnPtr<InspectorAgent> m_inspectorAgent;
     OwnPtr<InspectorBackendDispatcher> m_inspectorBackendDispatcher;
     OwnPtr<InspectorFrontendClient> m_inspectorFrontendClient;
     OwnPtr<InspectorFrontend> m_inspectorFrontend;
     InspectorClient* m_inspectorClient;
     bool m_openingFrontend;
+    bool m_startUserInitiatedDebuggingWhenFrontedIsConnected;
 };
 
 }
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.cpp b/Source/WebCore/inspector/InspectorDOMAgent.cpp
index 3edd72c..06c5977 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDOMAgent.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009-2011 Google Inc. All rights reserved.
  * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
@@ -47,6 +47,7 @@
 #include "ContainerNode.h"
 #include "Cookie.h"
 #include "CookieJar.h"
+#include "DOMNodeHighlighter.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "DocumentType.h"
@@ -57,15 +58,19 @@
 #include "EventTarget.h"
 #include "Frame.h"
 #include "FrameTree.h"
+#include "HitTestResult.h"
 #include "HTMLElement.h"
 #include "HTMLFrameOwnerElement.h"
-#include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
+#include "InspectorClient.h"
 #include "InspectorFrontend.h"
+#include "InspectorResourceAgent.h"
 #include "InspectorState.h"
 #include "InstrumentingAgents.h"
 #include "MutationEvent.h"
 #include "Node.h"
 #include "NodeList.h"
+#include "Page.h"
 #include "Pasteboard.h"
 #include "PlatformString.h"
 #include "RenderStyle.h"
@@ -206,8 +211,12 @@ public:
         unsigned long size = result->snapshotLength(ec);
         for (unsigned long i = 0; !ec && i < size; ++i) {
             Node* node = result->snapshotItem(i, ec);
-            if (!ec)
-                resultCollector.add(node);
+            if (ec)
+                break;
+
+            if (node->nodeType() == Node::ATTRIBUTE_NODE)
+                node = static_cast<Attr*>(node)->ownerElement();
+            resultCollector.add(node);
         }
 #else
         UNUSED_PARAM(resultCollector);
@@ -248,20 +257,25 @@ void RevalidateStyleAttributeTask::onTimer(Timer<RevalidateStyleAttributeTask>*)
     m_elements.clear();
 }
 
-InspectorDOMAgent::InspectorDOMAgent(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, InjectedScriptHost* injectedScriptHost)
+InspectorDOMAgent::InspectorDOMAgent(InstrumentingAgents* instrumentingAgents, Page* inspectedPage, InspectorClient* client, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
     : m_instrumentingAgents(instrumentingAgents)
+    , m_inspectedPage(inspectedPage)
+    , m_client(client)
     , m_inspectorState(inspectorState)
-    , m_injectedScriptHost(injectedScriptHost)
+    , m_injectedScriptManager(injectedScriptManager)
     , m_frontend(0)
     , m_domListener(0)
     , m_lastNodeId(1)
     , m_matchJobsTimer(this, &InspectorDOMAgent::onMatchJobsTimer)
+    , m_searchingForNode(false)
 {
 }
 
 InspectorDOMAgent::~InspectorDOMAgent()
 {
     reset();
+    ASSERT(!m_highlightedNode);
+    ASSERT(!m_searchingForNode);
 }
 
 void InspectorDOMAgent::setFrontend(InspectorFrontend* frontend)
@@ -269,17 +283,33 @@ void InspectorDOMAgent::setFrontend(InspectorFrontend* frontend)
     ASSERT(!m_frontend);
     m_frontend = frontend->dom();
     m_instrumentingAgents->setInspectorDOMAgent(this);
+    m_document = m_inspectedPage->mainFrame()->document();
+
+    if (m_nodeToFocus)
+        focusNode();
 }
 
 void InspectorDOMAgent::clearFrontend()
 {
     ASSERT(m_frontend);
+    setSearchingForNode(false);
+
+    ErrorString error;
+    hideHighlight(&error);
+
     m_frontend = 0;
     m_instrumentingAgents->setInspectorDOMAgent(0);
     m_inspectorState->setBoolean(DOMAgentState::documentRequested, false);
     reset();
 }
 
+void InspectorDOMAgent::restore()
+{
+    // Reset document to avoid early return from setDocument.
+    m_document = 0;
+    setDocument(m_inspectedPage->mainFrame()->document());
+}
+
 Vector<Document*> InspectorDOMAgent::documents()
 {
     Vector<Document*> result;
@@ -295,7 +325,7 @@ Vector<Document*> InspectorDOMAgent::documents()
 void InspectorDOMAgent::reset()
 {
     ErrorString error;
-    searchCanceled(&error);
+    cancelSearch(&error);
     discardBindings();
     if (m_revalidateStyleAttrTask)
         m_revalidateStyleAttrTask->reset();
@@ -326,9 +356,9 @@ void InspectorDOMAgent::releaseDanglingNodes()
     m_danglingNodeToIdMaps.clear();
 }
 
-long InspectorDOMAgent::bind(Node* node, NodeToIdMap* nodesMap)
+int InspectorDOMAgent::bind(Node* node, NodeToIdMap* nodesMap)
 {
-    long id = nodesMap->get(node);
+    int id = nodesMap->get(node);
     if (id)
         return id;
     id = m_lastNodeId++;
@@ -346,7 +376,7 @@ void InspectorDOMAgent::unbind(Node* node, NodeToIdMap* nodesMap)
             m_domListener->didRemoveDocument(frameOwner->contentDocument());
     }
 
-    long id = nodesMap->get(node);
+    int id = nodesMap->get(node);
     if (!id)
         return;
     m_idToNode.remove(id);
@@ -363,13 +393,53 @@ void InspectorDOMAgent::unbind(Node* node, NodeToIdMap* nodesMap)
     }
 }
 
-Node* InspectorDOMAgent::nodeToSelectOn(long nodeId, bool documentWide)
+Node* InspectorDOMAgent::assertNode(ErrorString* errorString, int nodeId)
+{
+    Node* node = nodeForId(nodeId);
+    if (!node) {
+        *errorString = "Could not find node with given id.";
+        return 0;
+    }
+    return node;
+}
+
+Element* InspectorDOMAgent::assertElement(ErrorString* errorString, int nodeId)
+{
+    Node* node = assertNode(errorString, nodeId);
+    if (!node)
+        return 0;
+
+    if (node->nodeType() != Node::ELEMENT_NODE) {
+        *errorString = "Node is not an Element.";
+        return 0;
+    }
+    return toElement(node);
+}
+
+
+HTMLElement* InspectorDOMAgent::assertHTMLElement(ErrorString* errorString, int nodeId)
+{
+    Element* element = assertElement(errorString, nodeId);
+    if (!element)
+        return 0;
+
+    if (!element->isHTMLElement()) {
+        *errorString = "Node is not an HTML Element.";
+        return 0;
+    }
+    return toHTMLElement(element);
+}
+
+Node* InspectorDOMAgent::nodeToSelectOn(ErrorString* errorString, int nodeId, bool documentWide)
 {
     Node* node;
-    if (!nodeId)
+    if (!nodeId) {
         node = m_document.get();
-    else
-        node = nodeForId(nodeId);
+        if (!node)
+            *errorString = "No document to query on.";
+    } else
+        node = assertNode(errorString, nodeId);
+
     if (!node)
         return 0;
 
@@ -394,7 +464,7 @@ void InspectorDOMAgent::getDocument(ErrorString*, RefPtr<InspectorObject>* root)
         *root = buildObjectForNode(m_document.get(), 2, &m_documentNodeToIdMap);
 }
 
-void InspectorDOMAgent::pushChildNodesToFrontend(long nodeId)
+void InspectorDOMAgent::pushChildNodesToFrontend(int nodeId)
 {
     Node* node = nodeForId(nodeId);
     if (!node || (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE && node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE))
@@ -414,57 +484,60 @@ void InspectorDOMAgent::discardBindings()
     m_idToNode.clear();
     releaseDanglingNodes();
     m_childrenRequested.clear();
-    m_injectedScriptHost->clearInspectedNodes();
 }
 
-Node* InspectorDOMAgent::nodeForId(long id)
+Node* InspectorDOMAgent::nodeForId(int id)
 {
     if (!id)
         return 0;
 
-    HashMap<long, Node*>::iterator it = m_idToNode.find(id);
+    HashMap<int, Node*>::iterator it = m_idToNode.find(id);
     if (it != m_idToNode.end())
         return it->second;
     return 0;
 }
 
-void InspectorDOMAgent::getChildNodes(ErrorString*, long nodeId)
+void InspectorDOMAgent::getChildNodes(ErrorString*, int nodeId)
 {
     pushChildNodesToFrontend(nodeId);
 }
 
-void InspectorDOMAgent::querySelector(ErrorString*, long nodeId, const String& selectors, bool documentWide, long* elementId)
+void InspectorDOMAgent::querySelector(ErrorString* errorString, int nodeId, const String& selectors, bool documentWide, int* elementId)
 {
     *elementId = 0;
-    Node* node = nodeToSelectOn(nodeId, documentWide);
+    Node* node = nodeToSelectOn(errorString, nodeId, documentWide);
     if (!node)
         return;
 
     ExceptionCode ec = 0;
     RefPtr<Element> element = node->querySelector(selectors, ec);
-    if (ec)
+    if (ec) {
+        *errorString = "DOM Error while querying.";
         return;
+    }
 
     if (element)
         *elementId = pushNodePathToFrontend(element.get());
 }
 
-void InspectorDOMAgent::querySelectorAll(ErrorString*, long nodeId, const String& selectors, bool documentWide, RefPtr<InspectorArray>* result)
+void InspectorDOMAgent::querySelectorAll(ErrorString* errorString, int nodeId, const String& selectors, bool documentWide, RefPtr<InspectorArray>* result)
 {
-    Node* node = nodeToSelectOn(nodeId, documentWide);
+    Node* node = nodeToSelectOn(errorString, nodeId, documentWide);
     if (!node)
         return;
 
     ExceptionCode ec = 0;
     RefPtr<NodeList> nodes = node->querySelectorAll(selectors, ec);
-    if (ec)
+    if (ec) {
+        *errorString = "DOM Error while querying.";
         return;
+    }
 
     for (unsigned i = 0; i < nodes->length(); ++i)
         (*result)->pushNumber(pushNodePathToFrontend(nodes->item(i)));
 }
 
-long InspectorDOMAgent::pushNodePathToFrontend(Node* nodeToPush)
+int InspectorDOMAgent::pushNodePathToFrontend(Node* nodeToPush)
 {
     ASSERT(nodeToPush);  // Invalid input
 
@@ -474,7 +547,7 @@ long InspectorDOMAgent::pushNodePathToFrontend(Node* nodeToPush)
         return 0;
 
     // Return id in case the node is known.
-    long result = m_documentNodeToIdMap.get(nodeToPush);
+    int result = m_documentNodeToIdMap.get(nodeToPush);
     if (result)
         return result;
 
@@ -503,60 +576,62 @@ long InspectorDOMAgent::pushNodePathToFrontend(Node* nodeToPush)
 
     NodeToIdMap* map = danglingMap ? danglingMap : &m_documentNodeToIdMap;
     for (int i = path.size() - 1; i >= 0; --i) {
-        long nodeId = map->get(path.at(i));
+        int nodeId = map->get(path.at(i));
         ASSERT(nodeId);
         pushChildNodesToFrontend(nodeId);
     }
     return map->get(nodeToPush);
 }
 
-long InspectorDOMAgent::boundNodeId(Node* node)
+int InspectorDOMAgent::boundNodeId(Node* node)
 {
     return m_documentNodeToIdMap.get(node);
 }
 
-void InspectorDOMAgent::setAttribute(ErrorString*, long elementId, const String& name, const String& value, bool* success)
+void InspectorDOMAgent::setAttribute(ErrorString* errorString, int elementId, const String& name, const String& value)
 {
-    Node* node = nodeForId(elementId);
-    if (node && (node->nodeType() == Node::ELEMENT_NODE)) {
-        Element* element = static_cast<Element*>(node);
+    Element* element = assertElement(errorString, elementId);
+    if (element) {
         ExceptionCode ec = 0;
         element->setAttribute(name, value, ec);
-        *success = !ec;
+        if (ec)
+            *errorString = "Exception while setting attribute value.";
     }
 }
 
-void InspectorDOMAgent::removeAttribute(ErrorString*, long elementId, const String& name, bool* success)
+void InspectorDOMAgent::removeAttribute(ErrorString* errorString, int elementId, const String& name)
 {
-    Node* node = nodeForId(elementId);
-    if (node && (node->nodeType() == Node::ELEMENT_NODE)) {
-        Element* element = static_cast<Element*>(node);
+    Element* element = assertElement(errorString, elementId);
+    if (element) {
         ExceptionCode ec = 0;
         element->removeAttribute(name, ec);
-        *success = !ec;
+        if (ec)
+            *errorString = "Exception while removing attribute.";
     }
 }
 
-void InspectorDOMAgent::removeNode(ErrorString*, long nodeId, long* outNodeId)
+void InspectorDOMAgent::removeNode(ErrorString* errorString, int nodeId)
 {
-    Node* node = nodeForId(nodeId);
+    Node* node = assertNode(errorString, nodeId);
     if (!node)
         return;
 
     ContainerNode* parentNode = node->parentNode();
-    if (!parentNode)
+    if (!parentNode) {
+        *errorString = "Can not remove detached node.";
         return;
+    }
 
     ExceptionCode ec = 0;
     parentNode->removeChild(node, ec);
     if (ec)
-        return;
-
-    *outNodeId = nodeId;
+        *errorString = "Could not remove node due to DOM exception.";
 }
 
-void InspectorDOMAgent::changeTagName(ErrorString*, long nodeId, const String& tagName, long* newId)
+void InspectorDOMAgent::setNodeName(ErrorString*, int nodeId, const String& tagName, int* newId)
 {
+    *newId = 0;
+
     Node* oldNode = nodeForId(nodeId);
     if (!oldNode || !oldNode->isElementNode())
         return;
@@ -590,28 +665,25 @@ void InspectorDOMAgent::changeTagName(ErrorString*, long nodeId, const String& t
         pushChildNodesToFrontend(*newId);
 }
 
-void InspectorDOMAgent::getOuterHTML(ErrorString*, long nodeId, WTF::String* outerHTML)
+void InspectorDOMAgent::getOuterHTML(ErrorString* errorString, int nodeId, WTF::String* outerHTML)
 {
-    Node* node = nodeForId(nodeId);
-    if (!node || !node->isHTMLElement())
-        return;
-
-    *outerHTML = toHTMLElement(node)->outerHTML();
+    HTMLElement* element = assertHTMLElement(errorString, nodeId);
+    if (element)
+        *outerHTML = element->outerHTML();
 }
 
-void InspectorDOMAgent::setOuterHTML(ErrorString*, long nodeId, const String& outerHTML, long* newId)
+void InspectorDOMAgent::setOuterHTML(ErrorString* errorString, int nodeId, const String& outerHTML, int* newId)
 {
-    Node* node = nodeForId(nodeId);
-    if (!node || !node->isHTMLElement())
+    HTMLElement* htmlElement = assertHTMLElement(errorString, nodeId);
+    if (!htmlElement)
         return;
 
-    bool requiresTotalUpdate = node->nodeName() == "HTML" || node->nodeName() == "BODY" || node->nodeName() == "HEAD";
+    bool requiresTotalUpdate = htmlElement->tagName() == "HTML" || htmlElement->tagName() == "BODY" || htmlElement->tagName() == "HEAD";
 
     bool childrenRequested = m_childrenRequested.contains(nodeId);
-    Node* previousSibling = node->previousSibling();
-    ContainerNode* parentNode = node->parentNode();
+    Node* previousSibling = htmlElement->previousSibling();
+    ContainerNode* parentNode = htmlElement->parentNode();
 
-    HTMLElement* htmlElement = toHTMLElement(node);
     ExceptionCode ec = 0;
     htmlElement->setOuterHTML(outerHTML, ec);
     if (ec)
@@ -637,21 +709,27 @@ void InspectorDOMAgent::setOuterHTML(ErrorString*, long nodeId, const String& ou
         pushChildNodesToFrontend(*newId);
 }
 
-void InspectorDOMAgent::setTextNodeValue(ErrorString*, long nodeId, const String& value, bool* success)
+void InspectorDOMAgent::setNodeValue(ErrorString* errorString, int nodeId, const String& value)
 {
-    Node* node = nodeForId(nodeId);
-    if (node && (node->nodeType() == Node::TEXT_NODE)) {
-        Text* text_node = static_cast<Text*>(node);
-        ExceptionCode ec = 0;
-        text_node->replaceWholeText(value, ec);
-        *success = !ec;
+    Node* node = assertNode(errorString, nodeId);
+    if (!node)
+        return;
+
+    if (node->nodeType() != Node::TEXT_NODE) {
+        *errorString = "Can only set value of text nodes.";
+        return;
     }
+
+    Text* textNode = static_cast<Text*>(node);
+    ExceptionCode ec = 0;
+    textNode->replaceWholeText(value, ec);
+    if (ec)
+        *errorString = "DOM Error while setting the node value.";
 }
 
-void InspectorDOMAgent::getEventListenersForNode(ErrorString*, long nodeId, long* outNodeId, RefPtr<InspectorArray>* listenersArray)
+void InspectorDOMAgent::getEventListenersForNode(ErrorString*, int nodeId, RefPtr<InspectorArray>* listenersArray)
 {
     Node* node = nodeForId(nodeId);
-    *outNodeId = nodeId;
     EventTargetData* d;
 
     // Quick break if a null node or no listeners at all
@@ -670,18 +748,19 @@ void InspectorDOMAgent::getEventListenersForNode(ErrorString*, long nodeId, long
     if (!eventTypesLength)
         return;
 
-    // The Node's Event Ancestors (not including self)
-    Vector<EventContext> ancestors;
-    node->getEventAncestors(ancestors, node);
+    // The Node's Ancestors (not including self)
+    Vector<ContainerNode*> ancestors;
+    for (ContainerNode* ancestor = node->parentOrHostNode(); ancestor; ancestor = ancestor->parentOrHostNode())
+        ancestors.append(ancestor);
 
     // Nodes and their Listeners for the concerned event types (order is top to bottom)
     Vector<EventListenerInfo> eventInformation;
     for (size_t i = ancestors.size(); i; --i) {
-        Node* ancestor = ancestors[i - 1].node();
+        ContainerNode* ancestor = ancestors[i - 1];
         for (size_t j = 0; j < eventTypesLength; ++j) {
             AtomicString& type = eventTypes[j];
             if (ancestor->hasEventListeners(type))
-                eventInformation.append(EventListenerInfo(static_cast<Node*>(ancestor), type, ancestor->getEventListeners(type)));
+                eventInformation.append(EventListenerInfo(ancestor, type, ancestor->getEventListeners(type)));
         }
     }
 
@@ -715,14 +794,6 @@ void InspectorDOMAgent::getEventListenersForNode(ErrorString*, long nodeId, long
     }
 }
 
-void InspectorDOMAgent::addInspectedNode(ErrorString*, long nodeId)
-{
-    Node* node = nodeForId(nodeId);
-    if (!node)
-        return;
-    m_injectedScriptHost->addInspectedNode(node);
-}
-
 void InspectorDOMAgent::performSearch(ErrorString* error, const String& whitespaceTrimmedQuery, bool runSynchronously)
 {
     // FIXME: Few things are missing here:
@@ -750,7 +821,7 @@ void InspectorDOMAgent::performSearch(ErrorString* error, const String& whitespa
     escapedTagNameQuery.replace("'", "\\'");
 
     // Clear pending jobs.
-    searchCanceled(error);
+    cancelSearch(error);
 
     // Find all frames, iframes and object elements to search their documents.
     Vector<Document*> docs = documents();
@@ -804,13 +875,13 @@ void InspectorDOMAgent::performSearch(ErrorString* error, const String& whitespa
         for (Deque<MatchJob*>::iterator it = m_pendingMatchJobs.begin(); it != m_pendingMatchJobs.end(); ++it)
             (*it)->match(resultCollector);
         reportNodesAsSearchResults(resultCollector);
-        searchCanceled(error);
+        cancelSearch(error);
         return;
     }
     m_matchJobsTimer.startOneShot(0);
 }
 
-void InspectorDOMAgent::searchCanceled(ErrorString*)
+void InspectorDOMAgent::cancelSearch(ErrorString*)
 {
     if (m_matchJobsTimer.isActive())
         m_matchJobsTimer.stop();
@@ -819,19 +890,122 @@ void InspectorDOMAgent::searchCanceled(ErrorString*)
     m_searchResults.clear();
 }
 
-void InspectorDOMAgent::resolveNode(ErrorString* error, long nodeId, const String& objectGroup, RefPtr<InspectorValue>* result)
+bool InspectorDOMAgent::handleMousePress()
+{
+    if (!m_searchingForNode)
+        return false;
+
+    if (m_highlightedNode) {
+        RefPtr<Node> node = m_highlightedNode;
+        setSearchingForNode(false);
+        inspect(node.get());
+    }
+    return true;
+}
+
+void InspectorDOMAgent::inspect(Node* node)
+{
+    if (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE)
+        node = node->parentNode();
+    m_nodeToFocus = node;
+
+    focusNode();
+}
+
+void InspectorDOMAgent::focusNode()
+{
+    if (!m_frontend)
+        return;
+
+    ASSERT(m_nodeToFocus);
+
+    RefPtr<Node> node = m_nodeToFocus.get();
+    m_nodeToFocus = 0;
+
+    Document* document = node->ownerDocument();
+    if (!document)
+        return;
+    Frame* frame = document->frame();
+    if (!frame)
+        return;
+
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptFor(mainWorldScriptState(frame));
+    if (injectedScript.hasNoValue())
+        return;
+
+    injectedScript.inspectNode(node.get());
+}
+
+void InspectorDOMAgent::mouseDidMoveOverElement(const HitTestResult& result, unsigned)
+{
+    if (!m_searchingForNode)
+        return;
+
+    Node* node = result.innerNode();
+    while (node && node->nodeType() == Node::TEXT_NODE)
+        node = node->parentNode();
+    if (node) {
+        ErrorString error;
+        highlight(&error, node);
+    }
+}
+
+void InspectorDOMAgent::setSearchingForNode(bool enabled)
+{
+    if (m_searchingForNode == enabled)
+        return;
+    m_searchingForNode = enabled;
+    if (!enabled) {
+        ErrorString error;
+        hideHighlight(&error);
+    }
+}
+
+void InspectorDOMAgent::setSearchingForNode(ErrorString*, bool enabled, bool* newState)
+{
+    *newState = enabled;
+    setSearchingForNode(enabled);
+}
+
+void InspectorDOMAgent::highlight(ErrorString*, Node* node)
+{
+    ASSERT_ARG(node, node);
+    m_highlightedNode = node;
+    m_client->highlight(node);
+}
+
+void InspectorDOMAgent::highlightDOMNode(ErrorString* error, int nodeId)
+{
+    if (Node* node = nodeForId(nodeId))
+        highlight(error, node);
+}
+
+void InspectorDOMAgent::highlightFrame(ErrorString* error, const String& frameId)
+{
+    Frame* frame = m_instrumentingAgents->inspectorResourceAgent()->frameForId(frameId);
+    if (frame && frame->ownerElement())
+        highlight(error, frame->ownerElement());
+}
+
+void InspectorDOMAgent::hideHighlight(ErrorString*)
+{
+    m_highlightedNode = 0;
+    m_client->hideHighlight();
+}
+
+void InspectorDOMAgent::resolveNode(ErrorString* error, int nodeId, RefPtr<InspectorObject>* result)
 {
     Node* node = nodeForId(nodeId);
     if (!node) {
         *error = "No node with given id found.";
         return;
     }
-    *result = resolveNode(node, objectGroup);
+    *result = resolveNode(node);
 }
 
-void InspectorDOMAgent::pushNodeToFrontend(ErrorString*, PassRefPtr<InspectorObject> objectId, long* nodeId)
+void InspectorDOMAgent::pushNodeToFrontend(ErrorString*, const String& objectId, int* nodeId)
 {
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptForObjectId(objectId.get());
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(objectId);
     Node* node = injectedScript.nodeForObjectId(objectId);
     if (node)
         *nodeId = pushNodePathToFrontend(node);
@@ -850,7 +1024,7 @@ PassRefPtr<InspectorObject> InspectorDOMAgent::buildObjectForNode(Node* node, in
 {
     RefPtr<InspectorObject> value = InspectorObject::create();
 
-    long id = bind(node, nodesMap);
+    int id = bind(node, nodesMap);
     String nodeName;
     String localName;
     String nodeValue;
@@ -1036,7 +1210,7 @@ void InspectorDOMAgent::loadEventFired(Document* document)
     if (!frameOwner)
         return;
 
-    long frameOwnerId = m_documentNodeToIdMap.get(frameOwner);
+    int frameOwnerId = m_documentNodeToIdMap.get(frameOwner);
     if (!frameOwnerId)
         return;
 
@@ -1045,11 +1219,11 @@ void InspectorDOMAgent::loadEventFired(Document* document)
         m_frontend->childNodeCountUpdated(frameOwnerId, innerChildNodeCount(frameOwner));
     } else {
         // Re-add frame owner element together with its new children.
-        long parentId = m_documentNodeToIdMap.get(innerParentNode(frameOwner));
+        int parentId = m_documentNodeToIdMap.get(innerParentNode(frameOwner));
         m_frontend->childNodeRemoved(parentId, frameOwnerId);
         RefPtr<InspectorObject> value = buildObjectForNode(frameOwner, 0, &m_documentNodeToIdMap);
         Node* previousSibling = innerPreviousSibling(frameOwner);
-        long prevId = previousSibling ? m_documentNodeToIdMap.get(previousSibling) : 0;
+        int prevId = previousSibling ? m_documentNodeToIdMap.get(previousSibling) : 0;
         m_frontend->childNodeInserted(parentId, prevId, value.release());
         // Invalidate children requested flag for the element.
         m_childrenRequested.remove(m_childrenRequested.find(frameOwnerId));
@@ -1065,7 +1239,7 @@ void InspectorDOMAgent::didInsertDOMNode(Node* node)
     unbind(node, &m_documentNodeToIdMap);
 
     ContainerNode* parent = node->parentNode();
-    long parentId = m_documentNodeToIdMap.get(parent);
+    int parentId = m_documentNodeToIdMap.get(parent);
     // Return if parent is not mapped yet.
     if (!parentId)
         return;
@@ -1076,7 +1250,7 @@ void InspectorDOMAgent::didInsertDOMNode(Node* node)
     } else {
         // Children have been requested -> return value of a new child.
         Node* prevSibling = innerPreviousSibling(node);
-        long prevId = prevSibling ? m_documentNodeToIdMap.get(prevSibling) : 0;
+        int prevId = prevSibling ? m_documentNodeToIdMap.get(prevSibling) : 0;
         RefPtr<InspectorObject> value = buildObjectForNode(node, 0, &m_documentNodeToIdMap);
         m_frontend->childNodeInserted(parentId, prevId, value.release());
     }
@@ -1088,7 +1262,7 @@ void InspectorDOMAgent::didRemoveDOMNode(Node* node)
         return;
 
     ContainerNode* parent = node->parentNode();
-    long parentId = m_documentNodeToIdMap.get(parent);
+    int parentId = m_documentNodeToIdMap.get(parent);
     // If parent is not mapped yet -> ignore the event.
     if (!parentId)
         return;
@@ -1107,7 +1281,7 @@ void InspectorDOMAgent::didRemoveDOMNode(Node* node)
 
 void InspectorDOMAgent::didModifyDOMAttr(Element* element)
 {
-    long id = m_documentNodeToIdMap.get(element);
+    int id = m_documentNodeToIdMap.get(element);
     // If node is not mapped yet -> ignore the event.
     if (!id)
         return;
@@ -1120,7 +1294,7 @@ void InspectorDOMAgent::didModifyDOMAttr(Element* element)
 
 void InspectorDOMAgent::characterDataModified(CharacterData* characterData)
 {
-    long id = m_documentNodeToIdMap.get(characterData);
+    int id = m_documentNodeToIdMap.get(characterData);
     if (!id)
         return;
     m_frontend->characterDataModified(id, characterData->data());
@@ -1128,7 +1302,7 @@ void InspectorDOMAgent::characterDataModified(CharacterData* characterData)
 
 void InspectorDOMAgent::didInvalidateStyleAttr(Node* node)
 {
-    long id = m_documentNodeToIdMap.get(node);
+    int id = m_documentNodeToIdMap.get(node);
     // If node is not mapped yet -> ignore the event.
     if (!id)
         return;
@@ -1181,7 +1355,7 @@ void InspectorDOMAgent::onMatchJobsTimer(Timer<InspectorDOMAgent>*)
 {
     if (!m_pendingMatchJobs.size()) {
         ErrorString error;
-        searchCanceled(&error);
+        cancelSearch(&error);
         return;
     }
 
@@ -1202,12 +1376,12 @@ void InspectorDOMAgent::reportNodesAsSearchResults(ListHashSet<Node*>& resultCol
         if (m_searchResults.contains(*it))
             continue;
         m_searchResults.add(*it);
-        nodeIds->pushNumber(static_cast<long long>(pushNodePathToFrontend(*it)));
+        nodeIds->pushNumber(pushNodePathToFrontend(*it));
     }
-    m_frontend->addNodesToSearchResult(nodeIds.release());
+    m_frontend->searchResults(nodeIds.release());
 }
 
-void InspectorDOMAgent::copyNode(ErrorString*, long nodeId)
+void InspectorDOMAgent::copyNode(ErrorString*, int nodeId)
 {
     Node* node = nodeForId(nodeId);
     if (!node)
@@ -1216,24 +1390,32 @@ void InspectorDOMAgent::copyNode(ErrorString*, long nodeId)
     Pasteboard::generalPasteboard()->writePlainText(markup);
 }
 
-void InspectorDOMAgent::pushNodeByPathToFrontend(ErrorString*, const String& path, long* nodeId)
+void InspectorDOMAgent::pushNodeByPathToFrontend(ErrorString*, const String& path, int* nodeId)
 {
     if (Node* node = nodeForPath(path))
         *nodeId = pushNodePathToFrontend(node);
 }
 
-PassRefPtr<InspectorObject> InspectorDOMAgent::resolveNode(Node* node, const String& objectGroup)
+PassRefPtr<InspectorObject> InspectorDOMAgent::resolveNode(Node* node)
 {
     Document* document = node->ownerDocument();
     Frame* frame = document ? document->frame() : 0;
     if (!frame)
         return 0;
 
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptFor(mainWorldScriptState(frame));
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptFor(mainWorldScriptState(frame));
     if (injectedScript.hasNoValue())
         return 0;
 
-    return injectedScript.wrapNode(node, objectGroup);
+    return injectedScript.wrapNode(node);
+}
+
+void InspectorDOMAgent::drawNodeHighlight(GraphicsContext& context) const
+{
+    if (!m_highlightedNode)
+        return;
+
+    DOMNodeHighlighter::DrawNodeHighlight(context, m_highlightedNode.get());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.h b/Source/WebCore/inspector/InspectorDOMAgent.h
index 0368880..8aeb66b 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.h
+++ b/Source/WebCore/inspector/InspectorDOMAgent.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,8 +30,9 @@
 #ifndef InspectorDOMAgent_h
 #define InspectorDOMAgent_h
 
+#include "EventTarget.h"
 #include "InjectedScript.h"
-#include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
 #include "InspectorFrontend.h"
 #include "InspectorValues.h"
 #include "Timer.h"
@@ -52,9 +53,13 @@ class CharacterData;
 class Document;
 class Element;
 class Event;
+class GraphicsContext;
+class InspectorClient;
 class InspectorDOMAgent;
 class InspectorFrontend;
+class HitTestResult;
 class MatchJob;
+class HTMLElement;
 class InspectorState;
 class InstrumentingAgents;
 class NameNodeMap;
@@ -91,38 +96,44 @@ public:
         virtual void didModifyDOMAttr(Element*) = 0;
     };
 
-    static PassOwnPtr<InspectorDOMAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, InjectedScriptHost* injectedScriptHost)
+    static PassOwnPtr<InspectorDOMAgent> create(InstrumentingAgents* instrumentingAgents, Page* page, InspectorClient* client, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
     {
-        return adoptPtr(new InspectorDOMAgent(instrumentingAgents, inspectorState, injectedScriptHost));
+        return adoptPtr(new InspectorDOMAgent(instrumentingAgents, page, client, inspectorState, injectedScriptManager));
     }
 
     ~InspectorDOMAgent();
 
     void setFrontend(InspectorFrontend*);
     void clearFrontend();
+    void restore();
 
     Vector<Document*> documents();
     void reset();
 
     // Methods called from the frontend for DOM nodes inspection.
-    void querySelector(ErrorString*, long nodeId, const String& selectors, bool documentWide, long* elementId);
-    void querySelectorAll(ErrorString*, long nodeId, const String& selectors, bool documentWide, RefPtr<InspectorArray>* result);
+    void querySelector(ErrorString*, int nodeId, const String& selectors, bool documentWide, int* elementId);
+    void querySelectorAll(ErrorString*, int nodeId, const String& selectors, bool documentWide, RefPtr<InspectorArray>* result);
     void getDocument(ErrorString*, RefPtr<InspectorObject>* root);
-    void getChildNodes(ErrorString*, long nodeId);
-    void setAttribute(ErrorString*, long elementId, const String& name, const String& value, bool* success);
-    void removeAttribute(ErrorString*, long elementId, const String& name, bool* success);
-    void removeNode(ErrorString*, long nodeId, long* outNodeId);
-    void changeTagName(ErrorString*, long nodeId, const String& tagName, long* newId);
-    void getOuterHTML(ErrorString*, long nodeId, WTF::String* outerHTML);
-    void setOuterHTML(ErrorString*, long nodeId, const String& outerHTML, long* newId);
-    void setTextNodeValue(ErrorString*, long nodeId, const String& value, bool* success);
-    void getEventListenersForNode(ErrorString*, long nodeId, long* outNodeId, RefPtr<InspectorArray>* listenersArray);
-    void addInspectedNode(ErrorString*, long nodeId);
+    void getChildNodes(ErrorString*, int nodeId);
+    void setAttribute(ErrorString*, int elementId, const String& name, const String& value);
+    void removeAttribute(ErrorString*, int elementId, const String& name);
+    void removeNode(ErrorString*, int nodeId);
+    void setNodeName(ErrorString*, int nodeId, const String& name, int* newId);
+    void getOuterHTML(ErrorString*, int nodeId, WTF::String* outerHTML);
+    void setOuterHTML(ErrorString*, int nodeId, const String& outerHTML, int* newId);
+    void setNodeValue(ErrorString*, int nodeId, const String& value);
+    void getEventListenersForNode(ErrorString*, int nodeId, RefPtr<InspectorArray>* listenersArray);
     void performSearch(ErrorString*, const String& whitespaceTrimmedQuery, bool runSynchronously);
-    void searchCanceled(ErrorString*);
-    void resolveNode(ErrorString*, long nodeId, const String& objectGroup, RefPtr<InspectorValue>* result);
-    void pushNodeToFrontend(ErrorString*, PassRefPtr<InspectorObject> objectId, long* nodeId);
-    void pushNodeByPathToFrontend(ErrorString*, const String& path, long* nodeId);
+    void cancelSearch(ErrorString*);
+    void resolveNode(ErrorString*, int nodeId, RefPtr<InspectorObject>* result);
+    void setSearchingForNode(ErrorString*, bool enabled, bool* newState);
+    void pushNodeToFrontend(ErrorString*, const String& objectId, int* nodeId);
+    void pushNodeByPathToFrontend(ErrorString*, const String& path, int* nodeId);
+    void hideHighlight(ErrorString*);
+    void highlightDOMNode(ErrorString*, int nodeId);
+    void hideDOMNodeHighlight(ErrorString* error) { hideHighlight(error); }
+    void highlightFrame(ErrorString*, const String& frameId);
+    void hideFrameHighlight(ErrorString* error) { hideHighlight(error); }
 
     // Methods called from the InspectorInstrumentation.
     void setDocument(Document*);
@@ -137,14 +148,21 @@ public:
     void characterDataModified(CharacterData*);
     void didInvalidateStyleAttr(Node*);
 
-    Node* nodeForId(long nodeId);
-    long boundNodeId(Node*);
-    void copyNode(ErrorString*, long nodeId);
+    Node* nodeForId(int nodeId);
+    int boundNodeId(Node*);
+    void copyNode(ErrorString*, int nodeId);
     void setDOMListener(DOMListener*);
 
     String documentURLString(Document*) const;
 
-    PassRefPtr<InspectorObject> resolveNode(Node*, const String& objectGroup);
+    PassRefPtr<InspectorObject> resolveNode(Node*);
+    bool handleMousePress();
+    bool searchingForNodeInPage() const;
+    void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
+    void inspect(Node*);
+    void focusNode();
+
+    void drawNodeHighlight(GraphicsContext&) const;
 
     // We represent embedded doms as a part of the same hierarchy. Hence we treat children of frame owners differently.
     // We also skip whitespace text nodes conditionally. Following methods encapsulate these specifics.
@@ -156,21 +174,26 @@ public:
     static bool isWhitespace(Node*);
 
 private:
-    InspectorDOMAgent(InstrumentingAgents*, InspectorState*, InjectedScriptHost*);
+    InspectorDOMAgent(InstrumentingAgents*, Page*, InspectorClient*, InspectorState*, InjectedScriptManager*);
+
+    void setSearchingForNode(bool enabled);
+    void highlight(ErrorString*, Node*);
 
     // Node-related methods.
-    typedef HashMap<RefPtr<Node>, long> NodeToIdMap;
-    long bind(Node*, NodeToIdMap*);
+    typedef HashMap<RefPtr<Node>, int> NodeToIdMap;
+    int bind(Node*, NodeToIdMap*);
     void unbind(Node*, NodeToIdMap*);
+    Node* assertNode(ErrorString*, int nodeId);
+    Element* assertElement(ErrorString*, int nodeId);
+    HTMLElement* assertHTMLElement(ErrorString*, int nodeId);
+    Node* nodeToSelectOn(ErrorString*, int nodeId, bool documentWide);
 
-    Node* nodeToSelectOn(long nodeId, bool documentWide);
-
-    long pushNodePathToFrontend(Node*);
-    void pushChildNodesToFrontend(long nodeId);
+    int pushNodePathToFrontend(Node*);
+    void pushChildNodesToFrontend(int nodeId);
 
-    bool hasBreakpoint(Node*, long type);
+    bool hasBreakpoint(Node*, int type);
     void updateSubtreeBreakpoints(Node* root, uint32_t rootMask, bool value);
-    void descriptionForDOMEvent(Node* target, long breakpointType, bool insertion, PassRefPtr<InspectorObject> description);
+    void descriptionForDOMEvent(Node* target, int breakpointType, bool insertion, PassRefPtr<InspectorObject> description);
 
     PassRefPtr<InspectorObject> buildObjectForNode(Node*, int depth, NodeToIdMap*);
     PassRefPtr<InspectorArray> buildArrayForElementAttributes(Element*);
@@ -186,22 +209,27 @@ private:
     void discardBindings();
 
     InstrumentingAgents* m_instrumentingAgents;
+    Page* m_inspectedPage;
+    InspectorClient* m_client;
     InspectorState* m_inspectorState;
-    InjectedScriptHost* m_injectedScriptHost;
+    InjectedScriptManager* m_injectedScriptManager;
     InspectorFrontend::DOM* m_frontend;
     DOMListener* m_domListener;
     NodeToIdMap m_documentNodeToIdMap;
     // Owns node mappings for dangling nodes.
     Vector<NodeToIdMap*> m_danglingNodeToIdMaps;
-    HashMap<long, Node*> m_idToNode;
-    HashMap<long, NodeToIdMap*> m_idToNodesMap;
-    HashSet<long> m_childrenRequested;
-    long m_lastNodeId;
+    HashMap<int, Node*> m_idToNode;
+    HashMap<int, NodeToIdMap*> m_idToNodesMap;
+    HashSet<int> m_childrenRequested;
+    int m_lastNodeId;
     RefPtr<Document> m_document;
     Deque<MatchJob*> m_pendingMatchJobs;
     Timer<InspectorDOMAgent> m_matchJobsTimer;
     HashSet<RefPtr<Node> > m_searchResults;
     OwnPtr<RevalidateStyleAttributeTask> m_revalidateStyleAttrTask;
+    RefPtr<Node> m_highlightedNode;
+    RefPtr<Node> m_nodeToFocus;
+    bool m_searchingForNode;
 };
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp b/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp
index 6ea72f6..c44bbd8 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDOMStorageAgent.cpp
@@ -79,7 +79,7 @@ void InspectorDOMStorageAgent::clearFrontend()
     m_frontend = 0;
 }
 
-void InspectorDOMStorageAgent::getDOMStorageEntries(ErrorString*, long storageId, RefPtr<InspectorArray>* entries)
+void InspectorDOMStorageAgent::getDOMStorageEntries(ErrorString*, int storageId, RefPtr<InspectorArray>* entries)
 {
     InspectorDOMStorageResource* storageResource = getDOMStorageResourceForId(storageId);
     if (storageResource) {
@@ -96,7 +96,7 @@ void InspectorDOMStorageAgent::getDOMStorageEntries(ErrorString*, long storageId
     }
 }
 
-void InspectorDOMStorageAgent::setDOMStorageItem(ErrorString*, long storageId, const String& key, const String& value, bool* success)
+void InspectorDOMStorageAgent::setDOMStorageItem(ErrorString*, int storageId, const String& key, const String& value, bool* success)
 {
     InspectorDOMStorageResource* storageResource = getDOMStorageResourceForId(storageId);
     if (storageResource) {
@@ -106,7 +106,7 @@ void InspectorDOMStorageAgent::setDOMStorageItem(ErrorString*, long storageId, c
     }
 }
 
-void InspectorDOMStorageAgent::removeDOMStorageItem(ErrorString*, long storageId, const String& key, bool* success)
+void InspectorDOMStorageAgent::removeDOMStorageItem(ErrorString*, int storageId, const String& key, bool* success)
 {
     InspectorDOMStorageResource* storageResource = getDOMStorageResourceForId(storageId);
     if (storageResource) {
@@ -115,7 +115,7 @@ void InspectorDOMStorageAgent::removeDOMStorageItem(ErrorString*, long storageId
     }
 }
 
-long InspectorDOMStorageAgent::storageId(Storage* storage)
+int InspectorDOMStorageAgent::storageId(Storage* storage)
 {
     ASSERT(storage);
     Frame* frame = storage->frame();
@@ -129,7 +129,7 @@ long InspectorDOMStorageAgent::storageId(Storage* storage)
     return 0;
 }
 
-InspectorDOMStorageResource* InspectorDOMStorageAgent::getDOMStorageResourceForId(long storageId)
+InspectorDOMStorageResource* InspectorDOMStorageAgent::getDOMStorageResourceForId(int storageId)
 {
     DOMStorageResourcesMap::iterator it = m_resources.find(storageId);
     if (it == m_resources.end())
diff --git a/Source/WebCore/inspector/InspectorDOMStorageAgent.h b/Source/WebCore/inspector/InspectorDOMStorageAgent.h
index adae9b2..567a713 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageAgent.h
+++ b/Source/WebCore/inspector/InspectorDOMStorageAgent.h
@@ -59,12 +59,12 @@ public:
     void clearResources();
 
     // Called from the front-end.
-    void getDOMStorageEntries(ErrorString*, long storageId, RefPtr<InspectorArray>* entries);
-    void setDOMStorageItem(ErrorString*, long storageId, const String& key, const String& value, bool* success);
-    void removeDOMStorageItem(ErrorString*, long storageId, const String& key, bool* success);
+    void getDOMStorageEntries(ErrorString*, int storageId, RefPtr<InspectorArray>* entries);
+    void setDOMStorageItem(ErrorString*, int storageId, const String& key, const String& value, bool* success);
+    void removeDOMStorageItem(ErrorString*, int storageId, const String& key, bool* success);
 
     // Called from the injected script.
-    long storageId(Storage*);
+    int storageId(Storage*);
 
     // Called from InspectorInstrumentation
     void didUseDOMStorage(StorageArea*, bool isLocalStorage, Frame*);
@@ -72,10 +72,10 @@ public:
 private:
     explicit InspectorDOMStorageAgent(InstrumentingAgents*);
 
-    InspectorDOMStorageResource* getDOMStorageResourceForId(long storageId);
+    InspectorDOMStorageResource* getDOMStorageResourceForId(int storageId);
 
     InstrumentingAgents* m_instrumentingAgents;
-    typedef HashMap<long, RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesMap;
+    typedef HashMap<int, RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesMap;
     DOMStorageResourcesMap m_resources;
     InspectorFrontend* m_frontend;
 };
diff --git a/Source/WebCore/inspector/InspectorDOMStorageResource.cpp b/Source/WebCore/inspector/InspectorDOMStorageResource.cpp
index 6ff6418..d618eb5 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageResource.cpp
+++ b/Source/WebCore/inspector/InspectorDOMStorageResource.cpp
@@ -46,7 +46,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-long InspectorDOMStorageResource::s_nextUnusedId = 1;
+int InspectorDOMStorageResource::s_nextUnusedId = 1;
 
 InspectorDOMStorageResource::InspectorDOMStorageResource(Storage* domStorage, bool isLocalStorage, Frame* frame)
     :  EventListener(InspectorDOMStorageResourceType)
diff --git a/Source/WebCore/inspector/InspectorDOMStorageResource.h b/Source/WebCore/inspector/InspectorDOMStorageResource.h
index 9ad5b91..eb75113 100644
--- a/Source/WebCore/inspector/InspectorDOMStorageResource.h
+++ b/Source/WebCore/inspector/InspectorDOMStorageResource.h
@@ -66,7 +66,7 @@ namespace WebCore {
         virtual bool operator==(const EventListener& listener);
 
         bool isSameHostAndType(Frame*, bool isLocalStorage) const;
-        long id() const { return m_id; }
+        int id() const { return m_id; }
         Storage* domStorage() const { return m_domStorage.get(); }
 
     private:
@@ -77,10 +77,10 @@ namespace WebCore {
         bool m_isLocalStorage;
         RefPtr<Frame> m_frame;
         InspectorFrontend::DOMStorage* m_frontend;
-        long m_id;
+        int m_id;
         bool m_reportingChangesToFrontend;
 
-        static long s_nextUnusedId;
+        static int s_nextUnusedId;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorDatabaseAgent.cpp b/Source/WebCore/inspector/InspectorDatabaseAgent.cpp
index 45ec42a..7f6e379 100644
--- a/Source/WebCore/inspector/InspectorDatabaseAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDatabaseAgent.cpp
@@ -70,9 +70,9 @@ private:
 
 namespace {
 
-long lastTransactionId = 0;
+int lastTransactionId = 0;
 
-void reportTransactionFailed(InspectorFrontend::Database* frontend, long transactionId, SQLError* error)
+void reportTransactionFailed(InspectorFrontend::Database* frontend, int transactionId, SQLError* error)
 {
     if (!frontend)
         return;
@@ -84,7 +84,7 @@ void reportTransactionFailed(InspectorFrontend::Database* frontend, long transac
 
 class StatementCallback : public SQLStatementCallback {
 public:
-    static PassRefPtr<StatementCallback> create(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
+    static PassRefPtr<StatementCallback> create(int transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
     {
         return adoptRef(new StatementCallback(transactionId, frontendProvider));
     }
@@ -118,16 +118,16 @@ public:
     }
 
 private:
-    StatementCallback(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
+    StatementCallback(int transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
         : m_transactionId(transactionId)
         , m_frontendProvider(frontendProvider) { }
-    long m_transactionId;
+    int m_transactionId;
     RefPtr<InspectorDatabaseAgent::FrontendProvider> m_frontendProvider;
 };
 
 class StatementErrorCallback : public SQLStatementErrorCallback {
 public:
-    static PassRefPtr<StatementErrorCallback> create(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
+    static PassRefPtr<StatementErrorCallback> create(int transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
     {
         return adoptRef(new StatementErrorCallback(transactionId, frontendProvider));
     }
@@ -141,16 +141,16 @@ public:
     }
 
 private:
-    StatementErrorCallback(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
+    StatementErrorCallback(int transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
         : m_transactionId(transactionId)
         , m_frontendProvider(frontendProvider) { }
-    long m_transactionId;
+    int m_transactionId;
     RefPtr<InspectorDatabaseAgent::FrontendProvider> m_frontendProvider;
 };
 
 class TransactionCallback : public SQLTransactionCallback {
 public:
-    static PassRefPtr<TransactionCallback> create(const String& sqlStatement, long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
+    static PassRefPtr<TransactionCallback> create(const String& sqlStatement, int transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
     {
         return adoptRef(new TransactionCallback(sqlStatement, transactionId, frontendProvider));
     }
@@ -170,18 +170,18 @@ public:
         return true;
     }
 private:
-    TransactionCallback(const String& sqlStatement, long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
+    TransactionCallback(const String& sqlStatement, int transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
         : m_sqlStatement(sqlStatement)
         , m_transactionId(transactionId)
         , m_frontendProvider(frontendProvider) { }
     String m_sqlStatement;
-    long m_transactionId;
+    int m_transactionId;
     RefPtr<InspectorDatabaseAgent::FrontendProvider> m_frontendProvider;
 };
 
 class TransactionErrorCallback : public SQLTransactionErrorCallback {
 public:
-    static PassRefPtr<TransactionErrorCallback> create(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
+    static PassRefPtr<TransactionErrorCallback> create(int transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
     {
         return adoptRef(new TransactionErrorCallback(transactionId, frontendProvider));
     }
@@ -194,10 +194,10 @@ public:
         return true;
     }
 private:
-    TransactionErrorCallback(long transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
+    TransactionErrorCallback(int transactionId, PassRefPtr<InspectorDatabaseAgent::FrontendProvider> frontendProvider)
         : m_transactionId(transactionId)
         , m_frontendProvider(frontendProvider) { }
-    long m_transactionId;
+    int m_transactionId;
     RefPtr<InspectorDatabaseAgent::FrontendProvider> m_frontendProvider;
 };
 
@@ -257,7 +257,7 @@ void InspectorDatabaseAgent::clearFrontend()
     m_frontendProvider.clear();
 }
 
-void InspectorDatabaseAgent::getDatabaseTableNames(ErrorString*, long databaseId, RefPtr<InspectorArray>* names)
+void InspectorDatabaseAgent::getDatabaseTableNames(ErrorString*, int databaseId, RefPtr<InspectorArray>* names)
 {
     Database* database = databaseForId(databaseId);
     if (database) {
@@ -268,7 +268,7 @@ void InspectorDatabaseAgent::getDatabaseTableNames(ErrorString*, long databaseId
     }
 }
 
-void InspectorDatabaseAgent::executeSQL(ErrorString*, long databaseId, const String& query, bool* success, long* transactionId)
+void InspectorDatabaseAgent::executeSQL(ErrorString*, int databaseId, const String& query, bool* success, int* transactionId)
 {
     Database* database = databaseForId(databaseId);
     if (!database) {
@@ -284,7 +284,7 @@ void InspectorDatabaseAgent::executeSQL(ErrorString*, long databaseId, const Str
     *success = true;
 }
 
-long InspectorDatabaseAgent::databaseId(Database* database)
+int InspectorDatabaseAgent::databaseId(Database* database)
 {
     for (DatabaseResourcesMap::iterator it = m_resources.begin(); it != m_resources.end(); ++it) {
         if (it->second->database() == database)
@@ -293,7 +293,7 @@ long InspectorDatabaseAgent::databaseId(Database* database)
     return 0;
 }
 
-Database* InspectorDatabaseAgent::databaseForId(long databaseId)
+Database* InspectorDatabaseAgent::databaseForId(int databaseId)
 {
     DatabaseResourcesMap::iterator it = m_resources.find(databaseId);
     if (it == m_resources.end())
diff --git a/Source/WebCore/inspector/InspectorDatabaseAgent.h b/Source/WebCore/inspector/InspectorDatabaseAgent.h
index 7e42211..45fbfa4 100644
--- a/Source/WebCore/inspector/InspectorDatabaseAgent.h
+++ b/Source/WebCore/inspector/InspectorDatabaseAgent.h
@@ -59,17 +59,17 @@ public:
     void clearResources();
 
     // Called from the front-end.
-    void getDatabaseTableNames(ErrorString* error, long databaseId, RefPtr<InspectorArray>* names);
-    void executeSQL(ErrorString* error, long databaseId, const String& query, bool* success, long* transactionId);
+    void getDatabaseTableNames(ErrorString*, int databaseId, RefPtr<InspectorArray>* names);
+    void executeSQL(ErrorString*, int databaseId, const String& query, bool* success, int* transactionId);
 
     // Called from the injected script.
-    long databaseId(Database*);
+    int databaseId(Database*);
 
     void didOpenDatabase(PassRefPtr<Database>, const String& domain, const String& name, const String& version);
 private:
     explicit InspectorDatabaseAgent(InstrumentingAgents*);
 
-    Database* databaseForId(long databaseId);
+    Database* databaseForId(int databaseId);
 
     InstrumentingAgents* m_instrumentingAgents;
     typedef HashMap<int, RefPtr<InspectorDatabaseResource> > DatabaseResourcesMap;
diff --git a/Source/WebCore/inspector/InspectorDatabaseResource.cpp b/Source/WebCore/inspector/InspectorDatabaseResource.cpp
index 41342a4..852370e 100644
--- a/Source/WebCore/inspector/InspectorDatabaseResource.cpp
+++ b/Source/WebCore/inspector/InspectorDatabaseResource.cpp
@@ -38,7 +38,7 @@
 
 namespace WebCore {
 
-static long nextUnusedId = 1;
+static int nextUnusedId = 1;
 
 PassRefPtr<InspectorDatabaseResource> InspectorDatabaseResource::create(PassRefPtr<Database> database, const String& domain, const String& name, const String& version)
 {
diff --git a/Source/WebCore/inspector/InspectorDatabaseResource.h b/Source/WebCore/inspector/InspectorDatabaseResource.h
index 550fcd8..9fa7ebd 100644
--- a/Source/WebCore/inspector/InspectorDatabaseResource.h
+++ b/Source/WebCore/inspector/InspectorDatabaseResource.h
@@ -48,13 +48,13 @@ public:
 
     void bind(InspectorFrontend::Database*);
     Database* database() { return m_database.get(); }
-    long id() const { return m_id; }
+    int id() const { return m_id; }
 
 private:
     InspectorDatabaseResource(PassRefPtr<Database>, const String& domain, const String& name, const String& version);
 
     RefPtr<Database> m_database;
-    long m_id;
+    int m_id;
     String m_domain;
     String m_name;
     String m_version;
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
index 0cdc2b0..56bc7b7 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,7 +32,7 @@
 
 #if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
 #include "InjectedScript.h"
-#include "InjectedScriptHost.h"
+#include "InjectedScriptManager.h"
 #include "InspectorFrontend.h"
 #include "InspectorState.h"
 #include "InspectorValues.h"
@@ -45,20 +45,13 @@ namespace WebCore {
 
 namespace DebuggerAgentState {
 static const char debuggerEnabled[] = "debuggerEnabled";
-static const char enableWhenShown[] = "debuggerEnableWhenShown";
 static const char javaScriptBreakpoints[] = "javaScriptBreakopints";
 };
 
-PassOwnPtr<InspectorDebuggerAgent> InspectorDebuggerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, Page* inspectedPage, InjectedScriptHost* injectedScriptHost)
-{
-    return adoptPtr(new InspectorDebuggerAgent(instrumentingAgents, inspectorState, inspectedPage, injectedScriptHost));
-}
-
-InspectorDebuggerAgent::InspectorDebuggerAgent(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, Page* inspectedPage, InjectedScriptHost* injectedScriptHost)
+InspectorDebuggerAgent::InspectorDebuggerAgent(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
     : m_instrumentingAgents(instrumentingAgents)
     , m_inspectorState(inspectorState)
-    , m_inspectedPage(inspectedPage)
-    , m_injectedScriptHost(injectedScriptHost)
+    , m_injectedScriptManager(injectedScriptManager)
     , m_frontend(0)
     , m_pausedScriptState(0)
     , m_javaScriptPauseScheduled(false)
@@ -71,14 +64,6 @@ InspectorDebuggerAgent::~InspectorDebuggerAgent()
     ASSERT(!m_instrumentingAgents->inspectorDebuggerAgent());
 }
 
-void InspectorDebuggerAgent::startUserInitiatedDebugging()
-{
-    if (m_frontend)
-        enable(false);
-    else
-        m_inspectorState->setBoolean(DebuggerAgentState::enableWhenShown, true);
-}
-
 void InspectorDebuggerAgent::enable(bool restoringFromState)
 {
     ASSERT(m_frontend);
@@ -87,10 +72,10 @@ void InspectorDebuggerAgent::enable(bool restoringFromState)
     m_inspectorState->setBoolean(DebuggerAgentState::debuggerEnabled, true);
     m_instrumentingAgents->setInspectorDebuggerAgent(this);
 
-    ScriptDebugServer::shared().clearBreakpoints();
+    scriptDebugServer().clearBreakpoints();
     // FIXME(WK44513): breakpoints activated flag should be synchronized between all front-ends
-    ScriptDebugServer::shared().setBreakpointsActivated(true);
-    ScriptDebugServer::shared().addListener(this, m_inspectedPage);
+    scriptDebugServer().setBreakpointsActivated(true);
+    startListeningScriptDebugServer();
 
     m_frontend->debuggerWasEnabled();
     if (m_listener)
@@ -102,9 +87,10 @@ void InspectorDebuggerAgent::disable()
     if (!enabled())
         return;
     m_inspectorState->setBoolean(DebuggerAgentState::debuggerEnabled, false);
+    m_inspectorState->setObject(DebuggerAgentState::javaScriptBreakpoints, InspectorObject::create());
     m_instrumentingAgents->setInspectorDebuggerAgent(0);
 
-    ScriptDebugServer::shared().removeListener(this, m_inspectedPage);
+    stopListeningScriptDebugServer();
     clear();
 
     if (m_frontend)
@@ -129,17 +115,6 @@ void InspectorDebuggerAgent::setFrontend(InspectorFrontend* frontend)
     m_frontend = frontend->debugger();
 }
 
-void InspectorDebuggerAgent::enableDebuggerAfterShown()
-{
-    // Erase sticky breakpoints. If we are restoring from a cookie setFrontend msut be called
-    // before the state is loaded from the cookie.
-    m_inspectorState->setObject(DebuggerAgentState::javaScriptBreakpoints, InspectorObject::create());
-    if (m_inspectorState->getBoolean(DebuggerAgentState::enableWhenShown)) {
-        m_inspectorState->setBoolean(DebuggerAgentState::enableWhenShown, false);
-        enable(false);
-    }
-}
-
 void InspectorDebuggerAgent::clearFrontend()
 {
     m_frontend = 0;
@@ -150,17 +125,14 @@ void InspectorDebuggerAgent::clearFrontend()
     // remember this state to re-enable debugger on the next window
     // opening.
     disable();
-    m_inspectorState->setBoolean(DebuggerAgentState::enableWhenShown, true);
 }
 
-void InspectorDebuggerAgent::activateBreakpoints(ErrorString*)
+void InspectorDebuggerAgent::setBreakpointsActive(ErrorString*, bool active)
 {
-    ScriptDebugServer::shared().activateBreakpoints();
-}
-
-void InspectorDebuggerAgent::deactivateBreakpoints(ErrorString*)
-{
-    ScriptDebugServer::shared().deactivateBreakpoints();
+    if (active)
+        scriptDebugServer().activateBreakpoints();
+    else
+        scriptDebugServer().deactivateBreakpoints();
 }
 
 void InspectorDebuggerAgent::inspectedURLChanged(const String&)
@@ -169,7 +141,7 @@ void InspectorDebuggerAgent::inspectedURLChanged(const String&)
     m_breakpointIdToDebugServerBreakpointIds.clear();
 }
 
-void InspectorDebuggerAgent::setJavaScriptBreakpoint(ErrorString*, const String& url, int lineNumber, int columnNumber, const String& condition, bool enabled, String* outBreakpointId, RefPtr<InspectorArray>* locations)
+void InspectorDebuggerAgent::setBreakpointByUrl(ErrorString*, const String& url, int lineNumber, int columnNumber, const String& condition, bool enabled, String* outBreakpointId, RefPtr<InspectorArray>* locations)
 {
     String breakpointId = makeString(url, ":", String::number(lineNumber), ":", String::number(columnNumber));
     RefPtr<InspectorObject> breakpointsCookie = m_inspectorState->getObject(DebuggerAgentState::javaScriptBreakpoints);
@@ -200,7 +172,7 @@ void InspectorDebuggerAgent::setJavaScriptBreakpoint(ErrorString*, const String&
     *outBreakpointId = breakpointId;
 }
 
-void InspectorDebuggerAgent::setJavaScriptBreakpointBySourceId(ErrorString*, const String& sourceId, int lineNumber, int columnNumber, const String& condition, bool enabled, String* outBreakpointId, int* actualLineNumber, int* actualColumnNumber)
+void InspectorDebuggerAgent::setBreakpoint(ErrorString*, const String& sourceId, int lineNumber, int columnNumber, const String& condition, bool enabled, String* outBreakpointId, int* actualLineNumber, int* actualColumnNumber)
 {
     String breakpointId = makeString(sourceId, ":", String::number(lineNumber), ":", String::number(columnNumber));
     if (m_breakpointIdToDebugServerBreakpointIds.find(breakpointId) != m_breakpointIdToDebugServerBreakpointIds.end())
@@ -211,7 +183,7 @@ void InspectorDebuggerAgent::setJavaScriptBreakpointBySourceId(ErrorString*, con
     *outBreakpointId = breakpointId;
 }
 
-void InspectorDebuggerAgent::removeJavaScriptBreakpoint(ErrorString*, const String& breakpointId)
+void InspectorDebuggerAgent::removeBreakpoint(ErrorString*, const String& breakpointId)
 {
     RefPtr<InspectorObject> breakpointsCookie = m_inspectorState->getObject(DebuggerAgentState::javaScriptBreakpoints);
     breakpointsCookie->remove(breakpointId);
@@ -221,18 +193,18 @@ void InspectorDebuggerAgent::removeJavaScriptBreakpoint(ErrorString*, const Stri
     if (debugServerBreakpointIdsIterator == m_breakpointIdToDebugServerBreakpointIds.end())
         return;
     for (size_t i = 0; i < debugServerBreakpointIdsIterator->second.size(); ++i)
-        ScriptDebugServer::shared().removeBreakpoint(debugServerBreakpointIdsIterator->second[i]);
+        scriptDebugServer().removeBreakpoint(debugServerBreakpointIdsIterator->second[i]);
     m_breakpointIdToDebugServerBreakpointIds.remove(debugServerBreakpointIdsIterator);
 }
 
 void InspectorDebuggerAgent::continueToLocation(ErrorString* error, const String& sourceId, int lineNumber, int columnNumber)
 {
     if (!m_continueToLocationBreakpointId.isEmpty()) {
-        ScriptDebugServer::shared().removeBreakpoint(m_continueToLocationBreakpointId);
+        scriptDebugServer().removeBreakpoint(m_continueToLocationBreakpointId);
         m_continueToLocationBreakpointId = "";
     }
     ScriptBreakpoint breakpoint(lineNumber, columnNumber, "", true);
-    m_continueToLocationBreakpointId = ScriptDebugServer::shared().setBreakpoint(sourceId, breakpoint, &lineNumber, &columnNumber);
+    m_continueToLocationBreakpointId = scriptDebugServer().setBreakpoint(sourceId, breakpoint, &lineNumber, &columnNumber);
     resume(error);
 }
 
@@ -254,7 +226,7 @@ bool InspectorDebuggerAgent::resolveBreakpoint(const String& breakpointId, const
     if (breakpoint.lineNumber >= script.lineOffset + script.linesCount)
         return false;
 
-    String debugServerBreakpointId = ScriptDebugServer::shared().setBreakpoint(sourceId, breakpoint, actualLineNumber, actualColumnNumber);
+    String debugServerBreakpointId = scriptDebugServer().setBreakpoint(sourceId, breakpoint, actualLineNumber, actualColumnNumber);
     if (debugServerBreakpointId.isEmpty())
         return false;
 
@@ -266,10 +238,14 @@ bool InspectorDebuggerAgent::resolveBreakpoint(const String& breakpointId, const
     return true;
 }
 
-void InspectorDebuggerAgent::editScriptSource(ErrorString*, const String& sourceID, const String& newContent, bool* success, String* result, RefPtr<InspectorValue>* newCallFrames)
+void InspectorDebuggerAgent::editScriptSource(ErrorString* errorString, const String& sourceID, const String& newContent, String* result, RefPtr<InspectorArray>* newCallFrames)
 {
-    if ((*success = ScriptDebugServer::shared().editScriptSource(sourceID, newContent, *result)))
+    String editResult;
+    if (scriptDebugServer().editScriptSource(sourceID, newContent, editResult)) {
         *newCallFrames = currentCallFrames();
+        *result = editResult;
+    } else
+        *errorString = editResult;
 }
 
 void InspectorDebuggerAgent::getScriptSource(ErrorString*, const String& sourceID, String* scriptSource)
@@ -284,7 +260,7 @@ void InspectorDebuggerAgent::schedulePauseOnNextStatement(DebuggerEventType type
     m_breakProgramDetails = InspectorObject::create();
     m_breakProgramDetails->setNumber("eventType", type);
     m_breakProgramDetails->setValue("eventData", data);
-    ScriptDebugServer::shared().setPauseOnNextStatement(true);
+    scriptDebugServer().setPauseOnNextStatement(true);
 }
 
 void InspectorDebuggerAgent::cancelPauseOnNextStatement()
@@ -292,7 +268,7 @@ void InspectorDebuggerAgent::cancelPauseOnNextStatement()
     if (m_javaScriptPauseScheduled)
         return;
     m_breakProgramDetails = 0;
-    ScriptDebugServer::shared().setPauseOnNextStatement(false);
+    scriptDebugServer().setPauseOnNextStatement(false);
 }
 
 void InspectorDebuggerAgent::pause(ErrorString*)
@@ -303,45 +279,46 @@ void InspectorDebuggerAgent::pause(ErrorString*)
 
 void InspectorDebuggerAgent::resume(ErrorString*)
 {
-    ScriptDebugServer::shared().continueProgram();
+    scriptDebugServer().continueProgram();
 }
 
 void InspectorDebuggerAgent::stepOver(ErrorString*)
 {
-    ScriptDebugServer::shared().stepOverStatement();
+    scriptDebugServer().stepOverStatement();
 }
 
 void InspectorDebuggerAgent::stepInto(ErrorString*)
 {
-    ScriptDebugServer::shared().stepIntoStatement();
+    scriptDebugServer().stepIntoStatement();
 }
 
 void InspectorDebuggerAgent::stepOut(ErrorString*)
 {
-    ScriptDebugServer::shared().stepOutOfFunction();
+    scriptDebugServer().stepOutOfFunction();
 }
 
-void InspectorDebuggerAgent::setPauseOnExceptionsState(ErrorString*, long pauseState, long* newState)
+void InspectorDebuggerAgent::setPauseOnExceptionsState(ErrorString* errorString, int pauseState)
 {
-    ScriptDebugServer::shared().setPauseOnExceptionsState(static_cast<ScriptDebugServer::PauseOnExceptionsState>(pauseState));
-    *newState = ScriptDebugServer::shared().pauseOnExceptionsState();
+    scriptDebugServer().setPauseOnExceptionsState(static_cast<ScriptDebugServer::PauseOnExceptionsState>(pauseState));
+    if (scriptDebugServer().pauseOnExceptionsState() != pauseState)
+        *errorString = "Internal error. Could not change pause on exceptions state.";
 }
 
-void InspectorDebuggerAgent::evaluateOnCallFrame(ErrorString*, PassRefPtr<InspectorObject> callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result)
+void InspectorDebuggerAgent::evaluateOnCallFrame(ErrorString* errorString, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result)
 {
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptForObjectId(callFrameId.get());
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(callFrameId);
     if (!injectedScript.hasNoValue())
-        injectedScript.evaluateOnCallFrame(callFrameId, expression, objectGroup, includeCommandLineAPI, result);
+        injectedScript.evaluateOnCallFrame(errorString, callFrameId, expression, objectGroup, includeCommandLineAPI, result);
 }
 
-PassRefPtr<InspectorValue> InspectorDebuggerAgent::currentCallFrames()
+PassRefPtr<InspectorArray> InspectorDebuggerAgent::currentCallFrames()
 {
     if (!m_pausedScriptState)
-        return InspectorValue::null();
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptFor(m_pausedScriptState);
+        return InspectorArray::create();
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptFor(m_pausedScriptState);
     if (injectedScript.hasNoValue()) {
         ASSERT_NOT_REACHED();
-        return InspectorValue::null();
+        return InspectorArray::create();
     }
     return injectedScript.callFrames();
 }
@@ -351,7 +328,7 @@ PassRefPtr<InspectorValue> InspectorDebuggerAgent::currentCallFrames()
 void InspectorDebuggerAgent::didParseSource(const String& sourceID, const String& url, const String& data, int lineOffset, int columnOffset, ScriptWorldType worldType)
 {
     // Don't send script content to the front end until it's really needed.
-    m_frontend->parsedScriptSource(sourceID, url, lineOffset, columnOffset, data.length(), worldType);
+    m_frontend->scriptParsed(sourceID, url, lineOffset, columnOffset, data.length(), worldType);
 
     m_scripts.set(sourceID, Script(url, data, lineOffset, columnOffset));
 
@@ -378,7 +355,7 @@ void InspectorDebuggerAgent::didParseSource(const String& sourceID, const String
 
 void InspectorDebuggerAgent::failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage)
 {
-    m_frontend->failedToParseScriptSource(url, data, firstLine, errorLine, errorMessage);
+    m_frontend->scriptFailedToParse(url, data, firstLine, errorLine, errorMessage);
 }
 
 void InspectorDebuggerAgent::didPause(ScriptState* scriptState)
@@ -390,11 +367,11 @@ void InspectorDebuggerAgent::didPause(ScriptState* scriptState)
         m_breakProgramDetails = InspectorObject::create();
     m_breakProgramDetails->setValue("callFrames", currentCallFrames());
 
-    m_frontend->pausedScript(m_breakProgramDetails);
+    m_frontend->paused(m_breakProgramDetails);
     m_javaScriptPauseScheduled = false;
 
     if (!m_continueToLocationBreakpointId.isEmpty()) {
-        ScriptDebugServer::shared().removeBreakpoint(m_continueToLocationBreakpointId);
+        scriptDebugServer().removeBreakpoint(m_continueToLocationBreakpointId);
         m_continueToLocationBreakpointId = "";
     }
 }
@@ -403,7 +380,7 @@ void InspectorDebuggerAgent::didContinue()
 {
     m_pausedScriptState = 0;
     m_breakProgramDetails = 0;
-    m_frontend->resumedScript();
+    m_frontend->resumed();
 }
 
 void InspectorDebuggerAgent::breakProgram(DebuggerEventType type, PassRefPtr<InspectorValue> data)
@@ -411,7 +388,7 @@ void InspectorDebuggerAgent::breakProgram(DebuggerEventType type, PassRefPtr<Ins
     m_breakProgramDetails = InspectorObject::create();
     m_breakProgramDetails->setNumber("eventType", type);
     m_breakProgramDetails->setValue("eventData", data);
-    ScriptDebugServer::shared().breakProgram();
+    scriptDebugServer().breakProgram();
 }
 
 void InspectorDebuggerAgent::clear()
diff --git a/Source/WebCore/inspector/InspectorDebuggerAgent.h b/Source/WebCore/inspector/InspectorDebuggerAgent.h
index 394034a..d5726e7 100644
--- a/Source/WebCore/inspector/InspectorDebuggerAgent.h
+++ b/Source/WebCore/inspector/InspectorDebuggerAgent.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2010 Apple Inc. All rights reserved.
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,13 +44,14 @@
 
 namespace WebCore {
 
-class InjectedScriptHost;
+class InjectedScriptManager;
 class InspectorFrontend;
+class InspectorArray;
 class InspectorObject;
 class InspectorState;
 class InspectorValue;
 class InstrumentingAgents;
-class Page;
+class ScriptDebugServer;
 
 typedef String ErrorString;
 
@@ -63,42 +64,38 @@ enum DebuggerEventType {
 class InspectorDebuggerAgent : public ScriptDebugListener {
     WTF_MAKE_NONCOPYABLE(InspectorDebuggerAgent); WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassOwnPtr<InspectorDebuggerAgent> create(InstrumentingAgents*, InspectorState*, Page*, InjectedScriptHost*);
     virtual ~InspectorDebuggerAgent();
 
-    void startUserInitiatedDebugging();
     void enable(ErrorString*) { enable(false); }
     void disable(ErrorString*) { disable(); }
     void disable();
     bool enabled();
     void restore();
     void setFrontend(InspectorFrontend*);
-    void enableDebuggerAfterShown();
     void clearFrontend();
 
     void inspectedURLChanged(const String& url);
 
     // Part of the protocol.
-    void activateBreakpoints(ErrorString* error);
-    void deactivateBreakpoints(ErrorString* error);
+    void setBreakpointsActive(ErrorString*, bool active);
 
-    void setJavaScriptBreakpoint(ErrorString* error, const String& url, int lineNumber, int columnNumber, const String& condition, bool enabled, String* breakpointId, RefPtr<InspectorArray>* locations);
-    void setJavaScriptBreakpointBySourceId(ErrorString* error, const String& sourceId, int lineNumber, int columnNumber, const String& condition, bool enabled, String* breakpointId, int* actualLineNumber, int* actualColumnNumber);
-    void removeJavaScriptBreakpoint(ErrorString* error, const String& breakpointId);
-    void continueToLocation(ErrorString* error, const String& sourceId, int lineNumber, int columnNumber);
+    void setBreakpointByUrl(ErrorString*, const String& url, int lineNumber, int columnNumber, const String& condition, bool enabled, String* breakpointId, RefPtr<InspectorArray>* locations);
+    void setBreakpoint(ErrorString*, const String& sourceId, int lineNumber, int columnNumber, const String& condition, bool enabled, String* breakpointId, int* actualLineNumber, int* actualColumnNumber);
+    void removeBreakpoint(ErrorString*, const String& breakpointId);
+    void continueToLocation(ErrorString*, const String& sourceId, int lineNumber, int columnNumber);
 
-    void editScriptSource(ErrorString* error, const String& sourceID, const String& newContent, bool* success, String* result, RefPtr<InspectorValue>* newCallFrames);
-    void getScriptSource(ErrorString* error, const String& sourceID, String* scriptSource);
+    void editScriptSource(ErrorString*, const String& sourceID, const String& newContent, String* result, RefPtr<InspectorArray>* newCallFrames);
+    void getScriptSource(ErrorString*, const String& sourceID, String* scriptSource);
     void schedulePauseOnNextStatement(DebuggerEventType type, PassRefPtr<InspectorValue> data);
     void cancelPauseOnNextStatement();
     void breakProgram(DebuggerEventType type, PassRefPtr<InspectorValue> data);
-    void pause(ErrorString* error);
-    void resume(ErrorString* error);
-    void stepOver(ErrorString* error);
-    void stepInto(ErrorString* error);
-    void stepOut(ErrorString* error);
-    void setPauseOnExceptionsState(ErrorString* error, long pauseState, long* newState);
-    void evaluateOnCallFrame(ErrorString* error, PassRefPtr<InspectorObject> callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result);
+    void pause(ErrorString*);
+    void resume(ErrorString*);
+    void stepOver(ErrorString*);
+    void stepInto(ErrorString*);
+    void stepOut(ErrorString*);
+    void setPauseOnExceptionsState(ErrorString*, int pauseState);
+    void evaluateOnCallFrame(ErrorString*, const String& callFrameId, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result);
 
     class Listener {
     public:
@@ -108,12 +105,18 @@ public:
     };
     void setListener(Listener* listener) { m_listener = listener; }
 
-private:
-    InspectorDebuggerAgent(InstrumentingAgents*, InspectorState*, Page*, InjectedScriptHost*);
+    virtual ScriptDebugServer& scriptDebugServer() = 0;
+
+protected:
+    InspectorDebuggerAgent(InstrumentingAgents*, InspectorState*, InjectedScriptManager*);
 
+    virtual void startListeningScriptDebugServer() = 0;
+    virtual void stopListeningScriptDebugServer() = 0;
+
+private:
     void enable(bool restoringFromState);
 
-    PassRefPtr<InspectorValue> currentCallFrames();
+    PassRefPtr<InspectorArray> currentCallFrames();
 
     virtual void didParseSource(const String& sourceID, const String& url, const String& data, int lineOffset, int columnOffset, ScriptWorldType);
     virtual void failedToParseSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage);
@@ -153,8 +156,7 @@ private:
 
     InstrumentingAgents* m_instrumentingAgents;
     InspectorState* m_inspectorState;
-    Page* m_inspectedPage;
-    InjectedScriptHost* m_injectedScriptHost;
+    InjectedScriptManager* m_injectedScriptManager;
     InspectorFrontend::Debugger* m_frontend;
     ScriptState* m_pausedScriptState;
     ScriptsMap m_scripts;
diff --git a/Source/WebCore/inspector/InspectorFrontendClient.h b/Source/WebCore/inspector/InspectorFrontendClient.h
index 31f52b7..d5eeafb 100644
--- a/Source/WebCore/inspector/InspectorFrontendClient.h
+++ b/Source/WebCore/inspector/InspectorFrontendClient.h
@@ -62,6 +62,9 @@ public:
     virtual void inspectedURLChanged(const String&) = 0;
 
     virtual void sendMessageToBackend(const String&) = 0;
+
+    virtual void saveSessionSetting(const String&, const String&) {}
+    virtual void loadSessionSetting(const String&, String*) {}
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorFrontendHost.cpp b/Source/WebCore/inspector/InspectorFrontendHost.cpp
index f2e66bc..7450d35 100644
--- a/Source/WebCore/inspector/InspectorFrontendHost.cpp
+++ b/Source/WebCore/inspector/InspectorFrontendHost.cpp
@@ -220,6 +220,20 @@ void InspectorFrontendHost::copyText(const String& text)
     Pasteboard::generalPasteboard()->writePlainText(text);
 }
 
+void InspectorFrontendHost::saveSessionSetting(const String& key, const String& value)
+{
+    if (m_client)
+        m_client->saveSessionSetting(key, value);
+}
+
+String InspectorFrontendHost::loadSessionSetting(const String& key)
+{
+    String value;
+    if (m_client)
+        m_client->loadSessionSetting(key, &value);
+    return value;
+}
+
 void InspectorFrontendHost::sendMessageToBackend(const String& message)
 {
     m_client->sendMessageToBackend(message);
diff --git a/Source/WebCore/inspector/InspectorFrontendHost.h b/Source/WebCore/inspector/InspectorFrontendHost.h
index 03c55a9..05d555a 100644
--- a/Source/WebCore/inspector/InspectorFrontendHost.h
+++ b/Source/WebCore/inspector/InspectorFrontendHost.h
@@ -75,6 +75,9 @@ public:
 
     void copyText(const String& text);
 
+    void saveSessionSetting(const String& key, const String& value);
+    String loadSessionSetting(const String& key);
+
     // Called from [Custom] implementations.
     void showContextMenu(Event*, const Vector<ContextMenuItem*>& items);
     void sendMessageToBackend(const String& message);
diff --git a/Source/WebCore/inspector/InspectorFrontendHost.idl b/Source/WebCore/inspector/InspectorFrontendHost.idl
index 6853c7d..0703a8e 100644
--- a/Source/WebCore/inspector/InspectorFrontendHost.idl
+++ b/Source/WebCore/inspector/InspectorFrontendHost.idl
@@ -47,6 +47,9 @@ module core {
         DOMString localizedStringsURL();
         DOMString hiddenPanels();
 
+        void saveSessionSetting(in DOMString key, in DOMString value);
+        DOMString loadSessionSetting(in DOMString key);
+
         void copyText(in DOMString text);
 
         [Custom] DOMString platform();
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.cpp b/Source/WebCore/inspector/InspectorInstrumentation.cpp
index dfe1c28..6d3b4ad 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.cpp
+++ b/Source/WebCore/inspector/InspectorInstrumentation.cpp
@@ -47,6 +47,7 @@
 #include "InspectorDOMAgent.h"
 #include "InspectorDOMStorageAgent.h"
 #include "InspectorDebuggerAgent.h"
+#include "InspectorPageAgent.h"
 #include "InspectorProfilerAgent.h"
 #include "InspectorResourceAgent.h"
 #include "InspectorTimelineAgent.h"
@@ -92,6 +93,8 @@ static bool eventHasListeners(const AtomicString& eventType, DOMWindow* window,
 
 void InspectorInstrumentation::didClearWindowObjectInWorldImpl(InspectorAgent* inspectorAgent, Frame* frame, DOMWrapperWorld* world)
 {
+    if (InspectorPageAgent* pageAgent = inspectorAgent->instrumentingAgents()->inspectorPageAgent())
+        pageAgent->didClearWindowObjectInWorld(frame, world);
     inspectorAgent->didClearWindowObjectInWorld(frame, world);
 }
 
@@ -158,12 +161,15 @@ void InspectorInstrumentation::didInvalidateStyleAttrImpl(InspectorAgent* inspec
 
 void InspectorInstrumentation::mouseDidMoveOverElementImpl(InspectorAgent* inspectorAgent, const HitTestResult& result, unsigned modifierFlags)
 {
-    inspectorAgent->mouseDidMoveOverElement(result, modifierFlags);
+    if (InspectorDOMAgent* domAgent = inspectorAgent->instrumentingAgents()->inspectorDOMAgent())
+        domAgent->mouseDidMoveOverElement(result, modifierFlags);
 }
 
 bool InspectorInstrumentation::handleMousePressImpl(InspectorAgent* inspectorAgent)
 {
-    return inspectorAgent->handleMousePress();
+    if (InspectorDOMAgent* domAgent = inspectorAgent->instrumentingAgents()->inspectorDOMAgent())
+        return domAgent->handleMousePress();
+    return false;
 }
 
 void InspectorInstrumentation::characterDataModifiedImpl(InspectorAgent* inspectorAgent, CharacterData* characterData)
@@ -382,26 +388,18 @@ void InspectorInstrumentation::didRecalculateStyleImpl(const InspectorInstrument
         timelineAgent->didRecalculateStyle();
 }
 
-void InspectorInstrumentation::identifierForInitialRequestImpl(InspectorAgent* inspectorAgent, unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
-{
-    if (!inspectorAgent->enabled())
-        return;
-
-    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
-        resourceAgent->identifierForInitialRequest(identifier, request.url(), loader);
-}
-
 void InspectorInstrumentation::applyUserAgentOverrideImpl(InspectorAgent* inspectorAgent, String* userAgent)
 {
-    inspectorAgent->applyUserAgentOverride(userAgent);
+    if (InspectorPageAgent* pageAgent = retrievePageAgent(inspectorAgent))
+        pageAgent->applyUserAgentOverride(userAgent);
 }
 
-void InspectorInstrumentation::willSendRequestImpl(InspectorAgent* inspectorAgent, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+void InspectorInstrumentation::willSendRequestImpl(InspectorAgent* inspectorAgent, unsigned long identifier, DocumentLoader* loader, ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
     if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent))
         timelineAgent->willSendResourceRequest(identifier, request);
     if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
-        resourceAgent->willSendRequest(identifier, request, redirectResponse);
+        resourceAgent->willSendRequest(identifier, loader, request, redirectResponse);
 }
 
 void InspectorInstrumentation::markResourceAsCachedImpl(InspectorAgent* inspectorAgent, unsigned long identifier)
@@ -448,18 +446,21 @@ InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceResp
 
 void InspectorInstrumentation::didReceiveResourceResponseImpl(const InspectorInstrumentationCookie& cookie, unsigned long identifier, DocumentLoader* loader, const ResourceResponse& response)
 {
-    InspectorAgent* inspectorAgent = cookie.first;
-    if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
-        resourceAgent->didReceiveResponse(identifier, loader, response);
-    inspectorAgent->consoleAgent()->didReceiveResponse(identifier, response);
     if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
         timelineAgent->didReceiveResourceResponse();
+    if (!loader)
+        return;
+    if (InspectorAgent* inspectorAgent = inspectorAgentForFrame(loader->frame())) {
+        if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
+            resourceAgent->didReceiveResponse(identifier, loader, response);
+        inspectorAgent->consoleAgent()->didReceiveResponse(identifier, response); // This should come AFTER resource notification, front-end relies on this.
+    }
 }
 
-void InspectorInstrumentation::didReceiveContentLengthImpl(InspectorAgent* inspectorAgent, unsigned long identifier, int lengthReceived)
+void InspectorInstrumentation::didReceiveContentLengthImpl(InspectorAgent* inspectorAgent, unsigned long identifier, int dataLength, int lengthReceived)
 {
     if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
-        resourceAgent->didReceiveContentLength(identifier, lengthReceived);
+        resourceAgent->didReceiveContentLength(identifier, dataLength, lengthReceived);
 }
 
 void InspectorInstrumentation::didFinishLoadingImpl(InspectorAgent* inspectorAgent, unsigned long identifier, double finishTime)
@@ -472,11 +473,11 @@ void InspectorInstrumentation::didFinishLoadingImpl(InspectorAgent* inspectorAge
 
 void InspectorInstrumentation::didFailLoadingImpl(InspectorAgent* inspectorAgent, unsigned long identifier, const ResourceError& error)
 {
-    inspectorAgent->consoleAgent()->didFailLoading(identifier, error);
     if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorAgent))
         timelineAgent->didFinishLoadingResource(identifier, true, 0);
     if (InspectorResourceAgent* resourceAgent = retrieveResourceAgent(inspectorAgent))
         resourceAgent->didFailLoading(identifier, error);
+    inspectorAgent->consoleAgent()->didFailLoading(identifier, error); // This should come AFTER resource notification, front-end relies on this.
 }
 
 void InspectorInstrumentation::resourceRetrievedByXMLHttpRequestImpl(InspectorAgent* inspectorAgent, unsigned long identifier, const String& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber)
@@ -494,12 +495,40 @@ void InspectorInstrumentation::scriptImportedImpl(InspectorAgent* inspectorAgent
 
 void InspectorInstrumentation::domContentLoadedEventFiredImpl(InspectorAgent* inspectorAgent, Frame* frame, const KURL& url)
 {
-    inspectorAgent->domContentLoadedEventFired(frame->loader()->documentLoader(), url);
+    DocumentLoader* documentLoader = frame->loader()->documentLoader();
+    ASSERT(documentLoader);
+
+    if (frame->page()->mainFrame() != frame || url != documentLoader->requestURL())
+        return;
+
+    inspectorAgent->domContentLoadedEventFired();
+
+    if (InspectorDOMAgent* domAgent = inspectorAgent->instrumentingAgents()->inspectorDOMAgent())
+        domAgent->mainFrameDOMContentLoaded();
+
+    if (InspectorTimelineAgent* timelineAgent = inspectorAgent->instrumentingAgents()->inspectorTimelineAgent())
+        timelineAgent->didMarkDOMContentEvent();
+
+    if (InspectorPageAgent* pageAgent = inspectorAgent->instrumentingAgents()->inspectorPageAgent())
+        pageAgent->domContentEventFired();
 }
 
 void InspectorInstrumentation::loadEventFiredImpl(InspectorAgent* inspectorAgent, Frame* frame, const KURL& url)
 {
-    inspectorAgent->loadEventFired(frame->loader()->documentLoader(), url);
+    DocumentLoader* documentLoader = frame->loader()->documentLoader();
+    ASSERT(documentLoader);
+
+    if (InspectorDOMAgent* domAgent = inspectorAgent->instrumentingAgents()->inspectorDOMAgent())
+        domAgent->loadEventFired(documentLoader->frame()->document());
+
+    if (frame->page()->mainFrame() != frame || url != documentLoader->requestURL())
+        return;
+
+    if (InspectorTimelineAgent* timelineAgent = inspectorAgent->instrumentingAgents()->inspectorTimelineAgent())
+        timelineAgent->didMarkLoadEvent();
+
+    if (InspectorPageAgent* pageAgent = inspectorAgent->instrumentingAgents()->inspectorPageAgent())
+        pageAgent->loadEventFired();
 }
 
 void InspectorInstrumentation::frameDetachedFromParentImpl(InspectorAgent* inspectorAgent, Frame* frame)
@@ -527,8 +556,6 @@ void InspectorInstrumentation::didCommitLoadImpl(Page* page, InspectorAgent* ins
     if (InspectorDebuggerAgent* debuggerAgent = instrumentingAgents->inspectorDebuggerAgent()) {
         KURL url = inspectorAgent->inspectedURLWithoutFragment();
         debuggerAgent->inspectedURLChanged(url);
-        if (InspectorBrowserDebuggerAgent* browserDebuggerAgent = instrumentingAgents->inspectorBrowserDebuggerAgent())
-            browserDebuggerAgent->inspectedURLChanged(url);
     }
 #endif
 #if ENABLE(JAVASCRIPT_DEBUGGER) && USE(JSC)
@@ -549,7 +576,11 @@ void InspectorInstrumentation::didCommitLoadImpl(Page* page, InspectorAgent* ins
 #endif
     if (InspectorDOMAgent* domAgent = instrumentingAgents->inspectorDOMAgent())
         domAgent->setDocument(mainFrame->document());
-    inspectorAgent->didCommitLoad(loader);
+
+    if (InspectorPageAgent* pageAgent = instrumentingAgents->inspectorPageAgent())
+        pageAgent->inspectedURLChanged(loader->url().string());
+
+    inspectorAgent->didCommitLoad();
 }
 
 InspectorInstrumentationCookie InspectorInstrumentation::willWriteHTMLImpl(InspectorAgent* inspectorAgent, unsigned int length, unsigned int startLine)
@@ -627,7 +658,7 @@ String InspectorInstrumentation::getCurrentUserInitiatedProfileNameImpl(Inspecto
 
 bool InspectorInstrumentation::profilerEnabledImpl(InspectorAgent* inspectorAgent)
 {
-    return inspectorAgent->profilerEnabled();
+    return inspectorAgent->instrumentingAgents()->inspectorProfilerAgent()->enabled();
 }
 #endif
 
@@ -733,6 +764,8 @@ InspectorTimelineAgent* InspectorInstrumentation::retrieveTimelineAgent(Inspecto
 
 InspectorTimelineAgent* InspectorInstrumentation::retrieveTimelineAgent(const InspectorInstrumentationCookie& cookie)
 {
+    if (!cookie.first)
+        return 0;
     InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie.first);
     if (timelineAgent && timelineAgent->id() == cookie.second)
         return timelineAgent;
@@ -744,6 +777,11 @@ InspectorResourceAgent* InspectorInstrumentation::retrieveResourceAgent(Inspecto
     return inspectorAgent->instrumentingAgents()->inspectorResourceAgent();
 }
 
+InspectorPageAgent* InspectorInstrumentation::retrievePageAgent(InspectorAgent* inspectorAgent)
+{
+    return inspectorAgent->instrumentingAgents()->inspectorPageAgent();
+}
+
 } // namespace WebCore
 
 #endif // !ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.h b/Source/WebCore/inspector/InspectorInstrumentation.h
index 2ea4e4f..77c464e 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.h
+++ b/Source/WebCore/inspector/InspectorInstrumentation.h
@@ -48,6 +48,7 @@ class EventContext;
 class DocumentLoader;
 class HitTestResult;
 class InspectorAgent;
+class InspectorPageAgent;
 class InspectorResourceAgent;
 class InspectorTimelineAgent;
 class KURL;
@@ -110,15 +111,14 @@ public:
     static void didRecalculateStyle(const InspectorInstrumentationCookie&);
 
     static void applyUserAgentOverride(Frame*, String*);
-    static void identifierForInitialRequest(Frame*, unsigned long identifier, DocumentLoader*, const ResourceRequest&);
-    static void willSendRequest(Frame*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
+    static void willSendRequest(Frame*, unsigned long identifier, DocumentLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
     static void markResourceAsCached(Page*, unsigned long identifier);
     static void didLoadResourceFromMemoryCache(Page*, DocumentLoader*, const CachedResource*);
     static InspectorInstrumentationCookie willReceiveResourceData(Frame*, unsigned long identifier);
     static void didReceiveResourceData(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willReceiveResourceResponse(Frame*, unsigned long identifier, const ResourceResponse&);
     static void didReceiveResourceResponse(const InspectorInstrumentationCookie&, unsigned long identifier, DocumentLoader*, const ResourceResponse&);
-    static void didReceiveContentLength(Frame*, unsigned long identifier, int lengthReceived);
+    static void didReceiveContentLength(Frame*, unsigned long identifier, int dataLength, int lengthReceived);
     static void didFinishLoading(Frame*, unsigned long identifier, double finishTime);
     static void didFailLoading(Frame*, unsigned long identifier, const ResourceError&);
     static void resourceRetrievedByXMLHttpRequest(ScriptExecutionContext*, unsigned long identifier, const String& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber);
@@ -227,15 +227,14 @@ private:
     static void didRecalculateStyleImpl(const InspectorInstrumentationCookie&);
 
     static void applyUserAgentOverrideImpl(InspectorAgent*, String*);
-    static void identifierForInitialRequestImpl(InspectorAgent*, unsigned long identifier, DocumentLoader*, const ResourceRequest&);
-    static void willSendRequestImpl(InspectorAgent*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
+    static void willSendRequestImpl(InspectorAgent*, unsigned long identifier, DocumentLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
     static void markResourceAsCachedImpl(InspectorAgent*, unsigned long identifier);
     static void didLoadResourceFromMemoryCacheImpl(InspectorAgent*, DocumentLoader*, const CachedResource*);
     static InspectorInstrumentationCookie willReceiveResourceDataImpl(InspectorAgent*, unsigned long identifier);
     static void didReceiveResourceDataImpl(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willReceiveResourceResponseImpl(InspectorAgent*, unsigned long identifier, const ResourceResponse&);
     static void didReceiveResourceResponseImpl(const InspectorInstrumentationCookie&, unsigned long identifier, DocumentLoader*, const ResourceResponse&);
-    static void didReceiveContentLengthImpl(InspectorAgent*, unsigned long identifier, int lengthReceived);
+    static void didReceiveContentLengthImpl(InspectorAgent*, unsigned long identifier, int dataLength, int lengthReceived);
     static void didFinishLoadingImpl(InspectorAgent*, unsigned long identifier, double finishTime);
     static void didFailLoadingImpl(InspectorAgent*, unsigned long identifier, const ResourceError&);
     static void resourceRetrievedByXMLHttpRequestImpl(InspectorAgent*, unsigned long identifier, const String& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber);
@@ -301,6 +300,7 @@ private:
     static InspectorTimelineAgent* retrieveTimelineAgent(InspectorAgent*);
     static InspectorTimelineAgent* retrieveTimelineAgent(const InspectorInstrumentationCookie&);
     static InspectorResourceAgent* retrieveResourceAgent(InspectorAgent*);
+    static InspectorPageAgent* retrievePageAgent(InspectorAgent*);
 
     static HashMap<Page*, InspectorAgent*>& inspectorAgents();
     static int s_frontendCounter;
@@ -601,17 +601,6 @@ inline void InspectorInstrumentation::didRecalculateStyle(const InspectorInstrum
 #endif
 }
 
-inline void InspectorInstrumentation::identifierForInitialRequest(Frame* frame, unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
-{
-#if ENABLE(INSPECTOR)
-    // This notification should be procecessed even in cases there is no frontend.
-    if (!frame)
-        return;
-    if (InspectorAgent* ic = inspectorAgentForPage(frame->page()))
-        identifierForInitialRequestImpl(ic, identifier, loader, request);
-#endif
-}
-
 inline void InspectorInstrumentation::applyUserAgentOverride(Frame* frame, String* userAgent)
 {
 #if ENABLE(INSPECTOR)
@@ -620,11 +609,11 @@ inline void InspectorInstrumentation::applyUserAgentOverride(Frame* frame, Strin
 #endif
 }
 
-inline void InspectorInstrumentation::willSendRequest(Frame* frame, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+inline void InspectorInstrumentation::willSendRequest(Frame* frame, unsigned long identifier, DocumentLoader* loader, ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
 #if ENABLE(INSPECTOR)
     if (InspectorAgent* ic = inspectorAgentWithFrontendForFrame(frame))
-        willSendRequestImpl(ic, identifier, request, redirectResponse);
+        willSendRequestImpl(ic, identifier, loader, request, redirectResponse);
 #endif
 }
 
@@ -671,16 +660,16 @@ inline InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResou
 inline void InspectorInstrumentation::didReceiveResourceResponse(const InspectorInstrumentationCookie& cookie, unsigned long identifier, DocumentLoader* loader, const ResourceResponse& response)
 {
 #if ENABLE(INSPECTOR)
-    if (hasFrontends() && cookie.first)
-        didReceiveResourceResponseImpl(cookie, identifier, loader, response);
+    // Call this unconditionally so that we're able to log to console with no front-end attached.
+    didReceiveResourceResponseImpl(cookie, identifier, loader, response);
 #endif
 }
 
-inline void InspectorInstrumentation::didReceiveContentLength(Frame* frame, unsigned long identifier, int lengthReceived)
+inline void InspectorInstrumentation::didReceiveContentLength(Frame* frame, unsigned long identifier, int dataLength, int lengthReceived)
 {
 #if ENABLE(INSPECTOR)
     if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
-        didReceiveContentLengthImpl(inspectorAgent, identifier, lengthReceived);
+        didReceiveContentLengthImpl(inspectorAgent, identifier, dataLength, lengthReceived);
 #endif
 }
 
@@ -695,7 +684,7 @@ inline void InspectorInstrumentation::didFinishLoading(Frame* frame, unsigned lo
 inline void InspectorInstrumentation::didFailLoading(Frame* frame, unsigned long identifier, const ResourceError& error)
 {
 #if ENABLE(INSPECTOR)
-    if (InspectorAgent* inspectorAgent = inspectorAgentWithFrontendForFrame(frame))
+    if (InspectorAgent* inspectorAgent = inspectorAgentForFrame(frame))
         didFailLoadingImpl(inspectorAgent, identifier, error);
 #endif
 }
diff --git a/Source/WebCore/inspector/InspectorPageAgent.cpp b/Source/WebCore/inspector/InspectorPageAgent.cpp
new file mode 100644
index 0000000..af053c9
--- /dev/null
+++ b/Source/WebCore/inspector/InspectorPageAgent.cpp
@@ -0,0 +1,258 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "InspectorPageAgent.h"
+
+#if ENABLE(INSPECTOR) && ENABLE(JAVASCRIPT_DEBUGGER)
+
+#include "CachedResourceLoader.h"
+#include "Cookie.h"
+#include "CookieJar.h"
+#include "DocumentLoader.h"
+#include "Frame.h"
+#include "FrameLoadRequest.h"
+#include "InjectedScriptManager.h"
+#include "InspectorFrontend.h"
+#include "InspectorValues.h"
+#include "InstrumentingAgents.h"
+#include "Page.h"
+#include "ScriptObject.h"
+#include "UserGestureIndicator.h"
+#include "WindowFeatures.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/ListHashSet.h>
+
+namespace WebCore {
+
+PassOwnPtr<InspectorPageAgent> InspectorPageAgent::create(InstrumentingAgents* instrumentingAgents, Page* inspectedPage, InjectedScriptManager* injectedScriptManager)
+{
+    return adoptPtr(new InspectorPageAgent(instrumentingAgents, inspectedPage, injectedScriptManager));
+}
+
+InspectorPageAgent::InspectorPageAgent(InstrumentingAgents* instrumentingAgents, Page* inspectedPage, InjectedScriptManager* injectedScriptManager)
+    : m_instrumentingAgents(instrumentingAgents)
+    , m_inspectedPage(inspectedPage)
+    , m_injectedScriptManager(injectedScriptManager)
+    , m_frontend(0)
+{
+}
+
+void InspectorPageAgent::setFrontend(InspectorFrontend* frontend)
+{
+    m_frontend = frontend;
+    m_instrumentingAgents->setInspectorPageAgent(this);
+
+    // Initialize Web Inspector title.
+    m_frontend->page()->inspectedURLChanged(m_inspectedPage->mainFrame()->document()->url().string());
+
+}
+
+void InspectorPageAgent::clearFrontend()
+{
+    m_instrumentingAgents->setInspectorPageAgent(0);
+    m_userAgentOverride = "";
+    m_frontend = 0;
+}
+
+void InspectorPageAgent::addScriptToEvaluateOnLoad(ErrorString*, const String& source)
+{
+    m_scriptsToEvaluateOnLoad.append(source);
+}
+
+void InspectorPageAgent::removeAllScriptsToEvaluateOnLoad(ErrorString*)
+{
+    m_scriptsToEvaluateOnLoad.clear();
+}
+
+void InspectorPageAgent::reloadPage(ErrorString*, bool ignoreCache)
+{
+    m_inspectedPage->mainFrame()->loader()->reload(ignoreCache);
+}
+
+void InspectorPageAgent::openInInspectedWindow(ErrorString*, const String& url)
+{
+    Frame* mainFrame = m_inspectedPage->mainFrame();
+
+    FrameLoadRequest request(mainFrame->document()->securityOrigin(), ResourceRequest(), "_blank");
+
+    bool created;
+    WindowFeatures windowFeatures;
+    Frame* newFrame = WebCore::createWindow(mainFrame, mainFrame, request, windowFeatures, created);
+    if (!newFrame)
+        return;
+
+    UserGestureIndicator indicator(DefinitelyProcessingUserGesture);
+    newFrame->loader()->setOpener(mainFrame);
+    newFrame->page()->setOpenedByDOM();
+    newFrame->loader()->changeLocation(mainFrame->document()->securityOrigin(), newFrame->loader()->completeURL(url), "", false, false);
+}
+
+void InspectorPageAgent::setUserAgentOverride(ErrorString*, const String& userAgent)
+{
+    m_userAgentOverride = userAgent;
+}
+
+void InspectorPageAgent::applyUserAgentOverride(String* userAgent) const
+{
+    if (!m_userAgentOverride.isEmpty())
+        *userAgent = m_userAgentOverride;
+}
+
+static PassRefPtr<InspectorObject> buildObjectForCookie(const Cookie& cookie)
+{
+    RefPtr<InspectorObject> value = InspectorObject::create();
+    value->setString("name", cookie.name);
+    value->setString("value", cookie.value);
+    value->setString("domain", cookie.domain);
+    value->setString("path", cookie.path);
+    value->setNumber("expires", cookie.expires);
+    value->setNumber("size", (cookie.name.length() + cookie.value.length()));
+    value->setBoolean("httpOnly", cookie.httpOnly);
+    value->setBoolean("secure", cookie.secure);
+    value->setBoolean("session", cookie.session);
+    return value;
+}
+
+static PassRefPtr<InspectorArray> buildArrayForCookies(ListHashSet<Cookie>& cookiesList)
+{
+    RefPtr<InspectorArray> cookies = InspectorArray::create();
+
+    ListHashSet<Cookie>::iterator end = cookiesList.end();
+    ListHashSet<Cookie>::iterator it = cookiesList.begin();
+    for (int i = 0; it != end; ++it, i++)
+        cookies->pushObject(buildObjectForCookie(*it));
+
+    return cookies;
+}
+
+void InspectorPageAgent::getCookies(ErrorString*, RefPtr<InspectorArray>* cookies, WTF::String* cookiesString)
+{
+    // If we can get raw cookies.
+    ListHashSet<Cookie> rawCookiesList;
+
+    // If we can't get raw cookies - fall back to String representation
+    String stringCookiesList;
+
+    // Return value to getRawCookies should be the same for every call because
+    // the return value is platform/network backend specific, and the call will
+    // always return the same true/false value.
+    bool rawCookiesImplemented = false;
+
+    for (Frame* frame = m_inspectedPage->mainFrame(); frame; frame = frame->tree()->traverseNext(m_inspectedPage->mainFrame())) {
+        Document* document = frame->document();
+        const CachedResourceLoader::DocumentResourceMap& allResources = document->cachedResourceLoader()->allCachedResources();
+        CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
+        for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it) {
+            Vector<Cookie> docCookiesList;
+            rawCookiesImplemented = getRawCookies(document, KURL(ParsedURLString, it->second->url()), docCookiesList);
+
+            if (!rawCookiesImplemented) {
+                // FIXME: We need duplication checking for the String representation of cookies.
+                ExceptionCode ec = 0;
+                stringCookiesList += document->cookie(ec);
+                // Exceptions are thrown by cookie() in sandboxed frames. That won't happen here
+                // because "document" is the document of the main frame of the page.
+                ASSERT(!ec);
+            } else {
+                int cookiesSize = docCookiesList.size();
+                for (int i = 0; i < cookiesSize; i++) {
+                    if (!rawCookiesList.contains(docCookiesList[i]))
+                        rawCookiesList.add(docCookiesList[i]);
+                }
+            }
+        }
+    }
+
+    if (rawCookiesImplemented)
+        *cookies = buildArrayForCookies(rawCookiesList);
+    else
+        *cookiesString = stringCookiesList;
+}
+
+void InspectorPageAgent::deleteCookie(ErrorString*, const String& cookieName, const String& domain)
+{
+    for (Frame* frame = m_inspectedPage->mainFrame(); frame; frame = frame->tree()->traverseNext(m_inspectedPage->mainFrame())) {
+        Document* document = frame->document();
+        if (document->url().host() != domain)
+            continue;
+        const CachedResourceLoader::DocumentResourceMap& allResources = document->cachedResourceLoader()->allCachedResources();
+        CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
+        for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it)
+            WebCore::deleteCookie(document, KURL(ParsedURLString, it->second->url()), cookieName);
+    }
+}
+
+void InspectorPageAgent::inspectedURLChanged(const String& url)
+{
+    m_frontend->page()->inspectedURLChanged(url);
+}
+
+void InspectorPageAgent::restore()
+{
+    inspectedURLChanged(m_inspectedPage->mainFrame()->document()->url().string());
+}
+
+void InspectorPageAgent::didCommitLoad(const String& url)
+{
+    inspectedURLChanged(url);
+}
+
+void InspectorPageAgent::domContentEventFired()
+{
+     m_frontend->page()->domContentEventFired(currentTime());
+}
+
+void InspectorPageAgent::loadEventFired()
+{
+     m_frontend->page()->loadEventFired(currentTime());
+}
+
+void InspectorPageAgent::didClearWindowObjectInWorld(Frame* frame, DOMWrapperWorld* world)
+{
+    if (world != mainThreadNormalWorld())
+        return;
+
+    if (frame == m_inspectedPage->mainFrame())
+        m_injectedScriptManager->discardInjectedScripts();
+
+    if (m_scriptsToEvaluateOnLoad.size()) {
+        ScriptState* scriptState = mainWorldScriptState(frame);
+        for (Vector<String>::iterator it = m_scriptsToEvaluateOnLoad.begin();
+             it != m_scriptsToEvaluateOnLoad.end(); ++it) {
+            m_injectedScriptManager->injectScript(*it, scriptState);
+        }
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR) && ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebCore/inspector/InspectorPageAgent.h b/Source/WebCore/inspector/InspectorPageAgent.h
new file mode 100644
index 0000000..bb6b96f
--- /dev/null
+++ b/Source/WebCore/inspector/InspectorPageAgent.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorPageAgent_h
+#define InspectorPageAgent_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
+
+#include "PlatformString.h"
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class DOMWrapperWorld;
+class Frame;
+class Frontend;
+class InjectedScriptManager;
+class InspectorArray;
+class InspectorFrontend;
+class InstrumentingAgents;
+class Page;
+
+typedef String ErrorString;
+
+class InspectorPageAgent {
+    WTF_MAKE_NONCOPYABLE(InspectorPageAgent);
+public:
+    static PassOwnPtr<InspectorPageAgent> create(InstrumentingAgents*, Page*, InjectedScriptManager*);
+
+    // Page API for InspectorFrontend
+    void addScriptToEvaluateOnLoad(ErrorString*, const String& source);
+    void removeAllScriptsToEvaluateOnLoad(ErrorString*);
+    void reloadPage(ErrorString*, bool ignoreCache);
+    void openInInspectedWindow(ErrorString*, const String& url);
+    void setUserAgentOverride(ErrorString*, const String& userAgent);
+    void getCookies(ErrorString*, RefPtr<InspectorArray>* cookies, WTF::String* cookiesString);
+    void deleteCookie(ErrorString*, const String& cookieName, const String& domain);
+
+    // InspectorInstrumentation API
+    void inspectedURLChanged(const String& url);
+    void didCommitLoad(const String& url);
+    void didClearWindowObjectInWorld(Frame*, DOMWrapperWorld*);
+    void domContentEventFired();
+    void loadEventFired();
+
+    void setFrontend(InspectorFrontend*);
+    void clearFrontend();
+    void restore();
+    void applyUserAgentOverride(String* userAgent) const;
+
+private:
+    InspectorPageAgent(InstrumentingAgents*, Page*, InjectedScriptManager*);
+
+    InstrumentingAgents* m_instrumentingAgents;
+    Page* m_inspectedPage;
+    InjectedScriptManager* m_injectedScriptManager;
+    InspectorFrontend* m_frontend;
+    Vector<String> m_scriptsToEvaluateOnLoad;
+    String m_userAgentOverride;
+};
+
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
+
+#endif // !defined(InspectorPageAgent_h)
diff --git a/Source/WebCore/inspector/InspectorProfilerAgent.cpp b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
index 8867023..870a120 100644
--- a/Source/WebCore/inspector/InspectorProfilerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
@@ -33,14 +33,15 @@
 #if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
 
 #include "Console.h"
-#include "InspectorAgent.h"
 #include "InspectorConsoleAgent.h"
 #include "InspectorFrontend.h"
+#include "InspectorState.h"
 #include "InspectorValues.h"
 #include "InstrumentingAgents.h"
 #include "KURL.h"
 #include "Page.h"
-#include "ScriptDebugServer.h"
+#include "PageScriptDebugServer.h"
+#include "ScriptController.h"
 #include "ScriptHeapSnapshot.h"
 #include "ScriptProfile.h"
 #include "ScriptProfiler.h"
@@ -53,19 +54,25 @@
 
 namespace WebCore {
 
+namespace ProfilerAgentState {
+static const char userInitiatedProfiling[] = "userInitiatedProfiling";
+static const char profilerEnabled[] = "profilerEnabled";
+}
+
 static const char* const UserInitiatedProfileName = "org.webkit.profiles.user-initiated";
 static const char* const CPUProfileType = "CPU";
 static const char* const HeapProfileType = "HEAP";
 
-PassOwnPtr<InspectorProfilerAgent> InspectorProfilerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, Page* inspectedPage)
+PassOwnPtr<InspectorProfilerAgent> InspectorProfilerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, Page* inspectedPage, InspectorState* inspectorState)
 {
-    return adoptPtr(new InspectorProfilerAgent(instrumentingAgents, consoleAgent, inspectedPage));
+    return adoptPtr(new InspectorProfilerAgent(instrumentingAgents, consoleAgent, inspectedPage, inspectorState));
 }
 
-InspectorProfilerAgent::InspectorProfilerAgent(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, Page* inspectedPage)
+InspectorProfilerAgent::InspectorProfilerAgent(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, Page* inspectedPage, InspectorState* inspectorState)
     : m_instrumentingAgents(instrumentingAgents)
     , m_consoleAgent(consoleAgent)
     , m_inspectedPage(inspectedPage)
+    , m_inspectorState(inspectorState)
     , m_frontend(0)
     , m_enabled(false)
     , m_recordingUserInitiatedProfile(false)
@@ -108,6 +115,11 @@ void InspectorProfilerAgent::addStartProfilingMessageToConsole(const String& tit
     m_consoleAgent->addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
 }
 
+void InspectorProfilerAgent::collectGarbage(WebCore::ErrorString*)
+{
+    ScriptProfiler::collectGarbage();
+}
+
 PassRefPtr<InspectorObject> InspectorProfilerAgent::createProfileHeader(const ScriptProfile& profile)
 {
     RefPtr<InspectorObject> header = InspectorObject::create();
@@ -126,12 +138,26 @@ PassRefPtr<InspectorObject> InspectorProfilerAgent::createSnapshotHeader(const S
     return header;
 }
 
+void InspectorProfilerAgent::enable(ErrorString*)
+{
+    if (enabled())
+        return;
+    m_inspectorState->setBoolean(ProfilerAgentState::profilerEnabled, true);
+    enable(false);
+}
+
+void InspectorProfilerAgent::disable(ErrorString*)
+{
+    m_inspectorState->setBoolean(ProfilerAgentState::profilerEnabled, false);
+    disable();
+}
+
 void InspectorProfilerAgent::disable()
 {
     if (!m_enabled)
         return;
     m_enabled = false;
-    ScriptDebugServer::shared().recompileAllJSFunctionsSoon();
+    PageScriptDebugServer::shared().recompileAllJSFunctionsSoon();
     if (m_frontend)
         m_frontend->profilerWasDisabled();
 }
@@ -142,7 +168,7 @@ void InspectorProfilerAgent::enable(bool skipRecompile)
         return;
     m_enabled = true;
     if (!skipRecompile)
-        ScriptDebugServer::shared().recompileAllJSFunctionsSoon();
+        PageScriptDebugServer::shared().recompileAllJSFunctionsSoon();
     if (m_frontend)
         m_frontend->profilerWasEnabled();
 }
@@ -155,16 +181,6 @@ String InspectorProfilerAgent::getCurrentUserInitiatedProfileName(bool increment
     return makeString(UserInitiatedProfileName, '.', String::number(m_currentUserInitiatedProfileNumber));
 }
 
-void InspectorProfilerAgent::getExactHeapSnapshotNodeRetainedSize(ErrorString*, unsigned long uid, unsigned long nodeId, long* size)
-{
-    HeapSnapshotsMap::iterator it = m_snapshots.find(uid);
-    if (it != m_snapshots.end()) {
-        RefPtr<ScriptHeapSnapshot> snapshot = it->second;
-        *size = snapshot->exactRetainedSize(nodeId);
-    } else
-        *size = -1;
-}
-
 void InspectorProfilerAgent::getProfileHeaders(ErrorString*, RefPtr<InspectorArray>* headers)
 {
     ProfilesMap::iterator profilesEnd = m_profiles.end();
@@ -179,13 +195,13 @@ namespace {
 
 class OutputStream : public ScriptHeapSnapshot::OutputStream {
 public:
-    OutputStream(InspectorFrontend::Profiler* frontend, unsigned long uid)
+    OutputStream(InspectorFrontend::Profiler* frontend, unsigned uid)
         : m_frontend(frontend), m_uid(uid) { }
     void Write(const String& chunk) { m_frontend->addHeapSnapshotChunk(m_uid, chunk); }
     void Close() { m_frontend->finishHeapSnapshot(m_uid); }
 private:
     InspectorFrontend::Profiler* m_frontend;
-    unsigned long m_uid;
+    int m_uid;
 };
 
 } // namespace
@@ -224,6 +240,7 @@ void InspectorProfilerAgent::removeProfile(ErrorString*, const String& type, uns
 
 void InspectorProfilerAgent::resetState()
 {
+    stopUserInitiatedProfiling();
     m_profiles.clear();
     m_snapshots.clear();
     m_currentUserInitiatedProfileNumber = 1;
@@ -240,13 +257,44 @@ void InspectorProfilerAgent::resetFrontendProfiles()
         m_frontend->resetProfiles();
 }
 
+void InspectorProfilerAgent::setFrontend(InspectorFrontend* frontend)
+{
+    m_frontend = frontend->profiler();
+    restoreEnablement();
+}
+
+void InspectorProfilerAgent::clearFrontend()
+{
+    m_frontend = 0;
+    stopUserInitiatedProfiling();
+}
+
+void InspectorProfilerAgent::restore()
+{
+    // Need to restore enablement state here as in setFrontend m_inspectorState wasn't loaded yet.
+    restoreEnablement();
+
+    // Revisit this.
+    resetFrontendProfiles();
+    if (m_inspectorState->getBoolean(ProfilerAgentState::userInitiatedProfiling))
+        startUserInitiatedProfiling();
+}
+
+void InspectorProfilerAgent::restoreEnablement()
+{
+    if (m_inspectorState->getBoolean(ProfilerAgentState::profilerEnabled)) {
+        ErrorString error;
+        enable(&error);
+    }
+}
+
 void InspectorProfilerAgent::startUserInitiatedProfiling()
 {
     if (m_recordingUserInitiatedProfile)
         return;
     if (!enabled()) {
         enable(true);
-        ScriptDebugServer::shared().recompileAllJSFunctions();
+        PageScriptDebugServer::shared().recompileAllJSFunctions(0);
     }
     m_recordingUserInitiatedProfile = true;
     String title = getCurrentUserInitiatedProfileName(true);
@@ -258,6 +306,7 @@ void InspectorProfilerAgent::startUserInitiatedProfiling()
     ScriptProfiler::start(scriptState, title);
     addStartProfilingMessageToConsole(title, 0, String());
     toggleRecordButton(true);
+    m_inspectorState->setBoolean(ProfilerAgentState::userInitiatedProfiling, true);
 }
 
 void InspectorProfilerAgent::stopUserInitiatedProfiling(bool ignoreProfile)
@@ -281,6 +330,7 @@ void InspectorProfilerAgent::stopUserInitiatedProfiling(bool ignoreProfile)
             addProfileFinishedMessageToConsole(profile, 0, String());
     }
     toggleRecordButton(false);
+    m_inspectorState->setBoolean(ProfilerAgentState::userInitiatedProfiling, false);
 }
 
 namespace {
diff --git a/Source/WebCore/inspector/InspectorProfilerAgent.h b/Source/WebCore/inspector/InspectorProfilerAgent.h
index 839d801..6c5cf4c 100644
--- a/Source/WebCore/inspector/InspectorProfilerAgent.h
+++ b/Source/WebCore/inspector/InspectorProfilerAgent.h
@@ -45,6 +45,7 @@ class InspectorArray;
 class InspectorConsoleAgent;
 class InspectorFrontend;
 class InspectorObject;
+class InspectorState;
 class InstrumentingAgents;
 class Page;
 class ScriptHeapSnapshot;
@@ -55,26 +56,35 @@ typedef String ErrorString;
 class InspectorProfilerAgent {
     WTF_MAKE_NONCOPYABLE(InspectorProfilerAgent); WTF_MAKE_FAST_ALLOCATED;
 public:
-    static PassOwnPtr<InspectorProfilerAgent> create(InstrumentingAgents*, InspectorConsoleAgent*, Page*);
+    static PassOwnPtr<InspectorProfilerAgent> create(InstrumentingAgents*, InspectorConsoleAgent*, Page*, InspectorState*);
     virtual ~InspectorProfilerAgent();
 
     void addProfile(PassRefPtr<ScriptProfile> prpProfile, unsigned lineNumber, const String& sourceURL);
     void addProfileFinishedMessageToConsole(PassRefPtr<ScriptProfile>, unsigned lineNumber, const String& sourceURL);
     void addStartProfilingMessageToConsole(const String& title, unsigned lineNumber, const String& sourceURL);
+    void collectGarbage(ErrorString*);
     void clearProfiles(ErrorString*) { resetState(); }
+    void resetState();
+
+    void enable(ErrorString*);
+    void disable(ErrorString*);
+    void isEnabled(ErrorString*, bool* result) { *result = enabled(); }
+    void start(ErrorString*) { startUserInitiatedProfiling(); }
+    void stop(ErrorString*) { stopUserInitiatedProfiling(); }
+
     void disable();
     void enable(bool skipRecompile);
     bool enabled() { return m_enabled; }
     String getCurrentUserInitiatedProfileName(bool incrementProfileNumber = false);
-    void getExactHeapSnapshotNodeRetainedSize(ErrorString*, unsigned long uid, unsigned long nodeId, long* size);
     void getProfileHeaders(ErrorString* error, RefPtr<InspectorArray>* headers);
     void getProfile(ErrorString* error, const String& type, unsigned uid, RefPtr<InspectorObject>* profileObject);
     bool isRecordingUserInitiatedProfile() { return m_recordingUserInitiatedProfile; }
     void removeProfile(ErrorString* error, const String& type, unsigned uid);
-    void resetState();
-    void resetFrontendProfiles();
-    void setFrontend(InspectorFrontend* frontend) { m_frontend = frontend->profiler(); }
-    void clearFrontend() { m_frontend = 0; }
+
+    void setFrontend(InspectorFrontend*);
+    void clearFrontend();
+    void restore();
+
     void startUserInitiatedProfiling();
     void stopUserInitiatedProfiling(bool ignoreProfile = false);
     void takeHeapSnapshot(ErrorString* error, bool detailed);
@@ -84,13 +94,17 @@ private:
     typedef HashMap<unsigned int, RefPtr<ScriptProfile> > ProfilesMap;
     typedef HashMap<unsigned int, RefPtr<ScriptHeapSnapshot> > HeapSnapshotsMap;
 
-    InspectorProfilerAgent(InstrumentingAgents*, InspectorConsoleAgent*, Page*);
+    void resetFrontendProfiles();
+    void restoreEnablement();
+
+    InspectorProfilerAgent(InstrumentingAgents*, InspectorConsoleAgent*, Page*, InspectorState*);
     PassRefPtr<InspectorObject> createProfileHeader(const ScriptProfile& profile);
     PassRefPtr<InspectorObject> createSnapshotHeader(const ScriptHeapSnapshot& snapshot);
 
     InstrumentingAgents* m_instrumentingAgents;
     InspectorConsoleAgent* m_consoleAgent;
     Page* m_inspectedPage;
+    InspectorState* m_inspectorState;
     InspectorFrontend::Profiler* m_frontend;
     bool m_enabled;
     bool m_recordingUserInitiatedProfile;
diff --git a/Source/WebCore/inspector/InspectorResourceAgent.cpp b/Source/WebCore/inspector/InspectorResourceAgent.cpp
index db41640..1e2c16d 100644
--- a/Source/WebCore/inspector/InspectorResourceAgent.cpp
+++ b/Source/WebCore/inspector/InspectorResourceAgent.cpp
@@ -62,9 +62,10 @@
 #include "WebSocketHandshakeResponse.h"
 
 #include <wtf/CurrentTime.h>
+#include <wtf/HexNumber.h>
 #include <wtf/ListHashSet.h>
 #include <wtf/RefPtr.h>
-#include <wtf/text/StringBuffer.h>
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
@@ -90,10 +91,12 @@ void InspectorResourceAgent::restore()
         enable();
 }
 
-bool InspectorResourceAgent::resourceContent(Frame* frame, const KURL& url, String* result)
+void InspectorResourceAgent::resourceContent(ErrorString* errorString, Frame* frame, const KURL& url, String* result)
 {
-    if (!frame)
-        return false;
+    if (!frame) {
+        *errorString = "No frame to get resource content for."; 
+        return;
+    }
 
     String textEncodingName;
     RefPtr<SharedBuffer> buffer = InspectorResourceAgent::resourceData(frame, url, &textEncodingName);
@@ -103,23 +106,22 @@ bool InspectorResourceAgent::resourceContent(Frame* frame, const KURL& url, Stri
         if (!encoding.isValid())
             encoding = WindowsLatin1Encoding();
         *result = encoding.decode(buffer->data(), buffer->size());
-        return true;
+        return;
     }
-
-    return false;
+    *errorString = "No resource with given URL found."; 
 }
 
-bool InspectorResourceAgent::resourceContentBase64(Frame* frame, const KURL& url, String* result)
+void InspectorResourceAgent::resourceContentBase64(ErrorString* errorString, Frame* frame, const KURL& url, String* result)
 {
     String textEncodingName;
     RefPtr<SharedBuffer> data = InspectorResourceAgent::resourceData(frame, url, &textEncodingName);
     if (!data) {
         *result = String();
-        return false;
+        *errorString = "No resource with given URL found."; 
+        return;
     }
 
     *result = base64Encode(data->data(), data->size());
-    return true;
 }
 
 PassRefPtr<SharedBuffer> InspectorResourceAgent::resourceData(Frame* frame, const KURL& url, String* textEncodingName)
@@ -193,69 +195,41 @@ static PassRefPtr<InspectorObject> buildObjectForResourceRequest(const ResourceR
 {
     RefPtr<InspectorObject> requestObject = InspectorObject::create();
     requestObject->setString("url", request.url().string());
-    requestObject->setString("httpMethod", request.httpMethod());
-    requestObject->setObject("httpHeaderFields", buildObjectForHeaders(request.httpHeaderFields()));
+    requestObject->setString("method", request.httpMethod());
+    requestObject->setObject("headers", buildObjectForHeaders(request.httpHeaderFields()));
     if (request.httpBody() && !request.httpBody()->isEmpty())
-        requestObject->setString("requestFormData", request.httpBody()->flattenToString());
+        requestObject->setString("postData", request.httpBody()->flattenToString());
     return requestObject;
 }
 
 static PassRefPtr<InspectorObject> buildObjectForResourceResponse(const ResourceResponse& response)
 {
     RefPtr<InspectorObject> responseObject = InspectorObject::create();
-    if (response.isNull()) {
-        responseObject->setBoolean("isNull", true);
+    if (response.isNull())
         return responseObject;
-    }
-    responseObject->setString("url", response.url().string());
+
+    responseObject->setNumber("status", response.resourceLoadInfo() ? response.resourceLoadInfo()->httpStatusCode : response.httpStatusCode());
+    responseObject->setString("statusText", response.resourceLoadInfo() ? response.resourceLoadInfo()->httpStatusText : response.httpStatusText());
+    responseObject->setObject("headers", buildObjectForHeaders(response.resourceLoadInfo() ? response.resourceLoadInfo()->responseHeaders : response.httpHeaderFields()));
+
     responseObject->setString("mimeType", response.mimeType());
-    responseObject->setNumber("expectedContentLength", response.expectedContentLength());
-    responseObject->setString("textEncodingName", response.textEncodingName());
-    responseObject->setString("suggestedFilename", response.suggestedFilename());
-    responseObject->setNumber("httpStatusCode", response.httpStatusCode());
-    responseObject->setString("httpStatusText", response.httpStatusText());
-    responseObject->setObject("httpHeaderFields", buildObjectForHeaders(response.httpHeaderFields()));
     responseObject->setBoolean("connectionReused", response.connectionReused());
     responseObject->setNumber("connectionID", response.connectionID());
-    responseObject->setBoolean("wasCached", response.wasCached());
+    responseObject->setBoolean("fromDiskCache", response.wasCached());
     if (response.resourceLoadTiming())
         responseObject->setObject("timing", buildObjectForTiming(*response.resourceLoadTiming()));
-    if (response.resourceLoadInfo()) {
-        RefPtr<InspectorObject> loadInfoObject = InspectorObject::create();
-        loadInfoObject->setNumber("httpStatusCode", response.resourceLoadInfo()->httpStatusCode);
-        loadInfoObject->setString("httpStatusText", response.resourceLoadInfo()->httpStatusText);
-        loadInfoObject->setObject("requestHeaders", buildObjectForHeaders(response.resourceLoadInfo()->requestHeaders));
-        loadInfoObject->setObject("responseHeaders", buildObjectForHeaders(response.resourceLoadInfo()->responseHeaders));
-        responseObject->setObject("loadInfo", loadInfoObject);
-    }
-    return responseObject;
-}
 
-static unsigned long frameId(Frame* frame)
-{
-    return reinterpret_cast<uintptr_t>(frame);
-}
+    if (response.resourceLoadInfo())
+        responseObject->setObject("requestHeaders", buildObjectForHeaders(response.resourceLoadInfo()->requestHeaders));
 
-static PassRefPtr<InspectorObject> buildObjectForDocumentLoader(DocumentLoader* loader)
-{
-    RefPtr<InspectorObject> documentLoaderObject = InspectorObject::create();
-    documentLoaderObject->setNumber("frameId", frameId(loader->frame()));
-    documentLoaderObject->setNumber("loaderId", reinterpret_cast<uintptr_t>(loader));
-    documentLoaderObject->setString("url", loader->requestURL().string());
-    return documentLoaderObject;
+    return responseObject;
 }
 
-static PassRefPtr<InspectorObject> buildObjectForFrameResource(Frame* frame)
+static String pointerAsId(void* pointer)
 {
-    FrameLoader* frameLoader = frame->loader();
-    DocumentLoader* loader = frameLoader->documentLoader();
-
-    RefPtr<InspectorObject> resourceObject = InspectorObject::create();
-    resourceObject->setString("url", loader->url().string());
-    resourceObject->setObject("loader", buildObjectForDocumentLoader(loader));
-    resourceObject->setObject("request", buildObjectForResourceRequest(loader->request()));
-    resourceObject->setObject("response", buildObjectForResourceResponse(loader->response()));
-    return resourceObject;
+    unsigned long long address = reinterpret_cast<uintptr_t>(pointer);
+    // We want 0 to be "", so that JavaScript checks for if (frameId) worked.
+    return String::format("%.0llX", address);
 }
 
 static String cachedResourceTypeString(const CachedResource& cachedResource)
@@ -279,56 +253,22 @@ static String cachedResourceTypeString(const CachedResource& cachedResource)
     return "Other";
 }
 
-static PassRefPtr<InspectorObject> buildObjectForCachedResource(DocumentLoader* loader, const CachedResource& cachedResource)
+static PassRefPtr<InspectorObject> buildObjectForCachedResource(const CachedResource& cachedResource)
 {
     RefPtr<InspectorObject> resourceObject = InspectorObject::create();
     resourceObject->setString("url", cachedResource.url());
     resourceObject->setString("type", cachedResourceTypeString(cachedResource));
-    resourceObject->setNumber("encodedSize", cachedResource.encodedSize());
+    resourceObject->setNumber("bodySize", cachedResource.encodedSize());
     resourceObject->setObject("response", buildObjectForResourceResponse(cachedResource.response()));
-    resourceObject->setObject("loader", buildObjectForDocumentLoader(loader));
     return resourceObject;
 }
 
-static void populateObjectWithFrameResources(Frame* frame, PassRefPtr<InspectorObject> frameResources)
-{
-    frameResources->setObject("resource", buildObjectForFrameResource(frame));
-    RefPtr<InspectorArray> subresources = InspectorArray::create();
-    frameResources->setArray("subresources", subresources);
-
-    const CachedResourceLoader::DocumentResourceMap& allResources = frame->document()->cachedResourceLoader()->allCachedResources();
-    CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
-    for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it) {
-        CachedResource* cachedResource = it->second.get();
-        RefPtr<InspectorObject> cachedResourceObject = buildObjectForCachedResource(frame->loader()->documentLoader(), *cachedResource);
-        subresources->pushValue(cachedResourceObject);
-    }
-}
-
 InspectorResourceAgent::~InspectorResourceAgent()
 {
     ASSERT(!m_instrumentingAgents->inspectorResourceAgent());
 }
 
-void InspectorResourceAgent::identifierForInitialRequest(unsigned long identifier, const KURL& url, DocumentLoader* loader)
-{
-    RefPtr<InspectorObject> loaderObject = buildObjectForDocumentLoader(loader);
-    RefPtr<ScriptCallStack> callStack = createScriptCallStack(ScriptCallStack::maxCallStackSizeToCapture, true);
-    RefPtr<InspectorValue> callStackValue;
-    if (callStack)
-        callStackValue = callStack->buildInspectorObject();
-    else
-        callStackValue = InspectorValue::null();
-    m_frontend->identifierForInitialRequest(identifier, url.string(), loaderObject, callStackValue);
-}
-
-void InspectorResourceAgent::setExtraHeaders(ErrorString*, PassRefPtr<InspectorObject> headers)
-{
-    m_state->setObject(ResourceAgentState::extraRequestHeaders, headers);
-}
-
-
-void InspectorResourceAgent::willSendRequest(unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+void InspectorResourceAgent::willSendRequest(unsigned long identifier, DocumentLoader* loader, ResourceRequest& request, const ResourceResponse& redirectResponse)
 {
     RefPtr<InspectorObject> headers = m_state->getObject(ResourceAgentState::extraRequestHeaders);
 
@@ -344,12 +284,18 @@ void InspectorResourceAgent::willSendRequest(unsigned long identifier, ResourceR
     request.setReportLoadTiming(true);
     request.setReportRawHeaders(true);
 
-    m_frontend->willSendRequest(identifier, currentTime(), buildObjectForResourceRequest(request), buildObjectForResourceResponse(redirectResponse));
+    RefPtr<ScriptCallStack> callStack = createScriptCallStack(ScriptCallStack::maxCallStackSizeToCapture, true);
+    RefPtr<InspectorArray> callStackValue;
+    if (callStack)
+        callStackValue = callStack->buildInspectorArray();
+    else
+        callStackValue = InspectorArray::create();
+    m_frontend->requestWillBeSent(static_cast<int>(identifier), pointerAsId(loader->frame()), pointerAsId(loader), loader->url().string(), buildObjectForResourceRequest(request), buildObjectForResourceResponse(redirectResponse), currentTime(), callStackValue);
 }
 
 void InspectorResourceAgent::markResourceAsCached(unsigned long identifier)
 {
-    m_frontend->markResourceAsCached(identifier);
+    m_frontend->resourceMarkedAsCached(static_cast<int>(identifier));
 }
 
 void InspectorResourceAgent::didReceiveResponse(unsigned long identifier, DocumentLoader* loader, const ResourceResponse& response)
@@ -372,16 +318,16 @@ void InspectorResourceAgent::didReceiveResponse(unsigned long identifier, Docume
         else if (equalIgnoringFragmentIdentifier(response.url(), loader->url()) && type == "Other")
             type = "Document";
     }
-    m_frontend->didReceiveResponse(identifier, currentTime(), type, resourceResponse);
+    m_frontend->responseReceived(static_cast<int>(identifier), currentTime(), type, resourceResponse);
     // If we revalidated the resource and got Not modified, send content length following didReceiveResponse
     // as there will be no calls to didReceiveContentLength from the network stack.
     if (cachedResourceSize && response.httpStatusCode() == 304)
-        didReceiveContentLength(identifier, cachedResourceSize);
+        didReceiveContentLength(identifier, cachedResourceSize, 0);
 }
 
-void InspectorResourceAgent::didReceiveContentLength(unsigned long identifier, int lengthReceived)
+void InspectorResourceAgent::didReceiveContentLength(unsigned long identifier, int dataLength, int lengthReceived)
 {
-    m_frontend->didReceiveContentLength(identifier, currentTime(), lengthReceived);
+    m_frontend->dataReceived(static_cast<int>(identifier), currentTime(), dataLength, lengthReceived);
 }
 
 void InspectorResourceAgent::didFinishLoading(unsigned long identifier, double finishTime)
@@ -389,29 +335,29 @@ void InspectorResourceAgent::didFinishLoading(unsigned long identifier, double f
     if (!finishTime)
         finishTime = currentTime();
 
-    m_frontend->didFinishLoading(identifier, finishTime);
+    m_frontend->loadingFinished(static_cast<int>(identifier), finishTime);
 }
 
 void InspectorResourceAgent::didFailLoading(unsigned long identifier, const ResourceError& error)
 {
-    m_frontend->didFailLoading(identifier, currentTime(), error.localizedDescription());
+    m_frontend->loadingFailed(static_cast<int>(identifier), currentTime(), error.localizedDescription());
 }
 
 void InspectorResourceAgent::didLoadResourceFromMemoryCache(DocumentLoader* loader, const CachedResource* resource)
 {
-    m_frontend->didLoadResourceFromMemoryCache(currentTime(), buildObjectForCachedResource(loader, *resource));
+    m_frontend->resourceLoadedFromMemoryCache(pointerAsId(loader->frame()), pointerAsId(loader), loader->url().string(), currentTime(), buildObjectForCachedResource(*resource));
 }
 
 void InspectorResourceAgent::setInitialContent(unsigned long identifier, const String& sourceString, const String& type)
 {
-    m_frontend->setInitialContent(identifier, sourceString, type);
+    m_frontend->initialContentSet(static_cast<int>(identifier), sourceString, type);
 }
 
 static PassRefPtr<InspectorObject> buildObjectForFrame(Frame* frame)
 {
     RefPtr<InspectorObject> frameObject = InspectorObject::create();
-    frameObject->setNumber("id", frameId(frame));
-    frameObject->setNumber("parentId", frameId(frame->tree()->parent()));
+    frameObject->setString("id", pointerAsId(frame));
+    frameObject->setString("parentId", pointerAsId(frame->tree()->parent()));
     if (frame->ownerElement()) {
         String name = frame->ownerElement()->getAttribute(HTMLNames::nameAttr);
         if (name.isEmpty())
@@ -419,34 +365,48 @@ static PassRefPtr<InspectorObject> buildObjectForFrame(Frame* frame)
         frameObject->setString("name", name);
     }
     frameObject->setString("url", frame->document()->url().string());
+    frameObject->setString("loaderId", pointerAsId(frame->loader()->documentLoader()));
+
     return frameObject;
 }
 
-static PassRefPtr<InspectorObject> buildObjectForFrameTree(Frame* frame, bool dumpResources)
+static PassRefPtr<InspectorObject> buildObjectForFrameTree(Frame* frame)
 {
+    RefPtr<InspectorObject> result = InspectorObject::create();
     RefPtr<InspectorObject> frameObject = buildObjectForFrame(frame);
+    result->setObject("frame", frameObject);
+
+    RefPtr<InspectorArray> subresources = InspectorArray::create();
+    result->setArray("resources", subresources);
+    const CachedResourceLoader::DocumentResourceMap& allResources = frame->document()->cachedResourceLoader()->allCachedResources();
+    CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
+    for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it) {
+        CachedResource* cachedResource = it->second.get();
+        RefPtr<InspectorObject> resourceObject = InspectorObject::create();
+        resourceObject->setString("url", cachedResource->url());
+        resourceObject->setString("type", cachedResourceTypeString(*cachedResource));
+        subresources->pushValue(resourceObject);
+    }
 
-    if (dumpResources)
-        populateObjectWithFrameResources(frame, frameObject);
     RefPtr<InspectorArray> childrenArray;
     for (Frame* child = frame->tree()->firstChild(); child; child = child->tree()->nextSibling()) {
         if (!childrenArray) {
             childrenArray = InspectorArray::create();
-            frameObject->setArray("children", childrenArray);
+            result->setArray("childFrames", childrenArray);
         }
-        childrenArray->pushObject(buildObjectForFrameTree(child, dumpResources));
+        childrenArray->pushObject(buildObjectForFrameTree(child));
     }
-    return frameObject;
+    return result;
 }
 
 void InspectorResourceAgent::didCommitLoad(DocumentLoader* loader)
 {
-    m_frontend->didCommitLoadForFrame(buildObjectForFrame(loader->frame()), buildObjectForDocumentLoader(loader));
+    m_frontend->frameNavigated(buildObjectForFrame(loader->frame()), pointerAsId(loader));
 }
 
 void InspectorResourceAgent::frameDetachedFromParent(Frame* frame)
 {
-    m_frontend->frameDetachedFromParent(frameId(frame));
+    m_frontend->frameDetached(pointerAsId(frame));
 }
 
 #if ENABLE(WEB_SOCKETS)
@@ -456,63 +416,58 @@ void InspectorResourceAgent::frameDetachedFromParent(Frame* frame)
 static String createReadableStringFromBinary(const unsigned char* value, size_t length)
 {
     ASSERT(length > 0);
-    static const char hexDigits[17] = "0123456789ABCDEF";
-    size_t bufferSize = length * 3 - 1;
-    StringBuffer buffer(bufferSize);
-    size_t index = 0;
+    StringBuilder builder;
+    builder.reserveCapacity(length * 3 - 1);
     for (size_t i = 0; i < length; ++i) {
         if (i > 0)
-            buffer[index++] = ':';
-        buffer[index++] = hexDigits[value[i] >> 4];
-        buffer[index++] = hexDigits[value[i] & 0xF];
+            builder.append(':');
+        appendByteAsHex(value[i], builder);
     }
-    ASSERT(index == bufferSize);
-    return String::adopt(buffer);
+    return builder.toString();
 }
 
 void InspectorResourceAgent::didCreateWebSocket(unsigned long identifier, const KURL& requestURL)
 {
-    m_frontend->didCreateWebSocket(identifier, requestURL.string());
+    m_frontend->webSocketCreated(static_cast<int>(identifier), requestURL.string());
 }
 
 void InspectorResourceAgent::willSendWebSocketHandshakeRequest(unsigned long identifier, const WebSocketHandshakeRequest& request)
 {
     RefPtr<InspectorObject> requestObject = InspectorObject::create();
-    requestObject->setObject("webSocketHeaderFields", buildObjectForHeaders(request.headerFields()));
-    requestObject->setString("webSocketRequestKey3", createReadableStringFromBinary(request.key3().value, sizeof(request.key3().value)));
-    m_frontend->willSendWebSocketHandshakeRequest(identifier, currentTime(), requestObject);
+    requestObject->setObject("headers", buildObjectForHeaders(request.headerFields()));
+    requestObject->setString("requestKey3", createReadableStringFromBinary(request.key3().value, sizeof(request.key3().value)));
+    m_frontend->webSocketWillSendHandshakeRequest(static_cast<int>(identifier), currentTime(), requestObject);
 }
 
 void InspectorResourceAgent::didReceiveWebSocketHandshakeResponse(unsigned long identifier, const WebSocketHandshakeResponse& response)
 {
     RefPtr<InspectorObject> responseObject = InspectorObject::create();
-    responseObject->setNumber("statusCode", response.statusCode());
+    responseObject->setNumber("status", response.statusCode());
     responseObject->setString("statusText", response.statusText());
-    responseObject->setObject("webSocketHeaderFields", buildObjectForHeaders(response.headerFields()));
-    responseObject->setString("webSocketChallengeResponse", createReadableStringFromBinary(response.challengeResponse().value, sizeof(response.challengeResponse().value)));
-    m_frontend->didReceiveWebSocketHandshakeResponse(identifier, currentTime(), responseObject);
+    responseObject->setObject("headers", buildObjectForHeaders(response.headerFields()));
+    responseObject->setString("challengeResponse", createReadableStringFromBinary(response.challengeResponse().value, sizeof(response.challengeResponse().value)));
+    m_frontend->webSocketHandshakeResponseReceived(static_cast<int>(identifier), currentTime(), responseObject);
 }
 
 void InspectorResourceAgent::didCloseWebSocket(unsigned long identifier)
 {
-    m_frontend->didCloseWebSocket(identifier, currentTime());
+    m_frontend->webSocketClosed(static_cast<int>(identifier), currentTime());
 }
 #endif // ENABLE(WEB_SOCKETS)
 
-Frame* InspectorResourceAgent::frameForId(unsigned long frameId)
+Frame* InspectorResourceAgent::frameForId(const String& frameId)
 {
     Frame* mainFrame = m_page->mainFrame();
     for (Frame* frame = mainFrame; frame; frame = frame->tree()->traverseNext(mainFrame)) {
-        if (reinterpret_cast<uintptr_t>(frame) == frameId)
+        if (pointerAsId(frame) == frameId)
             return frame;
     }
     return 0;
 }
 
-void InspectorResourceAgent::enable(ErrorString*, RefPtr<InspectorObject>* object)
+void InspectorResourceAgent::enable(ErrorString*)
 {
     enable();
-    *object = buildObjectForFrameTree(m_page->mainFrame(), true);
 }
 
 void InspectorResourceAgent::enable()
@@ -529,17 +484,27 @@ void InspectorResourceAgent::disable(ErrorString*)
     m_instrumentingAgents->setInspectorResourceAgent(0);
 }
 
-void InspectorResourceAgent::resourceContent(ErrorString*, unsigned long frameId, const String& url, bool base64Encode, bool* success, String* content)
+void InspectorResourceAgent::getCachedResources(ErrorString*, RefPtr<InspectorObject>* object)
+{
+    *object = buildObjectForFrameTree(m_page->mainFrame());
+}
+
+void InspectorResourceAgent::getResourceContent(ErrorString* errorString, const String& frameId, const String& url, bool base64Encode, String* content)
 {
     Frame* frame = frameForId(frameId);
     if (!frame) {
-        *success = false;
+        *errorString = "No frame for given id found.";
         return;
     }
     if (base64Encode)
-        *success = InspectorResourceAgent::resourceContentBase64(frame, KURL(ParsedURLString, url), content);
+        InspectorResourceAgent::resourceContentBase64(errorString, frame, KURL(ParsedURLString, url), content);
     else
-        *success = InspectorResourceAgent::resourceContent(frame, KURL(ParsedURLString, url), content);
+        InspectorResourceAgent::resourceContent(errorString, frame, KURL(ParsedURLString, url), content);
+}
+
+void InspectorResourceAgent::setExtraHeaders(ErrorString*, PassRefPtr<InspectorObject> headers)
+{
+    m_state->setObject(ResourceAgentState::extraRequestHeaders, headers);
 }
 
 InspectorResourceAgent::InspectorResourceAgent(InstrumentingAgents* instrumentingAgents, Page* page, InspectorState* state)
diff --git a/Source/WebCore/inspector/InspectorResourceAgent.h b/Source/WebCore/inspector/InspectorResourceAgent.h
index f1b3d46..c919469 100644
--- a/Source/WebCore/inspector/InspectorResourceAgent.h
+++ b/Source/WebCore/inspector/InspectorResourceAgent.h
@@ -81,18 +81,17 @@ public:
 
     static PassRefPtr<InspectorResourceAgent> restore(Page*, InspectorState*, InspectorFrontend*);
 
-    static bool resourceContent(Frame*, const KURL&, String* result);
-    static bool resourceContentBase64(Frame*, const KURL&, String* result);
+    static void resourceContent(ErrorString*, Frame*, const KURL&, String* result);
+    static void resourceContentBase64(ErrorString*, Frame*, const KURL&, String* result);
     static PassRefPtr<SharedBuffer> resourceData(Frame*, const KURL&, String* textEncodingName);
     static CachedResource* cachedResource(Frame*, const KURL&);
 
     ~InspectorResourceAgent();
 
-    void identifierForInitialRequest(unsigned long identifier, const KURL&, DocumentLoader*);
-    void willSendRequest(unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
+    void willSendRequest(unsigned long identifier, DocumentLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
     void markResourceAsCached(unsigned long identifier);
     void didReceiveResponse(unsigned long identifier, DocumentLoader* laoder, const ResourceResponse&);
-    void didReceiveContentLength(unsigned long identifier, int lengthReceived);
+    void didReceiveContentLength(unsigned long identifier, int dataLength, int lengthReceived);
     void didFinishLoading(unsigned long identifier, double finishTime);
     void didFailLoading(unsigned long identifier, const ResourceError&);
     void didLoadResourceFromMemoryCache(DocumentLoader*, const CachedResource*);
@@ -107,12 +106,13 @@ public:
     void didCloseWebSocket(unsigned long identifier);
 #endif
 
-    Frame* frameForId(unsigned long);
+    Frame* frameForId(const String& frameId);
 
     // Called from frontend 
-    void enable(ErrorString*, RefPtr<InspectorObject>*);
+    void enable(ErrorString*);
     void disable(ErrorString*);
-    void resourceContent(ErrorString*, unsigned long frameId, const String& url, bool base64Encode, bool* resourceFound, String* content);
+    void getCachedResources(ErrorString*, RefPtr<InspectorObject>*);
+    void getResourceContent(ErrorString*, const String& frameId, const String& url, bool base64Encode, String* content);
     void setExtraHeaders(ErrorString*, PassRefPtr<InspectorObject>);
 
 private:
diff --git a/Source/WebCore/inspector/InspectorRuntimeAgent.cpp b/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
index badd8e1..04fed9d 100644
--- a/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
+++ b/Source/WebCore/inspector/InspectorRuntimeAgent.cpp
@@ -33,56 +33,71 @@
 
 #if ENABLE(INSPECTOR)
 
-#include "InjectedScriptHost.h"
+#include "InjectedScript.h"
+#include "InjectedScriptManager.h"
 #include "InspectorValues.h"
+#include "Page.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
-InspectorRuntimeAgent::InspectorRuntimeAgent(InjectedScriptHost* injectedScriptHost)
-    : m_injectedScriptHost(injectedScriptHost)
+PassOwnPtr<InspectorRuntimeAgent> InspectorRuntimeAgent::create(InjectedScriptManager* injectedScriptManager, Page* inspectedPage)
 {
+    return adoptPtr(new InspectorRuntimeAgent(injectedScriptManager, inspectedPage));
 }
 
-InspectorRuntimeAgent::~InspectorRuntimeAgent() { }
+InspectorRuntimeAgent::InspectorRuntimeAgent(InjectedScriptManager* injectedScriptManager, Page* inspectedPage)
+    : m_injectedScriptManager(injectedScriptManager)
+    , m_inspectedPage(inspectedPage)
+{
+}
+
+InspectorRuntimeAgent::~InspectorRuntimeAgent()
+{
+}
 
-void InspectorRuntimeAgent::evaluate(ErrorString*, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result)
+void InspectorRuntimeAgent::evaluate(ErrorString* errorString, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result)
 {
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptForMainFrame();
+    ScriptState* scriptState = mainWorldScriptState(m_inspectedPage->mainFrame());
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptFor(scriptState);
     if (!injectedScript.hasNoValue())
-        injectedScript.evaluate(expression, objectGroup, includeCommandLineAPI, result);
+        injectedScript.evaluate(errorString, expression, objectGroup, includeCommandLineAPI, result);
 }
 
-void InspectorRuntimeAgent::evaluateOn(ErrorString*, PassRefPtr<InspectorObject> objectId, const String& expression, RefPtr<InspectorValue>* result)
+void InspectorRuntimeAgent::evaluateOn(ErrorString* errorString, const String& objectId, const String& expression, RefPtr<InspectorObject>* result)
 {
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptForObjectId(objectId.get());
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(objectId);
     if (!injectedScript.hasNoValue())
-        injectedScript.evaluateOn(objectId, expression, result);
+        injectedScript.evaluateOn(errorString, objectId, expression, result);
 }
 
-void InspectorRuntimeAgent::getProperties(ErrorString*, PassRefPtr<InspectorObject> objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorValue>* result)
+void InspectorRuntimeAgent::getProperties(ErrorString* errorString, const String& objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorArray>* result)
 {
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptForObjectId(objectId.get());
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(objectId);
     if (!injectedScript.hasNoValue())
-        injectedScript.getProperties(objectId, ignoreHasOwnProperty, abbreviate, result);
+        injectedScript.getProperties(errorString, objectId, ignoreHasOwnProperty, abbreviate, result);
 }
 
-void InspectorRuntimeAgent::setPropertyValue(ErrorString*, PassRefPtr<InspectorObject> objectId, const String& propertyName, const String& expression, RefPtr<InspectorValue>* result)
+void InspectorRuntimeAgent::setPropertyValue(ErrorString* errorString, const String& objectId, const String& propertyName, const String& expression)
 {
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptForObjectId(objectId.get());
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(objectId);
     if (!injectedScript.hasNoValue())
-        injectedScript.setPropertyValue(objectId, propertyName, expression, result);
+        injectedScript.setPropertyValue(errorString, objectId, propertyName, expression);
+    else
+        *errorString = "No injected script found.";
 }
 
-void InspectorRuntimeAgent::releaseObject(ErrorString*, PassRefPtr<InspectorObject> objectId)
+void InspectorRuntimeAgent::releaseObject(ErrorString*, const String& objectId)
 {
-    InjectedScript injectedScript = m_injectedScriptHost->injectedScriptForObjectId(objectId.get());
+    InjectedScript injectedScript = m_injectedScriptManager->injectedScriptForObjectId(objectId);
     if (!injectedScript.hasNoValue())
         injectedScript.releaseObject(objectId);
 }
 
-void InspectorRuntimeAgent::releaseObjectGroup(ErrorString*, long injectedScriptId, const String& objectGroup)
+void InspectorRuntimeAgent::releaseObjectGroup(ErrorString*, const String& objectGroup)
 {
-    m_injectedScriptHost->releaseObjectGroup(injectedScriptId, objectGroup);
+    m_injectedScriptManager->releaseObjectGroup(objectGroup);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorRuntimeAgent.h b/Source/WebCore/inspector/InspectorRuntimeAgent.h
index 4274eea..48f3670 100644
--- a/Source/WebCore/inspector/InspectorRuntimeAgent.h
+++ b/Source/WebCore/inspector/InspectorRuntimeAgent.h
@@ -33,43 +33,38 @@
 
 #if ENABLE(INSPECTOR)
 
-#include "InjectedScript.h"
-#include "PlatformString.h"
-
+#include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
-#include <wtf/PassOwnPtr.h>
-#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
-class InjectedScriptHost;
+class InjectedScriptManager;
+class InspectorArray;
 class InspectorObject;
 class InspectorValue;
+class Page;
 
 typedef String ErrorString;
 
 class InspectorRuntimeAgent {
     WTF_MAKE_NONCOPYABLE(InspectorRuntimeAgent);
 public:
-    static PassOwnPtr<InspectorRuntimeAgent> create(InjectedScriptHost* injectedScriptHost)
-    {
-        return adoptPtr(new InspectorRuntimeAgent(injectedScriptHost));
-    }
-
+    static PassOwnPtr<InspectorRuntimeAgent> create(InjectedScriptManager*, Page*);
     ~InspectorRuntimeAgent();
 
     // Part of the protocol.
-    void evaluate(ErrorString*, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorValue>* result);
-    void evaluateOn(ErrorString*, PassRefPtr<InspectorObject> objectId, const String& expression, RefPtr<InspectorValue>* result);
-    void releaseObject(ErrorString*, PassRefPtr<InspectorObject> objectId);
-    void getProperties(ErrorString*, PassRefPtr<InspectorObject> objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorValue>* result);
-    void setPropertyValue(ErrorString*, PassRefPtr<InspectorObject> objectId, const String& propertyName, const String& expression, RefPtr<InspectorValue>* result);
-    void releaseObjectGroup(ErrorString*, long injectedScriptId, const String& objectGroup);
+    void evaluate(ErrorString*, const String& expression, const String& objectGroup, bool includeCommandLineAPI, RefPtr<InspectorObject>* result);
+    void evaluateOn(ErrorString*, const String& objectId, const String& expression, RefPtr<InspectorObject>* result);
+    void releaseObject(ErrorString*, const String& objectId);
+    void getProperties(ErrorString*, const String& objectId, bool ignoreHasOwnProperty, bool abbreviate, RefPtr<InspectorArray>* result);
+    void setPropertyValue(ErrorString*, const String& objectId, const String& propertyName, const String& expression);
+    void releaseObjectGroup(ErrorString*, const String& objectGroup);
 
 private:
-    InspectorRuntimeAgent(InjectedScriptHost*);
+    InspectorRuntimeAgent(InjectedScriptManager*, Page*);
 
-    InjectedScriptHost* m_injectedScriptHost;
+    InjectedScriptManager* m_injectedScriptManager;
+    Page* m_inspectedPage;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorStyleSheet.cpp b/Source/WebCore/inspector/InspectorStyleSheet.cpp
index 45e6e43..342cf54 100644
--- a/Source/WebCore/inspector/InspectorStyleSheet.cpp
+++ b/Source/WebCore/inspector/InspectorStyleSheet.cpp
@@ -450,13 +450,19 @@ void InspectorStyle::populateObjectWithStyleProperties(InspectorObject* result)
 
         RefPtr<InspectorObject> property = InspectorObject::create();
         propertiesObject->pushObject(property);
-        property->setString("status", it->disabled ? "disabled" : "active");
-        property->setBoolean("parsedOk", propertyEntry.parsedOk);
+        String status = it->disabled ? "disabled" : "active";
+
+        // Default "parsedOk" == true.
+        if (!propertyEntry.parsedOk)
+            property->setBoolean("parsedOk", false);
         if (it->hasRawText())
             property->setString("text", it->rawText);
         property->setString("name", name);
         property->setString("value", propertyEntry.value);
-        property->setString("priority", propertyEntry.important ? "important" : "");
+
+        // Default "priority" == "".
+        if (propertyEntry.important)
+            property->setString("priority", "important");
         if (!it->disabled) {
             if (it->hasSource) {
                 property->setBoolean("implicit", false);
@@ -481,25 +487,35 @@ void InspectorStyle::populateObjectWithStyleProperties(InspectorObject* result)
 
                 if (shouldInactivate) {
                     activeIt->second->setString("status", "inactive");
-                    activeIt->second->setString("shorthandName", "");
+                    activeIt->second->remove("shorthandName");
                     propertyNameToPreviousActiveProperty.set(name, property);
                 }
             } else {
-                property->setBoolean("implicit", m_style->isPropertyImplicit(name));
-                property->setString("status", "style");
+                bool implicit = m_style->isPropertyImplicit(name);
+                // Default "implicit" == false.
+                if (implicit)
+                    property->setBoolean("implicit", true);
+                status = "";
             }
         }
 
+        // Default "status" == "style".
+        if (!status.isEmpty())
+            property->setString("status", status);
+
         if (propertyEntry.parsedOk) {
             // Both for style-originated and parsed source properties.
             String shorthand = m_style->getPropertyShorthand(name);
-            property->setString("shorthandName", shorthand);
-            if (!shorthand.isEmpty() && !foundShorthands.contains(shorthand)) {
-                foundShorthands.add(shorthand);
-                shorthandValues->setString(shorthand, shorthandValue(shorthand));
+            if (!shorthand.isEmpty()) {
+                // Default "shorthandName" == "".
+                property->setString("shorthandName", shorthand);
+                if (!foundShorthands.contains(shorthand)) {
+                    foundShorthands.add(shorthand);
+                    shorthandValues->setString(shorthand, shorthandValue(shorthand));
+                }
             }
-        } else
-            property->setString("shorthandName", "");
+        }
+        // else shorthandName is not set
     }
 
     result->setArray("cssProperties", propertiesObject);
@@ -692,9 +708,7 @@ PassRefPtr<InspectorObject> InspectorStyleSheet::buildObjectForStyleSheet()
         return 0;
 
     RefPtr<InspectorObject> result = InspectorObject::create();
-    result->setBoolean("disabled", styleSheet->disabled());
-    result->setString("sourceURL", finalURL());
-    result->setString("title", styleSheet->title());
+    result->setString("styleSheetId", id());
     RefPtr<CSSRuleList> cssRuleList = CSSRuleList::create(styleSheet, true);
     RefPtr<InspectorArray> cssRules = buildArrayForRuleList(cssRuleList.get());
     result->setArray("rules", cssRules.release());
@@ -704,8 +718,20 @@ PassRefPtr<InspectorObject> InspectorStyleSheet::buildObjectForStyleSheet()
     if (success)
         result->setString("text", styleSheetText);
 
-    result->setString("styleSheetId", id());
+    return result.release();
+}
+
+PassRefPtr<InspectorObject> InspectorStyleSheet::buildObjectForStyleSheetInfo()
+{
+    CSSStyleSheet* styleSheet = pageStyleSheet();
+    if (!styleSheet)
+        return 0;
 
+    RefPtr<InspectorObject> result = InspectorObject::create();
+    result->setString("styleSheetId", id());
+    result->setBoolean("disabled", styleSheet->disabled());
+    result->setString("sourceURL", finalURL());
+    result->setString("title", styleSheet->title());
     return result.release();
 }
 
@@ -1017,7 +1043,9 @@ bool InspectorStyleSheet::resourceStyleSheetText(String* result) const
     if (!m_pageStyleSheet || !ownerDocument())
         return false;
 
-    return InspectorResourceAgent::resourceContent(ownerDocument()->frame(), m_pageStyleSheet->finalURL(), result);
+    String error;
+    InspectorResourceAgent::resourceContent(&error, ownerDocument()->frame(), m_pageStyleSheet->finalURL(), result);
+    return error.isEmpty();
 }
 
 bool InspectorStyleSheet::inlineStyleSheetText(String* result) const
diff --git a/Source/WebCore/inspector/InspectorStyleSheet.h b/Source/WebCore/inspector/InspectorStyleSheet.h
index 92318cb..3048b1b 100644
--- a/Source/WebCore/inspector/InspectorStyleSheet.h
+++ b/Source/WebCore/inspector/InspectorStyleSheet.h
@@ -168,6 +168,7 @@ public:
     CSSStyleRule* addRule(const String& selector);
     CSSStyleRule* ruleForId(const InspectorCSSId&) const;
     PassRefPtr<InspectorObject> buildObjectForStyleSheet();
+    PassRefPtr<InspectorObject> buildObjectForStyleSheetInfo();
     PassRefPtr<InspectorObject> buildObjectForRule(CSSStyleRule*);
     PassRefPtr<InspectorObject> buildObjectForStyle(CSSStyleDeclaration*);
     bool setPropertyText(const InspectorCSSId&, unsigned propertyIndex, const String& text, bool overwrite);
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.cpp b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
index d45a507..2faad67 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.cpp
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -50,6 +50,36 @@ namespace TimelineAgentState {
 static const char timelineAgentEnabled[] = "timelineAgentEnabled";
 }
 
+namespace TimelineRecordType {
+static const char EventDispatch[] = "EventDispatch";
+static const char Layout[] = "Layout";
+static const char RecalculateStyles[] = "RecalculateStyles";
+static const char Paint[] = "Paint";
+static const char ParseHTML[] = "ParseHTML";
+
+static const char TimerInstall[] = "TimerInstall";
+static const char TimerRemove[] = "TimerRemove";
+static const char TimerFire[] = "TimerFire";
+
+static const char EvaluateScript[] = "EvaluateScript";
+
+static const char MarkLoad[] = "MarkLoad";
+static const char MarkDOMContent[] = "MarkDOMContent";
+static const char MarkTimeline[] = "MarkTimeline";
+
+static const char ScheduleResourceRequest[] = "ScheduleResourceRequest";
+static const char ResourceSendRequest[] = "ResourceSendRequest";
+static const char ResourceReceiveResponse[] = "ResourceReceiveResponse";
+static const char ResourceReceivedData[] = "ResourceReceivedData";
+static const char ResourceFinish[] = "ResourceFinish";
+
+static const char XHRReadyStateChange[] = "XHRReadyStateChange";
+static const char XHRLoad[] = "XHRLoad";
+
+static const char FunctionCall[] = "FunctionCall";
+static const char GCEvent[] = "GCEvent";
+}
+
 void InspectorTimelineAgent::pushGCEventRecords()
 {
     if (!m_gcEvents.size())
@@ -61,7 +91,7 @@ void InspectorTimelineAgent::pushGCEventRecords()
         RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(i->startTime);
         record->setObject("data", TimelineRecordFactory::createGCEventData(i->collectedBytes));
         record->setNumber("endTime", i->endTime);
-        addRecordToTimeline(record.release(), GCEventTimelineRecordType);
+        addRecordToTimeline(record.release(), TimelineRecordType::GCEvent);
     }
 }
 
@@ -101,7 +131,7 @@ void InspectorTimelineAgent::start(ErrorString*)
         return;
     m_instrumentingAgents->setInspectorTimelineAgent(this);
     ScriptGCEvent::addEventListener(this);
-    m_frontend->timelineProfilerWasStarted();
+    m_frontend->started();
     m_state->setBoolean(TimelineAgentState::timelineAgentEnabled, true);
 }
 
@@ -111,7 +141,7 @@ void InspectorTimelineAgent::stop(ErrorString*)
         return;
     m_instrumentingAgents->setInspectorTimelineAgent(0);
     if (m_frontend)
-        m_frontend->timelineProfilerWasStopped();
+        m_frontend->stopped();
     ScriptGCEvent::removeEventListener(this);
 
     clearRecordStack();
@@ -127,58 +157,58 @@ bool InspectorTimelineAgent::started() const
 
 void InspectorTimelineAgent::willCallFunction(const String& scriptName, int scriptLine)
 {
-    pushCurrentRecord(TimelineRecordFactory::createFunctionCallData(scriptName, scriptLine), FunctionCallTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createFunctionCallData(scriptName, scriptLine), TimelineRecordType::FunctionCall);
 }
 
 void InspectorTimelineAgent::didCallFunction()
 {
-    didCompleteCurrentRecord(FunctionCallTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::FunctionCall);
 }
 
 void InspectorTimelineAgent::willDispatchEvent(const Event& event)
 {
     pushCurrentRecord(TimelineRecordFactory::createEventDispatchData(event),
-        EventDispatchTimelineRecordType);
+        TimelineRecordType::EventDispatch);
 }
 
 void InspectorTimelineAgent::didDispatchEvent()
 {
-    didCompleteCurrentRecord(EventDispatchTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::EventDispatch);
 }
 
 void InspectorTimelineAgent::willLayout()
 {
-    pushCurrentRecord(InspectorObject::create(), LayoutTimelineRecordType);
+    pushCurrentRecord(InspectorObject::create(), TimelineRecordType::Layout);
 }
 
 void InspectorTimelineAgent::didLayout()
 {
-    didCompleteCurrentRecord(LayoutTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::Layout);
 }
 
 void InspectorTimelineAgent::willRecalculateStyle()
 {
-    pushCurrentRecord(InspectorObject::create(), RecalculateStylesTimelineRecordType);
+    pushCurrentRecord(InspectorObject::create(), TimelineRecordType::RecalculateStyles);
 }
 
 void InspectorTimelineAgent::didRecalculateStyle()
 {
-    didCompleteCurrentRecord(RecalculateStylesTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::RecalculateStyles);
 }
 
 void InspectorTimelineAgent::willPaint(const IntRect& rect)
 {
-    pushCurrentRecord(TimelineRecordFactory::createPaintData(rect), PaintTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createPaintData(rect), TimelineRecordType::Paint);
 }
 
 void InspectorTimelineAgent::didPaint()
 {
-    didCompleteCurrentRecord(PaintTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::Paint);
 }
 
 void InspectorTimelineAgent::willWriteHTML(unsigned int length, unsigned int startLine)
 {
-    pushCurrentRecord(TimelineRecordFactory::createParseHTMLData(length, startLine), ParseHTMLTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createParseHTMLData(length, startLine), TimelineRecordType::ParseHTML);
 }
 
 void InspectorTimelineAgent::didWriteHTML(unsigned int endLine)
@@ -186,7 +216,7 @@ void InspectorTimelineAgent::didWriteHTML(unsigned int endLine)
     if (!m_recordStack.isEmpty()) {
         TimelineRecordEntry entry = m_recordStack.last();
         entry.data->setNumber("endLine", endLine);
-        didCompleteCurrentRecord(ParseHTMLTimelineRecordType);
+        didCompleteCurrentRecord(TimelineRecordType::ParseHTML);
     }
 }
 
@@ -195,7 +225,7 @@ void InspectorTimelineAgent::didInstallTimer(int timerId, int timeout, bool sing
     pushGCEventRecords();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
     record->setObject("data", TimelineRecordFactory::createTimerInstallData(timerId, timeout, singleShot));
-    addRecordToTimeline(record.release(), TimerInstallTimelineRecordType);
+    addRecordToTimeline(record.release(), TimelineRecordType::TimerInstall);
 }
 
 void InspectorTimelineAgent::didRemoveTimer(int timerId)
@@ -203,47 +233,47 @@ void InspectorTimelineAgent::didRemoveTimer(int timerId)
     pushGCEventRecords();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
     record->setObject("data", TimelineRecordFactory::createGenericTimerData(timerId));
-    addRecordToTimeline(record.release(), TimerRemoveTimelineRecordType);
+    addRecordToTimeline(record.release(), TimelineRecordType::TimerRemove);
 }
 
 void InspectorTimelineAgent::willFireTimer(int timerId)
 {
-    pushCurrentRecord(TimelineRecordFactory::createGenericTimerData(timerId), TimerFireTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createGenericTimerData(timerId), TimelineRecordType::TimerFire);
 }
 
 void InspectorTimelineAgent::didFireTimer()
 {
-    didCompleteCurrentRecord(TimerFireTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::TimerFire);
 }
 
 void InspectorTimelineAgent::willChangeXHRReadyState(const String& url, int readyState)
 {
-    pushCurrentRecord(TimelineRecordFactory::createXHRReadyStateChangeData(url, readyState), XHRReadyStateChangeRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createXHRReadyStateChangeData(url, readyState), TimelineRecordType::XHRReadyStateChange);
 }
 
 void InspectorTimelineAgent::didChangeXHRReadyState()
 {
-    didCompleteCurrentRecord(XHRReadyStateChangeRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::XHRReadyStateChange);
 }
 
 void InspectorTimelineAgent::willLoadXHR(const String& url) 
 {
-    pushCurrentRecord(TimelineRecordFactory::createXHRLoadData(url), XHRLoadRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createXHRLoadData(url), TimelineRecordType::XHRLoad);
 }
 
 void InspectorTimelineAgent::didLoadXHR()
 {
-    didCompleteCurrentRecord(XHRLoadRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::XHRLoad);
 }
 
 void InspectorTimelineAgent::willEvaluateScript(const String& url, int lineNumber)
 {
-    pushCurrentRecord(TimelineRecordFactory::createEvaluateScriptData(url, lineNumber), EvaluateScriptTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createEvaluateScriptData(url, lineNumber), TimelineRecordType::EvaluateScript);
 }
     
 void InspectorTimelineAgent::didEvaluateScript()
 {
-    didCompleteCurrentRecord(EvaluateScriptTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::EvaluateScript);
 }
 
 void InspectorTimelineAgent::didScheduleResourceRequest(const String& url)
@@ -251,8 +281,8 @@ void InspectorTimelineAgent::didScheduleResourceRequest(const String& url)
     pushGCEventRecords();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
     record->setObject("data", TimelineRecordFactory::createScheduleResourceRequestData(url));
-    record->setNumber("type", ScheduleResourceRequestTimelineRecordType);
-    addRecordToTimeline(record.release(), ScheduleResourceRequestTimelineRecordType);
+    record->setString("type", TimelineRecordType::ScheduleResourceRequest);
+    addRecordToTimeline(record.release(), TimelineRecordType::ScheduleResourceRequest);
 }
 
 void InspectorTimelineAgent::willSendResourceRequest(unsigned long identifier, const ResourceRequest& request)
@@ -260,29 +290,29 @@ void InspectorTimelineAgent::willSendResourceRequest(unsigned long identifier, c
     pushGCEventRecords();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
     record->setObject("data", TimelineRecordFactory::createResourceSendRequestData(identifier, request));
-    record->setNumber("type", ResourceSendRequestTimelineRecordType);
+    record->setString("type", TimelineRecordType::ResourceSendRequest);
     setHeapSizeStatistic(record.get());
-    m_frontend->addRecordToTimeline(record.release());
+    m_frontend->eventRecorded(record.release());
 }
 
 void InspectorTimelineAgent::willReceiveResourceData(unsigned long identifier)
 {
-    pushCurrentRecord(TimelineRecordFactory::createReceiveResourceData(identifier), ReceiveResourceDataTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createReceiveResourceData(identifier), TimelineRecordType::ResourceReceivedData);
 }
 
 void InspectorTimelineAgent::didReceiveResourceData()
 {
-    didCompleteCurrentRecord(ReceiveResourceDataTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::ResourceReceivedData);
 }
     
 void InspectorTimelineAgent::willReceiveResourceResponse(unsigned long identifier, const ResourceResponse& response)
 {
-    pushCurrentRecord(TimelineRecordFactory::createResourceReceiveResponseData(identifier, response), ResourceReceiveResponseTimelineRecordType);
+    pushCurrentRecord(TimelineRecordFactory::createResourceReceiveResponseData(identifier, response), TimelineRecordType::ResourceReceiveResponse);
 }
 
 void InspectorTimelineAgent::didReceiveResourceResponse()
 {
-    didCompleteCurrentRecord(ResourceReceiveResponseTimelineRecordType);
+    didCompleteCurrentRecord(TimelineRecordType::ResourceReceiveResponse);
 }
 
 void InspectorTimelineAgent::didFinishLoadingResource(unsigned long identifier, bool didFail, double finishTime)
@@ -291,9 +321,9 @@ void InspectorTimelineAgent::didFinishLoadingResource(unsigned long identifier,
     // Sometimes network stack can provide for us exact finish loading time. In the other case we will use currentTime.
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
     record->setObject("data", TimelineRecordFactory::createResourceFinishData(identifier, didFail, finishTime * 1000));
-    record->setNumber("type", ResourceFinishTimelineRecordType);
+    record->setString("type", TimelineRecordType::ResourceFinish);
     setHeapSizeStatistic(record.get());
-    m_frontend->addRecordToTimeline(record.release());
+    m_frontend->eventRecorded(record.release());
 }
 
 void InspectorTimelineAgent::didMarkTimeline(const String& message)
@@ -301,21 +331,21 @@ void InspectorTimelineAgent::didMarkTimeline(const String& message)
     pushGCEventRecords();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
     record->setObject("data", TimelineRecordFactory::createMarkTimelineData(message));
-    addRecordToTimeline(record.release(), MarkTimelineRecordType);
+    addRecordToTimeline(record.release(), TimelineRecordType::MarkTimeline);
 }
 
 void InspectorTimelineAgent::didMarkDOMContentEvent()
 {
     pushGCEventRecords();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
-    addRecordToTimeline(record.release(), MarkDOMContentEventType);
+    addRecordToTimeline(record.release(), TimelineRecordType::MarkDOMContent);
 }
 
 void InspectorTimelineAgent::didMarkLoadEvent()
 {
     pushGCEventRecords();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
-    addRecordToTimeline(record.release(), MarkLoadEventType);
+    addRecordToTimeline(record.release(), TimelineRecordType::MarkLoad);
 }
 
 void InspectorTimelineAgent::didCommitLoad()
@@ -323,13 +353,13 @@ void InspectorTimelineAgent::didCommitLoad()
     clearRecordStack();
 }
 
-void InspectorTimelineAgent::addRecordToTimeline(PassRefPtr<InspectorObject> prpRecord, TimelineRecordType type)
+void InspectorTimelineAgent::addRecordToTimeline(PassRefPtr<InspectorObject> prpRecord, const String& type)
 {
     RefPtr<InspectorObject> record(prpRecord);
-    record->setNumber("type", type);
+    record->setString("type", type);
     setHeapSizeStatistic(record.get());
     if (m_recordStack.isEmpty())
-        m_frontend->addRecordToTimeline(record.release());
+        m_frontend->eventRecorded(record.release());
     else {
         TimelineRecordEntry parent = m_recordStack.last();
         parent.children->pushObject(record.release());
@@ -346,7 +376,7 @@ void InspectorTimelineAgent::setHeapSizeStatistic(InspectorObject* record)
     record->setNumber("totalHeapSize", totalHeapSize);
 }
 
-void InspectorTimelineAgent::didCompleteCurrentRecord(TimelineRecordType type)
+void InspectorTimelineAgent::didCompleteCurrentRecord(const String& type)
 {
     // An empty stack could merely mean that the timeline agent was turned on in the middle of
     // an event.  Don't treat as an error.
@@ -370,7 +400,7 @@ InspectorTimelineAgent::InspectorTimelineAgent(InstrumentingAgents* instrumentin
 {
 }
 
-void InspectorTimelineAgent::pushCurrentRecord(PassRefPtr<InspectorObject> data, TimelineRecordType type)
+void InspectorTimelineAgent::pushCurrentRecord(PassRefPtr<InspectorObject> data, const String& type)
 {
     pushGCEventRecords();
     RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.h b/Source/WebCore/inspector/InspectorTimelineAgent.h
index c4c0f3b..3d8e973 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.h
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.h
@@ -51,31 +51,6 @@ class ResourceResponse;
 
 typedef String ErrorString;
 
-// Must be kept in sync with TimelineAgent.js
-enum TimelineRecordType {
-    EventDispatchTimelineRecordType = 0,
-    LayoutTimelineRecordType = 1,
-    RecalculateStylesTimelineRecordType = 2,
-    PaintTimelineRecordType = 3,
-    ParseHTMLTimelineRecordType = 4,
-    TimerInstallTimelineRecordType = 5,
-    TimerRemoveTimelineRecordType = 6,
-    TimerFireTimelineRecordType = 7,
-    XHRReadyStateChangeRecordType = 8,
-    XHRLoadRecordType = 9,
-    EvaluateScriptTimelineRecordType = 10,
-    MarkTimelineRecordType = 11,
-    ResourceSendRequestTimelineRecordType = 12,
-    ResourceReceiveResponseTimelineRecordType = 13,
-    ResourceFinishTimelineRecordType = 14,
-    FunctionCallTimelineRecordType = 15,
-    ReceiveResourceDataTimelineRecordType = 16,
-    GCEventTimelineRecordType = 17,
-    MarkDOMContentEventType = 18,
-    MarkLoadEventType = 19,
-    ScheduleResourceRequestTimelineRecordType = 20
-};
-
 class InspectorTimelineAgent : ScriptGCEventListener {
     WTF_MAKE_NONCOPYABLE(InspectorTimelineAgent);
 public:
@@ -148,24 +123,24 @@ public:
 
 private:
     struct TimelineRecordEntry {
-        TimelineRecordEntry(PassRefPtr<InspectorObject> record, PassRefPtr<InspectorObject> data, PassRefPtr<InspectorArray> children, TimelineRecordType type)
+        TimelineRecordEntry(PassRefPtr<InspectorObject> record, PassRefPtr<InspectorObject> data, PassRefPtr<InspectorArray> children, const String& type)
             : record(record), data(data), children(children), type(type)
         {
         }
         RefPtr<InspectorObject> record;
         RefPtr<InspectorObject> data;
         RefPtr<InspectorArray> children;
-        TimelineRecordType type;
+        String type;
     };
         
     InspectorTimelineAgent(InstrumentingAgents*, InspectorState*);
 
-    void pushCurrentRecord(PassRefPtr<InspectorObject>, TimelineRecordType);
+    void pushCurrentRecord(PassRefPtr<InspectorObject>, const String& type);
     void setHeapSizeStatistic(InspectorObject* record);
         
-    void didCompleteCurrentRecord(TimelineRecordType);
+    void didCompleteCurrentRecord(const String& type);
 
-    void addRecordToTimeline(PassRefPtr<InspectorObject>, TimelineRecordType);
+    void addRecordToTimeline(PassRefPtr<InspectorObject>, const String& type);
 
     void pushGCEventRecords();
     void clearRecordStack();
diff --git a/Source/WebCore/inspector/InstrumentingAgents.h b/Source/WebCore/inspector/InstrumentingAgents.h
index c53ef00..3b67edd 100644
--- a/Source/WebCore/inspector/InstrumentingAgents.h
+++ b/Source/WebCore/inspector/InstrumentingAgents.h
@@ -36,7 +36,9 @@
 
 namespace WebCore {
 
+class InspectorAgent;
 class InspectorApplicationCacheAgent;
+class InspectorPageAgent;
 class InspectorBrowserDebuggerAgent;
 class InspectorCSSAgent;
 class InspectorConsoleAgent;
@@ -54,7 +56,9 @@ class InstrumentingAgents {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     InstrumentingAgents()
-        : m_inspectorCSSAgent(0)
+        : m_inspectorAgent(0)
+        , m_inspectorPageAgent(0)
+        , m_inspectorCSSAgent(0)
         , m_inspectorConsoleAgent(0)
         , m_inspectorDOMAgent(0)
         , m_inspectorResourceAgent(0)
@@ -77,6 +81,12 @@ public:
     { }
     ~InstrumentingAgents() { }
 
+    InspectorAgent* inspectorAgent() const { return m_inspectorAgent; }
+    void setInspectorAgent(InspectorAgent* agent) { m_inspectorAgent = agent; }
+
+    InspectorPageAgent* inspectorPageAgent() const { return m_inspectorPageAgent; }
+    void setInspectorPageAgent(InspectorPageAgent* agent) { m_inspectorPageAgent = agent; }
+
     InspectorCSSAgent* inspectorCSSAgent() const { return m_inspectorCSSAgent; }
     void setInspectorCSSAgent(InspectorCSSAgent* agent) { m_inspectorCSSAgent = agent; }
 
@@ -119,6 +129,8 @@ public:
 #endif
 
 private:
+    InspectorAgent* m_inspectorAgent;
+    InspectorPageAgent* m_inspectorPageAgent;
     InspectorCSSAgent* m_inspectorCSSAgent;
     InspectorConsoleAgent* m_inspectorConsoleAgent;
     InspectorDOMAgent* m_inspectorDOMAgent;
diff --git a/Source/WebCore/inspector/PageDebuggerAgent.cpp b/Source/WebCore/inspector/PageDebuggerAgent.cpp
new file mode 100755
index 0000000..6b86232
--- /dev/null
+++ b/Source/WebCore/inspector/PageDebuggerAgent.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PageDebuggerAgent.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
+
+#include "PageScriptDebugServer.h"
+
+namespace WebCore {
+
+PassOwnPtr<PageDebuggerAgent> PageDebuggerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, Page* inspectedPage, InjectedScriptManager* injectedScriptManager)
+{
+    return adoptPtr(new PageDebuggerAgent(instrumentingAgents, inspectorState, inspectedPage, injectedScriptManager));
+}
+
+PageDebuggerAgent::PageDebuggerAgent(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, Page* inspectedPage, InjectedScriptManager* injectedScriptManager)
+    : InspectorDebuggerAgent(instrumentingAgents, inspectorState, injectedScriptManager)
+    , m_inspectedPage(inspectedPage)
+{
+}
+
+PageDebuggerAgent::~PageDebuggerAgent()
+{
+}
+
+void PageDebuggerAgent::startListeningScriptDebugServer()
+{
+    scriptDebugServer().addListener(this, m_inspectedPage);
+}
+
+void PageDebuggerAgent::stopListeningScriptDebugServer()
+{
+    scriptDebugServer().removeListener(this, m_inspectedPage);
+}
+
+PageScriptDebugServer& PageDebuggerAgent::scriptDebugServer()
+{
+    return PageScriptDebugServer::shared();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/PageDebuggerAgent.h b/Source/WebCore/inspector/PageDebuggerAgent.h
new file mode 100755
index 0000000..7d6af6c
--- /dev/null
+++ b/Source/WebCore/inspector/PageDebuggerAgent.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PageDebuggerAgent_h
+#define PageDebuggerAgent_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
+#include "InspectorDebuggerAgent.h"
+#include "PageScriptDebugServer.h"
+
+namespace WebCore {
+
+class Page;
+class PageScriptDebugServer;
+
+class PageDebuggerAgent : public InspectorDebuggerAgent {
+    WTF_MAKE_NONCOPYABLE(PageDebuggerAgent);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    static PassOwnPtr<PageDebuggerAgent> create(InstrumentingAgents*, InspectorState*, Page*, InjectedScriptManager*);
+    virtual ~PageDebuggerAgent();
+
+private:
+    virtual void startListeningScriptDebugServer();
+    virtual void stopListeningScriptDebugServer();
+    virtual PageScriptDebugServer& scriptDebugServer();
+
+    PageDebuggerAgent(InstrumentingAgents*, InspectorState*, Page*, InjectedScriptManager*);
+    Page* const m_inspectedPage;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
+
+#endif // !defined(PageDebuggerAgent_h)
diff --git a/Source/WebCore/inspector/ScriptCallStack.cpp b/Source/WebCore/inspector/ScriptCallStack.cpp
index 70229e5..06b5e30 100644
--- a/Source/WebCore/inspector/ScriptCallStack.cpp
+++ b/Source/WebCore/inspector/ScriptCallStack.cpp
@@ -78,7 +78,7 @@ bool ScriptCallStack::isEqual(ScriptCallStack* o) const
 }
 
 #if ENABLE(INSPECTOR)
-PassRefPtr<InspectorArray> ScriptCallStack::buildInspectorObject() const
+PassRefPtr<InspectorArray> ScriptCallStack::buildInspectorArray() const
 {
     RefPtr<InspectorArray> frames = InspectorArray::create();
     for (size_t i = 0; i < m_frames.size(); i++)
diff --git a/Source/WebCore/inspector/ScriptCallStack.h b/Source/WebCore/inspector/ScriptCallStack.h
index 4cb152f..df67006 100644
--- a/Source/WebCore/inspector/ScriptCallStack.h
+++ b/Source/WebCore/inspector/ScriptCallStack.h
@@ -52,7 +52,7 @@ public:
     size_t size() const;
 
     bool isEqual(ScriptCallStack*) const;
-    PassRefPtr<InspectorArray> buildInspectorObject() const;
+    PassRefPtr<InspectorArray> buildInspectorArray() const;
 
 private:
     ScriptCallStack(Vector<ScriptCallFrame>&);
diff --git a/Source/WebCore/inspector/TimelineRecordFactory.cpp b/Source/WebCore/inspector/TimelineRecordFactory.cpp
index dd7f2be..ff47ed4 100644
--- a/Source/WebCore/inspector/TimelineRecordFactory.cpp
+++ b/Source/WebCore/inspector/TimelineRecordFactory.cpp
@@ -50,7 +50,7 @@ PassRefPtr<InspectorObject> TimelineRecordFactory::createGenericRecord(double st
 
     RefPtr<ScriptCallStack> stackTrace = createScriptCallStack(5, true);
     if (stackTrace && stackTrace->size())
-        record->setArray("stackTrace", stackTrace->buildInspectorObject());
+        record->setArray("stackTrace", stackTrace->buildInspectorArray());
     return record.release();
 }
 
@@ -144,7 +144,6 @@ PassRefPtr<InspectorObject> TimelineRecordFactory::createResourceReceiveResponse
     data->setNumber("identifier", identifier);
     data->setNumber("statusCode", response.httpStatusCode());
     data->setString("mimeType", response.mimeType());
-    data->setNumber("expectedContentLength", response.expectedContentLength());
     return data.release();
 }
 
diff --git a/Source/WebCore/inspector/WorkerDebuggerAgent.cpp b/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
new file mode 100755
index 0000000..afd00a5
--- /dev/null
+++ b/Source/WebCore/inspector/WorkerDebuggerAgent.cpp
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WorkerDebuggerAgent.h"
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR) && ENABLE(WORKERS)
+#include "ScriptDebugServer.h"
+#include "WorkerContext.h"
+
+namespace WebCore {
+
+PassOwnPtr<WorkerDebuggerAgent> WorkerDebuggerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, WorkerContext* inspectedWorkerContext, InjectedScriptManager* injectedScriptManager)
+{
+    return adoptPtr(new WorkerDebuggerAgent(instrumentingAgents, inspectorState, inspectedWorkerContext, injectedScriptManager));
+}
+
+WorkerDebuggerAgent::WorkerDebuggerAgent(InstrumentingAgents* instrumentingAgents, InspectorState* inspectorState, WorkerContext* inspectedWorkerContext, InjectedScriptManager* injectedScriptManager)
+    : InspectorDebuggerAgent(instrumentingAgents, inspectorState, injectedScriptManager)
+    , m_inspectedWorkerContext(inspectedWorkerContext)
+{
+}
+
+WorkerDebuggerAgent::~WorkerDebuggerAgent()
+{
+}
+
+void WorkerDebuggerAgent::startListeningScriptDebugServer()
+{
+}
+
+void WorkerDebuggerAgent::stopListeningScriptDebugServer()
+{
+}
+
+WorkerScriptDebugServer& WorkerDebuggerAgent::scriptDebugServer()
+{
+    return m_scriptDebugServer;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR) && ENABLE(WORKERS)
diff --git a/Source/WebCore/inspector/WorkerDebuggerAgent.h b/Source/WebCore/inspector/WorkerDebuggerAgent.h
new file mode 100755
index 0000000..e88fd89
--- /dev/null
+++ b/Source/WebCore/inspector/WorkerDebuggerAgent.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerDebuggerAgent_h
+#define WorkerDebuggerAgent_h
+
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR) && ENABLE(WORKERS)
+#include "InspectorDebuggerAgent.h"
+#include "WorkerScriptDebugServer.h"
+
+namespace WebCore {
+
+class WorkerContext;
+
+class WorkerDebuggerAgent : public InspectorDebuggerAgent {
+    WTF_MAKE_NONCOPYABLE(WorkerDebuggerAgent);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    static PassOwnPtr<WorkerDebuggerAgent> create(InstrumentingAgents*, InspectorState*, WorkerContext*, InjectedScriptManager*);
+    virtual ~WorkerDebuggerAgent();
+
+private:
+    WorkerDebuggerAgent(InstrumentingAgents*, InspectorState*, WorkerContext*, InjectedScriptManager*);
+
+    virtual void startListeningScriptDebugServer();
+    virtual void stopListeningScriptDebugServer();
+    virtual WorkerScriptDebugServer& scriptDebugServer();
+
+    WorkerScriptDebugServer m_scriptDebugServer;
+    WorkerContext* m_inspectedWorkerContext;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR) && ENABLE(WORKERS)
+
+#endif // !defined(WorkerDebuggerAgent_h)
diff --git a/Source/WebCore/inspector/front-end/ApplicationCacheItemsView.js b/Source/WebCore/inspector/front-end/ApplicationCacheItemsView.js
index b345749..f181907 100644
--- a/Source/WebCore/inspector/front-end/ApplicationCacheItemsView.js
+++ b/Source/WebCore/inspector/front-end/ApplicationCacheItemsView.js
@@ -268,3 +268,33 @@ WebInspector.ApplicationCacheItemsView.prototype = {
 }
 
 WebInspector.ApplicationCacheItemsView.prototype.__proto__ = WebInspector.View.prototype;
+
+WebInspector.ApplicationCacheDispatcher = function()
+{
+}
+
+WebInspector.ApplicationCacheDispatcher.getApplicationCachesAsync = function(callback)
+{
+    function mycallback(error, applicationCaches)
+    {
+        // FIXME: Currently, this list only returns a single application cache.
+        if (!error && applicationCaches)
+            callback(applicationCaches);
+    }
+
+    ApplicationCacheAgent.getApplicationCaches(mycallback);
+}
+
+WebInspector.ApplicationCacheDispatcher.prototype = {
+    updateApplicationCacheStatus: function(status)
+    {
+        WebInspector.panels.resources.updateApplicationCacheStatus(status);
+    },
+
+    updateNetworkState: function(isNowOnline)
+    {
+        WebInspector.panels.resources.updateNetworkState(isNowOnline);
+    }
+}
+
+InspectorBackend.registerDomainDispatcher("ApplicationCache", new WebInspector.ApplicationCacheDispatcher());
diff --git a/Source/WebCore/inspector/front-end/AuditFormatters.js b/Source/WebCore/inspector/front-end/AuditFormatters.js
index 1bc1803..6545dd4 100644
--- a/Source/WebCore/inspector/front-end/AuditFormatters.js
+++ b/Source/WebCore/inspector/front-end/AuditFormatters.js
@@ -66,7 +66,7 @@ WebInspector.AuditFormatters = {
     snippet: function(snippetText)
     {
         var div = document.createElement("div");
-        div.innerText = snippetText;
+        div.textContent = snippetText;
         div.className = "source-code";
         return div;
     },
diff --git a/Source/WebCore/inspector/front-end/AuditRules.js b/Source/WebCore/inspector/front-end/AuditRules.js
index 803e9e0..ddab1df 100644
--- a/Source/WebCore/inspector/front-end/AuditRules.js
+++ b/Source/WebCore/inspector/front-end/AuditRules.js
@@ -65,9 +65,9 @@ WebInspector.AuditRules.getDomainToResourcesMap = function(resources, types, nee
 
 WebInspector.AuditRules.evaluateInTargetWindow = function(func, args, callback)
 {
-    function mycallback(result)
+    function mycallback(error, result)
     {
-        if (result)
+        if (!error && result)
             callback(JSON.parse(result.description));
         else
             callback(null);
@@ -377,24 +377,28 @@ WebInspector.AuditRules.UnusedCssRule.prototype = {
             WebInspector.AuditRules.evaluateInTargetWindow(routine, [selectors], selectorsCallback.bind(null, callback, styleSheets, testedSelectors));
         }
 
-        function styleSheetCallback(styleSheets, continuation, styleSheet)
+        function styleSheetCallback(styleSheets, sourceURL, continuation, styleSheet)
         {
-            if (styleSheet)
+            if (styleSheet) {
+                styleSheet.sourceURL = sourceURL;
                 styleSheets.push(styleSheet);
+            }
             if (continuation)
                 continuation(styleSheets);
         }
 
-        function allStylesCallback(styleSheetIds)
+        function allStylesCallback(error, styleSheetInfos)
         {
-            if (!styleSheetIds || !styleSheetIds.length)
+            if (error || !styleSheetInfos || !styleSheetInfos.length)
                 return evalCallback([]);
             var styleSheets = [];
-            for (var i = 0; i < styleSheetIds.length; ++i)
-                WebInspector.CSSStyleSheet.createForId(styleSheetIds[i], styleSheetCallback.bind(null, styleSheets, i == styleSheetIds.length - 1 ? evalCallback : null));
+            for (var i = 0; i < styleSheetInfos.length; ++i) {
+                var info = styleSheetInfos[i];
+                WebInspector.CSSStyleSheet.createForId(info.styleSheetId, styleSheetCallback.bind(null, styleSheets, info.sourceURL, i == styleSheetInfos.length - 1 ? evalCallback : null));
+            }
         }
 
-        CSSAgent.getAllStyles(allStylesCallback);
+        CSSAgent.getAllStyleSheets(allStylesCallback);
     }
 }
 
@@ -717,13 +721,20 @@ WebInspector.AuditRules.ImageDimensionsRule.prototype = {
                 doneCallback();
         }
 
-        function getStyles(nodeIds)
+        function getStyles(error, nodeIds)
         {
+            if (error)
+                return;
             for (var i = 0; i < nodeIds.length; ++i)
                 WebInspector.cssModel.getStylesAsync(nodeIds[i], imageStylesReady.bind(this, nodeIds[i], i === nodeIds.length - 1));
         }
 
-        DOMAgent.querySelectorAll(0, "img[src]", true, getStyles);
+        function getImages()
+        {
+            DOMAgent.querySelectorAll(0, "img[src]", true, getStyles);
+        }
+
+        WebInspector.domAgent.requestDocument(getImages);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/AuditsPanel.js b/Source/WebCore/inspector/front-end/AuditsPanel.js
index 3144c78..7f56f41 100644
--- a/Source/WebCore/inspector/front-end/AuditsPanel.js
+++ b/Source/WebCore/inspector/front-end/AuditsPanel.js
@@ -192,7 +192,7 @@ WebInspector.AuditsPanel.prototype = {
     _reloadResources: function(callback)
     {
         this._pageReloadCallback = callback;
-        InspectorAgent.reloadPage(false);
+        PageAgent.reloadPage(false);
     },
 
     _didMainResourceLoad: function()
diff --git a/Source/WebCore/inspector/front-end/BreakpointManager.js b/Source/WebCore/inspector/front-end/BreakpointManager.js
index b62820e..76348ff 100644
--- a/Source/WebCore/inspector/front-end/BreakpointManager.js
+++ b/Source/WebCore/inspector/front-end/BreakpointManager.js
@@ -51,8 +51,6 @@ WebInspector.BreakpointManager.BreakpointTypes = {
 
 WebInspector.BreakpointManager.Events = {
     DOMBreakpointAdded: "dom-breakpoint-added",
-    EventListenerBreakpointAdded: "event-listener-breakpoint-added",
-    XHRBreakpointAdded: "xhr-breakpoint-added",
     ProjectChanged: "project-changed"
 }
 
@@ -81,42 +79,6 @@ WebInspector.BreakpointManager.prototype = {
         this.dispatchEventToListeners(WebInspector.BreakpointManager.Events.DOMBreakpointAdded, breakpoint.view);
     },
 
-    createEventListenerBreakpoint: function(eventName)
-    {
-        this._createEventListenerBreakpoint(eventName, true, false);
-    },
-
-    _createEventListenerBreakpoint: function(eventName, enabled, restored)
-    {
-        var breakpointId = this._createEventListenerBreakpointId(eventName);
-        if (breakpointId in this._breakpoints)
-            return;
-
-        var breakpoint = new WebInspector.EventListenerBreakpoint(eventName);
-        this._setBreakpoint(breakpointId, breakpoint, enabled, restored);
-
-        breakpoint.view = new WebInspector.EventListenerBreakpointView(this, breakpointId, enabled, eventName);
-        this.dispatchEventToListeners(WebInspector.BreakpointManager.Events.EventListenerBreakpointAdded, breakpoint.view);
-    },
-
-    createXHRBreakpoint: function(url)
-    {
-        this._createXHRBreakpoint(url, true, false);
-    },
-
-    _createXHRBreakpoint: function(url, enabled, restored)
-    {
-        var breakpointId = this._createXHRBreakpointId(url);
-        if (breakpointId in this._breakpoints)
-            return;
-
-        var breakpoint = new WebInspector.XHRBreakpoint(url);
-        this._setBreakpoint(breakpointId, breakpoint, enabled, restored);
-
-        breakpoint.view = new WebInspector.XHRBreakpointView(this, breakpointId, enabled, url);
-        this.dispatchEventToListeners(WebInspector.BreakpointManager.Events.XHRBreakpointAdded, breakpoint.view);
-    },
-
     _setBreakpoint: function(breakpointId, breakpoint, enabled, restored)
     {
         this._breakpoints[breakpointId] = breakpoint;
@@ -155,10 +117,6 @@ WebInspector.BreakpointManager.prototype = {
         var breakpointId;
         if (eventData.breakpointType === WebInspector.BreakpointManager.BreakpointTypes.DOM)
             breakpointId = this._createDOMBreakpointId(eventData.nodeId, eventData.type);
-        else if (eventData.breakpointType === WebInspector.BreakpointManager.BreakpointTypes.EventListener)
-            breakpointId = this._createEventListenerBreakpointId(eventData.eventName);
-        else if (eventData.breakpointType === WebInspector.BreakpointManager.BreakpointTypes.XHR)
-            breakpointId = this._createXHRBreakpointId(eventData.breakpointURL);
         else
             return;
 
@@ -196,20 +154,6 @@ WebInspector.BreakpointManager.prototype = {
         this._breakpoints = {};
         this._domBreakpointsRestored = false;
         this.dispatchEventToListeners(WebInspector.BreakpointManager.Events.ProjectChanged);
-
-        var breakpoints = this._stickyBreakpoints[WebInspector.settings.projectId] || [];
-        for (var i = 0; i < breakpoints.length; ++i) {
-            var breakpoint = breakpoints[i];
-            if (breakpoint.type === WebInspector.BreakpointManager.BreakpointTypes.EventListener)
-                this._createEventListenerBreakpoint(breakpoint.condition.eventName, breakpoint.enabled, true);
-            else if (breakpoint.type === WebInspector.BreakpointManager.BreakpointTypes.XHR)
-                this._createXHRBreakpoint(breakpoint.condition.url, breakpoint.enabled, true);
-        }
-
-        if (!this._breakpointsPushedToFrontend) {
-            BrowserDebuggerAgent.setAllBrowserBreakpoints(this._stickyBreakpoints);
-            this._breakpointsPushedToFrontend = true;
-        }
     },
 
     restoreDOMBreakpoints: function()
@@ -271,7 +215,6 @@ WebInspector.BreakpointManager.prototype = {
         WebInspector.settings.nativeBreakpoints = breakpoints;
 
         this._stickyBreakpoints[WebInspector.settings.projectId] = breakpoints;
-        BrowserDebuggerAgent.setAllBrowserBreakpoints(this._stickyBreakpoints);
     },
 
     _validateBreakpoints: function(persistentBreakpoints)
@@ -288,16 +231,9 @@ WebInspector.BreakpointManager.prototype = {
                 if (typeof condition.path !== "string" || typeof condition.type !== "number")
                     continue;
                 id += condition.path + ":" + condition.type;
-            } else if (breakpoint.type === WebInspector.BreakpointManager.BreakpointTypes.EventListener) {
-                if (typeof condition.eventName !== "string")
-                    continue;
-                id += condition.eventName;
-            } else if (breakpoint.type === WebInspector.BreakpointManager.BreakpointTypes.XHR) {
-                if (typeof condition.url !== "string")
-                    continue;
-                id += condition.url;
             } else
                 continue;
+
             if (id in breakpointsSet)
                 continue;
             breakpointsSet[id] = true;
@@ -309,16 +245,6 @@ WebInspector.BreakpointManager.prototype = {
     _createDOMBreakpointId: function(nodeId, type)
     {
         return "dom:" + nodeId + ":" + type;
-    },
-
-    _createEventListenerBreakpointId: function(eventName)
-    {
-        return "eventListner:" + eventName;
-    },
-
-    _createXHRBreakpointId: function(url)
-    {
-        return "xhr:" + url;
     }
 }
 
@@ -349,54 +275,6 @@ WebInspector.DOMBreakpoint.prototype = {
     }
 }
 
-WebInspector.EventListenerBreakpoint = function(eventName)
-{
-    this._eventName = eventName;
-}
-
-WebInspector.EventListenerBreakpoint.prototype = {
-    _enable: function()
-    {
-        BrowserDebuggerAgent.setEventListenerBreakpoint(this._eventName);
-    },
-
-    _disable: function()
-    {
-        BrowserDebuggerAgent.removeEventListenerBreakpoint(this._eventName);
-    },
-
-    _serializeToJSON: function()
-    {
-        var type = WebInspector.BreakpointManager.BreakpointTypes.EventListener;
-        return { type: type, condition: { eventName: this._eventName } };
-    }
-}
-
-WebInspector.XHRBreakpoint = function(url)
-{
-    this._url = url;
-}
-
-WebInspector.XHRBreakpoint.prototype = {
-    _enable: function()
-    {
-        BrowserDebuggerAgent.setXHRBreakpoint(this._url);
-    },
-
-    _disable: function()
-    {
-        BrowserDebuggerAgent.removeXHRBreakpoint(this._url);
-    },
-
-    _serializeToJSON: function()
-    {
-        var type = WebInspector.BreakpointManager.BreakpointTypes.XHR;
-        return { type: type, condition: { url: this._url } };
-    }
-}
-
-
-
 WebInspector.NativeBreakpointView = function(manager, id, enabled)
 {
     this._manager = manager;
@@ -487,7 +365,7 @@ WebInspector.DOMBreakpointView.prototype = {
                 if (!targetNodeId)
                     return;
 
-                RuntimeAgent.releaseObject(eventData.targetNode);
+                targetNodeObject.release();
                 var targetNode = WebInspector.panels.elements.linkifyNodeById(targetNodeId);
                 if (eventData.insertion) {
                     if (targetNodeId !== this._nodeId)
@@ -530,91 +408,6 @@ WebInspector.DOMBreakpointView.prototype = {
 
 WebInspector.DOMBreakpointView.prototype.__proto__ = WebInspector.NativeBreakpointView.prototype;
 
-WebInspector.EventListenerBreakpointView = function(manager, id, enabled, eventName)
-{
-    WebInspector.NativeBreakpointView.call(this, manager, id, enabled);
-    this._eventName = eventName;
-}
-
-WebInspector.EventListenerBreakpointView.eventNameForUI = function(eventName)
-{
-    if (!WebInspector.EventListenerBreakpointView._eventNamesForUI) {
-        WebInspector.EventListenerBreakpointView._eventNamesForUI = {
-            "instrumentation:setTimer": WebInspector.UIString("Set Timer"),
-            "instrumentation:clearTimer": WebInspector.UIString("Clear Timer"),
-            "instrumentation:timerFired": WebInspector.UIString("Timer Fired")
-        };
-    }
-    return WebInspector.EventListenerBreakpointView._eventNamesForUI[eventName] || eventName.substring(eventName.indexOf(":") + 1);
-}
-
-WebInspector.EventListenerBreakpointView.prototype = {
-    get eventName()
-    {
-        return this._eventName;
-    },
-
-    compareTo: function(other)
-    {
-        return this._compare(this._eventName, other._eventName);
-    },
-
-    populateLabelElement: function(element)
-    {
-        element.appendChild(document.createTextNode(this._uiEventName()));
-    },
-
-    populateStatusMessageElement: function(element, eventData)
-    {
-        var status = WebInspector.UIString("Paused on a \"%s\" Event Listener.", this._uiEventName());
-        element.appendChild(document.createTextNode(status));
-    },
-
-    _uiEventName: function()
-    {
-        return WebInspector.EventListenerBreakpointView.eventNameForUI(this._eventName);
-    }
-}
-
-WebInspector.EventListenerBreakpointView.prototype.__proto__ = WebInspector.NativeBreakpointView.prototype;
-
-WebInspector.XHRBreakpointView = function(manager, id, enabled, url)
-{
-    WebInspector.NativeBreakpointView.call(this, manager, id, enabled);
-    this._url = url;
-}
-
-WebInspector.XHRBreakpointView.prototype = {
-    compareTo: function(other)
-    {
-        return this._compare(this._url, other._url);
-    },
-
-    populateEditElement: function(element)
-    {
-        element.textContent = this._url;
-    },
-
-    populateLabelElement: function(element)
-    {
-        var label;
-        if (!this._url.length)
-            label = WebInspector.UIString("Any XHR");
-        else
-            label = WebInspector.UIString("URL contains \"%s\"", this._url);
-        element.appendChild(document.createTextNode(label));
-        element.addStyleClass("cursor-auto");
-    },
-
-    populateStatusMessageElement: function(element)
-    {
-        var status = WebInspector.UIString("Paused on a XMLHttpRequest.");
-        element.appendChild(document.createTextNode(status));
-    }
-}
-
-WebInspector.XHRBreakpointView.prototype.__proto__ = WebInspector.NativeBreakpointView.prototype;
-
 WebInspector.DOMBreakpointTypes = {
     SubtreeModified: 0,
     AttributeModified: 1,
diff --git a/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js b/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
index 0c46463..63a6e2a 100644
--- a/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js
@@ -23,10 +23,12 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.JavaScriptBreakpointsSidebarPane = function(title)
+WebInspector.JavaScriptBreakpointsSidebarPane = function(model)
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Breakpoints"));
 
+    this._model = model;
+
     this.listElement = document.createElement("ol");
     this.listElement.className = "breakpoint-list";
 
@@ -37,36 +39,37 @@ WebInspector.JavaScriptBreakpointsSidebarPane = function(title)
     this.bodyElement.appendChild(this.emptyElement);
 
     this._items = {};
-
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointAdded, this._breakpointAdded, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointRemoved, this._breakpointRemoved, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointResolved, this._breakpointResolved, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ParsedScriptSource, this._parsedScriptSource, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerPaused, this._debuggerPaused, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerResumed, this._debuggerResumed, this);
-    WebInspector.breakpointManager.addEventListener(WebInspector.BreakpointManager.Events.ProjectChanged, this._projectChanged, this);
 }
 
 WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
-    _breakpointAdded: function(event)
+    addBreakpoint: function(breakpoint)
     {
-        var breakpoint = event.data;
-        var breakpointId = breakpoint.id;
-
-        if (breakpoint.url && !WebInspector.debuggerModel.scriptsForURL(breakpoint.url).length)
-            return;
-
         var element = document.createElement("li");
+        element.addStyleClass("cursor-pointer");
+        element.addEventListener("contextmenu", this._contextMenu.bind(this, breakpoint), true);
+        element.addEventListener("click", this._breakpointClicked.bind(this, breakpoint), false);
 
         var checkbox = document.createElement("input");
         checkbox.className = "checkbox-elem";
         checkbox.type = "checkbox";
         checkbox.checked = breakpoint.enabled;
-        checkbox.addEventListener("click", this._breakpointItemCheckboxClicked.bind(this, breakpointId), false);
+        checkbox.addEventListener("click", this._breakpointCheckboxClicked.bind(this, breakpoint), false);
         element.appendChild(checkbox);
 
-        var label = document.createElement("span");
-        element.appendChild(label);
+        var displayName = breakpoint.url ? WebInspector.displayNameForURL(breakpoint.url) : WebInspector.UIString("(program)");
+        var labelElement = document.createTextNode(displayName + ":" + (breakpoint.lineNumber + 1));
+        element.appendChild(labelElement);
+
+        var snippetElement = document.createElement("div");
+        snippetElement.className = "source-text monospace";
+        element.appendChild(snippetElement);
+        if (breakpoint.loadSnippet) {
+            function didLoadSnippet(snippet)
+            {
+                snippetElement.textContent = snippet;
+            }
+            breakpoint.loadSnippet(didLoadSnippet);
+        }
 
         element._data = breakpoint;
         var currentElement = this.listElement.firstChild;
@@ -77,88 +80,68 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
         }
         this._addListElement(element, currentElement);
 
-        element.addEventListener("contextmenu", this._contextMenuEventFired.bind(this, breakpointId), true);
-
-        this._setupBreakpointElement(breakpoint, element);
-
         var breakpointItem = {};
         breakpointItem.element = element;
         breakpointItem.checkbox = checkbox;
-        this._items[breakpointId] = breakpointItem;
+        this._items[this._createBreakpointItemId(breakpoint.sourceFileId, breakpoint.lineNumber)] = breakpointItem;
 
         if (!this.expanded)
             this.expanded = true;
     },
 
-    _breakpointRemoved: function(event)
+    removeBreakpoint: function(sourceFileId, lineNumber)
     {
-        var breakpointId = event.data;
-        var breakpointItem = this._items[breakpointId];
-        if (breakpointItem) {
-            delete this._items[breakpointId];
-            this._removeListElement(breakpointItem.element);
-        }
+        var breakpointItemId = this._createBreakpointItemId(sourceFileId, lineNumber);
+        var breakpointItem = this._items[breakpointItemId];
+        if (!breakpointItem)
+            return;
+        delete this._items[breakpointItemId];
+        this._removeListElement(breakpointItem.element);
     },
 
-    _breakpointResolved: function(event)
+    highlightBreakpoint: function(sourceFileId, lineNumber)
     {
-        var breakpoint = event.data;
-        this._breakpointRemoved({ data: breakpoint.id });
-        this._breakpointAdded({ data: breakpoint });
+        var breakpointItem = this._items[this._createBreakpointItemId(sourceFileId, lineNumber)];
+        if (!breakpointItem)
+            return;
+        breakpointItem.element.addStyleClass("breakpoint-hit");
+        this._highlightedBreakpointItem = breakpointItem;
     },
 
-    _parsedScriptSource: function(event)
+    clearBreakpointHighlight: function()
     {
-        var url = event.data.sourceURL;
-        var breakpoints = WebInspector.debuggerModel.breakpoints;
-        for (var id in breakpoints) {
-            if (!(id in this._items))
-                this._breakpointAdded({ data: breakpoints[id] });
+        if (this._highlightedBreakpointItem) {
+            this._highlightedBreakpointItem.element.removeStyleClass("breakpoint-hit");
+            delete this._highlightedBreakpointItem;
         }
     },
 
-    _breakpointEnableChanged: function(enabled, event)
+    _createBreakpointItemId: function(sourceFileId, lineNumber)
     {
-        var breakpointId = event.data;
-        var breakpointItem = this._items[breakpointId];
-        if (breakpointItem)
-            breakpointItem.checkbox.checked = enabled;
+        return sourceFileId + ":" + lineNumber;
     },
 
-    _breakpointItemCheckboxClicked: function(breakpointId, event)
+    _breakpointClicked: function(breakpoint, event)
     {
-        var breakpoint = WebInspector.debuggerModel.breakpointForId(breakpointId);
-        WebInspector.debuggerModel.updateBreakpoint(breakpointId, breakpoint.condition, event.target.checked);
+        WebInspector.panels.scripts.showSourceLine(breakpoint.sourceFileId, breakpoint.lineNumber + 1);
+    },
 
-        // Breakpoint element may have it's own click handler.
+    _breakpointCheckboxClicked: function(breakpoint, event)
+    {
+        // Breakpoint element has it's own click handler.
         event.stopPropagation();
+
+        this._model.setBreakpointEnabled(breakpoint.sourceFileId, breakpoint.lineNumber, event.target.checked);
     },
 
-    _contextMenuEventFired: function(breakpointId, event)
+    _contextMenu: function(breakpoint, event)
     {
         var contextMenu = new WebInspector.ContextMenu();
-        contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), this._removeBreakpoint.bind(this, breakpointId));
-        contextMenu.show(event);
-    },
 
-    _debuggerPaused: function(event)
-    {
-        var breakpoint = event.data.breakpoint;
-        if (!breakpoint)
-            return;
-        var breakpointItem = this._items[breakpoint.id];
-        if (!breakpointItem)
-            return;
-        breakpointItem.element.addStyleClass("breakpoint-hit");
-        this._lastHitBreakpointItem = breakpointItem;
-    },
+        var removeHandler = this._model.removeBreakpoint.bind(this._model, breakpoint.sourceFileId, breakpoint.lineNumber);
+        contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), removeHandler);
 
-    _debuggerResumed: function()
-    {
-        if (this._lastHitBreakpointItem) {
-            this._lastHitBreakpointItem.element.removeStyleClass("breakpoint-hit");
-            delete this._lastHitBreakpointItem;
-        }
+        contextMenu.show(event);
     },
 
     _addListElement: function(element, beforeElement)
@@ -183,16 +166,6 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
         }
     },
 
-    _projectChanged: function()
-    {
-        this.listElement.removeChildren();
-        if (this.listElement.parentElement) {
-            this.bodyElement.removeChild(this.listElement);
-            this.bodyElement.appendChild(this.emptyElement);
-        }
-        this._items = {};
-    },
-
     _compare: function(x, y)
     {
         if (x !== y)
@@ -205,40 +178,14 @@ WebInspector.JavaScriptBreakpointsSidebarPane.prototype = {
         return this._compare(b1.url, b2.url) || this._compare(b1.lineNumber, b2.lineNumber);
     },
 
-    _setupBreakpointElement: function(data, element)
+    reset: function()
     {
-        var sourceID;
-        var lineNumber = data.lineNumber;
-        if (data.locations.length) {
-            sourceID = data.locations[0].sourceID;
-            lineNumber = data.locations[0].lineNumber;
-        }
-
-        var displayName = data.url ? WebInspector.displayNameForURL(data.url) : WebInspector.UIString("(program)");
-        var labelElement = document.createTextNode(displayName + ":" + (lineNumber + 1));
-        element.appendChild(labelElement);
-
-        var sourceTextElement = document.createElement("div");
-        sourceTextElement.className = "source-text monospace";
-        element.appendChild(sourceTextElement);
-
-        if (sourceID) {
-            function didGetSourceLine(text)
-            {
-                sourceTextElement.textContent = text;
-            }
-            var script = WebInspector.debuggerModel.scriptForSourceID(sourceID);
-            script.sourceLine(lineNumber, didGetSourceLine.bind(this));
+        this.listElement.removeChildren();
+        if (this.listElement.parentElement) {
+            this.bodyElement.removeChild(this.listElement);
+            this.bodyElement.appendChild(this.emptyElement);
         }
-
-        element.addStyleClass("cursor-pointer");
-        var clickHandler = WebInspector.panels.scripts.showSourceLine.bind(WebInspector.panels.scripts, data.url, lineNumber + 1);
-        element.addEventListener("click", clickHandler, false);
-    },
-
-    _removeBreakpoint: function(breakpointId)
-    {
-        WebInspector.debuggerModel.removeBreakpoint(breakpointId);
+        this._items = {};
     }
 }
 
@@ -329,61 +276,177 @@ WebInspector.XHRBreakpointsSidebarPane = function()
 {
     WebInspector.NativeBreakpointsSidebarPane.call(this, WebInspector.UIString("XHR Breakpoints"));
 
-    function addButtonClicked(event)
-    {
-        event.stopPropagation();
-        this._startEditingBreakpoint(null);
-    }
+    this._breakpointElements = {};
 
     var addButton = document.createElement("button");
     addButton.className = "add";
-    addButton.addEventListener("click", addButtonClicked.bind(this), false);
+    addButton.addEventListener("click", this._addButtonClicked.bind(this), false);
     this.titleElement.appendChild(addButton);
+
+    this._restoreBreakpoints();
 }
 
 WebInspector.XHRBreakpointsSidebarPane.prototype = {
-    addBreakpointItem: function(breakpointItem)
+    _addButtonClicked: function(event)
     {
-        WebInspector.NativeBreakpointsSidebarPane.prototype.addBreakpointItem.call(this, breakpointItem);
-        breakpointItem._labelElement.addEventListener("dblclick", this._startEditingBreakpoint.bind(this, breakpointItem), false);
+        event.stopPropagation();
+
+        this.expanded = true;
+
+        var inputElement = document.createElement("span");
+        inputElement.className = "breakpoint-condition editing";
+        this._addListElement(inputElement, this.listElement.firstChild);
+
+        function finishEditing(accept, e, text)
+        {
+            this._removeListElement(inputElement);
+            if (accept) {
+                this._setBreakpoint(text, true);
+                this._saveBreakpoints();
+            }
+        }
+
+        WebInspector.startEditing(inputElement, {
+            commitHandler: finishEditing.bind(this, true),
+            cancelHandler: finishEditing.bind(this, false)
+        });
     },
 
-    _startEditingBreakpoint: function(breakpointItem)
+    _setBreakpoint: function(url, enabled)
     {
-        if (this._editingBreakpoint)
+        if (url in this._breakpointElements)
             return;
-        this._editingBreakpoint = true;
 
-        if (!this.expanded)
-            this.expanded = true;
+        var element = document.createElement("li");
+        element._url = url;
+        element.addEventListener("contextmenu", this._contextMenu.bind(this, url), true);
+
+        var checkboxElement = document.createElement("input");
+        checkboxElement.className = "checkbox-elem";
+        checkboxElement.type = "checkbox";
+        checkboxElement.checked = enabled;
+        checkboxElement.addEventListener("click", this._checkboxClicked.bind(this, url), false);
+        element._checkboxElement = checkboxElement;
+        element.appendChild(checkboxElement);
+
+        var labelElement = document.createElement("span");
+        if (!url)
+            labelElement.textContent = WebInspector.UIString("Any XHR");
+        else
+            labelElement.textContent = WebInspector.UIString("URL contains \"%s\"", url);
+        labelElement.addStyleClass("cursor-auto");
+        labelElement.addEventListener("dblclick", this._labelClicked.bind(this, url), false);
+        element.appendChild(labelElement);
+
+        var currentElement = this.listElement.firstChild;
+        while (currentElement) {
+            if (currentElement._url && currentElement._url < element._url)
+                break;
+            currentElement = currentElement.nextSibling;
+        }
+        this._addListElement(element, currentElement);
+        this._breakpointElements[url] = element;
+        if (enabled)
+            BrowserDebuggerAgent.setXHRBreakpoint(url);
+    },
+
+    _removeBreakpoint: function(url)
+    {
+        var element = this._breakpointElements[url];
+        if (!element)
+            return;
+
+        this._removeListElement(element);
+        delete this._breakpointElements[url];
+        if (element._checkboxElement.checked)
+            BrowserDebuggerAgent.removeXHRBreakpoint(url);
+    },
+
+    _contextMenu: function(url, event)
+    {
+        var contextMenu = new WebInspector.ContextMenu();
+        function removeBreakpoint()
+        {
+            this._removeBreakpoint(url);
+            this._saveBreakpoints();
+        }
+        contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), removeBreakpoint.bind(this));
+        contextMenu.show(event);
+    },
+
+    _checkboxClicked: function(url, event)
+    {
+        if (event.target.checked)
+            WebInspector.breakpointManager.setXHRBreakpoint(url);
+        else
+            WebInspector.breakpointManager.removeXHRBreakpoint(url);
+        this._saveBreakpoints();
+    },
 
+    _labelClicked: function(url)
+    {
+        var element = this._breakpointElements[url];
         var inputElement = document.createElement("span");
         inputElement.className = "breakpoint-condition editing";
-        if (breakpointItem) {
-            breakpointItem.populateEditElement(inputElement);
-            this.listElement.insertBefore(inputElement, breakpointItem.element);
-            breakpointItem.element.addStyleClass("hidden");
-        } else
-            this._addListElement(inputElement, this.listElement.firstChild);
+        inputElement.textContent = url;
+        this.listElement.insertBefore(inputElement, element);
+        element.addStyleClass("hidden");
+
+        function finishEditing(accept, e, text)
+        {
+            this._removeListElement(inputElement);
+            if (accept) {
+                this._removeBreakpoint(url);
+                this._setBreakpoint(text, element._checkboxElement.checked);
+                this._saveBreakpoints();
+            } else
+                element.removeStyleClass("hidden");
+        }
 
-        var commitHandler = this._hideEditBreakpointDialog.bind(this, inputElement, true, breakpointItem);
-        var cancelHandler = this._hideEditBreakpointDialog.bind(this, inputElement, false, breakpointItem);
         WebInspector.startEditing(inputElement, {
-            commitHandler: commitHandler,
-            cancelHandler: cancelHandler
+            commitHandler: finishEditing.bind(this, true),
+            cancelHandler: finishEditing.bind(this, false)
         });
     },
 
-    _hideEditBreakpointDialog: function(inputElement, accept, breakpointItem)
+    highlightBreakpoint: function(url)
+    {
+        var element = this._breakpointElements[url];
+        if (!element)
+            return;
+        this.expanded = true;
+        element.addStyleClass("breakpoint-hit");
+        this._highlightedElement = element;
+    },
+
+    clearBreakpointHighlight: function()
+    {
+        if (this._highlightedElement) {
+            this._highlightedElement.removeStyleClass("breakpoint-hit");
+            delete this._highlightedElement;
+        }
+    },
+
+    _saveBreakpoints: function()
+    {
+        var breakpoints = [];
+        for (var url in this._breakpointElements)
+            breakpoints.push({ url: url, enabled: this._breakpointElements[url]._checkboxElement.checked });
+        WebInspector.settings.xhrBreakpoints = breakpoints;
+    },
+
+    _restoreBreakpoints: function()
+    {
+        var breakpoints = WebInspector.settings.xhrBreakpoints;
+        for (var i = 0; i < breakpoints.length; ++i) {
+            var breakpoint = breakpoints[i];
+            if (breakpoint && typeof breakpoint.url === "string")
+                this._setBreakpoint(breakpoint.url, breakpoint.enabled);
+        }
+    },
+
+    _projectChanged: function()
     {
-        this._removeListElement(inputElement);
-        this._editingBreakpoint = false;
-        if (accept) {
-            if (breakpointItem)
-                breakpointItem.remove();
-            WebInspector.breakpointManager.createXHRBreakpoint(inputElement.textContent.toLowerCase());
-        } else if (breakpointItem)
-            breakpointItem.element.removeStyleClass("hidden");
     }
 }
 
@@ -478,13 +541,11 @@ WebInspector.EventListenerBreakpointsSidebarPane = function()
 
     this.categoriesElement = document.createElement("ol");
     this.categoriesElement.tabIndex = 0;
-    this.categoriesElement.addStyleClass("properties-tree event-listener-breakpoints");
+    this.categoriesElement.addStyleClass("properties-tree");
+    this.categoriesElement.addStyleClass("event-listener-breakpoints");
     this.categoriesTreeOutline = new TreeOutline(this.categoriesElement);
     this.bodyElement.appendChild(this.categoriesElement);
 
-    WebInspector.breakpointManager.addEventListener(WebInspector.BreakpointManager.Events.ProjectChanged, this._projectChanged, this);
-    WebInspector.breakpointManager.addEventListener(WebInspector.BreakpointManager.Events.EventListenerBreakpointAdded, this._breakpointAdded, this);
-
     this._breakpointItems = {};
     this._createCategory(WebInspector.UIString("Keyboard"), "listener", ["keydown", "keyup", "keypress", "textInput"]);
     this._createCategory(WebInspector.UIString("Mouse"), "listener", ["click", "dblclick", "mousedown", "mouseup", "mouseover", "mousemove", "mouseout", "mousewheel"]);
@@ -497,6 +558,20 @@ WebInspector.EventListenerBreakpointsSidebarPane = function()
     this._createCategory(WebInspector.UIString("DOM Mutation"), "listener", ["DOMActivate", "DOMFocusIn", "DOMFocusOut", "DOMAttrModified", "DOMCharacterDataModified", "DOMNodeInserted", "DOMNodeInsertedIntoDocument", "DOMNodeRemoved", "DOMNodeRemovedFromDocument", "DOMSubtreeModified", "DOMContentLoaded"]);
     this._createCategory(WebInspector.UIString("Device"), "listener", ["deviceorientation", "devicemotion"]);
     this._createCategory(WebInspector.UIString("Timer"), "instrumentation", ["setTimer", "clearTimer", "timerFired"]);
+
+    this._restoreBreakpoints();
+}
+
+WebInspector.EventListenerBreakpointsSidebarPane.eventNameForUI = function(eventName)
+{
+    if (!WebInspector.EventListenerBreakpointsSidebarPane._eventNamesForUI) {
+        WebInspector.EventListenerBreakpointsSidebarPane._eventNamesForUI = {
+            "instrumentation:setTimer": WebInspector.UIString("Set Timer"),
+            "instrumentation:clearTimer": WebInspector.UIString("Clear Timer"),
+            "instrumentation:timerFired": WebInspector.UIString("Timer Fired")
+        };
+    }
+    return WebInspector.EventListenerBreakpointsSidebarPane._eventNamesForUI[eventName] || eventName.substring(eventName.indexOf(":") + 1);
 }
 
 WebInspector.EventListenerBreakpointsSidebarPane.prototype = {
@@ -516,7 +591,7 @@ WebInspector.EventListenerBreakpointsSidebarPane.prototype = {
             var eventName = type + ":" + eventNames[i];
 
             var breakpointItem = {};
-            var title = WebInspector.EventListenerBreakpointView.eventNameForUI(eventName);
+            var title = WebInspector.EventListenerBreakpointsSidebarPane.eventNameForUI(eventName);
             breakpointItem.element = new TreeElement(title);
             categoryItem.element.appendChild(breakpointItem.element);
             var hitMarker = document.createElement("div");
@@ -526,9 +601,8 @@ WebInspector.EventListenerBreakpointsSidebarPane.prototype = {
             breakpointItem.element.selectable = true;
 
             breakpointItem.checkbox = this._createCheckbox(breakpointItem.element);
-            breakpointItem.checkbox.addEventListener("click", this._breakpointCheckboxClicked.bind(this, breakpointItem), true);
+            breakpointItem.checkbox.addEventListener("click", this._breakpointCheckboxClicked.bind(this, eventName), true);
             breakpointItem.parent = categoryItem;
-            breakpointItem.eventName = eventName;
 
             this._breakpointItems[eventName] = breakpointItem;
             categoryItem.children[eventName] = breakpointItem;
@@ -549,54 +623,47 @@ WebInspector.EventListenerBreakpointsSidebarPane.prototype = {
         var checked = categoryItem.checkbox.checked;
         for (var eventName in categoryItem.children) {
             var breakpointItem = categoryItem.children[eventName];
-            if (breakpointItem.checkbox.checked !== checked) {
-                breakpointItem.checkbox.checked = checked;
-                this._breakpointCheckboxClicked(breakpointItem);
-            }
+            if (breakpointItem.checkbox.checked === checked)
+                continue;
+            if (checked)
+                this._setBreakpoint(eventName);
+            else
+                this._removeBreakpoint(eventName);
         }
+        this._saveBreakpoints();
     },
 
-    _breakpointCheckboxClicked: function(breakpointItem)
+    _breakpointCheckboxClicked: function(eventName, event)
     {
-        if (breakpointItem.checkbox.checked)
-            WebInspector.breakpointManager.createEventListenerBreakpoint(breakpointItem.eventName);
+        if (event.target.checked)
+            this._setBreakpoint(eventName);
         else
-            breakpointItem.breakpoint.remove();
+            this._removeBreakpoint(eventName);
+        this._saveBreakpoints();
     },
 
-    _breakpointAdded: function(event)
+    _setBreakpoint: function(eventName)
     {
-        var breakpoint = event.data;
-
-        var breakpointItem = this._breakpointItems[breakpoint.eventName];
-        breakpointItem.breakpoint = breakpoint;
-        breakpoint.addEventListener("hit-state-changed", this._breakpointHitStateChanged.bind(this, breakpointItem));
-        breakpoint.addEventListener("removed", this._breakpointRemoved.bind(this, breakpointItem));
+        var breakpointItem = this._breakpointItems[eventName];
+        if (!breakpointItem)
+            return;
         breakpointItem.checkbox.checked = true;
-        this._updateCategoryCheckbox(breakpointItem);
+        BrowserDebuggerAgent.setEventListenerBreakpoint(eventName);
+        this._updateCategoryCheckbox(breakpointItem.parent);
     },
 
-    _breakpointHitStateChanged: function(breakpointItem, event)
+    _removeBreakpoint: function(eventName)
     {
-        if (event.target.hit) {
-            this.expanded = true;
-            var categoryItem = breakpointItem.parent;
-            categoryItem.element.expand();
-            breakpointItem.element.listItemElement.addStyleClass("breakpoint-hit");
-        } else
-            breakpointItem.element.listItemElement.removeStyleClass("breakpoint-hit");
-    },
-
-    _breakpointRemoved: function(breakpointItem)
-    {
-        breakpointItem.breakpoint = null;
+        var breakpointItem = this._breakpointItems[eventName];
+        if (!breakpointItem)
+            return;
         breakpointItem.checkbox.checked = false;
-        this._updateCategoryCheckbox(breakpointItem);
+        BrowserDebuggerAgent.removeEventListenerBreakpoint(eventName);
+        this._updateCategoryCheckbox(breakpointItem.parent);
     },
 
-    _updateCategoryCheckbox: function(breakpointItem)
+    _updateCategoryCheckbox: function(categoryItem)
     {
-        var categoryItem = breakpointItem.parent;
         var hasEnabled = false, hasDisabled = false;
         for (var eventName in categoryItem.children) {
             var breakpointItem = categoryItem.children[eventName];
@@ -609,13 +676,42 @@ WebInspector.EventListenerBreakpointsSidebarPane.prototype = {
         categoryItem.checkbox.indeterminate = hasEnabled && hasDisabled;
     },
 
-    _projectChanged: function()
+    highlightBreakpoint: function(eventName)
     {
+        var breakpointItem = this._breakpointItems[eventName];
+        if (!breakpointItem)
+            return;
+        this.expanded = true;
+        breakpointItem.parent.element.expand();
+        breakpointItem.element.listItemElement.addStyleClass("breakpoint-hit");
+        this._highlightedElement = breakpointItem.element.listItemElement;
+    },
+
+    clearBreakpointHighlight: function()
+    {
+        if (this._highlightedElement) {
+            this._highlightedElement.removeStyleClass("breakpoint-hit");
+            delete this._highlightedElement;
+        }
+    },
+
+    _saveBreakpoints: function()
+    {
+        var breakpoints = [];
         for (var eventName in this._breakpointItems) {
-            var breakpointItem = this._breakpointItems[eventName];
-            breakpointItem.breakpoint = null;
-            breakpointItem.checkbox.checked = false;
-            this._updateCategoryCheckbox(breakpointItem);
+            if (this._breakpointItems[eventName].checkbox.checked)
+                breakpoints.push({ eventName: eventName });
+        }
+        WebInspector.settings.eventListenerBreakpoints = breakpoints;
+    },
+
+    _restoreBreakpoints: function()
+    {
+        var breakpoints = WebInspector.settings.eventListenerBreakpoints;
+        for (var i = 0; i < breakpoints.length; ++i) {
+            var breakpoint = breakpoints[i];
+            if (breakpoint && typeof breakpoint.eventName === "string")
+                this._setBreakpoint(breakpoint.eventName);
         }
     }
 }
diff --git a/Source/WebCore/inspector/front-end/CSSStyleModel.js b/Source/WebCore/inspector/front-end/CSSStyleModel.js
index 700417e..148bfd8 100644
--- a/Source/WebCore/inspector/front-end/CSSStyleModel.js
+++ b/Source/WebCore/inspector/front-end/CSSStyleModel.js
@@ -43,9 +43,9 @@ WebInspector.CSSStyleModel.parseRuleArrayPayload = function(ruleArray)
 WebInspector.CSSStyleModel.prototype = {
     getStylesAsync: function(nodeId, userCallback)
     {
-        function callback(userCallback, payload)
+        function callback(userCallback, error, payload)
         {
-            if (!payload) {
+            if (error) {
                 if (userCallback)
                     userCallback(null);
                 return;
@@ -59,8 +59,11 @@ WebInspector.CSSStyleModel.prototype = {
             result.matchedCSSRules = WebInspector.CSSStyleModel.parseRuleArrayPayload(payload.matchedCSSRules);
 
             result.styleAttributes = {};
-            for (var name in payload.styleAttributes)
-                result.styleAttributes[name] = WebInspector.CSSStyleDeclaration.parsePayload(payload.styleAttributes[name]);
+            var payloadStyleAttributes = payload.styleAttributes;
+            for (var i = 0; i < payloadStyleAttributes.length; ++i) {
+                var name = payloadStyleAttributes[i].name;
+                result.styleAttributes[name] = WebInspector.CSSStyleDeclaration.parsePayload(payloadStyleAttributes[i].style);
+            }
 
             result.pseudoElements = [];
             for (var i = 0; i < payload.pseudoElements.length; ++i) {
@@ -88,9 +91,9 @@ WebInspector.CSSStyleModel.prototype = {
 
     getComputedStyleAsync: function(nodeId, userCallback)
     {
-        function callback(userCallback, stylePayload)
+        function callback(userCallback, error, stylePayload)
         {
-            if (!stylePayload)
+            if (error)
                 userCallback(null);
             else
                 userCallback(WebInspector.CSSStyleDeclaration.parsePayload(stylePayload));
@@ -101,9 +104,9 @@ WebInspector.CSSStyleModel.prototype = {
 
     getInlineStyleAsync: function(nodeId, userCallback)
     {
-        function callback(userCallback, stylePayload)
+        function callback(userCallback, error, stylePayload)
         {
-            if (!stylePayload)
+            if (error)
                 userCallback(null);
             else
                 userCallback(WebInspector.CSSStyleDeclaration.parsePayload(stylePayload));
@@ -114,28 +117,31 @@ WebInspector.CSSStyleModel.prototype = {
 
     setRuleSelector: function(ruleId, nodeId, newSelector, successCallback, failureCallback)
     {
-        function checkAffectsCallback(nodeId, successCallback, rulePayload, selectedNodeIds)
+        function checkAffectsCallback(nodeId, successCallback, rulePayload, error, selectedNodeIds)
         {
+            if (error)
+                return;
             var doesAffectSelectedNode = (selectedNodeIds.indexOf(nodeId) >= 0);
             var rule = WebInspector.CSSRule.parsePayload(rulePayload);
             successCallback(rule, doesAffectSelectedNode);
             this._styleSheetChanged(rule.id.styleSheetId, true);
         }
 
-        function callback(nodeId, successCallback, failureCallback, newSelector, rulePayload)
+        function callback(nodeId, successCallback, failureCallback, error, newSelector, rulePayload)
         {
-            if (!rulePayload)
+            // FIXME: looks like rulePayload is always null.
+            if (error)
                 failureCallback();
             else
                 DOMAgent.querySelectorAll(nodeId, newSelector, true, checkAffectsCallback.bind(this, nodeId, successCallback, rulePayload));
         }
 
-        CSSAgent.setRuleSelector(ruleId, newSelector, callback.bind(this, nodeId, successCallback, failureCallback));
+        CSSAgent.setRuleSelector(ruleId, newSelector, callback.bind(this, nodeId, successCallback, failureCallback, newSelector));
     },
 
     addRule: function(nodeId, selector, successCallback, failureCallback)
     {
-        function checkAffectsCallback(nodeId, successCallback, rulePayload, selectedNodeIds)
+        function checkAffectsCallback(nodeId, successCallback, rulePayload, error, selectedNodeIds)
         {
             var doesAffectSelectedNode = (selectedNodeIds.indexOf(nodeId) >= 0);
             var rule = WebInspector.CSSRule.parsePayload(rulePayload);
@@ -143,9 +149,9 @@ WebInspector.CSSStyleModel.prototype = {
             this._styleSheetChanged(rule.id.styleSheetId, true);
         }
 
-        function callback(successCallback, failureCallback, selector, rulePayload)
+        function callback(successCallback, failureCallback, selector, error, rulePayload)
         {
-            if (!rulePayload) {
+            if (error) {
                 // Invalid syntax for a selector
                 failureCallback();
             } else
@@ -160,21 +166,26 @@ WebInspector.CSSStyleModel.prototype = {
         if (!majorChange || !styleSheetId)
             return;
 
-        function callback(href, content)
+        function callback(error, href, content)
         {
+            if (error)
+                return;
             var resource = WebInspector.resourceForURL(href);
-            if (resource && resource.type === WebInspector.Resource.Type.Stylesheet)
+            if (resource && resource.type === WebInspector.Resource.Type.Stylesheet) {
                 resource.setContent(content, this._onRevert.bind(this, styleSheetId));
+                this.dispatchEventToListeners("stylesheet changed");
+            }
         }
         CSSAgent.getStyleSheetText(styleSheetId, callback.bind(this));
     },
 
     _onRevert: function(styleSheetId, contentToRevertTo)
     {
-        function callback(success)
+        function callback(error, success)
         {
+            if (error)
+                return;
             this._styleSheetChanged(styleSheetId, true);
-            this.dispatchEventToListeners("stylesheet changed");
         }
         CSSAgent.setStyleSheetText(styleSheetId, contentToRevertTo, callback.bind(this));
     }
@@ -335,12 +346,12 @@ WebInspector.CSSStyleDeclaration.prototype = {
 
     insertPropertyAt: function(index, name, value, userCallback)
     {
-        function callback(userCallback, payload)
+        function callback(userCallback, error, payload)
         {
             if (!userCallback)
                 return;
 
-            if (!payload)
+            if (error)
                 userCallback(null);
             else {
                 userCallback(WebInspector.CSSStyleDeclaration.parsePayload(payload));
@@ -412,8 +423,14 @@ WebInspector.CSSProperty = function(ownerStyle, index, name, value, priority, st
 
 WebInspector.CSSProperty.parsePayload = function(ownerStyle, index, payload)
 {
+    // The following default field values are used in the payload:
+    // priority: ""
+    // parsedOk: true
+    // implicit: false
+    // status: "style"
+    // shorthandName: ""
     var result = new WebInspector.CSSProperty(
-        ownerStyle, index, payload.name, payload.value, payload.priority, payload.status, payload.parsedOk, payload.implicit, payload.shorthandName, payload.text);
+        ownerStyle, index, payload.name, payload.value, payload.priority || "", payload.status || "style", ("parsedOk" in payload) ? payload.parsedOk : true, !!payload.implicit, payload.shorthandName || "", payload.text);
     return result;
 }
 
@@ -464,9 +481,9 @@ WebInspector.CSSProperty.prototype = {
                 userCallback(style);
         }
 
-        function callback(stylePayload)
+        function callback(error, stylePayload)
         {
-            if (stylePayload) {
+            if (!error && stylePayload) {
                 this.text = propertyText;
                 var style = WebInspector.CSSStyleDeclaration.parsePayload(stylePayload);
                 var newProperty = style.allProperties[this.index];
@@ -504,11 +521,11 @@ WebInspector.CSSProperty.prototype = {
         if (disabled === this.disabled && userCallback)
             userCallback(this.ownerStyle);
 
-        function callback(stylePayload)
+        function callback(error, stylePayload)
         {
             if (!userCallback)
                 return;
-            if (!stylePayload)
+            if (error)
                 userCallback(null);
             else {
                 var style = WebInspector.CSSStyleDeclaration.parsePayload(stylePayload);
@@ -524,9 +541,6 @@ WebInspector.CSSProperty.prototype = {
 WebInspector.CSSStyleSheet = function(payload)
 {
     this.id = payload.styleSheetId;
-    this.sourceURL = payload.sourceURL;
-    this.title = payload.title;
-    this.disabled = payload.disabled;
     this.rules = [];
     this.styles = {};
     for (var i = 0; i < payload.rules.length; ++i) {
@@ -541,9 +555,9 @@ WebInspector.CSSStyleSheet = function(payload)
 
 WebInspector.CSSStyleSheet.createForId = function(styleSheetId, userCallback)
 {
-    function callback(styleSheetPayload)
+    function callback(error, styleSheetPayload)
     {
-        if (!styleSheetPayload)
+        if (error)
             userCallback(null);
         else
             userCallback(new WebInspector.CSSStyleSheet(styleSheetPayload));
@@ -559,14 +573,12 @@ WebInspector.CSSStyleSheet.prototype = {
 
     setText: function(newText, userCallback)
     {
-        function callback(styleSheetPayload)
+        function callback(error, isChangeSuccessful)
         {
-            if (!styleSheetPayload)
-                userCallback(null);
-            else {
-                userCallback(new WebInspector.CSSStyleSheet(styleSheetPayload));
-                WebInspector.cssModel._styleSheetChanged(this.id, true);
-            }
+             if (userCallback)
+                 userCallback(isChangeSuccessful);
+             if (isChangeSuccessful)
+                 WebInspector.cssModel._styleSheetChanged(this.id, true);
         }
 
         CSSAgent.setStyleSheetText(this.id, newText, callback.bind(this));
diff --git a/Source/WebCore/inspector/front-end/CallStackSidebarPane.js b/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
index e1618b2..3d71101 100644
--- a/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/CallStackSidebarPane.js
@@ -27,16 +27,18 @@ WebInspector.CallStackSidebarPane = function(model)
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Call Stack"));
     this._model = model;
+
+    this.bodyElement.addEventListener("contextmenu", this._contextMenu.bind(this), true);
 }
 
 WebInspector.CallStackSidebarPane.prototype = {
-    update: function(details)
+    update: function(callFrames, details)
     {
         this.bodyElement.removeChildren();
 
         this.placards = [];
 
-        if (!details) {
+        if (!callFrames) {
             var infoElement = document.createElement("div");
             infoElement.className = "info";
             infoElement.textContent = WebInspector.UIString("Not Paused");
@@ -44,7 +46,6 @@ WebInspector.CallStackSidebarPane.prototype = {
             return;
         }
 
-        var callFrames = details.callFrames;
         var title;
         var subtitle;
         var script;
@@ -60,36 +61,38 @@ WebInspector.CallStackSidebarPane.prototype = {
                 break;
             }
 
-            script = WebInspector.debuggerModel.scriptForSourceID(callFrame.sourceID);
-            if (script)
-                subtitle = WebInspector.displayNameForURL(script.sourceURL);
+            var subtitle;
+            if (!callFrame.isInternalScript)
+                subtitle = WebInspector.displayNameForURL(callFrame.url);
             else
                 subtitle = WebInspector.UIString("(internal script)");
 
-            if (subtitle)
-                subtitle += ":" + (callFrame.line + 1);
-            else
-                subtitle = WebInspector.UIString("line %d", callFrame.line + 1);
-
             var placard = new WebInspector.Placard(title, subtitle);
             placard.callFrame = callFrame;
-
-            placard.element.addEventListener("click", this._placardSelected.bind(this), false);
+            placard.element.addEventListener("click", this._placardSelected.bind(this, placard), false);
+
+            function didGetSourceLocation(placard, sourceFileId, lineNumber, columnNumber)
+            {
+                if (placard.subtitle)
+                    placard.subtitle += ":" + (lineNumber + 1);
+                else
+                    placard.subtitle = WebInspector.UIString("line %d", lineNumber + 1);
+                placard._text = WebInspector.UIString("%s() at %s", placard.title, placard.subtitle);
+            }
+            callFrame.sourceLocation(didGetSourceLocation.bind(this, placard));
 
             this.placards.push(placard);
             this.bodyElement.appendChild(placard.element);
         }
 
-        if (details.breakpoint)
-            this._scriptBreakpointHit();
-        else if (details.eventType === WebInspector.DebuggerEventTypes.NativeBreakpoint)
-            this._nativeBreakpointHit(details.eventData);
+        if (details.eventType === WebInspector.DebuggerEventTypes.NativeBreakpoint) {
+            if (details.eventData.breakpointType === WebInspector.BreakpointManager.BreakpointTypes.DOM)
+                this._domBreakpointHit(details.eventData);
+        }
     },
 
     set selectedCallFrame(x)
     {
-        this._model.selectedCallFrame = x;
-
         for (var i = 0; i < this.placards.length; ++i) {
             var placard = this.placards[i];
             placard.selected = (placard.callFrame === x);
@@ -142,10 +145,27 @@ WebInspector.CallStackSidebarPane.prototype = {
         return -1;
     },
 
-    _placardSelected: function(event)
+    _placardSelected: function(placard, event)
+    {
+        this._model.selectedCallFrame = placard.callFrame;
+    },
+
+    _contextMenu: function(event)
+    {
+        if (!this.placards.length)
+            return;
+
+        var contextMenu = new WebInspector.ContextMenu();
+        contextMenu.appendItem(WebInspector.UIString("Copy Stack Trace"), this._copyStackTrace.bind(this));
+        contextMenu.show(event);
+    },
+
+    _copyStackTrace: function()
     {
-        var placardElement = event.target.enclosingNodeOrSelfWithClass("placard");
-        this.selectedCallFrame = placardElement.placard.callFrame;
+        var text = "";
+        for (var i = 0; i < this.placards.length; ++i)
+            text += this.placards[i]._text;
+        InspectorFrontendHost.copyText(text);
     },
 
     registerShortcuts: function(section)
@@ -163,15 +183,15 @@ WebInspector.CallStackSidebarPane.prototype = {
         section.addRelatedKeys([ nextCallFrame.name, prevCallFrame.name ], WebInspector.UIString("Next/previous call frame"));
     },
 
-    _scriptBreakpointHit: function()
+    setStatus: function(status)
     {
         var statusMessageElement = document.createElement("div");
         statusMessageElement.className = "info";
-        statusMessageElement.appendChild(document.createTextNode(WebInspector.UIString("Paused on a JavaScript breakpoint.")));
+        statusMessageElement.textContent = status;
         this.bodyElement.appendChild(statusMessageElement);
     },
 
-    _nativeBreakpointHit: function(eventData)
+    _domBreakpointHit: function(eventData)
     {
         var breakpoint = WebInspector.breakpointManager.breakpointViewForEventData(eventData);
         if (!breakpoint)
diff --git a/Source/WebCore/inspector/front-end/Color.js b/Source/WebCore/inspector/front-end/Color.js
index 5e7314c..73e47d4 100644
--- a/Source/WebCore/inspector/front-end/Color.js
+++ b/Source/WebCore/inspector/front-end/Color.js
@@ -597,7 +597,7 @@ WebInspector.Color.Nicknames = {
     "mediumaquamarine": "66CDAA",
     "mediumblue": "0000CD",
     "mediumorchid": "BA55D3",
-    "mediumpurple": "9370D8",
+    "mediumpurple": "9370DB",
     "mediumseagreen": "3CB371",
     "mediumslateblue": "7B68EE",
     "mediumspringgreen": "00FA9A",
@@ -618,7 +618,7 @@ WebInspector.Color.Nicknames = {
     "palegoldenrod": "EEE8AA",
     "palegreen": "98FB98",
     "paleturquoise": "AFEEEE",
-    "palevioletred": "D87093",
+    "palevioletred": "DB7093",
     "papayawhip": "FFEFD5",
     "peachpuff": "FFDAB9",
     "peru": "CD853F",
diff --git a/Source/WebCore/inspector/front-end/ConsoleView.js b/Source/WebCore/inspector/front-end/ConsoleView.js
index f59d87f..f3e3425 100644
--- a/Source/WebCore/inspector/front-end/ConsoleView.js
+++ b/Source/WebCore/inspector/front-end/ConsoleView.js
@@ -105,7 +105,7 @@ WebInspector.ConsoleView.prototype = {
     _registerConsoleDomainDispatcher: function() {
         var console = this;
         var dispatcher = {
-            addConsoleMessage: function(payload)
+            consoleMessage: function(payload)
             {
                 var consoleMessage = new WebInspector.ConsoleMessage(
                     payload.source,
@@ -121,13 +121,7 @@ WebInspector.ConsoleView.prototype = {
                 console.addMessage(consoleMessage);
             },
 
-            updateConsoleMessageExpiredCount: function(count)
-            {
-                var message = String.sprintf(WebInspector.UIString("%d console messages are not shown."), count);
-                console.addMessage(WebInspector.ConsoleMessage.createTextMessage(message, WebInspector.ConsoleMessage.MessageLevel.Warning));
-            },
-
-            updateConsoleMessageRepeatCount: function(count)
+            consoleMessageRepeatCountUpdated: function(count)
             {
                 var msg = console.previousMessage;
                 var prevRepeatCount = msg.totalRepeatCount;
@@ -154,6 +148,14 @@ WebInspector.ConsoleView.prototype = {
         InspectorBackend.registerDomainDispatcher("Console", dispatcher);
     },
 
+    setConsoleMessageExpiredCount: function(count)
+    {
+        if (count) {
+            var message = String.sprintf(WebInspector.UIString("%d console messages are not shown."), count);
+            this.addMessage(WebInspector.ConsoleMessage.createTextMessage(message, WebInspector.ConsoleMessage.MessageLevel.Warning));
+        }
+    },
+
     _updateFilter: function(e)
     {
         var isMac = WebInspector.isMac();
@@ -298,7 +300,8 @@ WebInspector.ConsoleView.prototype = {
             this.currentGroup.addMessage(msg);
         }
 
-        if (shouldScrollToLastMessage)
+        // Always scroll when command result arrives.
+        if (shouldScrollToLastMessage || (msg instanceof WebInspector.ConsoleCommandResult))
             this._scheduleScrollIntoView();
     },
 
@@ -364,7 +367,7 @@ WebInspector.ConsoleView.prototype = {
 
         function evaluatedProperties(properties)
         {
-            RuntimeAgent.releaseObjectGroup(0, "completion");
+            RuntimeAgent.releaseObjectGroup("completion");
             var propertyNames = [];
             for (var i = 0; properties && i < properties.length; ++i)
                 propertyNames.push(properties[i].name);
@@ -531,9 +534,10 @@ WebInspector.ConsoleView.prototype = {
             expression = "this";
         }
 
-        function evalCallback(result)
+        function evalCallback(error, result)
         {
-            callback(WebInspector.RemoteObject.fromPayload(result));
+            if (!error)
+                callback(WebInspector.RemoteObject.fromPayload(result));
         }
         RuntimeAgent.evaluate(expression, objectGroup, includeCommandLineAPI, evalCallback);
     },
diff --git a/Source/WebCore/inspector/front-end/CookieItemsView.js b/Source/WebCore/inspector/front-end/CookieItemsView.js
index c8187bb..6bf3326 100644
--- a/Source/WebCore/inspector/front-end/CookieItemsView.js
+++ b/Source/WebCore/inspector/front-end/CookieItemsView.js
@@ -140,7 +140,7 @@ WebInspector.CookieItemsView.prototype = {
 
     _deleteCookie: function(cookie)
     {
-        InspectorAgent.deleteCookie(cookie.name, this._cookieDomain);
+        PageAgent.deleteCookie(cookie.name, this._cookieDomain);
         this._update();
     },
 
@@ -199,3 +199,57 @@ WebInspector.SimpleCookiesTable.prototype = {
             this._dataGrid.updateWidths();
     }
 }
+
+
+WebInspector.Cookies = {}
+
+WebInspector.Cookies.getCookiesAsync = function(callback)
+{
+    function mycallback(error, cookies, cookiesString)
+    {
+        if (error)
+            return;
+        if (cookiesString)
+            callback(WebInspector.Cookies.buildCookiesFromString(cookiesString), false);
+        else
+            callback(cookies, true);
+    }
+
+    PageAgent.getCookies(mycallback);
+}
+
+WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
+{
+    var rawCookies = rawCookieString.split(/;\s*/);
+    var cookies = [];
+
+    if (!(/^\s*$/.test(rawCookieString))) {
+        for (var i = 0; i < rawCookies.length; ++i) {
+            var cookie = rawCookies[i];
+            var delimIndex = cookie.indexOf("=");
+            var name = cookie.substring(0, delimIndex);
+            var value = cookie.substring(delimIndex + 1);
+            var size = name.length + value.length;
+            cookies.push({ name: name, value: value, size: size });
+        }
+    }
+
+    return cookies;
+}
+
+WebInspector.Cookies.cookieMatchesResourceURL = function(cookie, resourceURL)
+{
+    var url = resourceURL.asParsedURL();
+    if (!url || !this.cookieDomainMatchesResourceDomain(cookie.domain, url.host))
+        return false;
+    return (url.path.indexOf(cookie.path) === 0
+        && (!cookie.port || url.port == cookie.port)
+        && (!cookie.secure || url.scheme === "https"));
+}
+
+WebInspector.Cookies.cookieDomainMatchesResourceDomain = function(cookieDomain, resourceDomain)
+{
+    if (cookieDomain.charAt(0) !== '.')
+        return resourceDomain === cookieDomain;
+    return !!resourceDomain.match(new RegExp("^([^\\.]+\\.)?" + cookieDomain.substring(1).escapeForRegExp() + "$"), "i");
+}
diff --git a/Source/WebCore/inspector/front-end/DOMAgent.js b/Source/WebCore/inspector/front-end/DOMAgent.js
index cb28aba..a2a9c2d 100644
--- a/Source/WebCore/inspector/front-end/DOMAgent.js
+++ b/Source/WebCore/inspector/front-end/DOMAgent.js
@@ -33,13 +33,12 @@ WebInspector.DOMNode = function(doc, payload) {
     this.ownerDocument = doc;
 
     this.id = payload.id;
-    this.nodeType = payload.nodeType;
-    this.nodeName = payload.nodeName;
-    this.localName = payload.localName;
+    this._nodeType = payload.nodeType;
+    this._nodeName = payload.nodeName;
+    this._localName = payload.localName;
     this._nodeValue = payload.nodeValue;
-    this.textContent = this.nodeValue;
 
-    this.attributes = [];
+    this._attributes = [];
     this._attributesMap = {};
     if (payload.attributes)
         this._setAttributesPayload(payload.attributes);
@@ -62,21 +61,21 @@ WebInspector.DOMNode = function(doc, payload) {
 
     this.breakpoints = {};
 
-    if (this.nodeType === Node.ELEMENT_NODE) {
+    if (this._nodeType === Node.ELEMENT_NODE) {
         // HTML and BODY from internal iframes should not overwrite top-level ones.
-        if (!this.ownerDocument.documentElement && this.nodeName === "HTML")
+        if (!this.ownerDocument.documentElement && this._nodeName === "HTML")
             this.ownerDocument.documentElement = this;
-        if (!this.ownerDocument.body && this.nodeName === "BODY")
+        if (!this.ownerDocument.body && this._nodeName === "BODY")
             this.ownerDocument.body = this;
         if (payload.documentURL)
             this.documentURL = payload.documentURL;
-    } else if (this.nodeType === Node.DOCUMENT_TYPE_NODE) {
+    } else if (this._nodeType === Node.DOCUMENT_TYPE_NODE) {
         this.publicId = payload.publicId;
         this.systemId = payload.systemId;
         this.internalSubset = payload.internalSubset;
-    } else if (this.nodeType === Node.DOCUMENT_NODE) {
+    } else if (this._nodeType === Node.DOCUMENT_NODE) {
         this.documentURL = payload.documentURL;
-    } else if (this.nodeType === Node.ATTRIBUTE_NODE) {
+    } else if (this._nodeType === Node.ATTRIBUTE_NODE) {
         this.name = payload.name;
         this.value = payload.value;
     }
@@ -85,7 +84,7 @@ WebInspector.DOMNode = function(doc, payload) {
 WebInspector.DOMNode.prototype = {
     hasAttributes: function()
     {
-        return this.attributes.length > 0;
+        return this._attributes.length > 0;
     },
 
     hasChildNodes: function()
@@ -93,14 +92,34 @@ WebInspector.DOMNode.prototype = {
         return this._childNodeCount > 0;
     },
 
-    get nodeValue() {
+    nodeType: function()
+    {
+        return this._nodeType;
+    },
+
+    nodeName: function()
+    {
+        return this._nodeName;
+    },
+
+    setNodeName: function(name, callback)
+    {
+        DOMAgent.setNodeName(this.id, name, callback);
+    },
+
+    localName: function()
+    {
+        return this._localName;
+    },
+
+    nodeValue: function()
+    {
         return this._nodeValue;
     },
 
-    set nodeValue(value) {
-        if (this.nodeType != Node.TEXT_NODE)
-            return;
-        this.ownerDocument._domAgent.setTextNodeValueAsync(this, value, function() {});
+    setNodeValue: function(value, callback)
+    {
+        DOMAgent.setNodeValue(this.id, value, callback);
     },
 
     getAttribute: function(name)
@@ -109,42 +128,95 @@ WebInspector.DOMNode.prototype = {
         return attr ? attr.value : undefined;
     },
 
-    setAttribute: function(name, value)
+    setAttribute: function(name, value, callback)
     {
-        var self = this;
-        var callback = function()
+        function mycallback(error)
         {
-            var attr = self._attributesMap[name];
-            if (attr)
-                attr.value = value;
-            else
-                attr = self._addAttribute(name, value);
-        };
-        this.ownerDocument._domAgent.setAttributeAsync(this, name, value, callback);
+            if (!error) {
+                var attr = this._attributesMap[name];
+                if (attr)
+                    attr.value = value;
+                else
+                    attr = this._addAttribute(name, value);
+            }
+
+            if (callback)
+                callback();
+        }
+        DOMAgent.setAttribute(this.id, name, value, mycallback.bind(this));
     },
 
-    removeAttribute: function(name)
+    attributes: function()
     {
-        var self = this;
-        var callback = function()
+        return this._attributes;
+    },
+
+    removeAttribute: function(name, callback)
+    {
+        function mycallback(error, success)
         {
-            delete self._attributesMap[name];
-            for (var i = 0;  i < self.attributes.length; ++i) {
-                if (self.attributes[i].name == name) {
-                    self.attributes.splice(i, 1);
-                    break;
+            if (!error) {
+                delete this._attributesMap[name];
+                for (var i = 0;  i < this._attributes.length; ++i) {
+                    if (this._attributes[i].name === name) {
+                        this._attributes.splice(i, 1);
+                        break;
+                    }
                 }
             }
-        };
-        this.ownerDocument._domAgent.removeAttributeAsync(this, name, callback);
+
+            if (callback)
+                callback();
+        }
+        DOMAgent.removeAttribute(this.id, name, mycallback.bind(this));
+    },
+
+    getChildNodes: function(callback)
+    {
+        if (this.children) {
+            if (callback)
+                callback(this.children);
+            return;
+        }
+
+        function mycallback(error) {
+            if (!error && callback)
+                callback(this.children);
+        }
+        DOMAgent.getChildNodes(this.id, mycallback.bind(this));
+    },
+
+    getOuterHTML: function(callback)
+    {
+        DOMAgent.getOuterHTML(this.id, callback);
+    },
+
+    setOuterHTML: function(html, callback)
+    {
+        DOMAgent.setOuterHTML(this.id, html, callback);
+    },
+
+    removeNode: function(callback)
+    {
+        DOMAgent.removeNode(this.id, callback);
+    },
+
+    copyNode: function(callback)
+    {
+        DOMAgent.copyNode(this.id, callback);
+    },
+
+    eventListeners: function(callback)
+    {
+        DOMAgent.getEventListenersForNode(this.id, callback);
     },
 
     path: function()
     {
         var path = [];
         var node = this;
-        while (node && "index" in node && node.nodeName.length) {
-            path.push([node.index, node.nodeName]);
+        while (node && "index" in node && node._nodeName.length) {
+            path.push([node.index, node._nodeName]);
             node = node.parentNode;
         }
         path.reverse();
@@ -153,7 +225,7 @@ WebInspector.DOMNode.prototype = {
 
     _setAttributesPayload: function(attrs)
     {
-        this.attributes = [];
+        this._attributes = [];
         this._attributesMap = {};
         for (var i = 0; i < attrs.length; i += 2)
             this._addAttribute(attrs[i], attrs[i + 1]);
@@ -219,7 +291,7 @@ WebInspector.DOMNode.prototype = {
             "_node": this
         };
         this._attributesMap[name] = attr;
-        this.attributes.push(attr);
+        this._attributes.push(attr);
     }
 }
 
@@ -230,42 +302,6 @@ WebInspector.DOMDocument = function(domAgent, payload)
     this._domAgent = domAgent;
 }
 
-WebInspector.DOMDocument.prototype = {
-
-    addEventListener: function(name, callback)
-    {
-        var listeners = this._listeners[name];
-        if (!listeners) {
-            listeners = [];
-            this._listeners[name] = listeners;
-        }
-        listeners.push(callback);
-    },
-
-    removeEventListener: function(name, callback)
-    {
-        var listeners = this._listeners[name];
-        if (!listeners)
-            return;
-
-        var index = listeners.indexOf(callback);
-        if (index != -1)
-            listeners.splice(index, 1);
-    },
-
-    _fireDomEvent: function(name, event)
-    {
-        var listeners = this._listeners[name];
-        if (!listeners)
-            return;
-
-        for (var i = 0; i < listeners.length; ++i) {
-            var listener = listeners[i];
-            listener.call(this, event);
-        }
-    }
-}
-
 WebInspector.DOMDocument.prototype.__proto__ = WebInspector.DOMNode.prototype;
 
 WebInspector.DOMAgent = function() {
@@ -274,101 +310,84 @@ WebInspector.DOMAgent = function() {
     InspectorBackend.registerDomainDispatcher("DOM", new WebInspector.DOMDispatcher(this));
 }
 
+WebInspector.DOMAgent.Events = {
+    AttrModified: "AttrModified",
+    CharacterDataModified: "CharacterDataModified",
+    NodeInserted: "NodeInserted",
+    NodeRemoved: "NodeRemoved",
+    DocumentUpdated: "DocumentUpdated",
+    ChildNodeCountUpdated: "ChildNodeCountUpdated"
+}
+
 WebInspector.DOMAgent.prototype = {
     requestDocument: function(callback)
     {
         if (this._document) {
             if (callback)
                 callback(this._document);
-        } else
-            this._documentUpdated(callback);
+            return;
+        }
+
+        function mycallback(error, root)
+        {
+            if (!error)
+                this._setDocument(root);
+
+            if (callback)
+                callback(this._document);
+        }
+        DOMAgent.getDocument(mycallback.bind(this));
     },
 
     pushNodeToFrontend: function(objectId, callback)
     {
+        function callbackWrapper(error, nodeId)
+        {
+            if (callback)
+                callback(error ? 0 : nodeId);
+        }
+
         function mycallback()
         {
             if (this._document)
-                DOMAgent.pushNodeToFrontend(objectId, callback);
-            else {
-                if (callback)
-                    callback(0);
-            }
+                DOMAgent.pushNodeToFrontend(objectId, callbackWrapper);
+            else
+                callbackWrapper("No document");
         }
+
         this.requestDocument(mycallback.bind(this));
     },
 
     pushNodeByPathToFrontend: function(path, callback)
     {
+        function callbackWrapper(error, nodeId)
+        {
+            if (callback)
+                callback(error ? 0 : nodeId);
+        }
+
         function mycallback()
         {
             if (this._document)
-                DOMAgent.pushNodeByPathToFrontend(path, callback);
-            else {
-                if (callback)
-                    callback(0);
-            }
+                DOMAgent.pushNodeByPathToFrontend(path, callbackWrapper);
+            else
+                callbackWrapper("No document");
         }
         this.requestDocument(mycallback.bind(this));
     },
 
-    getChildNodesAsync: function(parent, callback)
-    {
-        var children = parent.children;
-        if (children) {
-            callback(children);
-            return;
-        }
-        function mycallback() {
-            callback(parent.children);
-        }
-        DOMAgent.getChildNodes(parent.id, mycallback);
-    },
-
-    setAttributeAsync: function(node, name, value, callback)
-    {
-        var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        DOMAgent.setAttribute(node.id, name, value, mycallback);
-    },
-
-    removeAttributeAsync: function(node, name, callback)
-    {
-        var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        DOMAgent.removeAttribute(node.id, name, mycallback);
-    },
-
-    setTextNodeValueAsync: function(node, text, callback)
-    {
-        var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        DOMAgent.setTextNodeValue(node.id, text, mycallback);
-    },
-
-    _didApplyDomChange: function(node, callback, success)
-    {
-        if (!success)
-            return;
-        callback();
-        // TODO(pfeldman): Fix this hack.
-        var elem = WebInspector.panels.elements.treeOutline.findTreeElement(node);
-        if (elem)
-            elem.updateTitle();
-    },
-
     _attributesUpdated: function(nodeId, attrsArray)
     {
         var node = this._idToDOMNode[nodeId];
         node._setAttributesPayload(attrsArray);
-        var event = {target: node};
-        this._document._fireDomEvent("DOMAttrModified", event);
+        this.dispatchEventToListeners(WebInspector.DOMAgent.Events.AttrModified, node);
     },
 
     _characterDataModified: function(nodeId, newValue)
     {
         var node = this._idToDOMNode[nodeId];
         node._nodeValue = newValue;
-        node.textContent = newValue;
-        var event = { target : node };
-        this._document._fireDomEvent("DOMCharacterDataModified", event);
+        this.dispatchEventToListeners(WebInspector.DOMAgent.Events.CharacterDataModified, node);
     },
 
     nodeForId: function(nodeId)
@@ -376,15 +395,10 @@ WebInspector.DOMAgent.prototype = {
         return this._idToDOMNode[nodeId];
     },
 
-    _documentUpdated: function(callback)
+    _documentUpdated: function()
     {
-        function mycallback(root)
-        {
-            this._setDocument(root);
-            if (callback)
-                callback(this._document);
-        }
-        DOMAgent.getDocument(mycallback.bind(this));
+        this._setDocument(null);
+        this.requestDocument();
     },
 
     _setDocument: function(payload)
@@ -393,11 +407,11 @@ WebInspector.DOMAgent.prototype = {
         if (payload && "id" in payload) {
             this._document = new WebInspector.DOMDocument(this, payload);
             this._idToDOMNode[payload.id] = this._document;
-            this._bindNodes(this._document.children);
-            WebInspector.breakpointManager.restoreDOMBreakpoints();
+            if (this._document.children)
+                this._bindNodes(this._document.children);
         } else
             this._document = null;
-        WebInspector.panels.elements.setDocument(this._document);
+        this.dispatchEventToListeners(WebInspector.DOMAgent.Events.DocumentUpdated, this._document);
     },
 
     _setDetachedRoot: function(payload)
@@ -432,10 +446,7 @@ WebInspector.DOMAgent.prototype = {
     {
         var node = this._idToDOMNode[nodeId];
         node._childNodeCount = newValue;
-        var outline = WebInspector.panels.elements.treeOutline;
-        var treeElement = outline.findTreeElement(node);
-        if (treeElement)
-            treeElement.hasChildren = newValue;
+        this.dispatchEventToListeners(WebInspector.DOMAgent.Events.ChildNodeCountUpdated, node);
     },
 
     _childNodeInserted: function(parentId, prevId, payload)
@@ -444,8 +455,7 @@ WebInspector.DOMAgent.prototype = {
         var prev = this._idToDOMNode[prevId];
         var node = parent._insertChild(prev, payload);
         this._idToDOMNode[node.id] = node;
-        var event = { target : node, relatedNode : parent };
-        this._document._fireDomEvent("DOMNodeInserted", event);
+        this.dispatchEventToListeners(WebInspector.DOMAgent.Events.NodeInserted, node);
     },
 
     _childNodeRemoved: function(parentId, nodeId)
@@ -453,8 +463,7 @@ WebInspector.DOMAgent.prototype = {
         var parent = this._idToDOMNode[parentId];
         var node = this._idToDOMNode[nodeId];
         parent.removeChild_(node);
-        var event = { target : node, relatedNode : parent };
-        this._document._fireDomEvent("DOMNodeRemoved", event);
+        this.dispatchEventToListeners(WebInspector.DOMAgent.Events.NodeRemoved, {node:node, parent:parent});
         delete this._idToDOMNode[nodeId];
         this._removeBreakpoints(node);
     },
@@ -467,9 +476,23 @@ WebInspector.DOMAgent.prototype = {
             return;
         for (var i = 0; i < node.children.length; ++i)
             this._removeBreakpoints(node.children[i]);
+    },
+
+    performSearch: function(query, searchResultCollector, searchSynchronously)
+    {
+        this._searchResultCollector = searchResultCollector;
+        DOMAgent.performSearch(query, !!searchSynchronously);
+    },
+
+    cancelSearch: function()
+    {
+        delete this._searchResultCollector;
+        DOMAgent.cancelSearch();
     }
 }
 
+WebInspector.DOMAgent.prototype.__proto__ = WebInspector.Object.prototype;
+
 WebInspector.DOMDispatcher = function(domAgent)
 {
     this._domAgent = domAgent;
@@ -516,98 +539,9 @@ WebInspector.DOMDispatcher.prototype = {
         WebInspector.updateFocusedNode(nodeId);
     },
 
-    addNodesToSearchResult: function(nodeIds)
+    searchResults: function(nodeIds)
     {
-        WebInspector.panels.elements.addNodesToSearchResult(nodeIds);
+        if (this._domAgent._searchResultCollector)
+            this._domAgent._searchResultCollector(nodeIds);
     }
 }
-
-WebInspector.ApplicationCacheDispatcher = function()
-{
-}
-
-WebInspector.ApplicationCacheDispatcher.getApplicationCachesAsync = function(callback)
-{
-    function mycallback(applicationCaches)
-    {
-        // FIXME: Currently, this list only returns a single application cache.
-        if (applicationCaches)
-            callback(applicationCaches);
-    }
-
-    ApplicationCacheAgent.getApplicationCaches(mycallback);
-}
-
-WebInspector.ApplicationCacheDispatcher.prototype = {
-    updateApplicationCacheStatus: function(status)
-    {
-        WebInspector.panels.resources.updateApplicationCacheStatus(status);
-    },
-
-    updateNetworkState: function(isNowOnline)
-    {
-        WebInspector.panels.resources.updateNetworkState(isNowOnline);
-    }
-}
-
-InspectorBackend.registerDomainDispatcher("ApplicationCache", new WebInspector.ApplicationCacheDispatcher());
-
-WebInspector.Cookies = {}
-
-WebInspector.Cookies.getCookiesAsync = function(callback)
-{
-    function mycallback(cookies, cookiesString)
-    {
-        if (cookiesString)
-            callback(WebInspector.Cookies.buildCookiesFromString(cookiesString), false);
-        else
-            callback(cookies, true);
-    }
-
-    InspectorAgent.getCookies(mycallback);
-}
-
-WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
-{
-    var rawCookies = rawCookieString.split(/;\s*/);
-    var cookies = [];
-
-    if (!(/^\s*$/.test(rawCookieString))) {
-        for (var i = 0; i < rawCookies.length; ++i) {
-            var cookie = rawCookies[i];
-            var delimIndex = cookie.indexOf("=");
-            var name = cookie.substring(0, delimIndex);
-            var value = cookie.substring(delimIndex + 1);
-            var size = name.length + value.length;
-            cookies.push({ name: name, value: value, size: size });
-        }
-    }
-
-    return cookies;
-}
-
-WebInspector.Cookies.cookieMatchesResourceURL = function(cookie, resourceURL)
-{
-    var url = resourceURL.asParsedURL();
-    if (!url || !this.cookieDomainMatchesResourceDomain(cookie.domain, url.host))
-        return false;
-    return (url.path.indexOf(cookie.path) === 0
-        && (!cookie.port || url.port == cookie.port)
-        && (!cookie.secure || url.scheme === "https"));
-}
-
-WebInspector.Cookies.cookieDomainMatchesResourceDomain = function(cookieDomain, resourceDomain)
-{
-    if (cookieDomain.charAt(0) !== '.')
-        return resourceDomain === cookieDomain;
-    return !!resourceDomain.match(new RegExp("^([^\\.]+\\.)?" + cookieDomain.substring(1).escapeForRegExp() + "$"), "i");
-}
-
-WebInspector.EventListeners = {}
-
-WebInspector.EventListeners.getEventListenersForNodeAsync = function(node, callback)
-{
-    if (!node)
-        return;
-    DOMAgent.getEventListenersForNode(node.id, callback);
-}
diff --git a/Source/WebCore/inspector/front-end/DOMStorageItemsView.js b/Source/WebCore/inspector/front-end/DOMStorageItemsView.js
index dbd736b..b63bc96 100644
--- a/Source/WebCore/inspector/front-end/DOMStorageItemsView.js
+++ b/Source/WebCore/inspector/front-end/DOMStorageItemsView.js
@@ -61,12 +61,14 @@ WebInspector.DOMStorageItemsView.prototype = {
     update: function()
     {
         this.element.removeChildren();
-        var callback = this._showDOMStorageEntries.bind(this);
-        this.domStorage.getEntries(callback);
+        this.domStorage.getEntries(this._showDOMStorageEntries.bind(this));
     },
 
-    _showDOMStorageEntries: function(entries)
+    _showDOMStorageEntries: function(error, entries)
     {
+        if (error)
+            return;
+
         this._dataGrid = this._dataGridForDOMStorageEntries(entries);
         this.element.appendChild(this._dataGrid.element);
         this._dataGrid.autoSizeColumns(10);
diff --git a/Source/WebCore/inspector/front-end/Database.js b/Source/WebCore/inspector/front-end/Database.js
index e4bafea..685c288 100644
--- a/Source/WebCore/inspector/front-end/Database.js
+++ b/Source/WebCore/inspector/front-end/Database.js
@@ -77,17 +77,22 @@ WebInspector.Database.prototype = {
 
     getTableNames: function(callback)
     {
-        function sortingCallback(names)
+        function sortingCallback(error, names)
         {
-            callback(names.sort());
+            if (!error)
+                callback(names.sort());
         }
         DatabaseAgent.getDatabaseTableNames(this._id, sortingCallback);
     },
     
     executeSql: function(query, onSuccess, onError)
     {
-        function callback(success, transactionId)
+        function callback(error, success, transactionId)
         {
+            if (error) {
+                onError(error);
+                return;
+            }
             if (!success) {
                 onError(WebInspector.UIString("Database not found."));
                 return;
diff --git a/Source/WebCore/inspector/front-end/DebuggerModel.js b/Source/WebCore/inspector/front-end/DebuggerModel.js
index d31ff24..c1d59b1 100644
--- a/Source/WebCore/inspector/front-end/DebuggerModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerModel.js
@@ -30,8 +30,7 @@
 
 WebInspector.DebuggerModel = function()
 {
-    this._paused = false;
-    this._callFrames = [];
+    this._debuggerPausedDetails = {};
     this._breakpoints = {};
     this._scripts = {};
 
@@ -39,31 +38,20 @@ WebInspector.DebuggerModel = function()
 }
 
 WebInspector.DebuggerModel.Events = {
+    DebuggerWasEnabled: "debugger-was-enabled",
+    DebuggerWasDisabled: "debugger-was-disabled",
     DebuggerPaused: "debugger-paused",
     DebuggerResumed: "debugger-resumed",
     ParsedScriptSource: "parsed-script-source",
     FailedToParseScriptSource: "failed-to-parse-script-source",
-    ScriptSourceChanged: "script-source-changed",
-    BreakpointAdded: "breakpoint-added",
-    BreakpointRemoved: "breakpoint-removed",
-    BreakpointResolved: "breakpoint-resolved"
+    BreakpointResolved: "breakpoint-resolved",
+    Reset: "reset"
 }
 
 WebInspector.DebuggerModel.prototype = {
     enableDebugger: function()
     {
         DebuggerAgent.enable();
-        if (this._breakpointsPushedToBackend)
-            return;
-        var breakpoints = WebInspector.settings.breakpoints;
-        for (var i = 0; i < breakpoints.length; ++i) {
-            var breakpoint = breakpoints[i];
-            if (typeof breakpoint.url !== "string" || typeof breakpoint.lineNumber !== "number" || typeof breakpoint.columnNumber !== "number" ||
-                typeof breakpoint.condition !== "string" || typeof breakpoint.enabled !== "boolean")
-                continue;
-            this.setBreakpoint(breakpoint.url, breakpoint.lineNumber, breakpoint.columnNumber, breakpoint.condition, breakpoint.enabled);
-        }
-        this._breakpointsPushedToBackend = true;
     },
 
     disableDebugger: function()
@@ -71,120 +59,98 @@ WebInspector.DebuggerModel.prototype = {
         DebuggerAgent.disable();
     },
 
+    _debuggerWasEnabled: function()
+    {
+        this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.DebuggerWasEnabled);
+    },
+
+    _debuggerWasDisabled: function()
+    {
+        this._breakpoints = {};
+        this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.DebuggerWasDisabled);
+    },
+
     continueToLocation: function(sourceID, lineNumber, columnNumber)
     {
         DebuggerAgent.continueToLocation(sourceID, lineNumber, columnNumber);
     },
 
-    setBreakpoint: function(url, lineNumber, columnNumber, condition, enabled)
+    setBreakpoint: function(url, lineNumber, columnNumber, condition, enabled, callback)
     {
-        function didSetBreakpoint(breakpointsPushedToBackend, breakpointId, locations)
+        // Adjust column if needed.
+        var minColumnNumber = 0;
+        for (var id in this._scripts) {
+            var script = this._scripts[id];
+            if (url === script.sourceURL && lineNumber === script.lineOffset)
+                minColumnNumber = minColumnNumber ? Math.min(minColumnNumber, script.columnOffset) : script.columnOffset;
+        }
+        columnNumber = Math.max(columnNumber, minColumnNumber);
+
+        function didSetBreakpoint(error, breakpointId, locations)
         {
-            if (!breakpointId)
-                return;
-            var breakpoint = new WebInspector.Breakpoint(breakpointId, url, "", lineNumber, columnNumber, condition, enabled);
-            breakpoint.locations = locations;
-            this._breakpoints[breakpointId] = breakpoint;
-            if (breakpointsPushedToBackend)
-                this._saveBreakpoints();
-            this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.BreakpointAdded, breakpoint);
+            var breakpoint;
+            if (!error && breakpointId) {
+                breakpoint = new WebInspector.Breakpoint(breakpointId, url, "", lineNumber, columnNumber, condition, enabled);
+                breakpoint.locations = locations;
+                this._breakpoints[breakpointId] = breakpoint;
+            }
+            if (callback)
+                callback(breakpoint);
         }
-        DebuggerAgent.setJavaScriptBreakpoint(url, lineNumber, columnNumber, condition, enabled, didSetBreakpoint.bind(this, this._breakpointsPushedToBackend));
+        DebuggerAgent.setBreakpointByUrl(url, lineNumber, columnNumber, condition, enabled, didSetBreakpoint.bind(this));
     },
 
-    setBreakpointBySourceId: function(sourceID, lineNumber, columnNumber, condition, enabled)
+    setBreakpointBySourceId: function(sourceID, lineNumber, columnNumber, condition, enabled, callback)
     {
-        function didSetBreakpoint(breakpointId, actualLineNumber, actualColumnNumber)
+        function didSetBreakpoint(error, breakpointId, actualLineNumber, actualColumnNumber)
         {
-            if (!breakpointId)
-                return;
-            var breakpoint = new WebInspector.Breakpoint(breakpointId, "", sourceID, lineNumber, columnNumber, condition, enabled);
-            breakpoint.addLocation(sourceID, actualLineNumber, actualColumnNumber);
-            this._breakpoints[breakpointId] = breakpoint;
-            this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.BreakpointAdded, breakpoint);
+            var breakpoint;
+            if (!error && breakpointId) {
+                breakpoint = new WebInspector.Breakpoint(breakpointId, "", sourceID, lineNumber, columnNumber, condition, enabled);
+                breakpoint.addLocation(sourceID, actualLineNumber, actualColumnNumber);
+                this._breakpoints[breakpointId] = breakpoint;
+            }
+            if (callback)
+                callback(breakpoint);
         }
-        DebuggerAgent.setJavaScriptBreakpointBySourceId(sourceID, lineNumber, columnNumber, condition, enabled, didSetBreakpoint.bind(this));
+        DebuggerAgent.setBreakpoint(sourceID, lineNumber, columnNumber, condition, enabled, didSetBreakpoint.bind(this));
     },
 
     removeBreakpoint: function(breakpointId)
     {
-        DebuggerAgent.removeJavaScriptBreakpoint(breakpointId);
-        var breakpoint = this._breakpoints[breakpointId];
+        DebuggerAgent.removeBreakpoint(breakpointId);
         delete this._breakpoints[breakpointId];
-        this._saveBreakpoints();
-        this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.BreakpointRemoved, breakpointId);
-    },
-
-    updateBreakpoint: function(breakpointId, condition, enabled)
-    {
-        var breakpoint = this._breakpoints[breakpointId];
-        this.removeBreakpoint(breakpointId);
-        if (breakpoint.url)
-            this.setBreakpoint(breakpoint.url, breakpoint.lineNumber, breakpoint.columnNumber, condition, enabled);
-        else
-            this.setBreakpointBySourceId(breakpoint.sourceID, breakpoint.lineNumber, breakpoint.columnNumber, condition, enabled);
     },
 
     _breakpointResolved: function(breakpointId, sourceID, lineNumber, columnNumber)
     {
         var breakpoint = this._breakpoints[breakpointId];
-        if (!breakpoint)
-            return;
         breakpoint.addLocation(sourceID, lineNumber, columnNumber);
         this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.BreakpointResolved, breakpoint);
     },
 
-    _saveBreakpoints: function()
-    {
-        var serializedBreakpoints = [];
-        for (var id in this._breakpoints) {
-            var breakpoint = this._breakpoints[id];
-            if (!breakpoint.url)
-                continue;
-            var serializedBreakpoint = {};
-            serializedBreakpoint.url = breakpoint.url;
-            serializedBreakpoint.lineNumber = breakpoint.lineNumber;
-            serializedBreakpoint.columnNumber = breakpoint.columnNumber;
-            serializedBreakpoint.condition = breakpoint.condition;
-            serializedBreakpoint.enabled = breakpoint.enabled;
-            serializedBreakpoints.push(serializedBreakpoint);
-        }
-        WebInspector.settings.breakpoints = serializedBreakpoints;
-    },
-
     get breakpoints()
     {
         return this._breakpoints;
     },
 
-    breakpointForId: function(breakpointId)
-    {
-        return this._breakpoints[breakpointId];
-    },
-
-    queryBreakpoints: function(filter)
-    {
-        var breakpoints = [];
-        for (var id in this._breakpoints) {
-           var breakpoint = this._breakpoints[id];
-           if (filter(breakpoint))
-               breakpoints.push(breakpoint);
-        }
-        return breakpoints;
-    },
-
     reset: function()
     {
-        this._paused = false;
-        this._callFrames = [];
+        this._debuggerPausedDetails = {};
         for (var id in this._breakpoints) {
             var breakpoint = this._breakpoints[id];
             if (!breakpoint.url)
-                this.removeBreakpoint(id);
+                delete this._breakpoints[id];
             else
                 breakpoint.locations = [];
         }
         this._scripts = {};
+        this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.Reset);
+    },
+
+    get scripts()
+    {
+        return this._scripts;
     },
 
     scriptForSourceID: function(sourceID)
@@ -208,101 +174,42 @@ WebInspector.DebuggerModel.prototype = {
         return scripts;
     },
 
-    editScriptSource: function(sourceID, scriptSource)
+    editScriptSource: function(sourceID, newSource, callback)
     {
-        function didEditScriptSource(success, newBodyOrErrorMessage, callFrames)
-        {
-            if (success) {
-                if (callFrames && callFrames.length)
-                    this._callFrames = callFrames;
-                this._updateScriptSource(sourceID, newBodyOrErrorMessage);
-            } else
-                WebInspector.log(newBodyOrErrorMessage, WebInspector.ConsoleMessage.MessageLevel.Warning);
-        }
-        DebuggerAgent.editScriptSource(sourceID, scriptSource, didEditScriptSource.bind(this));
+        DebuggerAgent.editScriptSource(sourceID, newSource, this._didEditScriptSource.bind(this, sourceID, callback));
     },
 
-    _updateScriptSource: function(sourceID, scriptSource)
+    _didEditScriptSource: function(sourceID, callback, error, newBody, callFrames)
     {
-        var script = this._scripts[sourceID];
-        var oldSource = script.source;
-        script.source = scriptSource;
-
-        // Clear and re-create breakpoints according to text diff.
-        var diff = Array.diff(oldSource.split("\n"), script.source.split("\n"));
-        for (var id in this._breakpoints) {
-            var breakpoint = this._breakpoints[id];
-            if (breakpoint.url) {
-                if (breakpoint.url !== script.sourceURL)
-                    continue;
-            } else {
-                if (breakpoint.sourceID !== sourceID)
-                    continue;
-            }
-            this.removeBreakpoint(breakpoint.id);
-            var lineNumber = breakpoint.lineNumber;
-            var newLineNumber = diff.left[lineNumber].row;
-            if (newLineNumber === undefined) {
-                for (var i = lineNumber - 1; i >= 0; --i) {
-                    if (diff.left[i].row === undefined)
-                        continue;
-                    var shiftedLineNumber = diff.left[i].row + lineNumber - i;
-                    if (shiftedLineNumber < diff.right.length) {
-                        var originalLineNumber = diff.right[shiftedLineNumber].row;
-                        if (originalLineNumber === lineNumber || originalLineNumber === undefined)
-                            newLineNumber = shiftedLineNumber;
-                    }
-                    break;
-                }
-            }
-            if (newLineNumber === undefined)
-                continue;
-            if (breakpoint.url)
-                this.setBreakpoint(breakpoint.url, newLineNumber, breakpoint.columnNumber, breakpoint.condition, breakpoint.enabled);
-            else
-                this.setBreakpointBySourceId(sourceID, newLineNumber, breakpoint.columnNumber, breakpoint.condition, breakpoint.enabled);
-        }
-
-        this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.ScriptSourceChanged, { sourceID: sourceID, oldSource: oldSource });
+        callback(!error, error || newBody);
+        if (error)
+            return;
+        this._scripts[sourceID].source = newBody;
+        this._debuggerPausedDetails.callFrames = callFrames;
     },
 
     get callFrames()
     {
-        return this._callFrames;
+        return this._debuggerPausedDetails.callFrames;
+    },
+
+    get debuggerPausedDetails()
+    {
+        return this._debuggerPausedDetails;
     },
 
     _pausedScript: function(details)
     {
-        this._paused = true;
-        this._callFrames = details.callFrames;
-        details.breakpoint = this._breakpointForCallFrame(details.callFrames[0]);
+        this._debuggerPausedDetails = details;
         this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.DebuggerPaused, details);
     },
 
     _resumedScript: function()
     {
-        this._paused = false;
-        this._callFrames = [];
+        this._debuggerPausedDetails = {};
         this.dispatchEventToListeners(WebInspector.DebuggerModel.Events.DebuggerResumed);
     },
 
-    _breakpointForCallFrame: function(callFrame)
-    {
-        function match(location)
-        {
-            if (location.sourceID != callFrame.sourceID)
-                return false;
-            return location.lineNumber === callFrame.line && location.columnNumber === callFrame.column;
-        }
-        for (var id in this._breakpoints) {
-            var breakpoint = this._breakpoints[id];
-            for (var i = 0; i < breakpoint.locations.length; ++i) {
-                if (match(breakpoint.locations[i]))
-                    return breakpoint;
-            }
-        }
-    },
-
     _parsedScriptSource: function(sourceID, sourceURL, lineOffset, columnOffset, length, scriptWorldType)
     {
         var script = new WebInspector.Script(sourceID, sourceURL, "", lineOffset, columnOffset, length, undefined, undefined, scriptWorldType);
@@ -331,32 +238,32 @@ WebInspector.DebuggerDispatcher = function(debuggerModel)
 }
 
 WebInspector.DebuggerDispatcher.prototype = {
-    pausedScript: function(details)
+    paused: function(details)
     {
         this._debuggerModel._pausedScript(details);
     },
 
-    resumedScript: function()
+    resumed: function()
     {
         this._debuggerModel._resumedScript();
     },
 
     debuggerWasEnabled: function()
     {
-        WebInspector.panels.scripts.debuggerWasEnabled();
+        this._debuggerModel._debuggerWasEnabled();
     },
 
     debuggerWasDisabled: function()
     {
-        WebInspector.panels.scripts.debuggerWasDisabled();
+        this._debuggerModel._debuggerWasDisabled();
     },
 
-    parsedScriptSource: function(sourceID, sourceURL, lineOffset, columnOffset, length, scriptWorldType)
+    scriptParsed: function(sourceID, sourceURL, lineOffset, columnOffset, length, scriptWorldType)
     {
         this._debuggerModel._parsedScriptSource(sourceID, sourceURL, lineOffset, columnOffset, length, scriptWorldType);
     },
 
-    failedToParseScriptSource: function(sourceURL, source, startingLine, errorLine, errorMessage)
+    scriptFailedToParse: function(sourceURL, source, startingLine, errorLine, errorMessage)
     {
         this._debuggerModel._failedToParseScriptSource(sourceURL, source, startingLine, errorLine, errorMessage);
     },
@@ -364,17 +271,5 @@ WebInspector.DebuggerDispatcher.prototype = {
     breakpointResolved: function(breakpointId, sourceID, lineNumber, columnNumber)
     {
         this._debuggerModel._breakpointResolved(breakpointId, sourceID, lineNumber, columnNumber);
-    },
-
-    didCreateWorker: function()
-    {
-        var workersPane = WebInspector.panels.scripts.sidebarPanes.workers;
-        workersPane.addWorker.apply(workersPane, arguments);
-    },
-
-    didDestroyWorker: function()
-    {
-        var workersPane = WebInspector.panels.scripts.sidebarPanes.workers;
-        workersPane.removeWorker.apply(workersPane, arguments);
     }
 }
diff --git a/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js b/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
index a97db34..d12affe 100644
--- a/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
@@ -30,102 +30,549 @@
 
 WebInspector.DebuggerPresentationModel = function()
 {
-    this._breakpoints = {};
-    this._sourceLocationToBreakpointId = {};
+    this._sourceFiles = {};
+    this._messages = [];
+    this._presentationBreakpoints = {};
+    this._presentationCallFrames = [];
+    this._selectedCallFrameIndex = 0;
 
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointAdded, this._breakpointAdded, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointRemoved, this._breakpointRemoved, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerWasEnabled, this._debuggerWasEnabled, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ParsedScriptSource, this._parsedScriptSource, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.FailedToParseScriptSource, this._failedToParseScriptSource, this);
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.BreakpointResolved, this._breakpointResolved, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerPaused, this._debuggerPaused, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerResumed, this._debuggerResumed, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.Reset, this._reset, this);
 }
 
 WebInspector.DebuggerPresentationModel.Events = {
+    SourceFileAdded: "source-file-added",
+    SourceFileChanged: "source-file-changed",
+    ConsoleMessageAdded: "console-message-added",
     BreakpointAdded: "breakpoint-added",
-    BreakpointRemoved: "breakpoint-removed"
+    BreakpointRemoved: "breakpoint-removed",
+    DebuggerPaused: "debugger-paused",
+    DebuggerResumed: "debugger-resumed",
+    CallFrameSelected: "call-frame-selected"
 }
 
 WebInspector.DebuggerPresentationModel.prototype = {
+    _debuggerWasEnabled: function()
+    {
+        this._restoreBreakpoints();
+    },
+
+    sourceFile: function(sourceFileId)
+    {
+        return this._sourceFiles[sourceFileId];
+    },
+
+    requestSourceFileContent: function(sourceFileId, callback)
+    {
+        this._sourceFiles[sourceFileId].requestContent(callback);
+    },
+
+    _parsedScriptSource: function(event)
+    {
+        this._addScript(event.data);
+        this._refreshBreakpoints();
+    },
+
+    _failedToParseScriptSource: function(event)
+    {
+        this._addScript(event.data);
+        this._refreshBreakpoints();
+    },
+
+    _addScript: function(script)
+    {
+        var sourceFileId = script.sourceURL || script.sourceID;
+        var sourceFile = this._sourceFiles[sourceFileId];
+        if (sourceFile) {
+            sourceFile.addScript(script);
+            return;
+        }
+
+        function contentChanged(sourceFile)
+        {
+            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.SourceFileChanged, this._sourceFiles[sourceFileId]);
+        }
+        if (!this._formatSourceFiles)
+            sourceFile = new WebInspector.SourceFile(sourceFileId, script, contentChanged.bind(this));
+        else
+            sourceFile = new WebInspector.FormattedSourceFile(sourceFileId, script, contentChanged.bind(this), this._formatter);
+        this._sourceFiles[sourceFileId] = sourceFile;
+        this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.SourceFileAdded, sourceFile);
+    },
+
+    _refreshBreakpoints: function()
+    {
+        var breakpoints = WebInspector.debuggerModel.breakpoints;
+        for (var id in breakpoints) {
+            if (!(id in this._presentationBreakpoints))
+                this._breakpointAdded(breakpoints[id]);
+        }
+    },
+
+    canEditScriptSource: function(sourceFileId)
+    {
+        if (!Preferences.canEditScriptSource)
+            return false;
+        var script = this._scriptForSourceFileId(sourceFileId);
+        return  !script.lineOffset && !script.columnOffset;
+    },
+
+    editScriptSource: function(sourceFileId, text, callback)
+    {
+        var script = this._scriptForSourceFileId(sourceFileId);
+        var sourceFile = this._sourceFiles[sourceFileId];
+        var oldSource = sourceFile.content;
+        function didEditScriptSource(success, newBodyOrErrorMessage)
+        {
+            if (!success) {
+                callback(false, newBodyOrErrorMessage);
+                return;
+            }
+
+            var newSource = newBodyOrErrorMessage;
+            this._updateBreakpointsAfterLiveEdit(sourceFileId, oldSource, newSource);
+
+            var resource = WebInspector.resourceForURL(script.sourceURL);
+            if (resource) {
+                var revertHandle = this.editScriptSource.bind(this, sourceFileId, oldSource, sourceFile.reload.bind(sourceFile));
+                resource.setContent(newSource, revertHandle);
+            }
+
+            callback(true, newSource);
+
+            if (WebInspector.debuggerModel.callFrames)
+                this._debuggerPaused();
+        }
+        WebInspector.debuggerModel.editScriptSource(script.sourceID, text, didEditScriptSource.bind(this));
+    },
+
+    _updateBreakpointsAfterLiveEdit: function(sourceFileId, oldSource, newSource)
+    {
+        // Clear and re-create breakpoints according to text diff.
+        var diff = Array.diff(oldSource.split("\n"), newSource.split("\n"));
+        for (var id in this._presentationBreakpoints) {
+            var breakpoint = this._presentationBreakpoints[id];
+            if (breakpoint.sourceFileId !== sourceFileId)
+                continue;
+            var lineNumber = breakpoint.lineNumber;
+            this.removeBreakpoint(sourceFileId, lineNumber);
+
+            var newLineNumber = diff.left[lineNumber].row;
+            if (newLineNumber === undefined) {
+                for (var i = lineNumber - 1; i >= 0; --i) {
+                    if (diff.left[i].row === undefined)
+                        continue;
+                    var shiftedLineNumber = diff.left[i].row + lineNumber - i;
+                    if (shiftedLineNumber < diff.right.length) {
+                        var originalLineNumber = diff.right[shiftedLineNumber].row;
+                        if (originalLineNumber === lineNumber || originalLineNumber === undefined)
+                            newLineNumber = shiftedLineNumber;
+                    }
+                    break;
+                }
+            }
+            if (newLineNumber !== undefined)
+                this.setBreakpoint(sourceFileId, newLineNumber, breakpoint.condition, breakpoint.enabled);
+        }
+    },
+
+    toggleFormatSourceFiles: function()
+    {
+        this._formatSourceFiles = !this._formatSourceFiles;
+        if (this._formatSourceFiles && !this._formatter)
+            this._formatter = new WebInspector.ScriptFormatter();
+
+        var messages = this._messages;
+        this._sourceFiles = {};
+        this._messages = [];
+        this._presentationBreakpoints = {};
+
+        var scripts = WebInspector.debuggerModel.scripts;
+        for (var id in scripts)
+            this._addScript(scripts[id]);
+
+        for (var i = 0; i < messages.length; ++i)
+            this.addConsoleMessage(messages[i]);
+
+        this._refreshBreakpoints();
+
+        if (WebInspector.debuggerModel.callFrames)
+            this._debuggerPaused();
+    },
+
+    addConsoleMessage: function(message)
+    {
+        this._messages.push(message);
+
+        var sourceFile = this._sourceFileForScriptURL(message.url);
+        if (!sourceFile)
+            return;
+
+        function didRequestSourceMapping(mapping)
+        {
+            var presentationMessage = {};
+            presentationMessage.sourceFileId = sourceFile.id;
+            presentationMessage.lineNumber = mapping.scriptLocationToSourceLocation(message.line - 1, 0).lineNumber;
+            presentationMessage.originalMessage = message;
+            sourceFile.messages.push(presentationMessage);
+            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.ConsoleMessageAdded, presentationMessage);
+        }
+        sourceFile.requestSourceMapping(didRequestSourceMapping.bind(this));
+    },
+
+    clearConsoleMessages: function()
+    {
+        this._messages = [];
+        for (var id in this._sourceFiles)
+            this._sourceFiles[id].messages = [];
+    },
+
+    continueToLine: function(sourceFileId, lineNumber)
+    {
+        function didRequestSourceMapping(mapping)
+        {
+            var location = mapping.sourceLocationToScriptLocation(lineNumber, 0);
+            WebInspector.debuggerModel.continueToLocation(location.scriptId, location.lineNumber, location.columnNumber);
+        }
+        this._sourceFiles[sourceFileId].requestSourceMapping(didRequestSourceMapping.bind(this));
+    },
+
     breakpointsForSourceFileId: function(sourceFileId)
     {
+        var sourceFile = this.sourceFile(sourceFileId);
+        if (!sourceFile)
+            return [];
         var breakpoints = [];
-        for (var id in this._breakpoints) {
-            var breakpoint = this._breakpoints[id];
-            if (breakpoint.sourceFileId === sourceFileId)
-                breakpoints.push(breakpoint);
-        }
+        for (var lineNumber in sourceFile.breakpoints)
+            breakpoints.push(sourceFile.breakpoints[lineNumber]);
         return breakpoints;
     },
 
-    _breakpointAdded: function(event)
+    setBreakpoint: function(sourceFileId, lineNumber, condition, enabled)
     {
-        var breakpoint = event.data;
-        var location = breakpoint.locations.length ? breakpoint.locations[0] : breakpoint;
-        var sourceLocation = this._actualLocationToSourceLocation(breakpoint.url || breakpoint.sourceID, location.lineNumber, location.columnNumber);
+        function didSetBreakpoint(breakpoint)
+        {
+            if (breakpoint) {
+                this._breakpointAdded(breakpoint);
+                this._saveBreakpoints();
+            }
+        }
 
-        var encodedSourceLocation = this._encodeSourceLocation(sourceLocation.sourceFileId, sourceLocation.lineNumber);
-        if (encodedSourceLocation in this._sourceLocationToBreakpointId) {
-            // We can't show more than one breakpoint on a single source frame line. Remove newly added breakpoint.
-            WebInspector.debuggerModel.removeBreakpoint(breakpoint.id);
-            return;
+        function didRequestSourceMapping(mapping)
+        {
+            var location = mapping.sourceLocationToScriptLocation(lineNumber, 0);
+            var script = WebInspector.debuggerModel.scriptForSourceID(location.scriptId);
+            if (script.sourceURL)
+                WebInspector.debuggerModel.setBreakpoint(script.sourceURL, location.lineNumber, location.columnNumber, condition, enabled, didSetBreakpoint.bind(this));
+            else
+                WebInspector.debuggerModel.setBreakpointBySourceId(script.sourceID, location.lineNumber, location.columnNumber, condition, enabled, didSetBreakpoint.bind(this));
         }
+        this._sourceFiles[sourceFileId].requestSourceMapping(didRequestSourceMapping.bind(this));
+    },
 
-        var presentationBreakpoint = {
-            sourceFileId: sourceLocation.sourceFileId,
-            lineNumber: sourceLocation.lineNumber,
-            url: breakpoint.url,
-            resolved: !!breakpoint.locations.length,
-            condition: breakpoint.condition,
-            enabled: breakpoint.enabled
-        };
+    setBreakpointEnabled: function(sourceFileId, lineNumber, enabled)
+    {
+        var breakpoint = this.removeBreakpoint(sourceFileId, lineNumber);
+        this.setBreakpoint(sourceFileId, lineNumber, breakpoint.condition, enabled);
+    },
 
-        this._sourceLocationToBreakpointId[encodedSourceLocation] = breakpoint.id;
-        this._breakpoints[breakpoint.id] = presentationBreakpoint;
+    updateBreakpoint: function(sourceFileId, lineNumber, condition, enabled)
+    {
+        this.removeBreakpoint(sourceFileId, lineNumber);
+        this.setBreakpoint(sourceFileId, lineNumber, condition, enabled);
+    },
 
-        this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.BreakpointAdded, presentationBreakpoint);
+    removeBreakpoint: function(sourceFileId, lineNumber)
+    {
+        var breakpoint = this.findBreakpoint(sourceFileId, lineNumber);
+        WebInspector.debuggerModel.removeBreakpoint(breakpoint._id);
+        this._breakpointRemoved(breakpoint._id);
+        this._saveBreakpoints();
+        return breakpoint;
+    },
+
+    findBreakpoint: function(sourceFileId, lineNumber)
+    {
+        var sourceFile = this.sourceFile(sourceFileId);
+        if (sourceFile)
+            return sourceFile.breakpoints[lineNumber];
     },
 
-    _breakpointRemoved: function(event)
+    _breakpointAdded: function(breakpoint)
     {
-        var breakpointId = event.data;
-        var breakpoint = this._breakpoints[breakpointId];
-        var encodedSourceLocation = this._encodeSourceLocation(breakpoint.sourceFileId, breakpoint.lineNumber);
-        delete this._breakpoints[breakpointId];
-        delete this._sourceLocationToBreakpointId[encodedSourceLocation];
+        var script;
+        if (breakpoint.url)
+            script = WebInspector.debuggerModel.scriptsForURL(breakpoint.url)[0];
+        else
+            script = WebInspector.debuggerModel.scriptForSourceID(breakpoint.sourceID);
+        if (!script)
+            return;
+
+        function didRequestSourceMapping(mapping)
+        {
+            var scriptLocation = breakpoint.locations.length ? breakpoint.locations[0] : breakpoint;
+            var sourceLocation = mapping.scriptLocationToSourceLocation(scriptLocation.lineNumber, scriptLocation.columnNumber);
+            var lineNumber = sourceLocation.lineNumber;
+
+            if (this.findBreakpoint(sourceFile.id, lineNumber)) {
+                // We can't show more than one breakpoint on a single source file line.
+                WebInspector.debuggerModel.removeBreakpoint(breakpoint.id);
+                return;
+            }
+
+            var presentationBreakpoint = new WebInspector.PresentationBreakpoint(breakpoint, sourceFile, lineNumber);
+            presentationBreakpoint._id = breakpoint.id;
+            this._presentationBreakpoints[breakpoint.id] = presentationBreakpoint;
+            sourceFile.breakpoints[lineNumber] = presentationBreakpoint;
+            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.BreakpointAdded, presentationBreakpoint);
+        }
+        var sourceFile = this._sourceFileForScript(script);
+        sourceFile.requestSourceMapping(didRequestSourceMapping.bind(this));
+    },
+
+    _breakpointRemoved: function(breakpointId)
+    {
+        var breakpoint = this._presentationBreakpoints[breakpointId];
+        delete this._presentationBreakpoints[breakpointId];
+        var sourceFile = this.sourceFile(breakpoint.sourceFileId);
+        delete sourceFile.breakpoints[breakpoint.lineNumber];
         this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.BreakpointRemoved, breakpoint);
     },
 
     _breakpointResolved: function(event)
     {
         var breakpoint = event.data;
-        this._breakpointRemoved({ data: breakpoint.id });
-        this._breakpointAdded({ data: breakpoint });
+        if (!(breakpoint.id in this._presentationBreakpoints))
+            return;
+        this._breakpointRemoved(breakpoint.id);
+        this._breakpointAdded(breakpoint);
+    },
+
+    _restoreBreakpoints: function()
+    {
+        function didSetBreakpoint(breakpoint)
+        {
+            if (breakpoint)
+                this._breakpointAdded(breakpoint);
+        }
+        var breakpoints = WebInspector.settings.breakpoints;
+        for (var i = 0; i < breakpoints.length; ++i) {
+            var breakpoint = breakpoints[i];
+            WebInspector.debuggerModel.setBreakpoint(breakpoint.url, breakpoint.lineNumber, breakpoint.columnNumber, breakpoint.condition, breakpoint.enabled, didSetBreakpoint.bind(this));
+        }
     },
 
-    _encodeSourceLocation: function(sourceFileId, lineNumber)
+    _saveBreakpoints: function()
     {
-        return sourceFileId + ":" + lineNumber;
+        var serializedBreakpoints = [];
+        var breakpoints = WebInspector.debuggerModel.breakpoints;
+        for (var id in breakpoints) {
+            var breakpoint = breakpoints[id];
+            if (!breakpoint.url)
+                continue;
+            var serializedBreakpoint = {};
+            serializedBreakpoint.url = breakpoint.url;
+            serializedBreakpoint.lineNumber = breakpoint.lineNumber;
+            serializedBreakpoint.columnNumber = breakpoint.columnNumber;
+            serializedBreakpoint.condition = breakpoint.condition;
+            serializedBreakpoint.enabled = breakpoint.enabled;
+            serializedBreakpoints.push(serializedBreakpoint);
+        }
+        WebInspector.settings.breakpoints = serializedBreakpoints;
     },
 
-    set selectedCallFrame(callFrame)
+    _debuggerPaused: function()
     {
-        this._selectedCallFrame = callFrame;
-        if (!callFrame)
-            return;
+        var callFrames = WebInspector.debuggerModel.callFrames;
+        this._presentationCallFrames = [];
+        for (var i = 0; i < callFrames.length; ++i) {
+            var callFrame = callFrames[i];
+            var sourceFile;
+            var script = WebInspector.debuggerModel.scriptForSourceID(callFrame.sourceID);
+            if (script)
+                sourceFile = this._sourceFileForScript(script);
+            this._presentationCallFrames.push(new WebInspector.PresenationCallFrame(callFrame, i, sourceFile));
+        }
+        var details = WebInspector.debuggerModel.debuggerPausedDetails;
+        this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.DebuggerPaused, { callFrames: this._presentationCallFrames, details: details });
+
+        this.selectedCallFrame = this._presentationCallFrames[this._selectedCallFrameIndex];
+    },
+
+    _debuggerResumed: function()
+    {
+        this._presentationCallFrames = [];
+        this._selectedCallFrameIndex = 0;
+        this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.DebuggerResumed);
+    },
 
-        var script = WebInspector.debuggerModel.scriptForSourceID(callFrame.sourceID);
-        callFrame.sourceLocation = this._actualLocationToSourceLocation(script.sourceURL || script.sourceID, callFrame.line, callFrame.column);
+    set selectedCallFrame(callFrame)
+    {
+        this._selectedCallFrameIndex = callFrame.index;
+        callFrame.select();
         this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.CallFrameSelected, callFrame);
     },
 
     get selectedCallFrame()
     {
-        return this._selectedCallFrame;
+        return this._presentationCallFrames[this._selectedCallFrameIndex];
+    },
+
+    _sourceFileForScript: function(script)
+    {
+        return this._sourceFiles[script.sourceURL || script.sourceID];
+    },
+
+    _sourceFileForScriptURL: function(scriptURL)
+    {
+        return this._sourceFiles[scriptURL];
+    },
+
+    _scriptForSourceFileId: function(sourceFileId)
+    {
+        function filter(script)
+        {
+            return (script.sourceURL || script.sourceID) === sourceFileId;
+        }
+        return WebInspector.debuggerModel.queryScripts(filter)[0];
     },
 
-    _actualLocationToSourceLocation: function(sourceID, lineNumber, columnNumber)
+    _reset: function()
     {
-        // TODO: use source mapping to obtain source location.
-        return { sourceFileId: sourceID, lineNumber: lineNumber, columnNumber: columnNumber };
+        this._sourceFiles = {};
+        this._messages = [];
+        this._presentationBreakpoints = {};
+        this._presentationCallFrames = [];
+        this._selectedCallFrameIndex = 0;
     }
 }
 
 WebInspector.DebuggerPresentationModel.prototype.__proto__ = WebInspector.Object.prototype;
+
+WebInspector.PresentationBreakpoint = function(breakpoint, sourceFile, lineNumber)
+{
+    this._breakpoint = breakpoint;
+    this._sourceFile = sourceFile;
+    this._lineNumber = lineNumber;
+}
+
+WebInspector.PresentationBreakpoint.prototype = {
+    get sourceFileId()
+    {
+        return this._sourceFile.id;
+    },
+
+    get lineNumber()
+    {
+        return this._lineNumber;
+    },
+
+    get condition()
+    {
+        return this._breakpoint.condition;
+    },
+
+    get enabled()
+    {
+        return this._breakpoint.enabled;
+    },
+
+    get url()
+    {
+        return this._sourceFile.url;
+    },
+
+    get resolved()
+    {
+        return !!this._breakpoint.locations.length
+    },
+
+    loadSnippet: function(callback)
+    {
+        function didRequestContent(mimeType, content)
+        {
+            var lineEndings = content.lineEndings();
+            var snippet = "";
+            if (this.lineNumber < lineEndings.length)
+                snippet = content.substring(lineEndings[this.lineNumber - 1], lineEndings[this.lineNumber]);
+            callback(snippet);
+        }
+        this._sourceFile.requestContent(didRequestContent.bind(this));
+    }
+}
+
+WebInspector.PresenationCallFrame = function(callFrame, index, sourceFile)
+{
+    this._callFrame = callFrame;
+    this._index = index;
+    this._sourceFile = sourceFile;
+    this._script = WebInspector.debuggerModel.scriptForSourceID(callFrame.sourceID);
+}
+
+WebInspector.PresenationCallFrame.prototype = {
+    get functionName()
+    {
+        return this._callFrame.functionName;
+    },
+
+    get type()
+    {
+        return this._callFrame.type;
+    },
+
+    get isInternalScript()
+    {
+        return !this._script;
+    },
+
+    get url()
+    {
+        if (this._sourceFile)
+            return this._sourceFile.url;
+    },
+
+    get scopeChain()
+    {
+        return this._callFrame.scopeChain;
+    },
+
+    get index()
+    {
+        return this._index;
+    },
+
+    select: function()
+    {
+        if (this._sourceFile)
+            this._sourceFile.forceLoadContent(this._script);
+    },
+
+    evaluate: function(code, objectGroup, includeCommandLineAPI, callback)
+    {
+        function didEvaluateOnCallFrame(error, result)
+        {
+            callback(WebInspector.RemoteObject.fromPayload(result));
+        }
+        DebuggerAgent.evaluateOnCallFrame(this._callFrame.id, code, objectGroup, includeCommandLineAPI, didEvaluateOnCallFrame.bind(this));
+    },
+
+    sourceLocation: function(callback)
+    {
+        if (!this._sourceFile) {
+            callback(undefined, this._callFrame.line, this._callFrame.column);
+            return;
+        }
+
+        function didRequestSourceMapping(mapping)
+        {
+            var sourceLocation = mapping.scriptLocationToSourceLocation(this._callFrame.line, this._callFrame.column);
+            callback(this._sourceFile.id, sourceLocation.lineNumber, sourceLocation.columnNumber);
+        }
+        this._sourceFile.requestSourceMapping(didRequestSourceMapping.bind(this));
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js b/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js
index 14ba142..4fc1844 100644
--- a/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js
+++ b/Source/WebCore/inspector/front-end/DetailedHeapshotGridNodes.js
@@ -61,8 +61,8 @@ WebInspector.HeapSnapshotGridNode.prototype = {
     populateChildren: function(provider, howMany, atIndex)
     {
         if (!howMany && provider) {
-            howMany = provider.instancesCount;
-            provider.resetInstancesCount();
+            howMany = provider.instanceCount;
+            provider.instanceCount = 0;
         }
         provider = provider || this._provider;
         howMany = howMany || this._defaultPopulateCount;
@@ -75,7 +75,7 @@ WebInspector.HeapSnapshotGridNode.prototype = {
                 break;
             }
         }
-        for ( ; howMany > 0 && provider.hasNext(); provider.next(), provider.incInstancesCount(), --howMany) {
+        for ( ; howMany > 0 && provider.hasNext(); provider.next(), ++provider.instanceCount, --howMany) {
             var item = provider.item;
             if (haveSavedChildren) {
                 var hash = this._childHashForEntity(item);
@@ -131,7 +131,6 @@ WebInspector.HeapSnapshotGenericObjectNode = function(tree, node, hasChildren, p
     this._type = node.type;
     this._shallowSize = node.selfSize;
     this._retainedSize = node.retainedSize;
-    this._retainedSizeExact = this._shallowSize === this._retainedSize;
     this.snapshotNodeId = node.id;
     this.snapshotNodeIndex = node.nodeIndex;
 };
@@ -168,7 +167,7 @@ WebInspector.HeapSnapshotGenericObjectNode.prototype = {
 
     get _countPercent()
     {
-        return this._count / this.tree.snapshot.nodesCount * 100.0;
+        return this._count / this.tree.snapshot.nodeCount * 100.0;
     },
 
     get data()
@@ -204,18 +203,11 @@ WebInspector.HeapSnapshotGenericObjectNode.prototype = {
 
         var view = this.dataGrid.snapshotView;
         data["shallowSize"] = view.showShallowSizeAsPercent ? WebInspector.UIString("%.2f%%", this._shallowSizePercent) : Number.bytesToString(this._shallowSize);
-        data["retainedSize"] = (this._retainedSizeExact ? "" : "\u2248") + (view.showRetainedSizeAsPercent ? WebInspector.UIString("%.2f%%", this._retainedSizePercent) : Number.bytesToString(this._retainedSize));
+        data["retainedSize"] = view.showRetainedSizeAsPercent ? WebInspector.UIString("%.2f%%", this._retainedSizePercent) : Number.bytesToString(this._retainedSize);
 
         return this._enhanceData ? this._enhanceData(data) : data;
     },
 
-    set exactRetainedSize(size)
-    {
-        this._retainedSize = size;
-        this._retainedSizeExact = true;
-        this.refresh();
-    },
-
     get _retainedSizePercent()
     {
         return this._retainedSize / this.dataGrid.snapshot.totalSize * 100.0;
@@ -231,9 +223,8 @@ WebInspector.HeapSnapshotGenericObjectNode.prototype.__proto__ = WebInspector.He
 
 WebInspector.HeapSnapshotObjectNode = function(tree, edge)
 {
-    var node = edge.node;
-    var provider = this._createProvider(tree.snapshot, node.rawEdges);
-    WebInspector.HeapSnapshotGenericObjectNode.call(this, tree, node, !provider.isEmpty, 100);
+    var provider = this._createProvider(tree.snapshot, edge.nodeIndex);
+    WebInspector.HeapSnapshotGenericObjectNode.call(this, tree, edge.node, !provider.isEmpty, 100);
     this._referenceName = edge.name;
     this._referenceType = edge.type;
     this._provider = provider;
@@ -245,12 +236,12 @@ WebInspector.HeapSnapshotObjectNode.prototype = {
         return new WebInspector.HeapSnapshotObjectNode(this.dataGrid, provider.item);
     },
 
-    _createProvider: function(snapshot, rawEdges)
+    _createProvider: function(snapshot, nodeIndex)
     {
         var showHiddenData = WebInspector.DetailedHeapshotView.prototype.showHiddenData;
         return new WebInspector.HeapSnapshotEdgesProvider(
             snapshot,
-            rawEdges,
+            nodeIndex,
             function(edge) {
                 return !edge.isInvisible
                     && (showHiddenData || (!edge.isHidden && !edge.node.isHidden));
@@ -321,7 +312,7 @@ WebInspector.HeapSnapshotObjectNode.prototype.__proto__ = WebInspector.HeapSnaps
 
 WebInspector.HeapSnapshotInstanceNode = function(tree, baseSnapshot, snapshot, node)
 {
-    var provider = this._createProvider(baseSnapshot || snapshot, node.rawEdges);  
+    var provider = this._createProvider(baseSnapshot || snapshot, node.nodeIndex);  
     WebInspector.HeapSnapshotGenericObjectNode.call(this, tree, node, !provider.isEmpty, 100);
     this._isDeletedNode = !!baseSnapshot;
     this._provider = provider;    
@@ -333,12 +324,12 @@ WebInspector.HeapSnapshotInstanceNode.prototype = {
         return new WebInspector.HeapSnapshotObjectNode(this.dataGrid, provider.item);
     },
 
-    _createProvider: function(snapshot, rawEdges)
+    _createProvider: function(snapshot, nodeIndex)
     {
         var showHiddenData = WebInspector.DetailedHeapshotView.prototype.showHiddenData;
         return new WebInspector.HeapSnapshotEdgesProvider(
             snapshot,
-            rawEdges,
+            nodeIndex,
             function(edge) {
                 return !edge.isInvisible
                     && (showHiddenData || (!edge.isHidden && !edge.node.isHidden));
@@ -394,14 +385,14 @@ WebInspector.HeapSnapshotInstanceNode.prototype = {
 
 WebInspector.HeapSnapshotInstanceNode.prototype.__proto__ = WebInspector.HeapSnapshotGenericObjectNode.prototype;
 
-WebInspector.HeapSnapshotConstructorNode = function(tree, constructor, aggregate)
+WebInspector.HeapSnapshotConstructorNode = function(tree, className, aggregate)
 {
     WebInspector.HeapSnapshotGridNode.call(this, tree, aggregate.count > 0, 100);
-    this._name = constructor;
+    this._name = className;
     this._count = aggregate.count;
     this._shallowSize = aggregate.self;
     this._retainedSize = aggregate.maxRet;
-    this._provider = this._createNodesProvider(tree.snapshot, aggregate.type, aggregate.name);
+    this._provider = this._createNodesProvider(tree.snapshot, aggregate.type, className);
 }
 
 WebInspector.HeapSnapshotConstructorNode.prototype = {
@@ -410,14 +401,13 @@ WebInspector.HeapSnapshotConstructorNode.prototype = {
         return new WebInspector.HeapSnapshotInstanceNode(this.dataGrid, null, this.dataGrid.snapshot, provider.item);
     },
 
-    _createNodesProvider: function(snapshot, nodeType, nodeName)
+    _createNodesProvider: function(snapshot, nodeType, nodeClassName)
     {
         return new WebInspector.HeapSnapshotNodesProvider(
             snapshot,
-            snapshot.allNodes,
             function (node) {
                  return node.type === nodeType
-                     && (nodeName === null || node.name === nodeName);
+                    && (nodeClassName === null || node.className === nodeClassName);
             });
     },
 
@@ -456,7 +446,7 @@ WebInspector.HeapSnapshotConstructorNode.prototype = {
 
     get _countPercent()
     {
-        return this._count / this.dataGrid.snapshot.nodesCount * 100.0;
+        return this._count / this.dataGrid.snapshot.nodeCount * 100.0;
     },
 
     get _retainedSizePercent()
@@ -485,12 +475,6 @@ WebInspector.HeapSnapshotIteratorsTuple.prototype = {
         this._it2.first();
     },
 
-    resetInstancesCount: function()
-    {
-        this._it1.resetInstancesCount();
-        this._it2.resetInstancesCount();
-    },
-
     sort: function(comparator)
     {
         this._it1.sort(comparator);
@@ -498,16 +482,16 @@ WebInspector.HeapSnapshotIteratorsTuple.prototype = {
     }
 };
 
-WebInspector.HeapSnapshotDiffNode = function(tree, constructor, baseAggregate, aggregate)
+WebInspector.HeapSnapshotDiffNode = function(tree, className, baseAggregate, aggregate)
 {
     if (!baseAggregate)
         baseAggregate = { count: 0, self: 0, maxRet: 0, type:aggregate.type, name:aggregate.name, idxs: [] };
     if (!aggregate)
         aggregate = { count: 0, self: 0, maxRet: 0, type:baseAggregate.type, name:baseAggregate.name, idxs: [] };
     WebInspector.HeapSnapshotGridNode.call(this, tree, true, 50);
-    this._name = constructor;
+    this._name = className;
     this._calculateDiff(tree.baseSnapshot, tree.snapshot, baseAggregate.idxs, aggregate.idxs);
-    this._provider = this._createNodesProvider(tree.baseSnapshot, tree.snapshot, aggregate.type, aggregate.name);
+    this._provider = this._createNodesProvider(tree.baseSnapshot, tree.snapshot, aggregate.type, className);
 }
 
 WebInspector.HeapSnapshotDiffNode.prototype = {
@@ -559,7 +543,7 @@ WebInspector.HeapSnapshotDiffNode.prototype = {
             return new WebInspector.HeapSnapshotInstanceNode(this.dataGrid, provider.snapshot, null, provider.item);
     },
 
-    _createNodesProvider: function(baseSnapshot, snapshot, nodeType, nodeName)
+    _createNodesProvider: function(baseSnapshot, snapshot, nodeType, nodeClassName)
     {
         return new WebInspector.HeapSnapshotIteratorsTuple(
             createProvider(snapshot, baseSnapshot), createProvider(baseSnapshot, snapshot));
@@ -568,11 +552,10 @@ WebInspector.HeapSnapshotDiffNode.prototype = {
         {
             return new WebInspector.HeapSnapshotNodesProvider(
                 snapshot,
-                snapshot.allNodes,
                 function (node) {
                      return node.type === nodeType
-                         && (nodeName === null || node.name === nodeName)
-                         && !(node.id in otherSnapshot.idsMap);
+                         && (nodeClassName === null || node.className === nodeClassName)
+                         && !otherSnapshot.hasId(node.id);
                 });
         }
     },
@@ -655,9 +638,8 @@ WebInspector.HeapSnapshotDominatorObjectNode.prototype = {
         var showHiddenData = WebInspector.DetailedHeapshotView.prototype.showHiddenData;
         return new WebInspector.HeapSnapshotNodesProvider(
             snapshot,
-            snapshot.allNodes,
             function (node) {
-                 var dominatorIndex = node.dominatorIndex();
+                 var dominatorIndex = node.dominatorIndex;
                  return dominatorIndex === nodeIndex
                      && dominatorIndex !== node.nodeIndex
                      && (showHiddenData || !node.isHidden);
diff --git a/Source/WebCore/inspector/front-end/DetailedHeapshotView.js b/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
index ffce1dd..21d0fa9 100644
--- a/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
+++ b/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
@@ -45,8 +45,8 @@ WebInspector.HeapSnapshotContainmentDataGrid.prototype = {
     {
         this.snapshotView = snapshotView;
         this.snapshot = snapshot;
-        this.snapshotNodeIndex = this.snapshot._rootNodeIndex;
-        this._provider = this._createProvider(snapshot, snapshot.rootNode.rawEdges);
+        this.snapshotNodeIndex = this.snapshot.rootNodeIndex;
+        this._provider = this._createProvider(snapshot, this.snapshotNodeIndex);
         this.sort();
     }
 };
@@ -227,7 +227,7 @@ WebInspector.HeapSnapshotDominatorsDataGrid.prototype = {
     {
         this.snapshotView = snapshotView;
         this.snapshot = snapshot;
-        this.snapshotNodeIndex = this.snapshot._rootNodeIndex;
+        this.snapshotNodeIndex = this.snapshot.rootNodeIndex;
         this._provider = this._createProvider(snapshot, this.snapshotNodeIndex);
         this.sort();
     }
@@ -263,11 +263,21 @@ WebInspector.HeapSnapshotRetainingPathsList.prototype = {
             this.searchCancelled();
 
         this.pathFinder = new WebInspector.HeapSnapshotPathFinder(snapshot, nodeIndex);
+        this._setRootChildrenForFinder();
 
         this.removeChildren();
 
         this._counter = 0;
-        this.showNext(10);
+        this.showNext(100);
+    },
+
+    refresh: function()
+    {
+        this.removeChildren();
+        this._counter = 0;
+        delete this._cancel;
+        this._setRootChildrenForFinder();
+        this.showNext(100);
     },
 
     showNext: function(pathsCount)
@@ -283,7 +293,7 @@ WebInspector.HeapSnapshotRetainingPathsList.prototype = {
                     if (result === null) {
                         WebInspector.PleaseWaitMessage.prototype.hide();
                         if (!this.children.length)
-                            this.appendChild(new WebInspector.DataGridNode({path:WebInspector.UIString("This object is either only accessible via hidden properties, or current path search depth isn't enough."), len:""}, false));
+                            this.appendChild(new WebInspector.DataGridNode({path:WebInspector.UIString("Can't find any paths."), len:""}, false));
                         return;
                     } else if (result !== false) {
                         if (this._prefix)
@@ -311,6 +321,19 @@ WebInspector.HeapSnapshotRetainingPathsList.prototype = {
         }
     },
 
+    _setRootChildrenForFinder: function()
+    {
+        function FilterDOMWindow(node)
+        {
+            return node.name === "DOMWindow";
+        }
+
+        if (this.snapshotView.isTracingToWindowObjects)
+            this.pathFinder.updateRoots(FilterDOMWindow);
+        else
+            this.pathFinder.updateRoots();
+    },
+
     _performSorting: function(sortFunction)
     {
         function DataExtractorWrapper(nodeA, nodeB)
@@ -341,7 +364,6 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.containmentView.element.addStyleClass("view");
     this.containmentDataGrid = new WebInspector.HeapSnapshotContainmentDataGrid();
     this.containmentDataGrid.element.addEventListener("click", this._mouseClickInContainmentGrid.bind(this), true);
-    this.containmentDataGrid.element.addEventListener("dblclick", this._dblClickInContainmentGrid.bind(this), true);
     this.containmentView.element.appendChild(this.containmentDataGrid.element);
     this.element.appendChild(this.containmentView.element);
 
@@ -349,7 +371,6 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.constructorsView.element.addStyleClass("view");
     this.constructorsDataGrid = new WebInspector.HeapSnapshotConstructorsDataGrid();
     this.constructorsDataGrid.element.addEventListener("click", this._mouseClickInContainmentGrid.bind(this), true);
-    this.constructorsDataGrid.element.addEventListener("dblclick", this._dblClickInContainmentGrid.bind(this), true);
     this.constructorsView.element.appendChild(this.constructorsDataGrid.element);
     this.element.appendChild(this.constructorsView.element);
 
@@ -357,7 +378,6 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.diffView.element.addStyleClass("view");
     this.diffDataGrid = new WebInspector.HeapSnapshotDiffDataGrid();
     this.diffDataGrid.element.addEventListener("click", this._mouseClickInContainmentGrid.bind(this), true);
-    this.diffDataGrid.element.addEventListener("dblclick", this._dblClickInContainmentGrid.bind(this), true);
     this.diffView.element.appendChild(this.diffDataGrid.element);
     this.element.appendChild(this.diffView.element);
 
@@ -365,17 +385,27 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.dominatorView.element.addStyleClass("view");
     this.dominatorDataGrid = new WebInspector.HeapSnapshotDominatorsDataGrid();
     this.dominatorDataGrid.element.addEventListener("click", this._mouseClickInContainmentGrid.bind(this), true);
-    this.dominatorDataGrid.element.addEventListener("dblclick", this._dblClickInContainmentGrid.bind(this), true);
     this.dominatorView.element.appendChild(this.dominatorDataGrid.element);
     this.element.appendChild(this.dominatorView.element);
 
     var retainmentView = new WebInspector.View();
-    retainmentView.element.addStyleClass("view retaining-paths-view");
+    retainmentView.element.addStyleClass("view");
+    retainmentView.element.addStyleClass("retaining-paths-view");
     var retainingPathsTitleDiv = document.createElement("div");
     retainingPathsTitleDiv.className = "title";
     var retainingPathsTitle = document.createElement("span");
-    retainingPathsTitle.textContent = WebInspector.UIString("Retaining paths of the selected object");
+    retainingPathsTitle.textContent = WebInspector.UIString("Paths from the selected object");
+    this.retainingPathsRoot = document.createElement("select");
+    this.retainingPathsRoot.className = "status-bar-item";
+    this.retainingPathsRoot.addEventListener("change", this._changeRetainingPathsRoot.bind(this), false);
+    var toGCRootsTraceOption = document.createElement("option");
+    toGCRootsTraceOption.label = WebInspector.UIString("to GC roots");
+    var toWindowObjectsTraceOption = document.createElement("option");
+    toWindowObjectsTraceOption.label = WebInspector.UIString("to window objects");
+    this.retainingPathsRoot.appendChild(toGCRootsTraceOption);
+    this.retainingPathsRoot.appendChild(toWindowObjectsTraceOption);
     retainingPathsTitleDiv.appendChild(retainingPathsTitle);
+    retainingPathsTitleDiv.appendChild(this.retainingPathsRoot);
     retainmentView.element.appendChild(retainingPathsTitleDiv);
     this.retainmentDataGrid = new WebInspector.HeapSnapshotRetainingPathsList();
     retainmentView.element.appendChild(this.retainmentDataGrid.element);
@@ -416,6 +446,8 @@ WebInspector.DetailedHeapshotView = function(parent, profile)
     this.helpButton = new WebInspector.StatusBarButton("", "heapshot-help-status-bar-item status-bar-item");
     this.helpButton.addEventListener("click", this._helpClicked.bind(this), false);
 
+    var popoverHelper = new WebInspector.PopoverHelper(this.element, this._getHoverAnchor.bind(this), this._showStringContentPopup.bind(this));
+
     this._loadProfile(this._profileUid, profileCallback.bind(this));
 
     function profileCallback(profile)
@@ -714,24 +746,10 @@ WebInspector.DetailedHeapshotView.prototype = {
         profile.sideBarElement.subtitle = Number.bytesToString(s.totalSize);
     },
 
-    _dblClickInContainmentGrid: function(event)
-    {
-        var cell = event.target.enclosingNodeOrSelfWithNodeName("td");
-        if (!cell || (!cell.hasStyleClass("retainedSize-column")))
-            return;
-        var nodeItem = event.target.enclosingNodeOrSelfWithNodeName("tr")._dataGridNode;
-        ProfilerAgent.getExactHeapSnapshotNodeRetainedSize(this._profileUid, nodeItem.snapshotNodeId, setExactRetainedSize);
-
-        function setExactRetainedSize(exactSize) {
-            if (exactSize && exactSize != -1)
-                nodeItem.exactRetainedSize = exactSize;
-        }
-    },
-
     _mouseClickInContainmentGrid: function(event)
     {
         var cell = event.target.enclosingNodeOrSelfWithNodeName("td");
-        if (!cell || !(cell.hasStyleClass("object-column") ||  cell.hasStyleClass("shallowSize-column")))
+        if (!cell || (!cell.hasStyleClass("object-column") && !cell.hasStyleClass("shallowSize-column") && !cell.hasStyleClass("retainedSize-column")))
             return;
         var row = event.target.enclosingNodeOrSelfWithNodeName("tr");
         if (!row)
@@ -794,6 +812,33 @@ WebInspector.DetailedHeapshotView.prototype = {
         this.performSearch(this.currentQuery, this._searchFinishedCallback);
     },
 
+    _changeRetainingPathsRoot: function(event)
+    {
+        if (!event)
+            return;
+        this.retainmentDataGrid.refresh();
+    },
+
+    _getHoverAnchor: function(target)
+    {
+        var span = target.enclosingNodeOrSelfWithNodeName("span");
+        if (!span || !span.hasStyleClass("console-formatted-string"))
+            return;
+        var row = target.enclosingNodeOrSelfWithNodeName("tr");
+        if (!row)
+            return;
+        var gridNode = row._dataGridNode;
+        if (!gridNode.snapshotNodeIndex)
+            return;
+        span.snapshotNodeIndex = gridNode.snapshotNodeIndex;
+        return span;
+    },
+
+    get isTracingToWindowObjects()
+    {
+        return this.retainingPathsRoot.selectedIndex === 1;
+    },
+
     get _isShowingAsPercent()
     {
         return this.showCountAsPercent && this.showShallowSizeAsPercent && this.showRetainedSizeAsPercent;
@@ -808,6 +853,18 @@ WebInspector.DetailedHeapshotView.prototype = {
         this.refreshShowAsPercents();
     },
 
+    _showStringContentPopup: function(span)
+    {
+        var snapshotNode = new WebInspector.HeapSnapshotNode(this.profileWrapper, span.snapshotNodeIndex);
+        var stringContentElement = document.createElement("span");
+        stringContentElement.className = "monospace console-formatted-string";
+        stringContentElement.style.whiteSpace = "pre";
+        stringContentElement.textContent = "\"" + snapshotNode.name + "\"";
+        var popover = new WebInspector.Popover(stringContentElement);
+        popover.show(span);
+        return popover;
+    },
+
     _helpClicked: function(event)
     {
         if (!this.helpPopover) {
diff --git a/Source/WebCore/inspector/front-end/ElementsPanel.js b/Source/WebCore/inspector/front-end/ElementsPanel.js
index 246abe8..724e0e2 100644
--- a/Source/WebCore/inspector/front-end/ElementsPanel.js
+++ b/Source/WebCore/inspector/front-end/ElementsPanel.js
@@ -35,6 +35,10 @@ WebInspector.ElementsPanel = function()
     this.contentElement = document.createElement("div");
     this.contentElement.id = "elements-content";
     this.contentElement.className = "outline-disclosure source-code";
+    if (!WebInspector.settings.domWordWrap)
+        this.contentElement.classList.add("nowrap");
+
+    this.element.addEventListener("contextmenu", this._contextMenuEventFired.bind(this), true);
 
     this.treeOutline = new WebInspector.ElementsTreeOutline();
     this.treeOutline.panel = this;
@@ -57,7 +61,7 @@ WebInspector.ElementsPanel = function()
         this.panel.updateEventListeners();
 
         if (this._focusedDOMNode) {
-            DOMAgent.addInspectedNode(this._focusedDOMNode.id);
+            ConsoleAgent.addInspectedNode(this._focusedDOMNode.id);
             WebInspector.extensionServer.notifyObjectSelected(this.panel.name);
         }
     };
@@ -109,7 +113,14 @@ WebInspector.ElementsPanel = function()
 
     this._registerShortcuts();
 
-    this.reset();
+    WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.NodeInserted, this._nodeInserted, this);
+    WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.NodeRemoved, this._nodeRemoved, this);
+    WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.AttrModified, this._attributesUpdated, this);
+    WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.CharacterDataModified, this._characterDataModified, this);
+    WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.DocumentUpdated, this._documentUpdated, this);
+    WebInspector.domAgent.addEventListener(WebInspector.DOMAgent.Events.ChildNodeCountUpdated, this._childNodeCountUpdated, this);
+
+    this.recentlyModifiedNodes = [];
 }
 
 WebInspector.ElementsPanel.prototype = {
@@ -160,7 +171,7 @@ WebInspector.ElementsPanel.prototype = {
         this.updateBreadcrumbSizes();
     },
 
-    reset: function()
+    _reset: function()
     {
         if (this.focusedDOMNode)
             this._selectedPathOnReset = this.focusedDOMNode.path();
@@ -175,18 +186,21 @@ WebInspector.ElementsPanel.prototype = {
         delete this.currentQuery;
     },
 
-    setDocument: function(inspectedRootDocument)
+    _documentUpdated: function(event)
+    {
+        this._setDocument(event.data);
+    },
+
+    _setDocument: function(inspectedRootDocument)
     {
-        this.reset();
+        this._reset();
         this.searchCanceled();
 
         if (!inspectedRootDocument)
             return;
 
-        inspectedRootDocument.addEventListener("DOMNodeInserted", this._nodeInserted.bind(this));
-        inspectedRootDocument.addEventListener("DOMNodeRemoved", this._nodeRemoved.bind(this));
-        inspectedRootDocument.addEventListener("DOMAttrModified", this._attributesUpdated.bind(this));
-        inspectedRootDocument.addEventListener("DOMCharacterDataModified", this._characterDataModified.bind(this));
+        WebInspector.breakpointManager.restoreDOMBreakpoints();
+
 
         this.rootDOMNode = inspectedRootDocument;
 
@@ -229,7 +243,7 @@ WebInspector.ElementsPanel.prototype = {
 
         delete this._currentSearchResultIndex;
         this._searchResults = [];
-        DOMAgent.searchCanceled();
+        WebInspector.domAgent.cancelSearch();
     },
 
     performSearch: function(query)
@@ -245,7 +259,34 @@ WebInspector.ElementsPanel.prototype = {
         this._matchesCountUpdateTimeout = null;
         this._searchQuery = query;
 
-        DOMAgent.performSearch(whitespaceTrimmedQuery, false);
+        WebInspector.domAgent.performSearch(whitespaceTrimmedQuery, this._addNodesToSearchResult.bind(this));
+    },
+
+    _contextMenuEventFired: function(event)
+    {
+        function isTextWrapped()
+        {
+            return !this.contentElement.hasStyleClass("nowrap");
+        }
+
+        function toggleWordWrap()
+        {
+            this.contentElement.classList.toggle("nowrap");
+            WebInspector.settings.domWordWrap = !this.contentElement.classList.contains("nowrap");
+
+            var treeElement = this.treeOutline.findTreeElement(this.focusedDOMNode);
+            if (treeElement)
+                treeElement.updateSelection(); // Recalculate selection highlight dimensions.
+        }
+
+        var contextMenu = new WebInspector.ContextMenu();
+
+        var populated = this.treeOutline.populateContextMenu(contextMenu, event);
+        if (populated)
+            contextMenu.appendSeparator();
+        contextMenu.appendCheckboxItem(WebInspector.UIString("Word Wrap"), toggleWordWrap.bind(this), isTextWrapped.call(this));
+
+        contextMenu.show(event);
     },
 
     populateHrefContextMenu: function(contextMenu, event, anchorElement)
@@ -289,7 +330,7 @@ WebInspector.ElementsPanel.prototype = {
         this._matchesCountUpdateTimeout = setTimeout(this._updateMatchesCount.bind(this), 500);
     },
 
-    addNodesToSearchResult: function(nodeIds)
+    _addNodesToSearchResult: function(nodeIds)
     {
         if (!nodeIds.length)
             return;
@@ -379,35 +420,42 @@ WebInspector.ElementsPanel.prototype = {
 
     _attributesUpdated: function(event)
     {
-        this.recentlyModifiedNodes.push({node: event.target, updated: true});
+        this.recentlyModifiedNodes.push({node: event.data, updated: true});
         if (this.visible)
             this._updateModifiedNodesSoon();
 
-        if (!this.sidebarPanes.styles.isModifyingStyle && event.target === this.focusedDOMNode)
+        if (!this.sidebarPanes.styles.isModifyingStyle && event.data === this.focusedDOMNode)
             this._styleSheetChanged();
     },
 
     _characterDataModified: function(event)
     {
-        this.recentlyModifiedNodes.push({node: event.target, updated: true});
+        this.recentlyModifiedNodes.push({node: event.data, updated: true});
         if (this.visible)
             this._updateModifiedNodesSoon();
     },
 
     _nodeInserted: function(event)
     {
-        this.recentlyModifiedNodes.push({node: event.target, parent: event.relatedNode, inserted: true});
+        this.recentlyModifiedNodes.push({node: event.data, parent: event.data.parentNode, inserted: true});
         if (this.visible)
             this._updateModifiedNodesSoon();
     },
 
     _nodeRemoved: function(event)
     {
-        this.recentlyModifiedNodes.push({node: event.target, parent: event.relatedNode, removed: true});
+        this.recentlyModifiedNodes.push({node: event.data.node, parent: event.data.parent, removed: true});
         if (this.visible)
             this._updateModifiedNodesSoon();
     },
 
+    _childNodeCountUpdated: function(event)
+    {
+        var treeElement = this.treeOutline.findTreeElement(event.data);
+        if (treeElement)
+            treeElement.hasChildren = event.data.hasChildNodes();
+    },
+
     _updateModifiedNodesSoon: function()
     {
         if ("_updateModifiedNodesTimeout" in this)
@@ -426,7 +474,6 @@ WebInspector.ElementsPanel.prototype = {
         var updateBreadcrumbs = false;
 
         for (var i = 0; i < this.recentlyModifiedNodes.length; ++i) {
-            var replaced = this.recentlyModifiedNodes[i].replaced;
             var parent = this.recentlyModifiedNodes[i].parent;
             var node = this.recentlyModifiedNodes[i].node;
 
@@ -442,7 +489,7 @@ WebInspector.ElementsPanel.prototype = {
 
             var parentNodeItem = this.treeOutline.findTreeElement(parent);
             if (parentNodeItem && !parentNodeItem.alreadyUpdatedChildren) {
-                parentNodeItem.updateChildren(replaced);
+                parentNodeItem.updateChildren();
                 parentNodeItem.alreadyUpdatedChildren = true;
                 updatedParentTreeElements.push(parentNodeItem);
             }
@@ -577,7 +624,7 @@ WebInspector.ElementsPanel.prototype = {
 
         foundRoot = false;
         for (var current = this.focusedDOMNode; current; current = current.parentNode) {
-            if (current.nodeType === Node.DOCUMENT_NODE)
+            if (current.nodeType() === Node.DOCUMENT_NODE)
                 continue;
 
             if (current === this.rootDOMNode)
@@ -589,7 +636,7 @@ WebInspector.ElementsPanel.prototype = {
             crumb.addEventListener("mousedown", selectCrumbFunction, false);
 
             var crumbTitle;
-            switch (current.nodeType) {
+            switch (current.nodeType()) {
                 case Node.ELEMENT_NODE:
                     this.decorateNodeLabel(current, crumb);
                     break;
@@ -610,7 +657,7 @@ WebInspector.ElementsPanel.prototype = {
                     break;
 
                 default:
-                    crumbTitle = this.treeOutline.nodeNameToCorrectCase(current.nodeName);
+                    crumbTitle = this.treeOutline.nodeNameToCorrectCase(current.nodeName());
             }
 
             if (!crumb.childNodes.length) {
@@ -638,7 +685,7 @@ WebInspector.ElementsPanel.prototype = {
 
     decorateNodeLabel: function(node, parentElement)
     {
-        var title = this.treeOutline.nodeNameToCorrectCase(node.nodeName);
+        var title = this.treeOutline.nodeNameToCorrectCase(node.nodeName());
 
         var nameElement = document.createElement("span");
         nameElement.textContent = title;
@@ -1033,7 +1080,7 @@ WebInspector.ElementsPanel.prototype = {
             return;
         event.clipboardData.clearData();
         event.preventDefault();
-        DOMAgent.copyNode(this.focusedDOMNode.id);
+        this.focusedDOMNode.copyNode();
     },
 
     rightSidebarResizerDragStart: function(event)
@@ -1073,14 +1120,15 @@ WebInspector.ElementsPanel.prototype = {
         this._nodeSearchButton.toggled = false;
     },
 
-    _setSearchingForNode: function(enabled)
+    _setSearchingForNode: function(error, enabled)
     {
-        this._nodeSearchButton.toggled = enabled;
+        if (!error)
+            this._nodeSearchButton.toggled = enabled;
     },
 
     setSearchingForNode: function(enabled)
     {
-        InspectorAgent.setSearchingForNode(enabled, this._setSearchingForNode.bind(this));
+        DOMAgent.setSearchingForNode(enabled, this._setSearchingForNode.bind(this));
     },
 
     toggleSearchingForNode: function()
diff --git a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
index 7b5ff2f..dd99db1 100644
--- a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -41,8 +41,6 @@ WebInspector.ElementsTreeOutline = function() {
     this.showInElementsPanelEnabled = false;
     this.rootDOMNode = null;
     this.focusedDOMNode = null;
-
-    this.element.addEventListener("contextmenu", this._contextMenuEventFired.bind(this), true);
 }
 
 WebInspector.ElementsTreeOutline.prototype = {
@@ -144,7 +142,7 @@ WebInspector.ElementsTreeOutline.prototype = {
     findTreeElement: function(node)
     {
         var treeElement = TreeOutline.prototype.findTreeElement.call(this, node, isAncestorNode, parentNode);
-        if (!treeElement && node.nodeType === Node.TEXT_NODE) {
+        if (!treeElement && node.nodeType() === Node.TEXT_NODE) {
             // The text node might have been inlined if it was short, so try to find the parent element.
             treeElement = TreeOutline.prototype.findTreeElement.call(this, node.parentNode, isAncestorNode, parentNode);
         }
@@ -189,11 +187,13 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     _treeElementFromEvent: function(event)
     {
-        var root = this.element;
+        var scrollContainer = this.element.parentElement;
 
         // We choose this X coordinate based on the knowledge that our list
-        // items extend nearly to the right edge of the outer <ol>.
-        var x = root.totalOffsetLeft + root.offsetWidth - 20;
+        // items extend at least to the right edge of the outer <ol> container.
+        // In the no-word-wrap mode the outer <ol> may be wider than the tree container
+        // (and partially hidden), in which case we are left to use only its right boundary.
+        var x = scrollContainer.totalOffsetLeft + scrollContainer.offsetWidth - 36;
 
         var y = event.pageY;
 
@@ -258,37 +258,40 @@ WebInspector.ElementsTreeOutline.prototype = {
         WebInspector.highlightDOMNode(0);
     },
 
-    _contextMenuEventFired: function(event)
+    populateContextMenu: function(contextMenu, event)
     {
         var listItem = event.target.enclosingNodeOrSelfWithNodeName("LI");
         if (!listItem || !listItem.treeElement)
-            return;
+            return false;
 
-        var contextMenu = new WebInspector.ContextMenu();
+        var populated;
         if (this.showInElementsPanelEnabled) {
             function focusElement()
             {
                 WebInspector.panels.elements.switchToAndFocus(listItem.treeElement.representedObject);
             }
             contextMenu.appendItem(WebInspector.UIString("Reveal in Elements Panel"), focusElement.bind(this));
+            populated = true;
         } else {
             var href = event.target.enclosingNodeOrSelfWithClass("webkit-html-resource-link") || event.target.enclosingNodeOrSelfWithClass("webkit-html-external-link");
             var tag = event.target.enclosingNodeOrSelfWithClass("webkit-html-tag");
             var textNode = event.target.enclosingNodeOrSelfWithClass("webkit-html-text-node");
-            var needSeparator;
             if (href)
-                needSeparator = WebInspector.panels.elements.populateHrefContextMenu(contextMenu, event, href);
+                populated = WebInspector.panels.elements.populateHrefContextMenu(contextMenu, event, href);
             if (tag && listItem.treeElement._populateTagContextMenu) {
-                if (needSeparator)
+                if (populated)
                     contextMenu.appendSeparator();
                 listItem.treeElement._populateTagContextMenu(contextMenu, event);
+                populated = true;
             } else if (textNode && listItem.treeElement._populateTextContextMenu) {
-                if (needSeparator)
+                if (populated)
                     contextMenu.appendSeparator();
                 listItem.treeElement._populateTextContextMenu(contextMenu, textNode);
+                populated = true;
             }
         }
-        contextMenu.show(event);
+
+        return populated;
     }
 }
 
@@ -302,7 +305,7 @@ WebInspector.ElementsTreeElement = function(node, elementCloseTag)
     // The title will be updated in onattach.
     TreeElement.call(this, "", node, hasChildrenOverride);
 
-    if (this.representedObject.nodeType == Node.ELEMENT_NODE && !elementCloseTag)
+    if (this.representedObject.nodeType() == Node.ELEMENT_NODE && !elementCloseTag)
         this._canAddAttributes = true;
     this._searchQuery = null;
     this._expandedChildrenLimit = WebInspector.ElementsTreeElement.InitialChildrenLimit;
@@ -400,12 +403,12 @@ WebInspector.ElementsTreeElement.prototype = {
     _createTooltipForNode: function()
     {
         var node = this.representedObject;
-        if (!node.nodeName || node.nodeName.toLowerCase() !== "img")
+        if (!node.nodeName() || node.nodeName().toLowerCase() !== "img")
             return;
 
-        function setTooltip(result)
+        function setTooltip(error, result)
         {
-            if (!result || result.type !== "string")
+            if (error || !result || result.type !== "string")
                 return;
 
             try {
@@ -423,15 +426,15 @@ WebInspector.ElementsTreeElement.prototype = {
             }
         }
 
-        function resolvedNode(objectPayload)
+        function resolvedNode(object)
         {
-            if (!objectPayload)
+            if (!object)
                 return;
 
-            var object = WebInspector.RemoteObject.fromPayload(objectPayload);
             object.evaluate("return '[' + this.offsetWidth + ',' + this.offsetHeight + ',' + this.naturalWidth + ',' + this.naturalHeight + ']'", setTooltip.bind(this));
+            object.release();
         }
-        DOMAgent.resolveNode(node.id, "", resolvedNode.bind(this));
+        WebInspector.RemoteObject.resolveNode(node, resolvedNode.bind(this));
     },
 
     updateSelection: function()
@@ -489,8 +492,7 @@ WebInspector.ElementsTreeElement.prototype = {
     {
         if (this._elementCloseTag)
             return;
-
-        WebInspector.domAgent.getChildNodesAsync(this.representedObject, this._updateChildren.bind(this, fullRefresh));
+        this.representedObject.getChildNodes(this._updateChildren.bind(this, fullRefresh));
     },
 
     insertChildElement: function(child, index, closingTag)
@@ -587,7 +589,7 @@ WebInspector.ElementsTreeElement.prototype = {
         this.adjustCollapsedRange(false);
 
         var lastChild = this.children[this.children.length - 1];
-        if (this.representedObject.nodeType == Node.ELEMENT_NODE && (!lastChild || !lastChild._elementCloseTag))
+        if (this.representedObject.nodeType() == Node.ELEMENT_NODE && (!lastChild || !lastChild._elementCloseTag))
             this.insertChildElement(this.representedObject, this.children.length, true);
 
         // We want to restore the original selection and tree scroll position after a full refresh, if possible.
@@ -660,8 +662,13 @@ WebInspector.ElementsTreeElement.prototype = {
 
     onreveal: function()
     {
-        if (this.listItemElement)
-            this.listItemElement.scrollIntoViewIfNeeded(false);
+        if (this.listItemElement) {
+            var tagSpans = this.listItemElement.getElementsByClassName("webkit-html-tag-name");
+            if (tagSpans.length)
+                tagSpans[0].scrollIntoViewIfNeeded(false);
+            else
+                this.listItemElement.scrollIntoViewIfNeeded(false);
+        }
     },
 
     onselect: function(treeElement, selectedByUser)
@@ -743,7 +750,7 @@ WebInspector.ElementsTreeElement.prototype = {
         if (this.treeOutline.focusedDOMNode != this.representedObject)
             return;
 
-        if (this.representedObject.nodeType != Node.ELEMENT_NODE && this.representedObject.nodeType != Node.TEXT_NODE)
+        if (this.representedObject.nodeType() != Node.ELEMENT_NODE && this.representedObject.nodeType() != Node.TEXT_NODE)
             return false;
 
         var textNode = eventTarget.enclosingNodeOrSelfWithClass("webkit-html-text-node");
@@ -824,7 +831,7 @@ WebInspector.ElementsTreeElement.prototype = {
             return this._addNewAttribute();
         }
 
-        if (this.representedObject.nodeType === Node.TEXT_NODE) {
+        if (this.representedObject.nodeType() === Node.TEXT_NODE) {
             var textNode = listItem.getElementsByClassName("webkit-html-text-node")[0];
             if (textNode)
                 return this._startEditingTextNode(textNode);
@@ -872,7 +879,7 @@ WebInspector.ElementsTreeElement.prototype = {
         if (!attributeNameElement)
             return false;
 
-        var attributeName = attributeNameElement.innerText;
+        var attributeName = attributeNameElement.textContent;
 
         function removeZeroWidthSpaceRecursive(node)
         {
@@ -962,10 +969,12 @@ WebInspector.ElementsTreeElement.prototype = {
         return true;
     },
 
-    _startEditingAsHTML: function(commitCallback, initialValue)
+    _startEditingAsHTML: function(commitCallback, error, initialValue)
     {
+        if (error)
+            return;
         if (this._htmlEditElement && WebInspector.isBeingEdited(this._htmlEditElement))
-            return true;
+            return;
 
         this._htmlEditElement = document.createElement("div");
         this._htmlEditElement.className = "source-code elements-tree-editor";
@@ -1030,7 +1039,7 @@ WebInspector.ElementsTreeElement.prototype = {
             var found = false;
 
             // Search for the attribute's position, and then decide where to move to.
-            var attributes = this.representedObject.attributes;
+            var attributes = this.representedObject.attributes();
             for (var i = 0; i < attributes.length; ++i) {
                 if (attributes[i].name === attributeName) {
                     found = true;
@@ -1095,7 +1104,7 @@ WebInspector.ElementsTreeElement.prototype = {
         }
 
         if (!parseElement.hasAttributes()) {
-            this.representedObject.removeAttribute(attributeName);
+            this.representedObject.removeAttribute(attributeName, this.updateTitle.bind(this));
             this.treeOutline.focusedNodeChanged(true);
             moveToNextAttributeIfNeeded.call(this);
             return;
@@ -1106,13 +1115,13 @@ WebInspector.ElementsTreeElement.prototype = {
             var attr = parseElement.attributes[i];
             foundOriginalAttribute = foundOriginalAttribute || attr.name === attributeName;
             try {
-                this.representedObject.setAttribute(attr.name, attr.value);
+                this.representedObject.setAttribute(attr.name, attr.value, this.updateTitle.bind(this));
                 regenerateStyledAttribute.call(this, attr.name, attr.value);
             } catch(e) {} // ignore invalid attribute (innerHTML doesn't throw errors, but this can)
         }
 
         if (!foundOriginalAttribute)
-            this.representedObject.removeAttribute(attributeName);
+            this.representedObject.removeAttribute(attributeName, this.updateTitle.bind(this));
 
         this.treeOutline.focusedNodeChanged(true);
 
@@ -1141,7 +1150,7 @@ WebInspector.ElementsTreeElement.prototype = {
                 return;
             }
 
-            var attributes = this.representedObject.attributes;
+            var attributes = this.representedObject.attributes();
             if (attributes.length > 0)
                 this._triggerEditAttribute(attributes[0].name);
             else
@@ -1157,9 +1166,9 @@ WebInspector.ElementsTreeElement.prototype = {
         var treeOutline = this.treeOutline;
         var wasExpanded = this.expanded;
 
-        function changeTagNameCallback(nodeId)
+        function changeTagNameCallback(error, nodeId)
         {
-            if (!nodeId) {
+            if (error || !nodeId) {
                 cancel();
                 return;
             }
@@ -1175,7 +1184,7 @@ WebInspector.ElementsTreeElement.prototype = {
             moveToNextAttributeIfNeeded.call(newTreeItem);
         }
 
-        DOMAgent.changeTagName(this.representedObject.id, newText, changeTagNameCallback);
+        this.representedObject.setNodeName(newText, changeTagNameCallback);
     },
 
     _textNodeEditingCommitted: function(element, newText)
@@ -1183,14 +1192,14 @@ WebInspector.ElementsTreeElement.prototype = {
         delete this._editing;
 
         var textNode;
-        if (this.representedObject.nodeType === Node.ELEMENT_NODE) {
+        if (this.representedObject.nodeType() === Node.ELEMENT_NODE) {
             // We only show text nodes inline in elements if the element only
             // has a single child, and that child is a text node.
             textNode = this.representedObject.firstChild;
-        } else if (this.representedObject.nodeType == Node.TEXT_NODE)
+        } else if (this.representedObject.nodeType() == Node.TEXT_NODE)
             textNode = this.representedObject;
 
-        textNode.nodeValue = newText;
+        textNode.setNodeValue(newText, this.updateTitle.bind(this));
     },
 
     _editingCancelled: function(element, context)
@@ -1250,7 +1259,7 @@ WebInspector.ElementsTreeElement.prototype = {
         if (linkify && (name === "src" || name === "href")) {
             var rewrittenHref = WebInspector.resourceURLForRelatedNode(node, value);
             value = value.replace(/([\/;:\)\]\}])/g, "$1\u200B");
-            html += linkify(rewrittenHref, value, "webkit-html-attribute-value", node.nodeName.toLowerCase() === "a");
+            html += linkify(rewrittenHref, value, "webkit-html-attribute-value", node.nodeName().toLowerCase() === "a");
         } else {
             value = value.escapeHTML().replace(/([\/;:\)\]\}])/g, "$1&#8203;");
             html += "<span class=\"webkit-html-attribute-value\">" + value + "</span>";
@@ -1269,8 +1278,9 @@ WebInspector.ElementsTreeElement.prototype = {
         var result = "<span class=\"webkit-html-tag" + (isClosingTag && isDistinctTreeElement ? " close" : "")  + "\">&lt;";
         result += "<span " + (isClosingTag ? "" : "class=\"webkit-html-tag-name\"") + ">" + (isClosingTag ? "/" : "") + tagName + "</span>";
         if (!isClosingTag && node.hasAttributes()) {
-            for (var i = 0; i < node.attributes.length; ++i) {
-                var attr = node.attributes[i];
+            var attributes = node.attributes();
+            for (var i = 0; i < attributes.length; ++i) {
+                var attr = attributes[i];
                 result += " " + this._attributeHTML(attr.name, attr.value, node, linkify);
             }
         }
@@ -1284,7 +1294,7 @@ WebInspector.ElementsTreeElement.prototype = {
         var node = this.representedObject;
         var info = {titleHTML: "", hasChildren: this.hasChildren};
 
-        switch (node.nodeType) {
+        switch (node.nodeType()) {
             case Node.DOCUMENT_NODE:
                 info.titleHTML = "Document";
                 break;
@@ -1299,7 +1309,7 @@ WebInspector.ElementsTreeElement.prototype = {
                 break;
 
             case Node.ELEMENT_NODE:
-                var tagName = this.treeOutline.nodeNameToCorrectCase(node.nodeName).escapeHTML();
+                var tagName = this.treeOutline.nodeNameToCorrectCase(node.nodeName()).escapeHTML();
                 if (this._elementCloseTag) {
                     info.titleHTML = this._tagHTML(tagName, true, true);
                     info.hasChildren = false;
@@ -1308,8 +1318,8 @@ WebInspector.ElementsTreeElement.prototype = {
 
                 var titleHTML = this._tagHTML(tagName, false, false, linkify);
 
-                var textChild = onlyTextChild.call(node);
-                var showInlineText = textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength;
+                var textChild = this._singleTextChild(node);
+                var showInlineText = textChild && textChild.nodeValue().length < Preferences.maxInlineTextChildLength;
 
                 if (!this.expanded && (!showInlineText && (this.treeOutline.isXMLMimeType || !WebInspector.ElementsTreeElement.ForbiddenClosingTagElements[tagName]))) {
                     if (this.hasChildren)
@@ -1321,7 +1331,7 @@ WebInspector.ElementsTreeElement.prototype = {
                 // just show that text and the closing tag inline rather than
                 // create a subtree for them
                 if (showInlineText) {
-                    titleHTML += "<span class=\"webkit-html-text-node\">" + textChild.nodeValue.escapeHTML() + "</span>&#8203;" + this._tagHTML(tagName, true, false);
+                    titleHTML += "<span class=\"webkit-html-text-node\">" + textChild.nodeValue().escapeHTML() + "</span>&#8203;" + this._tagHTML(tagName, true, false);
                     info.hasChildren = false;
                 }
                 info.titleHTML = titleHTML;
@@ -1331,33 +1341,33 @@ WebInspector.ElementsTreeElement.prototype = {
                 if (isNodeWhitespace.call(node))
                     info.titleHTML = "(whitespace)";
                 else {
-                    if (node.parentNode && node.parentNode.nodeName.toLowerCase() === "script") {
+                    if (node.parentNode && node.parentNode.nodeName().toLowerCase() === "script") {
                         var newNode = document.createElement("span");
-                        newNode.textContent = node.textContent;
+                        newNode.textContent = node.nodeValue();
 
                         var javascriptSyntaxHighlighter = new WebInspector.DOMSyntaxHighlighter("text/javascript");
                         javascriptSyntaxHighlighter.syntaxHighlightNode(newNode);
 
                         info.titleHTML = "<span class=\"webkit-html-text-node webkit-html-js-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
-                    } else if (node.parentNode && node.parentNode.nodeName.toLowerCase() === "style") {
+                    } else if (node.parentNode && node.parentNode.nodeName().toLowerCase() === "style") {
                         var newNode = document.createElement("span");
-                        newNode.textContent = node.textContent;
+                        newNode.textContent = node.nodeValue();
 
                         var cssSyntaxHighlighter = new WebInspector.DOMSyntaxHighlighter("text/css");
                         cssSyntaxHighlighter.syntaxHighlightNode(newNode);
 
                         info.titleHTML = "<span class=\"webkit-html-text-node webkit-html-css-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
                     } else
-                        info.titleHTML = "\"<span class=\"webkit-html-text-node\">" + node.nodeValue.escapeHTML() + "</span>\"";
+                        info.titleHTML = "\"<span class=\"webkit-html-text-node\">" + node.nodeValue().escapeHTML() + "</span>\"";
                 }
                 break;
 
             case Node.COMMENT_NODE:
-                info.titleHTML = "<span class=\"webkit-html-comment\">&lt;!--" + node.nodeValue.escapeHTML() + "--&gt;</span>";
+                info.titleHTML = "<span class=\"webkit-html-comment\">&lt;!--" + node.nodeValue().escapeHTML() + "--&gt;</span>";
                 break;
 
             case Node.DOCUMENT_TYPE_NODE:
-                var titleHTML = "<span class=\"webkit-html-doctype\">&lt;!DOCTYPE " + node.nodeName;
+                var titleHTML = "<span class=\"webkit-html-doctype\">&lt;!DOCTYPE " + node.nodeName();
                 if (node.publicId) {
                     titleHTML += " PUBLIC \"" + node.publicId + "\"";
                     if (node.systemId)
@@ -1371,20 +1381,33 @@ WebInspector.ElementsTreeElement.prototype = {
                 break;
 
             case Node.CDATA_SECTION_NODE:
-                info.titleHTML = "<span class=\"webkit-html-text-node\">&lt;![CDATA[" + node.nodeValue.escapeHTML() + "]]&gt;</span>";
+                info.titleHTML = "<span class=\"webkit-html-text-node\">&lt;![CDATA[" + node.nodeValue().escapeHTML() + "]]&gt;</span>";
                 break;
             default:
-                info.titleHTML = this.treeOutline.nodeNameToCorrectCase(node.nodeName).collapseWhitespace().escapeHTML();
+                info.titleHTML = this.treeOutline.nodeNameToCorrectCase(node.nodeName()).collapseWhitespace().escapeHTML();
         }
 
         return info;
     },
 
+    _singleTextChild: function(node)
+    {
+        if (!node)
+            return null;
+
+        var firstChild = node.firstChild;
+        if (!firstChild || firstChild.nodeType() !== Node.TEXT_NODE)
+            return null;
+
+        var sibling = firstChild.nextSibling;
+        return sibling ? null : firstChild;
+    },
+
     _showInlineText: function(node)
     {
-        if (node.nodeType === Node.ELEMENT_NODE) {
-            var textChild = onlyTextChild.call(node);
-            if (textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength)
+        if (node.nodeType() === Node.ELEMENT_NODE) {
+            var textChild = this._singleTextChild(node);
+            if (textChild && textChild.nodeValue().length < Preferences.maxInlineTextChildLength)
                 return true;
         }
         return false;
@@ -1397,18 +1420,16 @@ WebInspector.ElementsTreeElement.prototype = {
             return;
 
         var self = this;
-        function removeNodeCallback(removedNodeId)
+        function removeNodeCallback(error, removedNodeId)
         {
-            // -1 is an error code, which means removing the node from the DOM failed,
-            // so we shouldn't remove it from the tree.
-            if (removedNodeId === -1)
+            if (error)
                 return;
 
             parentElement.removeChild(self);
             parentElement.adjustCollapsedRange(true);
         }
 
-        DOMAgent.removeNode(this.representedObject.id, removeNodeCallback);
+        this.representedObject.removeNode(removeNodeCallback);
     },
 
     _editAsHTML: function()
@@ -1417,9 +1438,9 @@ WebInspector.ElementsTreeElement.prototype = {
         var node = this.representedObject;
         var wasExpanded = this.expanded;
 
-        function selectNode(nodeId)
+        function selectNode(error, nodeId)
         {
-            if (!nodeId)
+            if (error || !nodeId)
                 return;
 
             // Select it and expand if necessary. We force tree update so that it processes dom events and is up to date.
@@ -1435,15 +1456,15 @@ WebInspector.ElementsTreeElement.prototype = {
 
         function commitChange(value)
         {
-            DOMAgent.setOuterHTML(node.id, value, selectNode);
+            node.setOuterHTML(value, selectNode);
         }
 
-        DOMAgent.getOuterHTML(node.id, this._startEditingAsHTML.bind(this, commitChange));
+        node.getOuterHTML(this._startEditingAsHTML.bind(this, commitChange));
     },
 
     _copyHTML: function()
     {
-        DOMAgent.copyNode(this.representedObject.id);
+        this.representedObject.copyNode();
     },
 
     _highlightSearchResults: function()
@@ -1468,6 +1489,11 @@ WebInspector.ElementsTreeElement.prototype = {
             matchRanges.push({ offset: match.index, length: match[0].length });
             match = regexObject.exec(text);
         }
+
+        // Fall back for XPath, etc. matches.
+        if (!matchRanges.length)
+            matchRanges.push({ offset: 0, length: text.length });
+
         highlightSearchResults(this.listItemElement, matchRanges);
         this._searchHighlightedHTML = this.listItemElement.innerHTML;
     }
diff --git a/Source/WebCore/inspector/front-end/EventListenersSidebarPane.js b/Source/WebCore/inspector/front-end/EventListenersSidebarPane.js
index bc8bb12..00576f1 100644
--- a/Source/WebCore/inspector/front-end/EventListenersSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/EventListenersSidebarPane.js
@@ -65,7 +65,10 @@ WebInspector.EventListenersSidebarPane.prototype = {
         this.sections = [];
 
         var self = this;
-        function callback(nodeId, eventListeners) {
+        function callback(error, eventListeners) {
+            if (error)
+                return;
+
             var sectionNames = [];
             var sectionMap = {};
             for (var i = 0; i < eventListeners.length; ++i) {
@@ -77,7 +80,7 @@ WebInspector.EventListenersSidebarPane.prototype = {
                 var type = eventListener.type;
                 var section = sectionMap[type];
                 if (!section) {
-                    section = new WebInspector.EventListenersSection(type, nodeId);
+                    section = new WebInspector.EventListenersSection(type, node.id);
                     sectionMap[type] = section;
                     sectionNames.push(type);
                     self.sections.push(section);
@@ -101,7 +104,8 @@ WebInspector.EventListenersSidebarPane.prototype = {
             }
         }
 
-        WebInspector.EventListeners.getEventListenersForNodeAsync(node, callback);
+        if (node)
+            node.eventListeners(callback);
     },
 
     _changeSetting: function(event)
@@ -190,6 +194,8 @@ WebInspector.EventListenerBar.prototype = {
                 properties.push(new WebInspector.RemoteObjectProperty(propertyName, value));
             }
             this.updateProperties(properties);
+            if (nodeObject)
+                nodeObject.release();
         }
         var node = this.eventListener.node;
         delete this.eventListener.node;
@@ -202,7 +208,7 @@ WebInspector.EventListenerBar.prototype = {
         if (!node)
             return;
 
-        if (node.nodeType === Node.DOCUMENT_NODE) {
+        if (node.nodeType() === Node.DOCUMENT_NODE) {
             this.titleElement.textContent = "document";
             return;
         }
diff --git a/Source/WebCore/inspector/front-end/ExtensionAPI.js b/Source/WebCore/inspector/front-end/ExtensionAPI.js
index 6a11d62..ea7324c 100644
--- a/Source/WebCore/inspector/front-end/ExtensionAPI.js
+++ b/Source/WebCore/inspector/front-end/ExtensionAPI.js
@@ -516,5 +516,7 @@ var WatchExpressionSidebarPane = declareInterfaceClass(WatchExpressionSidebarPan
 var extensionServer = new ExtensionServerClient();
 
 webInspector = new InspectorExtensionAPI();
+experimental = window.experimental || {};
+experimental.webInspector = webInspector;
 
 }
diff --git a/Source/WebCore/inspector/front-end/ExtensionAPISchema.json b/Source/WebCore/inspector/front-end/ExtensionAPISchema.json
index 28084ba..0aa7aa8 100755
--- a/Source/WebCore/inspector/front-end/ExtensionAPISchema.json
+++ b/Source/WebCore/inspector/front-end/ExtensionAPISchema.json
@@ -1,57 +1,5 @@
 [
   {
-    "namespace": "experimental.webInspector.inspectedWindow",
-    "description": "Provides access to the window being inspected.",
-    "functions": [
-      {
-        "name": "eval",
-        "type": "function",
-        "description": "Evaluates a JavaScript expression in the context of inspected page (NOTE: the expression must evaluate to a JSON-compliant object, otherwise the exception is thrown)",
-        "parameters": [
-          {
-            "name": "expression",
-            "type": "string",
-            "description": "An expression to evaluate."
-          },
-          {
-            "name": "callback",
-            "type": "function",
-            "description": "A function called when evaluation completes.",
-            "parameters": [
-              {
-                "name": "result",
-                "type": "object",
-                "description": "The result of evaluation"
-              },
-              {
-                "name": "isException",
-                "type": "boolean",
-                "description": "Set if an exception was caught while evaluating the expression"
-              }
-            ]
-          }
-        ]
-      }
-    ],
-    "events": [
-      {
-        "name": "onDOMContentLoaded",
-        "type": "function",
-        "description": "Fired after DOMContentLoaded event on inspected page is fired."
-      },
-      {
-        "name": "onLoaded",
-        "type": "function",
-        "description": "Fired after load event on inspected page is fired."
-      },
-      {
-        "name": "onNavigated",
-        "type": "function",
-        "description": "Fired when navigation occurs in the window being inspected."
-      }
-    ]
-  },
-  {
     "namespace": "experimental.webInspector.panels",
     "types": [
       {
@@ -150,7 +98,7 @@
               }
             ]
           }
-       	]
+        ]
       },
       {
         "id": "ExtensionSidebarPane",
diff --git a/Source/WebCore/inspector/front-end/ExtensionPanel.js b/Source/WebCore/inspector/front-end/ExtensionPanel.js
index 142b8c1..4249b2c 100644
--- a/Source/WebCore/inspector/front-end/ExtensionPanel.js
+++ b/Source/WebCore/inspector/front-end/ExtensionPanel.js
@@ -98,9 +98,10 @@ WebInspector.ExtensionWatchSidebarPane.prototype = {
         RuntimeAgent.evaluate(expression, "extension-watch", false, this._onEvaluate.bind(this, title));
     },
 
-    _onEvaluate: function(title, result)
+    _onEvaluate: function(title, error, result)
     {
-        this._setObject(WebInspector.RemoteObject.fromPayload(result), title);
+        if (!error)
+            this._setObject(WebInspector.RemoteObject.fromPayload(result), title);
     },
 
     _setObject: function(object, title)
diff --git a/Source/WebCore/inspector/front-end/ExtensionServer.js b/Source/WebCore/inspector/front-end/ExtensionServer.js
index f9af7dc..9554dfa 100644
--- a/Source/WebCore/inspector/front-end/ExtensionServer.js
+++ b/Source/WebCore/inspector/front-end/ExtensionServer.js
@@ -118,7 +118,13 @@ WebInspector.ExtensionServer.prototype = {
     _notifyResourceFinished: function(event)
     {
         var resource = event.data;
-        this._postNotification("resource-finished", this._resourceId(resource), (new WebInspector.HAREntry(resource)).build());
+        if (this._hasSubscribers("resource-finished"))
+            this._postNotification("resource-finished", this._resourceId(resource), (new WebInspector.HAREntry(resource)).build());
+    },
+
+    _hasSubscribers: function(type)
+    {
+        return !!this._subscribers[type];
     },
 
     _postNotification: function(type, details)
@@ -261,16 +267,18 @@ WebInspector.ExtensionServer.prototype = {
     _onReload: function(message)
     {
         if (typeof message.userAgent === "string")
-            InspectorAgent.setUserAgentOverride(message.userAgent);
+            PageAgent.setUserAgentOverride(message.userAgent);
 
-        InspectorAgent.reloadPage(false);
+        PageAgent.reloadPage(false);
         return this._status.OK();
     },
 
     _onEvaluateOnInspectedPage: function(message, port)
     {
-        function callback(resultPayload)
+        function callback(error, resultPayload)
         {
+            if (error)
+                return;
             var resultObject = WebInspector.RemoteObject.fromPayload(resultPayload);
             var result = {};
             if (resultObject.isError())
diff --git a/Source/WebCore/inspector/front-end/GoToLineDialog.js b/Source/WebCore/inspector/front-end/GoToLineDialog.js
index f246159..9f4504d 100644
--- a/Source/WebCore/inspector/front-end/GoToLineDialog.js
+++ b/Source/WebCore/inspector/front-end/GoToLineDialog.js
@@ -40,7 +40,7 @@ WebInspector.GoToLineDialog = function(view)
 
     var dialogWindow = this._element;
 
-    dialogWindow.createChild("label").innerText = WebInspector.UIString("Go to line: ");
+    dialogWindow.createChild("label").textContent = WebInspector.UIString("Go to line: ");
 
     this._input = dialogWindow.createChild("input");
     this._input.setAttribute("type", "text");
@@ -53,7 +53,7 @@ WebInspector.GoToLineDialog = function(view)
     
 
     var go = dialogWindow.createChild("button");
-    go.innerText = WebInspector.UIString("Go");
+    go.textContent = WebInspector.UIString("Go");
     go.addEventListener("click", this._onClick.bind(this), false);
     go.addEventListener("mousedown", function(e) {
         // Ok button click will close the dialog, removing onBlur listener
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshot.js b/Source/WebCore/inspector/front-end/HeapSnapshot.js
index 215f31c..c9d1e30 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshot.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshot.js
@@ -197,6 +197,134 @@ WebInspector.HeapSnapshotEdgeIterator.prototype = {
     }
 };
 
+WebInspector.HeapSnapshotRetainerEdge = function(snapshot, retainers, retainerIndex)
+{
+    this._snapshot = snapshot;
+    this._retainers = retainers;
+    this.retainerIndex = retainerIndex || 0;
+}
+
+WebInspector.HeapSnapshotRetainerEdge.prototype = {
+    clone: function()
+    {
+        return new WebInspector.HeapSnapshotRetainerEdge(this._snapshot, this._retainers, this.retainerIndex);
+    },
+
+    get hasStringName()
+    {
+        return this._edge.hasStringName;
+    },
+
+    get isElement()
+    {
+        return this._edge.isElement;
+    },
+
+    get isHidden()
+    {
+        return this._edge.isHidden;
+    },
+
+    get isInternal()
+    {
+        return this._edge.isInternal;
+    },
+
+    get isInvisible()
+    {
+        return this._edge.isInvisible;
+    },
+
+    get isShortcut()
+    {
+        return this._edge.isShortcut;
+    },
+
+    get name()
+    {
+        return this._edge.name;
+    },
+
+    get node()
+    {
+        return this._node;
+    },
+
+    get nodeIndex()
+    {
+        return this._nodeIndex;
+    },
+
+    get retainerIndex()
+    {
+        return this._retainerIndex;
+    },
+
+    set retainerIndex(newIndex)
+    {
+        if (newIndex !== this._retainerIndex) {
+            this._retainerIndex = newIndex;
+            this._setupEdge();
+        }
+    },
+
+    _setupEdge: function()
+    {
+        var globalEdgeIndex = this._retainers.item(this._retainerIndex);
+        this._nodeIndex = this._snapshot._findNearestNodeIndex(globalEdgeIndex);
+        this._node = new WebInspector.HeapSnapshotNode(this._snapshot, this._nodeIndex);
+        var edgeIndex = globalEdgeIndex - this._nodeIndex - this._snapshot._firstEdgeOffset;
+        this._edge = new WebInspector.HeapSnapshotEdge(this._snapshot, this._node.rawEdges, edgeIndex);
+    },
+
+    toString: function()
+    {
+        return this._edge.toString();
+    },
+
+    get type()
+    {
+        return this._edge.type;
+    }
+}
+
+WebInspector.HeapSnapshotRetainerEdgeIterator = function(retainer)
+{
+    this.retainer = retainer;
+}
+
+WebInspector.HeapSnapshotRetainerEdgeIterator.prototype = {
+    first: function()
+    {
+        this.retainer.retainerIndex = 0;
+    },
+
+    hasNext: function()
+    {
+        return this.retainer.retainerIndex < this.retainer._retainers.length;
+    },
+
+    get index()
+    {
+        return this.retainer.retainerIndex;
+    },
+
+    set index(newIndex)
+    {
+        this.retainer.retainerIndex = newIndex;
+    },
+
+    get item()
+    {
+        return this.retainer;
+    },
+
+    next: function()
+    {
+        ++this.retainer.retainerIndex;
+    }
+};
+
 WebInspector.HeapSnapshotNode = function(snapshot, nodeIndex)
 {
     this._snapshot = snapshot;
@@ -212,6 +340,10 @@ WebInspector.HeapSnapshotNode.prototype = {
             return WebInspector.UIString("(system)");
         case "object":
             return this.name;
+        case "native": {
+            var entitiesCountPos = this.name.indexOf("/");
+            return entitiesCountPos !== -1 ? this.name.substring(0, entitiesCountPos).trimRight() : this.name;
+        }
         case "code":
             return WebInspector.UIString("(compiled code)");
         default:
@@ -219,7 +351,7 @@ WebInspector.HeapSnapshotNode.prototype = {
         }
     },
 
-    dominatorIndex: function()
+    get dominatorIndex()
     {
         return this._nodes[this.nodeIndex + this._snapshot._dominatorOffset];
     },
@@ -272,7 +404,7 @@ WebInspector.HeapSnapshotNode.prototype = {
 
     get retainers()
     {
-        return new WebInspector.HeapSnapshotEdgeIterator(new WebInspector.HeapSnapshotEdge(this._snapshot, this._snapshot.retainers(this)));
+        return new WebInspector.HeapSnapshotRetainerEdgeIterator(new WebInspector.HeapSnapshotRetainerEdge(this._snapshot, this._snapshot._retainersForNode(this)));
     },
 
     get selfSize()
@@ -350,6 +482,7 @@ WebInspector.HeapSnapshotNodeIterator.prototype = {
 
 WebInspector.HeapSnapshot = function(profile)
 {
+    this.uid = profile.uid;
     this._nodes = profile.nodes;
     this._strings = profile.strings;
 
@@ -393,32 +526,30 @@ WebInspector.HeapSnapshot.prototype = {
     {
         delete this._nodes;
         delete this._strings;
-        if (this._idsMap)
-            delete this._idsMap;
-        if (this._retainers) {
-            delete this._retainers;
-            delete this._nodesToRetainers;
-        }
+        delete this._idsList;
+        delete this._retainers;
+        delete this._retainerIndex;
+        delete this._nodeIndex;
         if (this._aggregates) {
             delete this._aggregates;
             this._aggregatesWithIndexes = false;
         }
     },
 
-    get allNodes()
+    get _allNodes()
     {
         return new WebInspector.HeapSnapshotNodeIterator(this.rootNode);
     },
 
-    get nodesCount()
+    get nodeCount()
     {
-        if (this._nodesCount)
-            return this._nodesCount;
+        if (this._nodeCount)
+            return this._nodeCount;
 
-        this._nodesCount = 0;
-        for (var iter = this.allNodes; iter.hasNext(); iter.next())
-            ++this._nodesCount;
-        return this._nodesCount;
+        this._nodeCount = 0;
+        for (var iter = this._allNodes; iter.hasNext(); iter.next())
+            ++this._nodeCount;
+        return this._nodeCount;
     },
 
     restore: function(profile)
@@ -432,30 +563,35 @@ WebInspector.HeapSnapshot.prototype = {
         return new WebInspector.HeapSnapshotNode(this, this._rootNodeIndex);
     },
 
+    get rootNodeIndex()
+    {
+        return this._rootNodeIndex;
+    },
+
     get totalSize()
     {
         return this.rootNode.retainedSize;
     },
 
-    get idsMap()
+    hasId: function(id)
     {
-        if (this._idsMap)
-            return this._idsMap;
+        return this.nodeIds.binaryIndexOf(id, this._numbersComparator) >= 0;
+    },
 
-        this._idsMap = [];
-        for (var iter = this.allNodes; iter.hasNext(); iter.next()) {
-            this._idsMap[iter.node.id] = true;
-        }
-        return this._idsMap;
+    get nodeIds()
+    {
+        if (!this._idsList)
+            this._buildIdsList();
+        return this._idsList;
     },
 
-    retainers: function(node)
+    _retainersForNode: function(node)
     {
         if (!this._retainers)
             this._buildRetainers();
 
-        var retIndexFrom = this._nodesToRetainers[node.nodeIndex];
-        var retIndexTo = this._nodesToRetainers[node._nextNodeIndex];
+        var retIndexFrom = this._getRetainerIndex(node.nodeIndex);
+        var retIndexTo = this._getRetainerIndex(node._nextNodeIndex);
         return new WebInspector.HeapSnapshotArraySlice(this, "_retainers", retIndexFrom, retIndexTo);
     },
 
@@ -470,51 +606,39 @@ WebInspector.HeapSnapshot.prototype = {
 
     _buildRetainers: function()
     {
-        this._nodesToRetainers = [];
-        for (var nodesIter = this.allNodes; nodesIter.hasNext(); nodesIter.next()) {
+        if (!this._nodeIndex)
+            this._buildNodeIndex();
+
+        this._retainerIndex = new Array(this._nodeIndex.length);
+        for (var i = 0, l = this._retainerIndex.length; i < l; ++i)
+            this._retainerIndex[i] = 0;
+        for (var nodesIter = this._allNodes; nodesIter.hasNext(); nodesIter.next()) {
             var node = nodesIter.node;
-            if (!(node.nodeIndex in this._nodesToRetainers))
-                this._nodesToRetainers[node.nodeIndex] = 0;
             for (var edgesIter = node.edges; edgesIter.hasNext(); edgesIter.next()) {
                 var edge = edgesIter.edge;
                 var nodeIndex = edge.nodeIndex;
-                if (!(nodeIndex in this._nodesToRetainers))
-                    this._nodesToRetainers[nodeIndex] = 0;
-                this._nodesToRetainers[nodeIndex] += this._edgeFieldsCount;
+                var position = this._findNodePositionInIndex(nodeIndex);
+                ++this._retainerIndex[position];
             }
         }
-        nodesIter = this.allNodes;
-        var node = nodesIter.node;
-        var prevIndex = this._nodesToRetainers[node.nodeIndex] = 0;
-        var prevRetsCount = this._nodesToRetainers[node.nodeIndex];
-        nodesIter.next();
-        for (; nodesIter.hasNext(); nodesIter.next()) {
-            node = nodesIter.node;
-            var savedRefsCount = this._nodesToRetainers[node.nodeIndex];
-            this._nodesToRetainers[node.nodeIndex] = prevIndex + prevRetsCount;
-            prevIndex = this._nodesToRetainers[node.nodeIndex];
-            prevRetsCount = savedRefsCount;
-        }
-        this._retainers = new Array(prevIndex + prevRetsCount);
-        this._nodesToRetainers[this._nodes.length] = this._retainers.length;
-        for (nodesIter = this.allNodes; nodesIter.hasNext(); nodesIter.next()) {
-            node = nodesIter.node;
-            var retsCount = this._nodesToRetainers[node._nextNodeIndex] - this._nodesToRetainers[node.nodeIndex];
-            if (retsCount > 0) {
-                this._retainers[this._nodesToRetainers[node.nodeIndex]] = retsCount;
-            }
+        var retainerCount = 0;
+        for (i = 0, l = this._retainerIndex.length; i < l; ++i)
+            retainerCount += this._retainerIndex[i];
+        this._retainers = new Array(retainerCount + 1);
+        var retainerPosition = 0;
+        for (i = 0, l = this._retainerIndex.length; i < l; ++i) {
+            retainerCount = this._retainers[retainerPosition] = this._retainerIndex[i];
+            this._retainerIndex[i] = retainerPosition;
+            retainerPosition += retainerCount;
         }
-        for (nodesIter = this.allNodes; nodesIter.hasNext(); nodesIter.next()) {
-            node = nodesIter.node;
+        for (nodesIter = this._allNodes; nodesIter.hasNext(); nodesIter.next()) {
+            var node = nodesIter.node;
             for (var edgesIter = node.edges; edgesIter.hasNext(); edgesIter.next()) {
                 var edge = edgesIter.edge;
                 var nodeIndex = edge.nodeIndex;
-                var retIndex = this._nodesToRetainers[nodeIndex];
-                this._retainers[retIndex] -= this._edgeFieldsCount;
-                var idx = retIndex + this._retainers[retIndex];
-                this._retainers[idx + this._edgeTypeOffset] = edge._type();
-                this._retainers[idx + this._edgeNameOffset] = edge._nameOrIndex;
-                this._retainers[idx + this._edgeToNodeOffset] = node.nodeIndex;
+                var retIndex = this._getRetainerIndex(nodeIndex);
+                var idx = retIndex + (--this._retainers[retIndex]);
+                this._retainers[idx] = node.nodeIndex + this._firstEdgeOffset + edge.edgeIndex;
             }
         }
     },
@@ -522,11 +646,11 @@ WebInspector.HeapSnapshot.prototype = {
     _buildAggregates: function()
     {
         this._aggregates = {};
-        for (var iter = this.allNodes; iter.hasNext(); iter.next()) {
+        for (var iter = this._allNodes; iter.hasNext(); iter.next()) {
             var node = iter.node;
             var className = node.className;
-            var nameMatters = node.type === "object";
-            if (node.selfSize === 0)
+            var nameMatters = node.type === "object" || node.type === "native";
+            if (node.type !== "native" && node.selfSize === 0)
                 continue;
             if (!(className in this._aggregates))
                 this._aggregates[className] = { count: 0, self: 0, maxRet: 0, type: node.type, name: nameMatters ? node.name : null, idxs: [] };
@@ -540,7 +664,7 @@ WebInspector.HeapSnapshot.prototype = {
 
     _buildAggregatesIndexes: function()
     {
-        for (var iter = this.allNodes; iter.hasNext(); iter.next()) {
+        for (var iter = this._allNodes; iter.hasNext(); iter.next()) {
             var node = iter.node;
             var className = node.className;
             var clss = this._aggregates[className];
@@ -561,6 +685,53 @@ WebInspector.HeapSnapshot.prototype = {
         this._aggregatesWithIndexes = true;
     },
 
+    _buildIdsList: function()
+    {
+        var count = 0;
+        for (var nodesIter = this._allNodes; nodesIter.hasNext(); nodesIter.next(), ++count);
+        this._idsList = new Array(count);
+        count = 0;
+        for (nodesIter = this._allNodes; nodesIter.hasNext(); nodesIter.next(), ++count)
+            this._idsList[count] = nodesIter.node.id;
+        this._idsList.sort(this._numbersComparator);
+    },
+
+    _buildNodeIndex: function()
+    {
+        var count = 0;
+        for (var nodesIter = this._allNodes; nodesIter.hasNext(); nodesIter.next(), ++count);
+        this._nodeIndex = new Array(count + 1);
+        count = 0;
+        for (nodesIter = this._allNodes; nodesIter.hasNext(); nodesIter.next(), ++count)
+            this._nodeIndex[count] = nodesIter.index;
+        this._nodeIndex[count] = this._nodes.length;
+    },
+
+    _findNodePositionInIndex: function(index)
+    {
+        return binarySearch(index, this._nodeIndex, this._numbersComparator);
+    },
+
+    _findNearestNodeIndex: function(index)
+    {
+        var result = this._findNodePositionInIndex(index);
+        if (result < 0) {
+            result = -result - 1;
+            nodeIndex = this._nodeIndex[result];
+            // Binary search can return either maximum lower value, or minimum higher value.
+            if (nodeIndex > index)
+                nodeIndex = this._nodeIndex[result - 1];
+        } else
+            var nodeIndex = this._nodeIndex[result];
+        return nodeIndex;
+    },
+
+    _getRetainerIndex: function(nodeIndex)
+    {
+        var nodePosition = this._findNodePositionInIndex(nodeIndex);
+        return this._retainerIndex[nodePosition];
+    },
+  
     _markInvisibleEdges: function()
     {
         // Mark hidden edges of global objects as invisible.
@@ -586,6 +757,11 @@ WebInspector.HeapSnapshot.prototype = {
                     this._nodes[globalObjEdge._edges._start + globalObjEdge.edgeIndex + this._edgeTypeOffset] = this._edgeInvisibleType;
             }
         }
+    },
+
+    _numbersComparator: function(a, b)
+    {
+        return a < b ? -1 : (a > b ? 1 : 0);
     }
 };
 
@@ -596,7 +772,6 @@ WebInspector.HeapSnapshotFilteredOrderedIterator = function(iterator, filter)
     this._iterationOrder = null;
     this._position = 0;
     this._lastComparator = null;
-    this._instancesCount = 0;
 }
 
 WebInspector.HeapSnapshotFilteredOrderedIterator.prototype = {
@@ -625,16 +800,6 @@ WebInspector.HeapSnapshotFilteredOrderedIterator.prototype = {
         return this._position < this._iterationOrder.length;
     },
 
-    incInstancesCount: function()
-    {
-        ++this._instancesCount;
-    },
-
-    get instancesCount()
-    {
-        return this._instancesCount;
-    },
-
     get isEmpty()
     {
         if (this._iterationOrder)
@@ -655,11 +820,6 @@ WebInspector.HeapSnapshotFilteredOrderedIterator.prototype = {
         return this._iterator.item;
     },
 
-    get lastComparator()
-    {
-        return this._lastComparator;
-    },
-
     get length()
     {
         if (!this._iterationOrder)
@@ -671,11 +831,6 @@ WebInspector.HeapSnapshotFilteredOrderedIterator.prototype = {
     {
         ++this._position;
     },
-
-    resetInstancesCount: function()
-    {
-        this._instancesCount = 0;
-    }
 }
 
 WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.createComparator = function(fieldNames)
@@ -683,10 +838,11 @@ WebInspector.HeapSnapshotFilteredOrderedIterator.prototype.createComparator = fu
     return {fieldName1:fieldNames[0], ascending1:fieldNames[1], fieldName2:fieldNames[2], ascending2:fieldNames[3]};
 }
 
-WebInspector.HeapSnapshotEdgesProvider = function(snapshot, rawEdges, filter)
+WebInspector.HeapSnapshotEdgesProvider = function(snapshot, nodeIndex, filter)
 {
     this.snapshot = snapshot;
-    WebInspector.HeapSnapshotFilteredOrderedIterator.call(this, new WebInspector.HeapSnapshotEdgeIterator(new WebInspector.HeapSnapshotEdge(snapshot, rawEdges)), filter);
+    var node = new WebInspector.HeapSnapshotNode(snapshot, nodeIndex);
+    WebInspector.HeapSnapshotFilteredOrderedIterator.call(this, new WebInspector.HeapSnapshotEdgeIterator(new WebInspector.HeapSnapshotEdge(snapshot, node.rawEdges)), filter);
 }
 
 WebInspector.HeapSnapshotEdgesProvider.prototype = {
@@ -766,10 +922,10 @@ WebInspector.HeapSnapshotEdgesProvider.prototype = {
 
 WebInspector.HeapSnapshotEdgesProvider.prototype.__proto__ = WebInspector.HeapSnapshotFilteredOrderedIterator.prototype;
 
-WebInspector.HeapSnapshotNodesProvider = function(snapshot, nodes, filter)
+WebInspector.HeapSnapshotNodesProvider = function(snapshot, filter)
 {
     this.snapshot = snapshot;
-    WebInspector.HeapSnapshotFilteredOrderedIterator.call(this, nodes, filter);
+    WebInspector.HeapSnapshotFilteredOrderedIterator.call(this, snapshot._allNodes, filter);
 }
 
 WebInspector.HeapSnapshotNodesProvider.prototype = {
@@ -842,11 +998,18 @@ WebInspector.HeapSnapshotPathFinder.prototype = {
         return false;
     },
 
-    _fillRootChildren: function()
+    updateRoots: function(filter)
+    {
+        this._rootChildren = this._fillRootChildren(filter);  
+    },
+
+    _fillRootChildren: function(filter)
     {
         var result = [];
-        for (var iter = this._snapshot.rootNode.edges; iter.hasNext(); iter.next())
-            result[iter.edge.nodeIndex] = true;
+        for (var iter = this._snapshot.rootNode.edges; iter.hasNext(); iter.next()) {
+            if (!filter || filter(iter.edge.node))
+                result[iter.edge.nodeIndex] = true;
+        }
         return result;
     },
 
@@ -881,7 +1044,7 @@ WebInspector.HeapSnapshotPathFinder.prototype = {
 
     get _lastEdge()
     {
-        return this._lastEdgeIter.edge;
+        return this._lastEdgeIter.item;
     },
 
     _skipEdge: function(edge)
@@ -894,7 +1057,7 @@ WebInspector.HeapSnapshotPathFinder.prototype = {
     _nextEdgeIter: function()
     {
         var iter = this._lastEdgeIter;
-        while (this._skipEdge(iter.edge) && iter.hasNext())
+        while (this._skipEdge(iter.item) && iter.hasNext())
             iter.next();
         return iter;
     },
@@ -917,7 +1080,7 @@ WebInspector.HeapSnapshotPathFinder.prototype = {
                             while (this._currentPath.length < this._maxLength) {
                                 iter = this._nextEdgeIter();
                                 if (iter.hasNext())
-                                    this._appendToCurrentPath(iter.edge.node.retainers);
+                                    this._appendToCurrentPath(iter.item.node.retainers);
                                 else
                                     return true;
                             }
@@ -934,7 +1097,7 @@ WebInspector.HeapSnapshotPathFinder.prototype = {
             while (this._currentPath.length < this._maxLength) {
                 var iter = this._nextEdgeIter();
                 if (iter.hasNext())
-                    this._appendToCurrentPath(iter.edge.node.retainers);
+                    this._appendToCurrentPath(iter.item.node.retainers);
                 else
                     break;
             }
@@ -956,8 +1119,8 @@ WebInspector.HeapSnapshotPathFinder.prototype = {
             return "";
         var sPath = [];
         for (var j = 0; j < path.length; ++j)
-            sPath.push(path[j].edge.toString());
-        sPath.push(this._nodeToString(path[path.length - 1].edge.node));
+            sPath.push(path[j].item.toString());
+        sPath.push(this._nodeToString(path[path.length - 1].item.node));
         sPath.reverse();
         return sPath.join("");
     }
diff --git a/Source/WebCore/inspector/front-end/HelpScreen.js b/Source/WebCore/inspector/front-end/HelpScreen.js
index a1bbf1e..aa47712 100644
--- a/Source/WebCore/inspector/front-end/HelpScreen.js
+++ b/Source/WebCore/inspector/front-end/HelpScreen.js
@@ -40,9 +40,9 @@ WebInspector.HelpScreen = function(title)
     this.contentElement = mainWindow.createChild("div", "help-content");
     this.contentElement.tabIndex = 0;
     this.contentElement.addEventListener("blur", this._onBlur.bind(this), false);
-    captionWindow.createChild("h1", "help-window-title").innerText = title;
+    captionWindow.createChild("h1", "help-window-title").textContent = title;
 
-    closeButton.innerText = "\u2716"; // Code stands for HEAVY MULTIPLICATION X.
+    closeButton.textContent = "\u2716"; // Code stands for HEAVY MULTIPLICATION X.
     closeButton.addEventListener("click", this._hide.bind(this), false);
     this._closeKeys = [
         WebInspector.KeyboardShortcut.Keys.Enter.code,
diff --git a/Source/WebCore/inspector/front-end/Images/applicationCache.png b/Source/WebCore/inspector/front-end/Images/applicationCache.png
index 50bad87..fb18e75 100644
--- a/Source/WebCore/inspector/front-end/Images/applicationCache.png
+++ b/Source/WebCore/inspector/front-end/Images/applicationCache.png
diff --git a/Source/WebCore/inspector/front-end/Images/auditsIcon.png b/Source/WebCore/inspector/front-end/Images/auditsIcon.png
index ebeafdc..9f9dd8b 100644
--- a/Source/WebCore/inspector/front-end/Images/auditsIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/auditsIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/back.png b/Source/WebCore/inspector/front-end/Images/back.png
index 9363960..b1c0c19 100644
--- a/Source/WebCore/inspector/front-end/Images/back.png
+++ b/Source/WebCore/inspector/front-end/Images/back.png
diff --git a/Source/WebCore/inspector/front-end/Images/breakpointBorder.png b/Source/WebCore/inspector/front-end/Images/breakpointBorder.png
index 0b1b550..a4c74d5 100644
--- a/Source/WebCore/inspector/front-end/Images/breakpointBorder.png
+++ b/Source/WebCore/inspector/front-end/Images/breakpointBorder.png
diff --git a/Source/WebCore/inspector/front-end/Images/breakpointConditionalBorder.png b/Source/WebCore/inspector/front-end/Images/breakpointConditionalBorder.png
index 430e37e..5fda706 100644
--- a/Source/WebCore/inspector/front-end/Images/breakpointConditionalBorder.png
+++ b/Source/WebCore/inspector/front-end/Images/breakpointConditionalBorder.png
diff --git a/Source/WebCore/inspector/front-end/Images/breakpointConditionalCounterBorder.png b/Source/WebCore/inspector/front-end/Images/breakpointConditionalCounterBorder.png
index b4a5030..a173c9d 100644
--- a/Source/WebCore/inspector/front-end/Images/breakpointConditionalCounterBorder.png
+++ b/Source/WebCore/inspector/front-end/Images/breakpointConditionalCounterBorder.png
diff --git a/Source/WebCore/inspector/front-end/Images/breakpointCounterBorder.png b/Source/WebCore/inspector/front-end/Images/breakpointCounterBorder.png
index 8b77b61..d078545 100644
--- a/Source/WebCore/inspector/front-end/Images/breakpointCounterBorder.png
+++ b/Source/WebCore/inspector/front-end/Images/breakpointCounterBorder.png
diff --git a/Source/WebCore/inspector/front-end/Images/breakpointsActivateButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/breakpointsActivateButtonGlyph.png
index ce49aac..6307d13 100644
--- a/Source/WebCore/inspector/front-end/Images/breakpointsActivateButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/breakpointsActivateButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png
index 5c5fcf6..bf1c5bb 100644
--- a/Source/WebCore/inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/breakpointsDeactivateButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/checker.png b/Source/WebCore/inspector/front-end/Images/checker.png
index 8349908..816a4ec 100644
--- a/Source/WebCore/inspector/front-end/Images/checker.png
+++ b/Source/WebCore/inspector/front-end/Images/checker.png
diff --git a/Source/WebCore/inspector/front-end/Images/clearConsoleButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/clearConsoleButtonGlyph.png
index b1f9465..c243f7d 100644
--- a/Source/WebCore/inspector/front-end/Images/clearConsoleButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/clearConsoleButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/closeButtons.png b/Source/WebCore/inspector/front-end/Images/closeButtons.png
index 28158a4..a574061 100644
--- a/Source/WebCore/inspector/front-end/Images/closeButtons.png
+++ b/Source/WebCore/inspector/front-end/Images/closeButtons.png
diff --git a/Source/WebCore/inspector/front-end/Images/consoleButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/consoleButtonGlyph.png
index d10d43c..7ae29c2 100644
--- a/Source/WebCore/inspector/front-end/Images/consoleButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/consoleButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/consoleIcon.png b/Source/WebCore/inspector/front-end/Images/consoleIcon.png
index 94ffa95..24bb164 100644
--- a/Source/WebCore/inspector/front-end/Images/consoleIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/consoleIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/cookie.png b/Source/WebCore/inspector/front-end/Images/cookie.png
index 90c3c15..69af785 100644
--- a/Source/WebCore/inspector/front-end/Images/cookie.png
+++ b/Source/WebCore/inspector/front-end/Images/cookie.png
diff --git a/Source/WebCore/inspector/front-end/Images/database.png b/Source/WebCore/inspector/front-end/Images/database.png
index 339efa6..5ffb12e 100644
--- a/Source/WebCore/inspector/front-end/Images/database.png
+++ b/Source/WebCore/inspector/front-end/Images/database.png
diff --git a/Source/WebCore/inspector/front-end/Images/databaseTable.png b/Source/WebCore/inspector/front-end/Images/databaseTable.png
index 3718708..2359352 100644
--- a/Source/WebCore/inspector/front-end/Images/databaseTable.png
+++ b/Source/WebCore/inspector/front-end/Images/databaseTable.png
diff --git a/Source/WebCore/inspector/front-end/Images/debuggerContinue.png b/Source/WebCore/inspector/front-end/Images/debuggerContinue.png
index d90a855..01d99ee 100644
--- a/Source/WebCore/inspector/front-end/Images/debuggerContinue.png
+++ b/Source/WebCore/inspector/front-end/Images/debuggerContinue.png
diff --git a/Source/WebCore/inspector/front-end/Images/debuggerPause.png b/Source/WebCore/inspector/front-end/Images/debuggerPause.png
index 97f958a..c173868 100644
--- a/Source/WebCore/inspector/front-end/Images/debuggerPause.png
+++ b/Source/WebCore/inspector/front-end/Images/debuggerPause.png
diff --git a/Source/WebCore/inspector/front-end/Images/debuggerStepInto.png b/Source/WebCore/inspector/front-end/Images/debuggerStepInto.png
index 277f126..68ec92f 100644
--- a/Source/WebCore/inspector/front-end/Images/debuggerStepInto.png
+++ b/Source/WebCore/inspector/front-end/Images/debuggerStepInto.png
diff --git a/Source/WebCore/inspector/front-end/Images/debuggerStepOut.png b/Source/WebCore/inspector/front-end/Images/debuggerStepOut.png
index 3032e32..caf1394 100644
--- a/Source/WebCore/inspector/front-end/Images/debuggerStepOut.png
+++ b/Source/WebCore/inspector/front-end/Images/debuggerStepOut.png
diff --git a/Source/WebCore/inspector/front-end/Images/debuggerStepOver.png b/Source/WebCore/inspector/front-end/Images/debuggerStepOver.png
index 7d47245..94f116d 100644
--- a/Source/WebCore/inspector/front-end/Images/debuggerStepOver.png
+++ b/Source/WebCore/inspector/front-end/Images/debuggerStepOver.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDown.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDown.png
index cffc835..02ecfa4 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDown.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDown.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDownBlack.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDownBlack.png
index 4b49c13..e100043 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDownBlack.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDownBlack.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDownWhite.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDownWhite.png
index aebae12..38a7aff 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDownWhite.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallDownWhite.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRight.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRight.png
index a3102ea..b21f351 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRight.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRight.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightBlack.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightBlack.png
index 2c45859..5bc717f 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightBlack.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightBlack.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDown.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDown.png
index 035c069..be65ed7 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDown.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDown.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDownBlack.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDownBlack.png
index 86f67bd..44f304f 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDownBlack.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDownBlack.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDownWhite.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDownWhite.png
index 972d794..71ee8cc 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDownWhite.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightDownWhite.png
diff --git a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightWhite.png b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightWhite.png
index a10168f..f4e705c 100644
--- a/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightWhite.png
+++ b/Source/WebCore/inspector/front-end/Images/disclosureTriangleSmallRightWhite.png
diff --git a/Source/WebCore/inspector/front-end/Images/dockButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/dockButtonGlyph.png
index 7052f4b..29e511d 100644
--- a/Source/WebCore/inspector/front-end/Images/dockButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/dockButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/elementsIcon.png b/Source/WebCore/inspector/front-end/Images/elementsIcon.png
index fde3db9..4f3dbcc 100644
--- a/Source/WebCore/inspector/front-end/Images/elementsIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/elementsIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/enableOutlineButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/enableOutlineButtonGlyph.png
index 85e0bd6..84e44d2 100644
--- a/Source/WebCore/inspector/front-end/Images/enableOutlineButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/enableOutlineButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/enableSolidButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/enableSolidButtonGlyph.png
index 25b2e96..7fb146b 100644
--- a/Source/WebCore/inspector/front-end/Images/enableSolidButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/enableSolidButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/errorIcon.png b/Source/WebCore/inspector/front-end/Images/errorIcon.png
index c697263..a921076 100644
--- a/Source/WebCore/inspector/front-end/Images/errorIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/errorIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/errorMediumIcon.png b/Source/WebCore/inspector/front-end/Images/errorMediumIcon.png
index 6ca32bb..e0d05d6 100644
--- a/Source/WebCore/inspector/front-end/Images/errorMediumIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/errorMediumIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/errorRedDot.png b/Source/WebCore/inspector/front-end/Images/errorRedDot.png
index 6f0b164..2acc65d 100644
--- a/Source/WebCore/inspector/front-end/Images/errorRedDot.png
+++ b/Source/WebCore/inspector/front-end/Images/errorRedDot.png
diff --git a/Source/WebCore/inspector/front-end/Images/excludeButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/excludeButtonGlyph.png
index 5128576..0dd3e19 100644
--- a/Source/WebCore/inspector/front-end/Images/excludeButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/excludeButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/focusButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/focusButtonGlyph.png
index b71807c..7f331b5 100644
--- a/Source/WebCore/inspector/front-end/Images/focusButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/focusButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/forward.png b/Source/WebCore/inspector/front-end/Images/forward.png
index ad70f3e..843392b 100644
--- a/Source/WebCore/inspector/front-end/Images/forward.png
+++ b/Source/WebCore/inspector/front-end/Images/forward.png
diff --git a/Source/WebCore/inspector/front-end/Images/frame.png b/Source/WebCore/inspector/front-end/Images/frame.png
index 0d1953c..27f5ea4 100644
--- a/Source/WebCore/inspector/front-end/Images/frame.png
+++ b/Source/WebCore/inspector/front-end/Images/frame.png
diff --git a/Source/WebCore/inspector/front-end/Images/garbageCollectButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/garbageCollectButtonGlyph.png
new file mode 100644
index 0000000..699f5ee
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/Images/garbageCollectButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/gearButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/gearButtonGlyph.png
index 19659c9..4b59250 100644
--- a/Source/WebCore/inspector/front-end/Images/gearButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/gearButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/glossyHeader.png b/Source/WebCore/inspector/front-end/Images/glossyHeader.png
index 6cbefb7..e85c596 100644
--- a/Source/WebCore/inspector/front-end/Images/glossyHeader.png
+++ b/Source/WebCore/inspector/front-end/Images/glossyHeader.png
diff --git a/Source/WebCore/inspector/front-end/Images/glossyHeaderPressed.png b/Source/WebCore/inspector/front-end/Images/glossyHeaderPressed.png
index 1153506..01872cd 100644
--- a/Source/WebCore/inspector/front-end/Images/glossyHeaderPressed.png
+++ b/Source/WebCore/inspector/front-end/Images/glossyHeaderPressed.png
diff --git a/Source/WebCore/inspector/front-end/Images/glossyHeaderSelected.png b/Source/WebCore/inspector/front-end/Images/glossyHeaderSelected.png
index 71d5af6..f7d615c 100644
--- a/Source/WebCore/inspector/front-end/Images/glossyHeaderSelected.png
+++ b/Source/WebCore/inspector/front-end/Images/glossyHeaderSelected.png
diff --git a/Source/WebCore/inspector/front-end/Images/glossyHeaderSelectedPressed.png b/Source/WebCore/inspector/front-end/Images/glossyHeaderSelectedPressed.png
index 7047dbe..75d37fb 100644
--- a/Source/WebCore/inspector/front-end/Images/glossyHeaderSelectedPressed.png
+++ b/Source/WebCore/inspector/front-end/Images/glossyHeaderSelectedPressed.png
diff --git a/Source/WebCore/inspector/front-end/Images/goArrow.png b/Source/WebCore/inspector/front-end/Images/goArrow.png
index f318a56..980e159 100644
--- a/Source/WebCore/inspector/front-end/Images/goArrow.png
+++ b/Source/WebCore/inspector/front-end/Images/goArrow.png
diff --git a/Source/WebCore/inspector/front-end/Images/graphLabelCalloutLeft.png b/Source/WebCore/inspector/front-end/Images/graphLabelCalloutLeft.png
index 6426dbd..f80dccf 100644
--- a/Source/WebCore/inspector/front-end/Images/graphLabelCalloutLeft.png
+++ b/Source/WebCore/inspector/front-end/Images/graphLabelCalloutLeft.png
diff --git a/Source/WebCore/inspector/front-end/Images/graphLabelCalloutRight.png b/Source/WebCore/inspector/front-end/Images/graphLabelCalloutRight.png
index 8c87eae..3ee8221 100644
--- a/Source/WebCore/inspector/front-end/Images/graphLabelCalloutRight.png
+++ b/Source/WebCore/inspector/front-end/Images/graphLabelCalloutRight.png
diff --git a/Source/WebCore/inspector/front-end/Images/helpButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/helpButtonGlyph.png
index 92fe59a..83f0425 100644
--- a/Source/WebCore/inspector/front-end/Images/helpButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/helpButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/largerResourcesButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/largerResourcesButtonGlyph.png
index 71256d6..4884c8c 100644
--- a/Source/WebCore/inspector/front-end/Images/largerResourcesButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/largerResourcesButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/localStorage.png b/Source/WebCore/inspector/front-end/Images/localStorage.png
index 44a3019..0e615ce 100644
--- a/Source/WebCore/inspector/front-end/Images/localStorage.png
+++ b/Source/WebCore/inspector/front-end/Images/localStorage.png
diff --git a/Source/WebCore/inspector/front-end/Images/networkIcon.png b/Source/WebCore/inspector/front-end/Images/networkIcon.png
index ba10bba..f34338e 100644
--- a/Source/WebCore/inspector/front-end/Images/networkIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/networkIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/nodeSearchButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/nodeSearchButtonGlyph.png
index faf5df2..bcaf651 100644
--- a/Source/WebCore/inspector/front-end/Images/nodeSearchButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/nodeSearchButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/paneAddButtons.png b/Source/WebCore/inspector/front-end/Images/paneAddButtons.png
index f1c0047..8790f53 100644
--- a/Source/WebCore/inspector/front-end/Images/paneAddButtons.png
+++ b/Source/WebCore/inspector/front-end/Images/paneAddButtons.png
diff --git a/Source/WebCore/inspector/front-end/Images/paneBottomGrow.png b/Source/WebCore/inspector/front-end/Images/paneBottomGrow.png
index d55b865..c215657 100644
--- a/Source/WebCore/inspector/front-end/Images/paneBottomGrow.png
+++ b/Source/WebCore/inspector/front-end/Images/paneBottomGrow.png
diff --git a/Source/WebCore/inspector/front-end/Images/paneBottomGrowActive.png b/Source/WebCore/inspector/front-end/Images/paneBottomGrowActive.png
index ef3f259..5a8d068 100644
--- a/Source/WebCore/inspector/front-end/Images/paneBottomGrowActive.png
+++ b/Source/WebCore/inspector/front-end/Images/paneBottomGrowActive.png
diff --git a/Source/WebCore/inspector/front-end/Images/paneGrowHandleLine.png b/Source/WebCore/inspector/front-end/Images/paneGrowHandleLine.png
index 4eaf61b..87cc2c4 100644
--- a/Source/WebCore/inspector/front-end/Images/paneGrowHandleLine.png
+++ b/Source/WebCore/inspector/front-end/Images/paneGrowHandleLine.png
diff --git a/Source/WebCore/inspector/front-end/Images/paneSettingsButtons.png b/Source/WebCore/inspector/front-end/Images/paneSettingsButtons.png
index 36a6244..1288b89 100644
--- a/Source/WebCore/inspector/front-end/Images/paneSettingsButtons.png
+++ b/Source/WebCore/inspector/front-end/Images/paneSettingsButtons.png
diff --git a/Source/WebCore/inspector/front-end/Images/pauseOnExceptionButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/pauseOnExceptionButtonGlyph.png
index c3cec5f..13bd54e 100644
--- a/Source/WebCore/inspector/front-end/Images/pauseOnExceptionButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/pauseOnExceptionButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/percentButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/percentButtonGlyph.png
index 0ace3b7..cdbc120 100644
--- a/Source/WebCore/inspector/front-end/Images/percentButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/percentButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/popoverArrows.png b/Source/WebCore/inspector/front-end/Images/popoverArrows.png
index ccefa16..a1fc766 100644
--- a/Source/WebCore/inspector/front-end/Images/popoverArrows.png
+++ b/Source/WebCore/inspector/front-end/Images/popoverArrows.png
diff --git a/Source/WebCore/inspector/front-end/Images/popoverBackground.png b/Source/WebCore/inspector/front-end/Images/popoverBackground.png
index f20c988..fd8fc99 100644
--- a/Source/WebCore/inspector/front-end/Images/popoverBackground.png
+++ b/Source/WebCore/inspector/front-end/Images/popoverBackground.png
diff --git a/Source/WebCore/inspector/front-end/Images/profileGroupIcon.png b/Source/WebCore/inspector/front-end/Images/profileGroupIcon.png
index 44616d4..a25de24 100644
--- a/Source/WebCore/inspector/front-end/Images/profileGroupIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/profileGroupIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/profileIcon.png b/Source/WebCore/inspector/front-end/Images/profileIcon.png
index 8008f9b..015c791 100644
--- a/Source/WebCore/inspector/front-end/Images/profileIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/profileIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/profileSmallIcon.png b/Source/WebCore/inspector/front-end/Images/profileSmallIcon.png
index 7935520..cbdcac2 100644
--- a/Source/WebCore/inspector/front-end/Images/profileSmallIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/profileSmallIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/profilesIcon.png b/Source/WebCore/inspector/front-end/Images/profilesIcon.png
index ecd5b04..91630ae 100644
--- a/Source/WebCore/inspector/front-end/Images/profilesIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/profilesIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/profilesSilhouette.png b/Source/WebCore/inspector/front-end/Images/profilesSilhouette.png
index 42bb966..42daec2 100644
--- a/Source/WebCore/inspector/front-end/Images/profilesSilhouette.png
+++ b/Source/WebCore/inspector/front-end/Images/profilesSilhouette.png
diff --git a/Source/WebCore/inspector/front-end/Images/programCounterBorder.png b/Source/WebCore/inspector/front-end/Images/programCounterBorder.png
index fed2f3e..5e7717e 100644
--- a/Source/WebCore/inspector/front-end/Images/programCounterBorder.png
+++ b/Source/WebCore/inspector/front-end/Images/programCounterBorder.png
diff --git a/Source/WebCore/inspector/front-end/Images/radioDot.png b/Source/WebCore/inspector/front-end/Images/radioDot.png
index 609878f..1a99f93 100644
--- a/Source/WebCore/inspector/front-end/Images/radioDot.png
+++ b/Source/WebCore/inspector/front-end/Images/radioDot.png
diff --git a/Source/WebCore/inspector/front-end/Images/recordButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/recordButtonGlyph.png
index bfdad1a..9ffac9a 100644
--- a/Source/WebCore/inspector/front-end/Images/recordButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/recordButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/recordToggledButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/recordToggledButtonGlyph.png
index 2c22f87..ee02021 100644
--- a/Source/WebCore/inspector/front-end/Images/recordToggledButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/recordToggledButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/reloadButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/reloadButtonGlyph.png
index 28e047a..c8739f2 100644
--- a/Source/WebCore/inspector/front-end/Images/reloadButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/reloadButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourceCSSIcon.png b/Source/WebCore/inspector/front-end/Images/resourceCSSIcon.png
index aead6a7..3782125 100644
--- a/Source/WebCore/inspector/front-end/Images/resourceCSSIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/resourceCSSIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourceDocumentIcon.png b/Source/WebCore/inspector/front-end/Images/resourceDocumentIcon.png
index 1683a09..5ef6559 100644
--- a/Source/WebCore/inspector/front-end/Images/resourceDocumentIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/resourceDocumentIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourceDocumentIconSmall.png b/Source/WebCore/inspector/front-end/Images/resourceDocumentIconSmall.png
index 468ced9..b70bd50 100644
--- a/Source/WebCore/inspector/front-end/Images/resourceDocumentIconSmall.png
+++ b/Source/WebCore/inspector/front-end/Images/resourceDocumentIconSmall.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourceJSIcon.png b/Source/WebCore/inspector/front-end/Images/resourceJSIcon.png
index 9ef6ed0..73bc05d 100644
--- a/Source/WebCore/inspector/front-end/Images/resourceJSIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/resourceJSIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourcePlainIcon.png b/Source/WebCore/inspector/front-end/Images/resourcePlainIcon.png
index 0ed37b6..2cd9e06 100644
--- a/Source/WebCore/inspector/front-end/Images/resourcePlainIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/resourcePlainIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourcePlainIconSmall.png b/Source/WebCore/inspector/front-end/Images/resourcePlainIconSmall.png
index 0fa967d..1adf8ac 100644
--- a/Source/WebCore/inspector/front-end/Images/resourcePlainIconSmall.png
+++ b/Source/WebCore/inspector/front-end/Images/resourcePlainIconSmall.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourcesIcon.png b/Source/WebCore/inspector/front-end/Images/resourcesIcon.png
index 982424d..c472dbd 100644
--- a/Source/WebCore/inspector/front-end/Images/resourcesIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/resourcesIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourcesSizeGraphIcon.png b/Source/WebCore/inspector/front-end/Images/resourcesSizeGraphIcon.png
index e60dbe5..4765e02 100644
--- a/Source/WebCore/inspector/front-end/Images/resourcesSizeGraphIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/resourcesSizeGraphIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/resourcesTimeGraphIcon.png b/Source/WebCore/inspector/front-end/Images/resourcesTimeGraphIcon.png
index c6953e9..27acd35 100644
--- a/Source/WebCore/inspector/front-end/Images/resourcesTimeGraphIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/resourcesTimeGraphIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/scriptsIcon.png b/Source/WebCore/inspector/front-end/Images/scriptsIcon.png
index 213b31e..4cda81f 100644
--- a/Source/WebCore/inspector/front-end/Images/scriptsIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/scriptsIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/scriptsSilhouette.png b/Source/WebCore/inspector/front-end/Images/scriptsSilhouette.png
index 206396f..09c4fcc 100644
--- a/Source/WebCore/inspector/front-end/Images/scriptsSilhouette.png
+++ b/Source/WebCore/inspector/front-end/Images/scriptsSilhouette.png
diff --git a/Source/WebCore/inspector/front-end/Images/searchSmallBlue.png b/Source/WebCore/inspector/front-end/Images/searchSmallBlue.png
index 9c990f4..08350f7 100644
--- a/Source/WebCore/inspector/front-end/Images/searchSmallBlue.png
+++ b/Source/WebCore/inspector/front-end/Images/searchSmallBlue.png
diff --git a/Source/WebCore/inspector/front-end/Images/searchSmallBrightBlue.png b/Source/WebCore/inspector/front-end/Images/searchSmallBrightBlue.png
index b1d8055..09813af 100644
--- a/Source/WebCore/inspector/front-end/Images/searchSmallBrightBlue.png
+++ b/Source/WebCore/inspector/front-end/Images/searchSmallBrightBlue.png
diff --git a/Source/WebCore/inspector/front-end/Images/searchSmallGray.png b/Source/WebCore/inspector/front-end/Images/searchSmallGray.png
index 4f3c068..7780820 100644
--- a/Source/WebCore/inspector/front-end/Images/searchSmallGray.png
+++ b/Source/WebCore/inspector/front-end/Images/searchSmallGray.png
diff --git a/Source/WebCore/inspector/front-end/Images/searchSmallWhite.png b/Source/WebCore/inspector/front-end/Images/searchSmallWhite.png
index 85f430d..8b57eaa 100644
--- a/Source/WebCore/inspector/front-end/Images/searchSmallWhite.png
+++ b/Source/WebCore/inspector/front-end/Images/searchSmallWhite.png
diff --git a/Source/WebCore/inspector/front-end/Images/segment.png b/Source/WebCore/inspector/front-end/Images/segment.png
index 759266e..735ec1a 100644
--- a/Source/WebCore/inspector/front-end/Images/segment.png
+++ b/Source/WebCore/inspector/front-end/Images/segment.png
diff --git a/Source/WebCore/inspector/front-end/Images/segmentEnd.png b/Source/WebCore/inspector/front-end/Images/segmentEnd.png
index 72672ff..a262b7d 100644
--- a/Source/WebCore/inspector/front-end/Images/segmentEnd.png
+++ b/Source/WebCore/inspector/front-end/Images/segmentEnd.png
diff --git a/Source/WebCore/inspector/front-end/Images/segmentHover.png b/Source/WebCore/inspector/front-end/Images/segmentHover.png
index c5017f4..ffe99ee 100644
--- a/Source/WebCore/inspector/front-end/Images/segmentHover.png
+++ b/Source/WebCore/inspector/front-end/Images/segmentHover.png
diff --git a/Source/WebCore/inspector/front-end/Images/segmentHoverEnd.png b/Source/WebCore/inspector/front-end/Images/segmentHoverEnd.png
index d51363d..c2c27fa 100644
--- a/Source/WebCore/inspector/front-end/Images/segmentHoverEnd.png
+++ b/Source/WebCore/inspector/front-end/Images/segmentHoverEnd.png
diff --git a/Source/WebCore/inspector/front-end/Images/segmentSelected.png b/Source/WebCore/inspector/front-end/Images/segmentSelected.png
index c92f584..114ffc9 100644
--- a/Source/WebCore/inspector/front-end/Images/segmentSelected.png
+++ b/Source/WebCore/inspector/front-end/Images/segmentSelected.png
diff --git a/Source/WebCore/inspector/front-end/Images/segmentSelectedEnd.png b/Source/WebCore/inspector/front-end/Images/segmentSelectedEnd.png
index be5e085..6cb3ac5 100644
--- a/Source/WebCore/inspector/front-end/Images/segmentSelectedEnd.png
+++ b/Source/WebCore/inspector/front-end/Images/segmentSelectedEnd.png
diff --git a/Source/WebCore/inspector/front-end/Images/sessionStorage.png b/Source/WebCore/inspector/front-end/Images/sessionStorage.png
index 4d50e35..144ef65 100644
--- a/Source/WebCore/inspector/front-end/Images/sessionStorage.png
+++ b/Source/WebCore/inspector/front-end/Images/sessionStorage.png
diff --git a/Source/WebCore/inspector/front-end/Images/splitviewDimple.png b/Source/WebCore/inspector/front-end/Images/splitviewDimple.png
index 584ffd4..23b88b5 100644
--- a/Source/WebCore/inspector/front-end/Images/splitviewDimple.png
+++ b/Source/WebCore/inspector/front-end/Images/splitviewDimple.png
diff --git a/Source/WebCore/inspector/front-end/Images/splitviewDividerBackground.png b/Source/WebCore/inspector/front-end/Images/splitviewDividerBackground.png
index 1120a7f..2e48b06 100644
--- a/Source/WebCore/inspector/front-end/Images/splitviewDividerBackground.png
+++ b/Source/WebCore/inspector/front-end/Images/splitviewDividerBackground.png
diff --git a/Source/WebCore/inspector/front-end/Images/statusbarButtons.png b/Source/WebCore/inspector/front-end/Images/statusbarButtons.png
index e8090cb..163d7b5 100644
--- a/Source/WebCore/inspector/front-end/Images/statusbarButtons.png
+++ b/Source/WebCore/inspector/front-end/Images/statusbarButtons.png
diff --git a/Source/WebCore/inspector/front-end/Images/statusbarMenuButton.png b/Source/WebCore/inspector/front-end/Images/statusbarMenuButton.png
index 9b3abdd..8904217 100644
--- a/Source/WebCore/inspector/front-end/Images/statusbarMenuButton.png
+++ b/Source/WebCore/inspector/front-end/Images/statusbarMenuButton.png
diff --git a/Source/WebCore/inspector/front-end/Images/statusbarMenuButtonSelected.png b/Source/WebCore/inspector/front-end/Images/statusbarMenuButtonSelected.png
index 8189c43..74fe953 100644
--- a/Source/WebCore/inspector/front-end/Images/statusbarMenuButtonSelected.png
+++ b/Source/WebCore/inspector/front-end/Images/statusbarMenuButtonSelected.png
diff --git a/Source/WebCore/inspector/front-end/Images/statusbarResizerHorizontal.png b/Source/WebCore/inspector/front-end/Images/statusbarResizerHorizontal.png
index 56deeab..674b895 100644
--- a/Source/WebCore/inspector/front-end/Images/statusbarResizerHorizontal.png
+++ b/Source/WebCore/inspector/front-end/Images/statusbarResizerHorizontal.png
diff --git a/Source/WebCore/inspector/front-end/Images/statusbarResizerVertical.png b/Source/WebCore/inspector/front-end/Images/statusbarResizerVertical.png
index 7fc1452..bf84d1e 100644
--- a/Source/WebCore/inspector/front-end/Images/statusbarResizerVertical.png
+++ b/Source/WebCore/inspector/front-end/Images/statusbarResizerVertical.png
diff --git a/Source/WebCore/inspector/front-end/Images/successGreenDot.png b/Source/WebCore/inspector/front-end/Images/successGreenDot.png
index 8b9319c..8a3232a 100644
--- a/Source/WebCore/inspector/front-end/Images/successGreenDot.png
+++ b/Source/WebCore/inspector/front-end/Images/successGreenDot.png
diff --git a/Source/WebCore/inspector/front-end/Images/thumbActiveHoriz.png b/Source/WebCore/inspector/front-end/Images/thumbActiveHoriz.png
index a6ee561..8648eb1 100644
--- a/Source/WebCore/inspector/front-end/Images/thumbActiveHoriz.png
+++ b/Source/WebCore/inspector/front-end/Images/thumbActiveHoriz.png
diff --git a/Source/WebCore/inspector/front-end/Images/thumbActiveVert.png b/Source/WebCore/inspector/front-end/Images/thumbActiveVert.png
index a3eabe8..10b71b7 100644
--- a/Source/WebCore/inspector/front-end/Images/thumbActiveVert.png
+++ b/Source/WebCore/inspector/front-end/Images/thumbActiveVert.png
diff --git a/Source/WebCore/inspector/front-end/Images/thumbHoriz.png b/Source/WebCore/inspector/front-end/Images/thumbHoriz.png
index c16559a..f4b8694 100644
--- a/Source/WebCore/inspector/front-end/Images/thumbHoriz.png
+++ b/Source/WebCore/inspector/front-end/Images/thumbHoriz.png
diff --git a/Source/WebCore/inspector/front-end/Images/thumbHoverHoriz.png b/Source/WebCore/inspector/front-end/Images/thumbHoverHoriz.png
index 0fe8d6a..74e43b8 100644
--- a/Source/WebCore/inspector/front-end/Images/thumbHoverHoriz.png
+++ b/Source/WebCore/inspector/front-end/Images/thumbHoverHoriz.png
diff --git a/Source/WebCore/inspector/front-end/Images/thumbHoverVert.png b/Source/WebCore/inspector/front-end/Images/thumbHoverVert.png
index 30e315a..140ab8e 100644
--- a/Source/WebCore/inspector/front-end/Images/thumbHoverVert.png
+++ b/Source/WebCore/inspector/front-end/Images/thumbHoverVert.png
diff --git a/Source/WebCore/inspector/front-end/Images/thumbVert.png b/Source/WebCore/inspector/front-end/Images/thumbVert.png
index 61fbc06..460815e 100644
--- a/Source/WebCore/inspector/front-end/Images/thumbVert.png
+++ b/Source/WebCore/inspector/front-end/Images/thumbVert.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarBlue.png b/Source/WebCore/inspector/front-end/Images/timelineBarBlue.png
index 22641b5..5af3195 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarBlue.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarBlue.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarGray.png b/Source/WebCore/inspector/front-end/Images/timelineBarGray.png
index f66cf43..4e11aa4 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarGray.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarGray.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarGreen.png b/Source/WebCore/inspector/front-end/Images/timelineBarGreen.png
index cc59082..ec1955c 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarGreen.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarGreen.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarOrange.png b/Source/WebCore/inspector/front-end/Images/timelineBarOrange.png
index e5ae6f5..435b0f1 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarOrange.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarOrange.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarPurple.png b/Source/WebCore/inspector/front-end/Images/timelineBarPurple.png
index f891252..02649cd 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarPurple.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarPurple.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarRed.png b/Source/WebCore/inspector/front-end/Images/timelineBarRed.png
index b850037..9c47280 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarRed.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarRed.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineBarYellow.png b/Source/WebCore/inspector/front-end/Images/timelineBarYellow.png
index 2b3e9a7..39716ea 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineBarYellow.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineBarYellow.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineCheckmarks.png b/Source/WebCore/inspector/front-end/Images/timelineCheckmarks.png
index 9afa9bb..1b32449 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineCheckmarks.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineCheckmarks.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineDots.png b/Source/WebCore/inspector/front-end/Images/timelineDots.png
index e9ba4d3..325f2ab 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineDots.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineDots.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillBlue.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillBlue.png
index c7c273b..92f7f72 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillBlue.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillBlue.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillGray.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillGray.png
index 9ff37ef..fd8afe1 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillGray.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillGray.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillGreen.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillGreen.png
index cc5a8f3..af34c30 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillGreen.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillGreen.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillOrange.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillOrange.png
index 08a81e4..b46edde 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillOrange.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillOrange.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillPurple.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillPurple.png
index 565a05c..6ce6640 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillPurple.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillPurple.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillRed.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillRed.png
index c3a1b9b..67cccfd 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillRed.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillRed.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineHollowPillYellow.png b/Source/WebCore/inspector/front-end/Images/timelineHollowPillYellow.png
index 780045b..9e71a9a 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineHollowPillYellow.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineHollowPillYellow.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelineIcon.png b/Source/WebCore/inspector/front-end/Images/timelineIcon.png
index 09bcf30..6ab8621 100644
--- a/Source/WebCore/inspector/front-end/Images/timelineIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/timelineIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillBlue.png b/Source/WebCore/inspector/front-end/Images/timelinePillBlue.png
index c897faa..aef3652 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillBlue.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillBlue.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillGray.png b/Source/WebCore/inspector/front-end/Images/timelinePillGray.png
index 2128896..82ea80a 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillGray.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillGray.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillGreen.png b/Source/WebCore/inspector/front-end/Images/timelinePillGreen.png
index 9b66125..6973fdb 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillGreen.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillGreen.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillOrange.png b/Source/WebCore/inspector/front-end/Images/timelinePillOrange.png
index dd944fb..09cfa4a 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillOrange.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillOrange.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillPurple.png b/Source/WebCore/inspector/front-end/Images/timelinePillPurple.png
index 21b96f7..6fb5b35 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillPurple.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillPurple.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillRed.png b/Source/WebCore/inspector/front-end/Images/timelinePillRed.png
index f5e213b..64234f7 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillRed.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillRed.png
diff --git a/Source/WebCore/inspector/front-end/Images/timelinePillYellow.png b/Source/WebCore/inspector/front-end/Images/timelinePillYellow.png
index ae2a5a2..a2deee6 100644
--- a/Source/WebCore/inspector/front-end/Images/timelinePillYellow.png
+++ b/Source/WebCore/inspector/front-end/Images/timelinePillYellow.png
diff --git a/Source/WebCore/inspector/front-end/Images/toolbarItemSelected.png b/Source/WebCore/inspector/front-end/Images/toolbarItemSelected.png
index bd681f1..dab787e 100644
--- a/Source/WebCore/inspector/front-end/Images/toolbarItemSelected.png
+++ b/Source/WebCore/inspector/front-end/Images/toolbarItemSelected.png
diff --git a/Source/WebCore/inspector/front-end/Images/trackHoriz.png b/Source/WebCore/inspector/front-end/Images/trackHoriz.png
index 517d306..541dd11 100644
--- a/Source/WebCore/inspector/front-end/Images/trackHoriz.png
+++ b/Source/WebCore/inspector/front-end/Images/trackHoriz.png
diff --git a/Source/WebCore/inspector/front-end/Images/trackVert.png b/Source/WebCore/inspector/front-end/Images/trackVert.png
index d49620d..1375a14 100644
--- a/Source/WebCore/inspector/front-end/Images/trackVert.png
+++ b/Source/WebCore/inspector/front-end/Images/trackVert.png
diff --git a/Source/WebCore/inspector/front-end/Images/treeDownTriangleBlack.png b/Source/WebCore/inspector/front-end/Images/treeDownTriangleBlack.png
index 0821112..f797585 100644
--- a/Source/WebCore/inspector/front-end/Images/treeDownTriangleBlack.png
+++ b/Source/WebCore/inspector/front-end/Images/treeDownTriangleBlack.png
diff --git a/Source/WebCore/inspector/front-end/Images/treeDownTriangleWhite.png b/Source/WebCore/inspector/front-end/Images/treeDownTriangleWhite.png
index 1667b51..24d3d55 100644
--- a/Source/WebCore/inspector/front-end/Images/treeDownTriangleWhite.png
+++ b/Source/WebCore/inspector/front-end/Images/treeDownTriangleWhite.png
diff --git a/Source/WebCore/inspector/front-end/Images/treeRightTriangleBlack.png b/Source/WebCore/inspector/front-end/Images/treeRightTriangleBlack.png
index 90de820..9b4c2f1 100644
--- a/Source/WebCore/inspector/front-end/Images/treeRightTriangleBlack.png
+++ b/Source/WebCore/inspector/front-end/Images/treeRightTriangleBlack.png
diff --git a/Source/WebCore/inspector/front-end/Images/treeRightTriangleWhite.png b/Source/WebCore/inspector/front-end/Images/treeRightTriangleWhite.png
index 2b6a82f..fcb2eb6 100644
--- a/Source/WebCore/inspector/front-end/Images/treeRightTriangleWhite.png
+++ b/Source/WebCore/inspector/front-end/Images/treeRightTriangleWhite.png
diff --git a/Source/WebCore/inspector/front-end/Images/treeUpTriangleBlack.png b/Source/WebCore/inspector/front-end/Images/treeUpTriangleBlack.png
index ef69dbc..91bde8a 100644
--- a/Source/WebCore/inspector/front-end/Images/treeUpTriangleBlack.png
+++ b/Source/WebCore/inspector/front-end/Images/treeUpTriangleBlack.png
diff --git a/Source/WebCore/inspector/front-end/Images/treeUpTriangleWhite.png b/Source/WebCore/inspector/front-end/Images/treeUpTriangleWhite.png
index 43ce4be..c49a0ae 100644
--- a/Source/WebCore/inspector/front-end/Images/treeUpTriangleWhite.png
+++ b/Source/WebCore/inspector/front-end/Images/treeUpTriangleWhite.png
diff --git a/Source/WebCore/inspector/front-end/Images/undockButtonGlyph.png b/Source/WebCore/inspector/front-end/Images/undockButtonGlyph.png
index eed2b65..bf0a081 100644
--- a/Source/WebCore/inspector/front-end/Images/undockButtonGlyph.png
+++ b/Source/WebCore/inspector/front-end/Images/undockButtonGlyph.png
diff --git a/Source/WebCore/inspector/front-end/Images/userInputIcon.png b/Source/WebCore/inspector/front-end/Images/userInputIcon.png
index 325023f..d00819f 100644
--- a/Source/WebCore/inspector/front-end/Images/userInputIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/userInputIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/userInputPreviousIcon.png b/Source/WebCore/inspector/front-end/Images/userInputPreviousIcon.png
index 068d572..779f815 100644
--- a/Source/WebCore/inspector/front-end/Images/userInputPreviousIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/userInputPreviousIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/userInputResultIcon.png b/Source/WebCore/inspector/front-end/Images/userInputResultIcon.png
index 794a5ca..9f77181 100644
--- a/Source/WebCore/inspector/front-end/Images/userInputResultIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/userInputResultIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/warningIcon.png b/Source/WebCore/inspector/front-end/Images/warningIcon.png
index d5e4c82..3637420 100644
--- a/Source/WebCore/inspector/front-end/Images/warningIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/warningIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/warningMediumIcon.png b/Source/WebCore/inspector/front-end/Images/warningMediumIcon.png
index 291e111..6a92f67 100644
--- a/Source/WebCore/inspector/front-end/Images/warningMediumIcon.png
+++ b/Source/WebCore/inspector/front-end/Images/warningMediumIcon.png
diff --git a/Source/WebCore/inspector/front-end/Images/warningOrangeDot.png b/Source/WebCore/inspector/front-end/Images/warningOrangeDot.png
index 8c8b635..a193712 100644
--- a/Source/WebCore/inspector/front-end/Images/warningOrangeDot.png
+++ b/Source/WebCore/inspector/front-end/Images/warningOrangeDot.png
diff --git a/Source/WebCore/inspector/front-end/Images/warningsErrors.png b/Source/WebCore/inspector/front-end/Images/warningsErrors.png
index 878b593..c005698 100644
--- a/Source/WebCore/inspector/front-end/Images/warningsErrors.png
+++ b/Source/WebCore/inspector/front-end/Images/warningsErrors.png
diff --git a/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js b/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
index 07f392d..c0bc273 100644
--- a/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
+++ b/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
@@ -122,6 +122,10 @@ WebInspector.InspectorFrontendHostStub.prototype = {
 
     sendMessageToBackend: function(message)
     {
+    },
+
+    loadSessionSetting: function()
+    {
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/MetricsSidebarPane.js b/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
index 14039ef..1288973 100644
--- a/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
@@ -40,7 +40,7 @@ WebInspector.MetricsSidebarPane.prototype = {
         else
             node = this.node;
 
-        if (!node || node.nodeType !== Node.ELEMENT_NODE) {
+        if (!node || node.nodeType() !== Node.ELEMENT_NODE) {
             this.bodyElement.removeChildren();
             return;
         }
diff --git a/Source/WebCore/inspector/front-end/NetworkItemView.js b/Source/WebCore/inspector/front-end/NetworkItemView.js
index 418f559..0e5d14c 100644
--- a/Source/WebCore/inspector/front-end/NetworkItemView.js
+++ b/Source/WebCore/inspector/front-end/NetworkItemView.js
@@ -40,15 +40,26 @@ WebInspector.NetworkItemView = function(resource)
 
     this._tabbedPane = new WebInspector.TabbedPane(this.element);
     this._tabbedPane.appendTab("headers", WebInspector.UIString("Headers"), this._headersView);
+
     if (contentView.hasContent()) {
         // Reusing this view, so hide it at first.
         contentView.visible = false;
         this._tabbedPane.appendTab("content", WebInspector.UIString("Content"), contentView);
     }
+
+    if (resource.type === WebInspector.Resource.Type.XHR && resource.content) {
+        var parsedJSON = WebInspector.ResourceJSONView.parseJSON(resource.content);
+        if (parsedJSON) {
+            var jsonView = new WebInspector.ResourceJSONView(resource, parsedJSON);
+            this._tabbedPane.appendTab("json", WebInspector.UIString("JSON"), jsonView);
+        }
+    }
+
     if (Preferences.showCookiesTab) {
         this._cookiesView = new WebInspector.ResourceCookiesView(resource);
         this._tabbedPane.appendTab("cookies", WebInspector.UIString("Cookies"), this._cookiesView);
     }
+
     if (Preferences.showTimingTab) {
         var timingView = new WebInspector.ResourceTimingView(resource);
         this._tabbedPane.appendTab("timing", WebInspector.UIString("Timing"), timingView);
diff --git a/Source/WebCore/inspector/front-end/NetworkManager.js b/Source/WebCore/inspector/front-end/NetworkManager.js
index 246b53c..98aa060 100644
--- a/Source/WebCore/inspector/front-end/NetworkManager.js
+++ b/Source/WebCore/inspector/front-end/NetworkManager.js
@@ -28,43 +28,34 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.NetworkManager = function(resourceTreeModel)
+WebInspector.NetworkManager = function()
 {
     WebInspector.Object.call(this);
-    this._resourceTreeModel = resourceTreeModel;
-    this._dispatcher = new WebInspector.NetworkDispatcher(resourceTreeModel, this);
-    NetworkAgent.enable(this._processCachedResources.bind(this));
+    this._dispatcher = new WebInspector.NetworkDispatcher(this);
+    NetworkAgent.enable();
 }
 
 WebInspector.NetworkManager.EventTypes = {
     ResourceStarted: "ResourceStarted",
     ResourceUpdated: "ResourceUpdated",
     ResourceFinished: "ResourceFinished",
-    MainResourceCommitLoad: "MainResourceCommitLoad"
+    FrameCommittedLoad: "FrameCommittedLoad",
+    FrameDetached: "FrameDetached"
 }
 
 WebInspector.NetworkManager.prototype = {
     frontendReused: function()
     {
-        WebInspector.panels.network.clear();
-        this._resourceTreeModel.reset();
-        NetworkAgent.enable(this._processCachedResources.bind(this));
+        NetworkAgent.enable();
     },
 
     requestContent: function(resource, base64Encode, callback)
     {
-        function callbackWrapper(success, content)
+        function callbackWrapper(error, content)
         {
-            callback(success ? content : null);
+            callback(!error ? content : null);
         }
-        NetworkAgent.resourceContent(resource.loader.frameId, resource.url, base64Encode, callbackWrapper);
-    },
-
-    _processCachedResources: function(mainFramePayload)
-    {
-        var mainResource = this._dispatcher._addFramesRecursively(mainFramePayload);
-        WebInspector.mainResource = mainResource;
-        mainResource.isMainResource = true;
+        NetworkAgent.getResourceContent(resource.frameId, resource.url, base64Encode, callbackWrapper);
     },
 
     inflightResourceForURL: function(url)
@@ -75,12 +66,11 @@ WebInspector.NetworkManager.prototype = {
 
 WebInspector.NetworkManager.prototype.__proto__ = WebInspector.Object.prototype;
 
-WebInspector.NetworkDispatcher = function(resourceTreeModel, manager)
+WebInspector.NetworkDispatcher = function(manager)
 {
     this._manager = manager;
     this._inflightResourcesById = {};
     this._inflightResourcesByURL = {};
-    this._resourceTreeModel = resourceTreeModel;
     this._lastIdentifierForCachedResource = 0;
     InspectorBackend.registerDomainDispatcher("Network", this);
 }
@@ -88,78 +78,55 @@ WebInspector.NetworkDispatcher = function(resourceTreeModel, manager)
 WebInspector.NetworkDispatcher.prototype = {
     _updateResourceWithRequest: function(resource, request)
     {
-        resource.requestMethod = request.httpMethod;
-        resource.requestHeaders = request.httpHeaderFields;
-        resource.requestFormData = request.requestFormData;
+        resource.requestMethod = request.method;
+        resource.requestHeaders = request.headers;
+        resource.requestFormData = request.postData;
     },
 
     _updateResourceWithResponse: function(resource, response)
     {
-        if (resource.isNull)
+        if (!("status" in response))
             return;
 
         resource.mimeType = response.mimeType;
-        resource.expectedContentLength = response.expectedContentLength;
-        resource.textEncodingName = response.textEncodingName;
-        resource.suggestedFilename = response.suggestedFilename;
-        resource.statusCode = response.httpStatusCode;
-        resource.statusText = response.httpStatusText;
+        resource.statusCode = response.status;
+        resource.statusText = response.statusText;
+        resource.responseHeaders = response.headers;
+        // Raw request headers can be a part of response as well.
+        if (response.requestHeaders)
+            resource.requestHeaders = response.requestHeaders;
 
-        resource.responseHeaders = response.httpHeaderFields;
         resource.connectionReused = response.connectionReused;
         resource.connectionID = response.connectionID;
 
-        if (response.wasCached)
+        if (response.fromDiskCache)
             resource.cached = true;
         else
             resource.timing = response.timing;
-
-        if (response.loadInfo) {
-            if (response.loadInfo.httpStatusCode)
-                resource.statusCode = response.loadInfo.httpStatusCode;
-            if (response.loadInfo.httpStatusText)
-                resource.statusText = response.loadInfo.httpStatusText;
-            resource.requestHeaders = response.loadInfo.requestHeaders;
-            resource.responseHeaders = response.loadInfo.responseHeaders;
-        }
     },
 
     _updateResourceWithCachedResource: function(resource, cachedResource)
     {
         resource.type = WebInspector.Resource.Type[cachedResource.type];
-        resource.resourceSize = cachedResource.encodedSize;
+        resource.resourceSize = cachedResource.bodySize;
         this._updateResourceWithResponse(resource, cachedResource.response);
     },
 
-    identifierForInitialRequest: function(identifier, url, loader, callStack)
-    {
-        this._startResource(this._createResource(identifier, url, loader, callStack));
-    },
-
-    willSendRequest: function(identifier, time, request, redirectResponse)
+    requestWillBeSent: function(identifier, frameId, loaderId, documentURL, request, redirectResponse, time, callStack)
     {
         var resource = this._inflightResourcesById[identifier];
-        if (!resource)
-            return;
-
-        // Redirect may have empty URL and we'd like to not crash with invalid HashMap entry.
-        // See http/tests/misc/will-send-request-returns-null-on-redirect.html
-        var isRedirect = !redirectResponse.isNull && request.url.length;
-        if (isRedirect) {
-            this.didReceiveResponse(identifier, time, "Other", redirectResponse);
-            resource = this._appendRedirect(resource.identifier, time, request.url);
-        }
-
+        if (resource) {
+            this.responseReceived(identifier, time, "Other", redirectResponse);
+            resource = this._appendRedirect(identifier, time, request.url);
+        } else
+            resource = this._createResource(identifier, frameId, loaderId, request.url, documentURL, callStack);
         this._updateResourceWithRequest(resource, request);
         resource.startTime = time;
 
-        if (isRedirect)
-            this._startResource(resource);
-        else
-            this._updateResource(resource);
+        this._startResource(resource);
     },
 
-    markResourceAsCached: function(identifier)
+    resourceMarkedAsCached: function(identifier)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
@@ -169,7 +136,7 @@ WebInspector.NetworkDispatcher.prototype = {
         this._updateResource(resource);
     },
 
-    didReceiveResponse: function(identifier, time, resourceType, response)
+    responseReceived: function(identifier, time, resourceType, response)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
@@ -181,22 +148,23 @@ WebInspector.NetworkDispatcher.prototype = {
         this._updateResourceWithResponse(resource, response);
 
         this._updateResource(resource);
-        this._resourceTreeModel.addResourceToFrame(resource.loader.frameId, resource);
     },
 
-    didReceiveContentLength: function(identifier, time, lengthReceived)
+    dataReceived: function(identifier, time, dataLength, lengthReceived)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
 
-        resource.resourceSize += lengthReceived;
+        resource.resourceSize += dataLength;
+        if (lengthReceived != -1)
+            resource.increaseTransferSize(lengthReceived);
         resource.endTime = time;
 
         this._updateResource(resource);
     },
 
-    didFinishLoading: function(identifier, finishTime)
+    loadingFinished: function(identifier, finishTime)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
@@ -205,7 +173,7 @@ WebInspector.NetworkDispatcher.prototype = {
         this._finishResource(resource, finishTime);
     },
 
-    didFailLoading: function(identifier, time, localizedDescription)
+    loadingFailed: function(identifier, time, localizedDescription)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
@@ -216,24 +184,23 @@ WebInspector.NetworkDispatcher.prototype = {
         this._finishResource(resource, time);
     },
 
-    didLoadResourceFromMemoryCache: function(time, cachedResource)
+    resourceLoadedFromMemoryCache: function(frameId, loaderId, documentURL, time, cachedResource)
     {
-        var resource = this._createResource("cached:" + ++this._lastIdentifierForCachedResource, cachedResource.url, cachedResource.loader);
+        var resource = this._createResource("cached:" + ++this._lastIdentifierForCachedResource, frameId, loaderId, cachedResource.url, documentURL);
         this._updateResourceWithCachedResource(resource, cachedResource);
         resource.cached = true;
         resource.requestMethod = "GET";
         this._startResource(resource);
         resource.startTime = resource.responseReceivedTime = time;
         this._finishResource(resource, time);
-        this._resourceTreeModel.addResourceToFrame(resource.loader.frameId, resource);
     },
 
-    frameDetachedFromParent: function(frameId)
+    frameDetached: function(frameId)
     {
-        this._resourceTreeModel.frameDetachedFromParent(frameId);
+        this._dispatchEventToListeners(WebInspector.NetworkManager.EventTypes.FrameDetached, frameId);
     },
 
-    setInitialContent: function(identifier, sourceString, type)
+    initialContentSet: function(identifier, sourceString, type)
     {
         var resource = WebInspector.networkResourceById(identifier);
         if (!resource)
@@ -244,56 +211,48 @@ WebInspector.NetworkDispatcher.prototype = {
         this._updateResource(resource);
     },
 
-    didCommitLoadForFrame: function(frame, loader)
+    frameNavigated: function(frame, loaderId)
     {
-        this._resourceTreeModel.didCommitLoadForFrame(frame, loader);
-        if (!frame.parentId) {
-            var mainResource = this._resourceTreeModel.resourceForURL(frame.url);
-            if (mainResource) {
-                WebInspector.mainResource = mainResource;
-                mainResource.isMainResource = true;
-                this._dispatchEventToListeners(WebInspector.NetworkManager.EventTypes.MainResourceCommitLoad, mainResource);
-            }
-        }
+        this._dispatchEventToListeners(WebInspector.NetworkManager.EventTypes.FrameCommittedLoad, { frame: frame, loaderId: loaderId });
     },
 
-    didCreateWebSocket: function(identifier, requestURL)
+    webSocketCreated: function(identifier, requestURL)
     {
-        var resource = this._createResource(identifier, requestURL);
+        var resource = this._createResource(identifier, null, null, requestURL);
         resource.type = WebInspector.Resource.Type.WebSocket;
         this._startResource(resource);
     },
 
-    willSendWebSocketHandshakeRequest: function(identifier, time, request)
+    webSocketWillSendHandshakeRequest: function(identifier, time, request)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
 
         resource.requestMethod = "GET";
-        resource.requestHeaders = request.webSocketHeaderFields;
-        resource.webSocketRequestKey3 = request.webSocketRequestKey3;
+        resource.requestHeaders = request.headers;
+        resource.webSocketRequestKey3 = request.requestKey3;
         resource.startTime = time;
 
         this._updateResource(resource);
     },
 
-    didReceiveWebSocketHandshakeResponse: function(identifier, time, response)
+    webSocketHandshakeResponseReceived: function(identifier, time, response)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
             return;
 
-        resource.statusCode = response.statusCode;
+        resource.statusCode = response.status;
         resource.statusText = response.statusText;
-        resource.responseHeaders = response.webSocketHeaderFields;
-        resource.webSocketChallengeResponse = response.webSocketChallengeResponse;
+        resource.responseHeaders = response.headers;
+        resource.webSocketChallengeResponse = response.challengeResponse;
         resource.responseReceivedTime = time;
 
         this._updateResource(resource);
     },
 
-    didCloseWebSocket: function(identifier, time)
+    webSocketClosed: function(identifier, time)
     {
         var resource = this._inflightResourcesById[identifier];
         if (!resource)
@@ -308,7 +267,8 @@ WebInspector.NetworkDispatcher.prototype = {
         originalResource.identifier = "redirected:" + identifier + "." + previousRedirects.length;
         delete originalResource.redirects;
         this._finishResource(originalResource, time);
-        var newResource = this._createResource(identifier, redirectURL, originalResource.loader, originalResource.stackTrace);
+        var newResource = this._createResource(identifier, originalResource.frameId, originalResource.loaderId,
+             redirectURL, originalResource.documentURL, originalResource.stackTrace);
         newResource.redirects = previousRedirects.concat(originalResource);
         return newResource;
     },
@@ -334,44 +294,17 @@ WebInspector.NetworkDispatcher.prototype = {
         delete this._inflightResourcesByURL[resource.url];
     },
 
-    _addFramesRecursively: function(framePayload)
-    {
-        var frameResource = this._createResource(null, framePayload.resource.url, framePayload.resource.loader);
-        this._updateResourceWithRequest(frameResource, framePayload.resource.request);
-        this._updateResourceWithResponse(frameResource, framePayload.resource.response);
-        frameResource.type = WebInspector.Resource.Type["Document"];
-        frameResource.finished = true;
-
-        this._resourceTreeModel.addOrUpdateFrame(framePayload);
-        this._resourceTreeModel.addResourceToFrame(framePayload.id, frameResource);
-
-        for (var i = 0; framePayload.children && i < framePayload.children.length; ++i)
-            this._addFramesRecursively(framePayload.children[i]);
-
-        if (!framePayload.subresources)
-            return;
-
-        for (var i = 0; i < framePayload.subresources.length; ++i) {
-            var cachedResource = framePayload.subresources[i];
-            var resource = this._createResource(null, cachedResource.url, cachedResource.loader);
-            this._updateResourceWithCachedResource(resource, cachedResource);
-            resource.finished = true;
-            this._resourceTreeModel.addResourceToFrame(framePayload.id, resource);
-        }
-        return frameResource;
-    },
-
     _dispatchEventToListeners: function(eventType, resource)
     {
         this._manager.dispatchEventToListeners(eventType, resource);
     },
 
-    _createResource: function(identifier, url, loader, stackTrace)
+    _createResource: function(identifier, frameId, loaderId, url, documentURL, stackTrace)
     {
         var resource = new WebInspector.Resource(identifier, url);
-        resource.loader = loader;
-        if (loader)
-            resource.documentURL = loader.url;
+        resource.documentURL = documentURL;
+        resource.frameId = frameId;
+        resource.loaderId = loaderId;
         resource.stackTrace = stackTrace;
         return resource;
     }
diff --git a/Source/WebCore/inspector/front-end/NetworkPanel.js b/Source/WebCore/inspector/front-end/NetworkPanel.js
index 06983f0..3c497d6 100644
--- a/Source/WebCore/inspector/front-end/NetworkPanel.js
+++ b/Source/WebCore/inspector/front-end/NetworkPanel.js
@@ -40,6 +40,7 @@ WebInspector.NetworkPanel = function()
     this._resourcesByURL = {};
     this._staleResources = [];
     this._resourceGridNodes = {};
+    this._lastResourceGridNodeId = 0;
     this._mainResourceLoadTime = -1;
     this._mainResourceDOMContentTime = -1;
     this._hiddenCategories = {};
@@ -82,7 +83,7 @@ WebInspector.NetworkPanel = function()
     WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.ResourceStarted, this._onResourceStarted, this);
     WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.ResourceUpdated, this._onResourceUpdated, this);
     WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.ResourceFinished, this._onResourceUpdated, this);
-    WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.MainResourceCommitLoad, this._onMainResourceCommitLoad, this);
+    WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.FrameCommittedLoad, this._onFrameCommitLoad, this);
 }
 
 WebInspector.NetworkPanel.prototype = {
@@ -367,7 +368,7 @@ WebInspector.NetworkPanel.prototype = {
         for (var i = 0; i < this._resources.length; ++i) {
             var resource = this._resources[i];
             transferSize += (resource.cached || !resource.transferSize) ? 0 : resource.transferSize;
-            if (resource.isMainResource)
+            if (resource === WebInspector.mainResource)
                 baseTime = resource.startTime;
             if (resource.endTime > maxTime)
                 maxTime = resource.endTime;
@@ -564,7 +565,15 @@ WebInspector.NetworkPanel.prototype = {
 
     _resourceGridNode: function(resource)
     {
-        return this._resourceGridNodes[resource.identifier];
+        return this._resourceGridNodes[resource.__gridNodeId];
+    },
+
+    _createResourceGridNode: function(resource)
+    {
+        var node = new WebInspector.NetworkDataGridNode(this, resource);
+        resource.__gridNodeId = this._lastResourceGridNodeId++;
+        this._resourceGridNodes[resource.__gridNodeId] = node;
+        return node;
     },
 
     revealAndSelectItem: function(resource)
@@ -671,8 +680,7 @@ WebInspector.NetworkPanel.prototype = {
             var node = this._resourceGridNode(resource);
             if (!node) {
                 // Create the timeline tree element and graph.
-                node = new WebInspector.NetworkDataGridNode(this, resource);
-                this._resourceGridNodes[resource.identifier] = node;
+                node = this._createResourceGridNode(resource);
                 this._dataGrid.appendChild(node);
             }
             node.refreshResource();
@@ -794,15 +802,29 @@ WebInspector.NetworkPanel.prototype = {
         this._reset();
     },
 
-    _onMainResourceCommitLoad: function()
+    _onFrameCommitLoad: function(event)
     {
+        if (event.data.frame.parentId)
+            return;
+
+        // Main frame committed load.
         if (this._preserveLogToggle.toggled)
             return;
 
+        // Preserve provisional load resources.
+        var loaderId = event.data.loaderId;
+        var resourcesToPreserve = [];
+        for (var i = 0; i < this._resources.length; ++i) {
+            var resource = this._resources[i];
+            if (resource.loaderId === loaderId)
+                resourcesToPreserve.push(resource);
+        }
+
         this._reset();
-        // Now resurrect the main resource along with all redirects that lead to it.
-        var resourcesToAppend = (WebInspector.mainResource.redirects || []).concat(WebInspector.mainResource);
-        resourcesToAppend.forEach(this._appendResource, this);
+
+        // Restore preserved items.
+        for (var i = 0; i < resourcesToPreserve.length; ++i)
+            this._appendResource(resourcesToPreserve[i]);
     },
 
     canShowSourceLine: function(url, line)
@@ -972,16 +994,12 @@ WebInspector.NetworkPanel.prototype = {
 
     _contextMenu: function(event)
     {
-        // createBlobURL is enabled conditionally, do not expose resource export if it's not available.
-        if ((window.webkitURL && typeof window.webkitURL.createObjectURL !== "function") || !Preferences.resourceExportEnabled)
-            return;
-
         var contextMenu = new WebInspector.ContextMenu();
         var gridNode = this._dataGrid.dataGridNodeFromNode(event.target);
         var resource = gridNode && gridNode._resource;
         if (resource)
-            contextMenu.appendItem(WebInspector.UIString("Export to HAR"), this._exportResource.bind(this, resource));
-        contextMenu.appendItem(WebInspector.UIString("Export all to HAR"), this._exportAll.bind(this));
+            contextMenu.appendItem(WebInspector.UIString("Copy entry as HAR"), this._exportResource.bind(this, resource));
+        contextMenu.appendItem(WebInspector.UIString("Copy network log as HAR"), this._exportAll.bind(this));
         contextMenu.show(event);
     },
 
@@ -1359,7 +1377,7 @@ WebInspector.NetworkDataGridNode.prototype = {
 
     _openInNewTab: function()
     {
-        InspectorAgent.openInInspectedWindow(this._resource.url);
+        PageAgent.openInInspectedWindow(this._resource.url);
     },
 
     get selectable()
diff --git a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
index 88fddd6..1795843 100644
--- a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -184,7 +184,7 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
         var description = this.property.value.description;
         // Render \n as a nice unicode cr symbol.
         if (this.property.value.type === "string" && typeof description === "string")
-            description = description.replace(/\n/g, "\u21B5");
+            description = "\"" + description.replace(/\n/g, "\u21B5") + "\"";
         this.valueElement.textContent = description;
 
         if (this.property.isGetter)
@@ -278,23 +278,23 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
     {
         expression = expression.trim();
         var expressionLength = expression.length;
-        var self = this;
-        var callback = function(success) {
+        function callback(error)
+        {
             if (!updateInterface)
                 return;
 
-            if (!success)
-                self.update();
+            if (error)
+                this.update();
 
             if (!expressionLength) {
                 // The property was deleted, so remove this tree element.
-                self.parent.removeChild(this);
+                this.parent.removeChild(this);
             } else {
                 // Call updateSiblings since their value might be based on the value that just changed.
-                self.updateSiblings();
+                this.updateSiblings();
             }
         };
-        this.property.parentObject.setPropertyValue(this.property.name, expression.trim(), callback);
+        this.property.parentObject.setPropertyValue(this.property.name, expression.trim(), callback.bind(this));
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/ProfileView.js b/Source/WebCore/inspector/front-end/ProfileView.js
index 335bf03..a8c5ff4 100644
--- a/Source/WebCore/inspector/front-end/ProfileView.js
+++ b/Source/WebCore/inspector/front-end/ProfileView.js
@@ -81,8 +81,10 @@ WebInspector.CPUProfileView = function(profile)
     this.profile = profile;
 
     var self = this;
-    function profileCallback(profile)
+    function profileCallback(error, profile)
     {
+        if (error)
+            return;
         self.profile.head = profile.head;
         self._assignParentsInProfile();
       
@@ -593,9 +595,9 @@ WebInspector.CPUProfileType.prototype = {
         this._recording = !this._recording;
 
         if (this._recording)
-            InspectorAgent.startProfiling();
+            ProfilerAgent.start();
         else
-            InspectorAgent.stopProfiling();
+            ProfilerAgent.stop();
     },
 
     get welcomeMessage()
diff --git a/Source/WebCore/inspector/front-end/ProfilesPanel.js b/Source/WebCore/inspector/front-end/ProfilesPanel.js
index e5fb49e..ea5327b 100644
--- a/Source/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/Source/WebCore/inspector/front-end/ProfilesPanel.js
@@ -124,7 +124,26 @@ WebInspector.ProfilesPanel = function()
     this._profiles = [];
     this._profilerEnabled = Preferences.profilerAlwaysEnabled;
     this._reset();
+
+    this._registerProfileType(new WebInspector.CPUProfileType());
+    if (Preferences.heapProfilerPresent) {
+        if (!Preferences.detailedHeapProfiles)
+            this._registerProfileType(new WebInspector.HeapSnapshotProfileType());
+        else
+            this._registerProfileType(new WebInspector.DetailedHeapshotProfileType());
+    }
+
     InspectorBackend.registerDomainDispatcher("Profiler", new WebInspector.ProfilerDispatcher(this));
+
+    if (Preferences.profilerAlwaysEnabled || WebInspector.settings.profilerEnabled)
+        ProfilerAgent.enable();
+    else {
+        function onProfilerEnebled(error, value) {
+            if (value)
+                this._profilerWasEnabled();
+        }
+        ProfilerAgent.isEnabled(onProfilerEnebled.bind(this));
+    }
 }
 
 WebInspector.ProfilesPanel.prototype = {
@@ -230,7 +249,7 @@ WebInspector.ProfilesPanel.prototype = {
         this._reset();
     },
 
-    registerProfileType: function(profileType)
+    _registerProfileType: function(profileType)
     {
         this._profileTypesByIdMap[profileType.id] = profileType;
         profileType.treeElement = new WebInspector.SidebarSectionTreeElement(profileType.name, null, true);
@@ -614,10 +633,10 @@ WebInspector.ProfilesPanel.prototype = {
     {
         if (this._profilerEnabled) {
             WebInspector.settings.profilerEnabled = false;
-            InspectorAgent.disableProfiler(true);
+            ProfilerAgent.disable();
         } else {
             WebInspector.settings.profilerEnabled = !!optionalAlways;
-            InspectorAgent.enableProfiler();
+            ProfilerAgent.enable();
         }
     },
 
@@ -626,7 +645,9 @@ WebInspector.ProfilesPanel.prototype = {
         if (!this._profilerEnabled || this._profilesWereRequested)
             return;
 
-        function populateCallback(profileHeaders) {
+        function populateCallback(error, profileHeaders) {
+            if (error)
+                return;
             profileHeaders.sort(function(a, b) { return a.uid - b.uid; });
             var profileHeadersLength = profileHeaders.length;
             for (var i = 0; i < profileHeadersLength; ++i)
diff --git a/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js b/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js
index 0c314bc..4df313c 100644
--- a/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js
@@ -42,20 +42,19 @@ WebInspector.PropertiesSidebarPane.prototype = {
             return;
         }
 
-        RuntimeAgent.releaseObjectGroup(0, "dom-selection");
         WebInspector.RemoteObject.resolveNode(node, nodeResolved.bind(this));
 
-        function nodeResolved(objectPayload)
+        function nodeResolved(object)
         {
-            if (!objectPayload)
+            if (!object)
                 return;
-            var object = WebInspector.RemoteObject.fromPayload(objectPayload);
             object.evaluate("var proto = this; result = {}; var counter = 1; while (proto) { result[counter++] = proto; proto = proto.__proto__ }; return result;", nodePrototypesReady.bind(this));
+            object.release();
         }
 
-        function nodePrototypesReady(objectPayload)
+        function nodePrototypesReady(error, objectPayload)
         {
-            if (!objectPayload)
+            if (error || !objectPayload)
                 return;
             var object = WebInspector.RemoteObject.fromPayload(objectPayload);
             object.getOwnProperties(false, fillSection.bind(this));
diff --git a/Source/WebCore/inspector/front-end/RemoteObject.js b/Source/WebCore/inspector/front-end/RemoteObject.js
index 4a20cf1..294be50 100644
--- a/Source/WebCore/inspector/front-end/RemoteObject.js
+++ b/Source/WebCore/inspector/front-end/RemoteObject.js
@@ -48,11 +48,17 @@ WebInspector.RemoteObject.fromLocalObject = function(value)
 
 WebInspector.RemoteObject.resolveNode = function(node, callback)
 {
-    function mycallback(object)
+    function mycallback(error, object)
     {
-        callback(object ? WebInspector.RemoteObject.fromPayload(object) : null);
+        if (!callback)
+            return;
+
+        if (error || !object)
+            callback(null);
+        else
+            callback(WebInspector.RemoteObject.fromPayload(object));
     }
-    DOMAgent.resolveNode(node.id, "dom-selection", mycallback);
+    DOMAgent.resolveNode(node.id, mycallback);
 }
 
 WebInspector.RemoteObject.fromPayload = function(payload)
@@ -112,8 +118,10 @@ WebInspector.RemoteObject.prototype = {
             callback([]);
             return;
         }
-        function remoteObjectBinder(properties)
+        function remoteObjectBinder(error, properties)
         {
+            if (error)
+                return;
             for (var i = 0; properties && i < properties.length; ++i)
                 properties[i].value = WebInspector.RemoteObject.fromPayload(properties[i].value);
             callback(properties);
@@ -124,7 +132,7 @@ WebInspector.RemoteObject.prototype = {
     setPropertyValue: function(name, value, callback)
     {
         if (!this._objectId) {
-            callback(false);
+            callback("Can't get a property of non-object.");
             return;
         }
         RuntimeAgent.setPropertyValue(this._objectId, name, value, callback);
@@ -141,6 +149,11 @@ WebInspector.RemoteObject.prototype = {
     evaluate: function(expression, callback)
     {
         RuntimeAgent.evaluateOn(this._objectId, expression, callback);
+    },
+
+    release: function()
+    {
+        RuntimeAgent.releaseObject(this._objectId);
     }
 }
 
@@ -164,15 +177,50 @@ WebInspector.LocalJSONObject = function(value)
 WebInspector.LocalJSONObject.prototype = {
     get description()
     {
+        if (this._cachedDescription)
+            return this._cachedDescription;
+
         var type = this.type;
+
         switch (type) {
             case "array":
-                return "[" + this._value.length + "]";
+                function formatArrayItem(property)
+                {
+                    return property.value.description;
+                }
+                this._cachedDescription = this._concatenate("[", "]", formatArrayItem);
+                break;
             case "object":
-                return this.hasChildren ? "{...}" : "{ }";
+                function formatObjectItem(property)
+                {
+                    return property.name + ":" + property.value.description;
+                }
+                this._cachedDescription = this._concatenate("{", "}", formatObjectItem);
+                break;
             default:
-                return JSON.stringify(this._value);
+                this._cachedDescription = String(this._value);
         }
+        return this._cachedDescription;
+    },
+
+    _concatenate: function(prefix, suffix, formatProperty)
+    {
+        const previewChars = 100;
+
+        var buffer = prefix;
+        var children = this._children();
+        for (var i = 0; i < children.length; ++i) {
+            var itemDescription = formatProperty(children[i]);
+            if (buffer.length + itemDescription.length > previewChars) {
+                buffer += ",\u2026";
+                break;
+            }
+            if (i)
+                buffer += ", ";
+            buffer += itemDescription;
+        }
+        buffer += suffix;
+        return buffer;
     },
 
     get type()
@@ -196,11 +244,18 @@ WebInspector.LocalJSONObject.prototype = {
 
     getProperties: function(ignoreHasOwnProperty, abbreviate, callback)
     {
+        callback(this._children());
+    },
+
+    _children: function()
+    {
         function buildProperty(propName)
         {
             return new WebInspector.RemoteObjectProperty(propName, new WebInspector.LocalJSONObject(this._value[propName]));
         }
-        callback(Object.keys(this._value).map(buildProperty.bind(this)));
+        if (!this._cachedChildren)
+            this._cachedChildren = Object.keys(this._value).map(buildProperty.bind(this));
+        return this._cachedChildren;
     },
 
     isError: function()
diff --git a/Source/WebCore/inspector/front-end/Resource.js b/Source/WebCore/inspector/front-end/Resource.js
index 6cf5b9c..8035fd8 100644
--- a/Source/WebCore/inspector/front-end/Resource.js
+++ b/Source/WebCore/inspector/front-end/Resource.js
@@ -241,7 +241,10 @@ WebInspector.Resource.prototype = {
             return 0;
         if (this.statusCode === 304) // Not modified
             return this._responseHeadersSize;
-        // FIXME: We prefer using Content-Length over resourceSize as
+        if (this._transferSize !== undefined)
+            return this._transferSize;
+        // If we did not receive actual transfer size from network
+        // stack, we prefer using Content-Length over resourceSize as
         // resourceSize may differ from actual transfer size if platform's
         // network stack performed decoding (e.g. gzip decompression).
         // The Content-Length, though, is expected to come from raw
@@ -249,19 +252,14 @@ WebInspector.Resource.prototype = {
         // This won't work for chunked content encoding, so fall back to
         // resourceSize when we don't have Content-Length. This still won't
         // work for chunks with non-trivial encodings. We need a way to
-        // get actaul transfer size from the network stack.
+        // get actual transfer size from the network stack.
         var bodySize = Number(this.responseHeaders["Content-Length"] || this.resourceSize);
         return this._responseHeadersSize + bodySize;
     },
 
-    get expectedContentLength()
+    increaseTransferSize: function(x)
     {
-        return this._expectedContentLength || 0;
-    },
-
-    set expectedContentLength(x)
-    {
-        this._expectedContentLength = x;
+        this._transferSize = (this._transferSize || 0) + x;
     },
 
     get finished()
diff --git a/Source/WebCore/inspector/front-end/ResourceJSONView.js b/Source/WebCore/inspector/front-end/ResourceJSONView.js
new file mode 100644
index 0000000..694b100
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/ResourceJSONView.js
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.ResourceJSONView = function(resource, parsedJSON)
+{
+    WebInspector.ResourceView.call(this, resource);
+    this._parsedJSON = parsedJSON;
+    this.element.addStyleClass("json");
+}
+
+WebInspector.ResourceJSONView.parseJSON = function(text)
+{
+    // Trim while(1), for(;;), weird numbers, etc. We need JSON start.
+    var start = /[{[]/.exec(text);
+    if (start && start.index)
+        text = text.substring(start.index);
+
+    try {
+        return JSON.parse(text);
+    } catch (e) {
+        return;
+    }
+}
+
+WebInspector.ResourceJSONView.prototype = {
+    hasContent: function()
+    {
+        return true;
+    },
+
+    show: function(parentElement)
+    {
+        WebInspector.ResourceView.prototype.show.call(this, parentElement);
+        this._initialize();
+    },
+
+    _initialize: function()
+    {
+        if (this._initialized)
+            return;
+        this._initialized = true;
+
+        var obj = WebInspector.RemoteObject.fromLocalObject(this._parsedJSON);
+        this.element.appendChild(new WebInspector.ObjectPropertiesSection(obj, obj.description, null, true).element);
+    }
+}
+
+WebInspector.ResourceJSONView.prototype.__proto__ = WebInspector.ResourceView.prototype;
diff --git a/Source/WebCore/inspector/front-end/ResourceTreeModel.js b/Source/WebCore/inspector/front-end/ResourceTreeModel.js
index da2d47a..fa2c44e 100644
--- a/Source/WebCore/inspector/front-end/ResourceTreeModel.js
+++ b/Source/WebCore/inspector/front-end/ResourceTreeModel.js
@@ -29,62 +29,131 @@
  */
 
 
-WebInspector.ResourceTreeModel = function()
+WebInspector.ResourceTreeModel = function(networkManager)
 {
-    this.reset();
+    WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.ResourceFinished, this._onResourceUpdated, this);
+    WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.ResourceUpdated, this._onResourceUpdated, this);
+    WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.FrameDetached, this._onFrameDetachedFromParent, this);
+    WebInspector.networkManager.addEventListener(WebInspector.NetworkManager.EventTypes.FrameCommittedLoad, this._onCommitLoad, this);
+
+    this.frontendReused();
+}
+
+WebInspector.ResourceTreeModel.EventTypes = {
+    FrameAdded: "FrameAdded",
+    FrameNavigated: "FrameNavigated",
+    FrameDetached: "FrameDetached",
+    ResourceAdded: "ResourceAdded"
 }
 
 WebInspector.ResourceTreeModel.prototype = {
-    reset: function()
+    frontendReused: function()
     {
         this._resourcesByURL = {};
         this._resourcesByFrameId = {};
         this._subframes = {};
-        if (WebInspector.panels)
-            WebInspector.panels.resources.clear();
+        NetworkAgent.getCachedResources(this._processCachedResources.bind(this));
+    },
+
+    _processCachedResources: function(error, mainFramePayload)
+    {
+        if (error)
+            return;
+
+        this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.FrameNavigated, 0);
+
+        WebInspector.mainResource = this._addFramesRecursively(mainFramePayload);
+        this._cachedResourcesProcessed = true;
     },
 
-    addOrUpdateFrame: function(frame)
+    _addOrUpdateFrame: function(frame)
     {
-        var tmpResource = new WebInspector.Resource(null, frame.url);
-        WebInspector.panels.resources.addOrUpdateFrame(frame.parentId, frame.id, frame.name, tmpResource.displayName);
+        this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.FrameAdded, frame);
+
         var subframes = this._subframes[frame.parentId];
         if (!subframes) {
-            subframes = {};
+            subframes = [];
             this._subframes[frame.parentId || 0] = subframes;
         }
-        subframes[frame.id] = true;
+        subframes.push(frame);
     },
 
-    didCommitLoadForFrame: function(frame, loader)
+    frames: function(parentFrameId)
     {
+        return this._subframes[parentFrameId] || [];
+    },
+
+    subframes: function(parentFrameId)
+    {
+        return this._subframes[parentFrameId] || [];
+    },
+
+    resources: function(frameId)
+    {
+        var result = [];
+        var resources = this._resourcesByFrameId[frameId] || {};
+        for (var url in resources)
+            result.push(resources[url]);
+        return result;
+    },
+
+    _onCommitLoad: function(event)
+    {
+        if (!this._cachedResourcesProcessed)
+            return;
+
+        var frame = event.data.frame;
+        var loaderId = event.data.loaderId;
+        var isMainFrame = !frame.parentId;
+
         // frame.parentId === 0 is when main frame navigation happens.
-        this._clearChildFramesAndResources(frame.parentId ? frame.id : 0, loader.loaderId);
+        this._clearChildFramesAndResources(isMainFrame ? 0 : frame.id, loaderId);
 
-        this.addOrUpdateFrame(frame);
+        this._addOrUpdateFrame(frame);
 
         var resourcesForFrame = this._resourcesByFrameId[frame.id];
-        for (var i = 0; resourcesForFrame && i < resourcesForFrame.length; ++i)
-            WebInspector.panels.resources.addResourceToFrame(frame.id, resourcesForFrame[i]);
+        if (resourcesForFrame) {
+            for (var url in resourcesForFrame)
+                this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.ResourceAdded, resourcesForFrame[url]);
+        }
+
+        if (isMainFrame && this.resourceForURL(frame.url))
+            WebInspector.mainResource = this.resourceForURL(frame.url);
     },
 
-    frameDetachedFromParent: function(frameId)
+    _onFrameDetachedFromParent: function(event)
     {
+        if (!this._cachedResourcesProcessed)
+            return;
+
+        var frameId = event.data;
         this._clearChildFramesAndResources(frameId, 0);
-        WebInspector.panels.resources.removeFrame(frameId);
+        this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.FrameDetached, frameId);
+    },
+
+    _onResourceUpdated: function(event)
+    {
+        if (!this._cachedResourcesProcessed)
+            return;
+        this._addResourceToFrame(event.data);
     },
 
-    addResourceToFrame: function(frameId, resource)
+    _addResourceToFrame: function(resource)
     {
+        var frameId = resource.frameId;
         var resourcesForFrame = this._resourcesByFrameId[frameId];
         if (!resourcesForFrame) {
-            resourcesForFrame = [];
+            resourcesForFrame = {};
             this._resourcesByFrameId[frameId] = resourcesForFrame;
         }
-        resourcesForFrame.push(resource);
-        this._bindResourceURL(resource);
+        if (resourcesForFrame[resource.url] === resource) {
+            // Already in the tree, we just got an extra update.
+            return;
+        }
 
-        WebInspector.panels.resources.addResourceToFrame(frameId, resource);
+        resourcesForFrame[resource.url] = resource;
+        this._bindResourceURL(resource);
+        this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.ResourceAdded, resource);
     },
 
     forAllResources: function(callback)
@@ -108,7 +177,7 @@ WebInspector.ResourceTreeModel.prototype = {
         }
 
         var view = WebInspector.ResourceView.resourceViewForResource(resource);
-        if (view.addMessage)
+        if (view.addMessage && msg.isErrorOrWarning() && msg.message)
             view.addMessage(msg);
     },
 
@@ -123,36 +192,23 @@ WebInspector.ResourceTreeModel.prototype = {
 
     resourceForURL: function(url)
     {
-        // FIXME: receive frameId here.
-        var entry = this._resourcesByURL[url];
-        if (entry instanceof Array)
-            return entry[0];
-        return entry;
+        return this._resourcesByURL[url];
     },
 
     _bindResourceURL: function(resource)
     {
-        var resourceForURL = this._resourcesByURL[resource.url];
-        if (!resourceForURL)
-            this._resourcesByURL[resource.url] = resource;
-        else if (resourceForURL instanceof Array)
-            resourceForURL.push(resource);
-        else
-            this._resourcesByURL[resource.url] = [resourceForURL, resource];
+        this._resourcesByURL[resource.url] = resource;
     },
 
-    _clearChildFramesAndResources: function(frameId, loaderId)
+    _clearChildFramesAndResources: function(frameId, loaderToPreserveId)
     {
-        WebInspector.panels.resources.removeResourcesFromFrame(frameId);
+        this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.FrameNavigated, frameId);
 
-        this._clearResources(frameId, loaderId);
+        this._clearResources(frameId, loaderToPreserveId);
         var subframes = this._subframes[frameId];
-        if (!subframes)
-            return;
-
-        for (var childFrameId in subframes) {
-            WebInspector.panels.resources.removeFrame(childFrameId);
-            this._clearChildFramesAndResources(childFrameId, loaderId);
+        for (var i = 0; subframes && i < subframes.length; ++ i) {
+            this.dispatchEventToListeners(WebInspector.ResourceTreeModel.EventTypes.FrameRemoved, subframes[i].id);
+            this._clearChildFramesAndResources(subframes[i].id, loaderToPreserveId);
         }
         delete this._subframes[frameId];
     },
@@ -164,51 +220,81 @@ WebInspector.ResourceTreeModel.prototype = {
             return;
 
         var preservedResourcesForFrame = [];
-        for (var i = 0; i < resourcesForFrame.length; ++i) {
-            var resource = resourcesForFrame[i];
-            if (resource.loader.loaderId === loaderToPreserveId) {
-                preservedResourcesForFrame.push(resource);
+        for (var url in resourcesForFrame) {
+            var resource = resourcesForFrame[url];
+            if (resource.loaderId === loaderToPreserveId) {
+                preservedResourcesForFrame[url] = resource;
                 continue;
             }
             this._unbindResourceURL(resource);
         }
 
         delete this._resourcesByFrameId[frameId];
-        if (preservedResourcesForFrame.length)
+        if (preservedResourcesForFrame.length) {
             this._resourcesByFrameId[frameId] = preservedResourcesForFrame;
+        }
     },
 
     _callForFrameResources: function(frameId, callback)
     {
         var resources = this._resourcesByFrameId[frameId];
-        for (var i = 0; resources && i < resources.length; ++i) {
-            if (callback(resources[i]))
+        if (!resources)
+            return;
+
+        for (var url in resources) {
+            if (callback(resources[url]))
                 return true;
         }
         
         var frames = this._subframes[frameId];
-        if (frames) {
-            for (var id in frames) {
-                if (this._callForFrameResources(id, callback))
-                    return true;
-            }
+        for (var i = 0; frames && i < frames.length; ++i) {
+            if (this._callForFrameResources(frames[i].id, callback))
+                return true;
         }
         return false;
     },
 
     _unbindResourceURL: function(resource)
     {
-        var resourceForURL = this._resourcesByURL[resource.url];
-        if (!resourceForURL)
-            return;
+        delete this._resourcesByURL[resource.url];
+    },
+
+    _addFramesRecursively: function(frameTreePayload)
+    {
+        var framePayload = frameTreePayload.frame;
+
+        // Create frame resource.
+        var frameResource = this._createResource(framePayload, framePayload.url);
+        frameResource.type = WebInspector.Resource.Type.Document;
+        frameResource.finished = true;
+
+        this._addOrUpdateFrame(framePayload);
+        this._addResourceToFrame(frameResource);
 
-        if (resourceForURL instanceof Array) {
-            resourceForURL.remove(resource, true);
-            if (resourceForURL.length === 1)
-                this._resourcesByURL[resource.url] = resourceForURL[0];
+        for (var i = 0; frameTreePayload.childFrames && i < frameTreePayload.childFrames.length; ++i)
+            this._addFramesRecursively(frameTreePayload.childFrames[i]);
+
+        if (!frameTreePayload.resources)
             return;
+
+        // Create frame subresources.
+        for (var i = 0; i < frameTreePayload.resources.length; ++i) {
+            var subresource = frameTreePayload.resources[i];
+            var resource = this._createResource(framePayload, subresource.url);
+            resource.type = WebInspector.Resource.Type[subresource.type];
+            resource.finished = true;
+            this._addResourceToFrame(resource);
         }
+        return frameResource;
+    },
 
-        delete this._resourcesByURL[resource.url];
+    _createResource: function(frame, url)
+    {
+        var resource = new WebInspector.Resource(null, url);
+        resource.frameId = frame.id;
+        resource.loaderId = frame.loaderId;
+        return resource;
     }
 }
+
+WebInspector.ResourceTreeModel.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/ResourceView.js b/Source/WebCore/inspector/front-end/ResourceView.js
index 83cf99d5..ffd9062 100644
--- a/Source/WebCore/inspector/front-end/ResourceView.js
+++ b/Source/WebCore/inspector/front-end/ResourceView.js
@@ -45,15 +45,20 @@ WebInspector.ResourceView.prototype.__proto__ = WebInspector.View.prototype;
 
 WebInspector.ResourceView.createResourceView = function(resource)
 {
+    function sourceFrameForDelegateAndURL(delegate, url)
+    {
+        var view = new WebInspector.SourceFrame(delegate, url);
+        view.resource = resource;
+        return view;
+    }
+
     switch (resource.category) {
     case WebInspector.resourceCategories.documents:
-    case WebInspector.resourceCategories.stylesheets:
     case WebInspector.resourceCategories.scripts:
     case WebInspector.resourceCategories.xhr:
-        var delegate = new WebInspector.SourceFrameDelegateForResourcesPanel(resource);
-        var view = new WebInspector.SourceFrame(delegate, resource.url);
-        view.resource = resource;
-        return view;
+        return sourceFrameForDelegateAndURL(new WebInspector.SourceFrameDelegateForResourcesPanel(resource), resource.url);
+    case WebInspector.resourceCategories.stylesheets:
+        return sourceFrameForDelegateAndURL(new WebInspector.CSSSourceFrameDelegateForResourcesPanel(resource), resource.url);
     case WebInspector.resourceCategories.images:
         return new WebInspector.ImageView(resource);
     case WebInspector.resourceCategories.fonts:
@@ -147,3 +152,56 @@ WebInspector.SourceFrameDelegateForResourcesPanel.prototype = {
 }
 
 WebInspector.SourceFrameDelegateForResourcesPanel.prototype.__proto__ = WebInspector.SourceFrameDelegate.prototype;
+
+
+WebInspector.CSSSourceFrameDelegateForResourcesPanel = function(resource)
+{
+    WebInspector.SourceFrameDelegateForResourcesPanel.call(this, resource);
+}
+
+WebInspector.CSSSourceFrameDelegateForResourcesPanel.prototype = {
+    canEditScriptSource: function()
+    {
+        return true;
+    },
+
+    editScriptSource: function(newText)
+    {
+        function handleStyleSheet(newText, styleSheet)
+        {
+            this._styleSheet = styleSheet;
+            this._saveStyleSheet(newText);
+        }
+
+        function handleInfos(newText, error, infos)
+        {
+            if (error)
+                return;
+            for (var i = 0; i < infos.length; ++i) {
+                var info = infos[i];
+                if (info.sourceURL === this._resource.url) {
+                    WebInspector.CSSStyleSheet.createForId(info.styleSheetId, handleStyleSheet.bind(this, newText));
+                    break;
+                }
+            }
+        }
+
+        if (this._styleSheet)
+            this._saveStyleSheet(newText);
+        else
+            CSSAgent.getAllStyleSheets(handleInfos.bind(this, newText));
+    },
+
+    _saveStyleSheet: function(newText)
+    {
+        function callback(success)
+        {
+            if (!success)
+                console.error("Failed to save modified stylesheet %s", this._resource.url);
+        }
+
+        this._styleSheet.setText(newText, callback.bind(this));
+    }
+}
+
+WebInspector.CSSSourceFrameDelegateForResourcesPanel.prototype.__proto__ = WebInspector.SourceFrameDelegateForResourcesPanel.prototype;
diff --git a/Source/WebCore/inspector/front-end/ResourcesPanel.js b/Source/WebCore/inspector/front-end/ResourcesPanel.js
index 3c85892..c65e6b7 100644
--- a/Source/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/Source/WebCore/inspector/front-end/ResourcesPanel.js
@@ -34,26 +34,28 @@ WebInspector.ResourcesPanel = function(database)
     WebInspector.settings.installApplicationSetting("resourcesLastSelectedItem", {});
 
     this.createSidebar();
-    this.sidebarElement.addStyleClass("outline-disclosure filter-all children small");
+    this.sidebarElement.addStyleClass("outline-disclosure");
+    this.sidebarElement.addStyleClass("filter-all");
+    this.sidebarElement.addStyleClass("children");
+    this.sidebarElement.addStyleClass("small");
     this.sidebarTreeElement.removeStyleClass("sidebar-tree");
 
-    this.resourcesListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Frames"), "Frames", "frame-storage-tree-item");
+    this.resourcesListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Frames"), "Frames", ["frame-storage-tree-item"]);
     this.sidebarTree.appendChild(this.resourcesListTreeElement);
-    this._treeElementForFrameId = {};
 
-    this.databasesListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Databases"), "Databases", "database-storage-tree-item");
+    this.databasesListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Databases"), "Databases", ["database-storage-tree-item"]);
     this.sidebarTree.appendChild(this.databasesListTreeElement);
 
-    this.localStorageListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Local Storage"), "LocalStorage", "domstorage-storage-tree-item local-storage");
+    this.localStorageListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Local Storage"), "LocalStorage", ["domstorage-storage-tree-item", "local-storage"]);
     this.sidebarTree.appendChild(this.localStorageListTreeElement);
 
-    this.sessionStorageListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Session Storage"), "SessionStorage", "domstorage-storage-tree-item session-storage");
+    this.sessionStorageListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Session Storage"), "SessionStorage", ["domstorage-storage-tree-item", "session-storage"]);
     this.sidebarTree.appendChild(this.sessionStorageListTreeElement);
 
-    this.cookieListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Cookies"), "Cookies", "cookie-storage-tree-item");
+    this.cookieListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Cookies"), "Cookies", ["cookie-storage-tree-item"]);
     this.sidebarTree.appendChild(this.cookieListTreeElement);
 
-    this.applicationCacheListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Application Cache"), "ApplicationCache", "application-cache-storage-tree-item");
+    this.applicationCacheListTreeElement = new WebInspector.StorageCategoryTreeElement(this, WebInspector.UIString("Application Cache"), "ApplicationCache", ["application-cache-storage-tree-item"]);
     this.sidebarTree.appendChild(this.applicationCacheListTreeElement);
 
     this.storageViews = document.createElement("div");
@@ -96,10 +98,10 @@ WebInspector.ResourcesPanel.prototype = {
     {
         WebInspector.Panel.prototype.show.call(this);
 
+        this._populateResourceTree();
+
         if (this.visibleView && this.visibleView.resource)
             this._showResourceView(this.visibleView.resource);
-
-        this._initDefaultSelection();
     },
 
     loadEventFired: function()
@@ -165,15 +167,42 @@ WebInspector.ResourcesPanel.prototype = {
             this.sidebarTree.selectedTreeElement.deselect();
     },
 
-    clear: function()
+    _populateResourceTree: function()
     {
-        this.resourcesListTreeElement.removeChildren();
+        if (this._treeElementForFrameId)
+            return;
+
         this._treeElementForFrameId = {};
-        this.reset();
+        WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameAdded, this._frameAdded, this);
+        WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameNavigated, this._frameNavigated, this);
+        WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.FrameDetached, this._frameDetached, this);
+        WebInspector.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.ResourceAdded, this._resourceAdded, this);
+
+        function populateFrame(frameId)
+        {
+            var subframes = WebInspector.resourceTreeModel.subframes(frameId);
+            for (var i = 0; i < subframes.length; ++i) {
+                this._frameAdded({data:subframes[i]});
+                populateFrame.call(this, subframes[i].id);
+            }
+
+            var resources = WebInspector.resourceTreeModel.resources(frameId);
+            for (var i = 0; i < resources.length; ++i)
+                this._resourceAdded({data:resources[i]});
+        }
+        populateFrame.call(this, 0);
+        this._initDefaultSelection();
     },
 
-    addOrUpdateFrame: function(parentFrameId, frameId, title, subtitle)
+    _frameAdded: function(event)
     {
+        var frame = event.data;
+        var frameId = frame.id;
+        var parentFrameId = frame.parentId;
+        var title = frame.name;
+        var subtitle = new WebInspector.Resource(null, frame.url).displayName;
+        this.addDocumentURL(frame.url);
+        
         var frameTreeElement = this._treeElementForFrameId[frameId];
         if (frameTreeElement) {
             frameTreeElement.setTitles(title, subtitle);
@@ -182,7 +211,7 @@ WebInspector.ResourcesPanel.prototype = {
 
         var parentTreeElement = parentFrameId ? this._treeElementForFrameId[parentFrameId] : this.resourcesListTreeElement;
         if (!parentTreeElement) {
-            console.warning("No frame with id:" + parentFrameId + " to route " + displayName + " to.")
+            console.warn("No frame with id:" + parentFrameId + " to route " + title + "/" + subtitle + " to.")
             return;
         }
 
@@ -205,8 +234,9 @@ WebInspector.ResourcesPanel.prototype = {
         parentTreeElement.appendChild(frameTreeElement);
     },
 
-    removeFrame: function(frameId)
+    _frameDetached: function(event)
     {
+        var frameId = event.data;
         var frameTreeElement = this._treeElementForFrameId[frameId];
         if (!frameTreeElement)
             return;
@@ -215,9 +245,10 @@ WebInspector.ResourcesPanel.prototype = {
             frameTreeElement.parent.removeChild(frameTreeElement);
     },
 
-    addResourceToFrame: function(frameId, resource)
+    _resourceAdded: function(event)
     {
-        this.addDocumentURL(resource.documentURL);
+        var resource = event.data;
+        var frameId = resource.frameId;
 
         if (resource.statusCode >= 301 && resource.statusCode <= 303)
             return;
@@ -247,11 +278,20 @@ WebInspector.ResourcesPanel.prototype = {
         frameTreeElement.appendChild(resourceTreeElement);
     },
 
-    removeResourcesFromFrame: function(frameId)
+    _frameNavigated: function(event)
     {
+        var frameId = event.data;
+        if (!frameId) {
+            // Total update.
+            this.resourcesListTreeElement.removeChildren();
+            this._treeElementForFrameId = {};
+            this.reset();
+            return;
+        }
+
         var frameTreeElement = this._treeElementForFrameId[frameId];
         if (frameTreeElement)
-            frameTreeElement.removeChildren();
+            frameTreeElement.removeChildren();        
     },
 
     _refreshResource: function(event)
@@ -379,8 +419,8 @@ WebInspector.ResourcesPanel.prototype = {
     },
 
     _applyDiffMarkup: function(view, baseContent, newContent) {
-        var oldLines = baseContent.split("\n");
-        var newLines = newContent.split("\n");
+        var oldLines = baseContent.split(/\r?\n/);
+        var newLines = newContent.split(/\r?\n/);
 
         var diff = Array.diff(oldLines, newLines);
 
@@ -770,19 +810,22 @@ WebInspector.ResourcesPanel.prototype = {
 
 WebInspector.ResourcesPanel.prototype.__proto__ = WebInspector.Panel.prototype;
 
-WebInspector.BaseStorageTreeElement = function(storagePanel, representedObject, title, iconClass, hasChildren)
+WebInspector.BaseStorageTreeElement = function(storagePanel, representedObject, title, iconClasses, hasChildren)
 {
     TreeElement.call(this, "", representedObject, hasChildren);
     this._storagePanel = storagePanel;
     this._titleText = title;
-    this._iconClass = iconClass;
+    this._iconClasses = iconClasses;
 }
 
 WebInspector.BaseStorageTreeElement.prototype = {
     onattach: function()
     {
         this.listItemElement.removeChildren();
-        this.listItemElement.addStyleClass(this._iconClass);
+        if (this._iconClasses) {
+            for (var i = 0; i < this._iconClasses.length; ++i)
+                this.listItemElement.addStyleClass(this._iconClasses[i]);
+        }
 
         var selectionElement = document.createElement("div");
         selectionElement.className = "selection";
@@ -836,9 +879,9 @@ WebInspector.BaseStorageTreeElement.prototype = {
 
 WebInspector.BaseStorageTreeElement.prototype.__proto__ = TreeElement.prototype;
 
-WebInspector.StorageCategoryTreeElement = function(storagePanel, categoryName, settingsKey, iconClass)
+WebInspector.StorageCategoryTreeElement = function(storagePanel, categoryName, settingsKey, iconClasses)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, categoryName, iconClass, true);
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, categoryName, iconClasses, true);
     this._expandedSettingKey = "resources" + settingsKey + "Expanded";
     WebInspector.settings.installApplicationSetting(this._expandedSettingKey, settingsKey === "Frames");
     this._categoryName = categoryName;
@@ -877,7 +920,7 @@ WebInspector.StorageCategoryTreeElement.prototype.__proto__ = WebInspector.BaseS
 
 WebInspector.FrameTreeElement = function(storagePanel, frameId, title, subtitle)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, "", "frame-storage-tree-item");
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, "", ["frame-storage-tree-item"]);
     this._frameId = frameId;
     this.setTitles(title, subtitle);
 }
@@ -904,7 +947,7 @@ WebInspector.FrameTreeElement.prototype = {
         this._storagePanel.showCategoryView(this._displayName);
 
         this.listItemElement.removeStyleClass("hovered");
-        InspectorAgent.hideFrameHighlight();
+        DOMAgent.hideFrameHighlight();
     },
 
     get displayName()
@@ -916,10 +959,8 @@ WebInspector.FrameTreeElement.prototype = {
     {
         this._displayName = "";
         if (this.parent) {
-            if (title) {
-                this.titleElement.textContent = title;
-                this._displayName = title;
-            }
+            this.titleElement.textContent = title || "";
+            this._displayName = title || "";
             if (subtitle) {
                 var subtitleElement = document.createElement("span");
                 subtitleElement.className = "base-storage-tree-element-subtitle";
@@ -937,10 +978,10 @@ WebInspector.FrameTreeElement.prototype = {
     {
         if (hovered) {
             this.listItemElement.addStyleClass("hovered");
-            InspectorAgent.highlightFrame(this._frameId);
+            DOMAgent.highlightFrame(this._frameId);
         } else {
             this.listItemElement.removeStyleClass("hovered");
-            InspectorAgent.hideFrameHighlight();
+            DOMAgent.hideFrameHighlight();
         }
     }
 }
@@ -948,7 +989,7 @@ WebInspector.FrameTreeElement.prototype.__proto__ = WebInspector.BaseStorageTree
 
 WebInspector.FrameResourceTreeElement = function(storagePanel, resource)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, resource, resource.displayName, "resource-sidebar-tree-item resources-category-" + resource.category.name);
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, resource, resource.displayName, ["resource-sidebar-tree-item", "resources-category-" + resource.category.name]);
     this._resource = resource;
     this._resource.addEventListener("errors-warnings-updated", this._errorsWarningsUpdated, this);
     this._resource.addEventListener("content-changed", this._contentChanged, this);
@@ -969,7 +1010,7 @@ WebInspector.FrameResourceTreeElement.prototype = {
 
     ondblclick: function(event)
     {
-        InspectorAgent.openInInspectedWindow(this._resource.url);
+        PageAgent.openInInspectedWindow(this._resource.url);
     },
 
     onattach: function()
@@ -1070,7 +1111,7 @@ WebInspector.FrameResourceTreeElement.prototype = {
         if (oldView) {
             var newView = WebInspector.ResourceView.recreateResourceView(this._resource);
             if (oldView === this._storagePanel.visibleView)
-                this._storagePanel.visibleView = newView;
+                this._storagePanel._showResourceView(this._resource);
         }
     }
 }
@@ -1079,7 +1120,7 @@ WebInspector.FrameResourceTreeElement.prototype.__proto__ = WebInspector.BaseSto
 
 WebInspector.DatabaseTreeElement = function(storagePanel, database)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, database.name, "database-storage-tree-item", true);
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, database.name, ["database-storage-tree-item"], true);
     this._database = database;
 }
 
@@ -1120,7 +1161,7 @@ WebInspector.DatabaseTreeElement.prototype.__proto__ = WebInspector.BaseStorageT
 
 WebInspector.DatabaseTableTreeElement = function(storagePanel, database, tableName)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, tableName, "database-storage-tree-item");
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, tableName, ["database-storage-tree-item"]);
     this._database = database;
     this._tableName = tableName;
 }
@@ -1141,7 +1182,7 @@ WebInspector.DatabaseTableTreeElement.prototype.__proto__ = WebInspector.BaseSto
 
 WebInspector.DOMStorageTreeElement = function(storagePanel, domStorage, className)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, domStorage.domain ? domStorage.domain : WebInspector.UIString("Local Files"), "domstorage-storage-tree-item " + className);
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, domStorage.domain ? domStorage.domain : WebInspector.UIString("Local Files"), ["domstorage-storage-tree-item", className]);
     this._domStorage = domStorage;
 }
 
@@ -1161,7 +1202,7 @@ WebInspector.DOMStorageTreeElement.prototype.__proto__ = WebInspector.BaseStorag
 
 WebInspector.CookieTreeElement = function(storagePanel, cookieDomain)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, cookieDomain ? cookieDomain : WebInspector.UIString("Local Files"), "cookie-storage-tree-item");
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, cookieDomain ? cookieDomain : WebInspector.UIString("Local Files"), ["cookie-storage-tree-item"]);
     this._cookieDomain = cookieDomain;
 }
 
@@ -1181,7 +1222,7 @@ WebInspector.CookieTreeElement.prototype.__proto__ = WebInspector.BaseStorageTre
 
 WebInspector.ApplicationCacheTreeElement = function(storagePanel, appcacheDomain)
 {
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, appcacheDomain ? appcacheDomain : WebInspector.UIString("Local Files"), "application-cache-storage-tree-item");
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, appcacheDomain ? appcacheDomain : WebInspector.UIString("Local Files"), ["application-cache-storage-tree-item"]);
     this._appcacheDomain = appcacheDomain;
 }
 
@@ -1202,7 +1243,7 @@ WebInspector.ApplicationCacheTreeElement.prototype.__proto__ = WebInspector.Base
 WebInspector.ResourceRevisionTreeElement = function(storagePanel, revision)
 {
     var title = revision.timestamp ? revision.timestamp.toLocaleTimeString() : WebInspector.UIString("(original)");
-    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, title, "resource-sidebar-tree-item resources-category-" + revision.category.name);
+    WebInspector.BaseStorageTreeElement.call(this, storagePanel, null, title, ["resource-sidebar-tree-item", "resources-category-" + revision.category.name]);
     if (revision.timestamp)
         this.tooltip = revision.timestamp.toLocaleString();
     this._resource = revision;
diff --git a/Source/WebCore/inspector/front-end/Script.js b/Source/WebCore/inspector/front-end/Script.js
index 3f27485..805e191 100644
--- a/Source/WebCore/inspector/front-end/Script.js
+++ b/Source/WebCore/inspector/front-end/Script.js
@@ -115,8 +115,10 @@ WebInspector.Script.prototype = {
             return;
         }
 
-        function didGetScriptSource(source)
+        function didGetScriptSource(error, source)
         {
+            if (error)
+                return;
             this._source = source;
             callback(this._source);
         }
diff --git a/Source/WebCore/inspector/front-end/ScriptFormatter.js b/Source/WebCore/inspector/front-end/ScriptFormatter.js
index f70d6c6..2e166f4 100644
--- a/Source/WebCore/inspector/front-end/ScriptFormatter.js
+++ b/Source/WebCore/inspector/front-end/ScriptFormatter.js
@@ -69,25 +69,15 @@ WebInspector.ScriptFormatter.findScriptRanges = function(lineEndings, scripts)
 }
 
 WebInspector.ScriptFormatter.prototype = {
-    formatContent: function(content, callback)
+    formatContent: function(text, scripts, callback)
     {
-        var chunks = this._splitContentIntoChunks(content.text, content.scriptRanges);
+        var scriptRanges = WebInspector.ScriptFormatter.findScriptRanges(text.lineEndings(), scripts);
+        var chunks = this._splitContentIntoChunks(text, scriptRanges);
 
         function didFormatChunks()
         {
             var result = this._buildContentFromChunks(chunks);
-
-            var sourceMapping = new WebInspector.SourceMappingForFormattedScript(content.text.lineEndings(), result.text.lineEndings(), result.mapping);
-            var formattedScriptRanges = [];
-            for (var i = 0; i < content.scriptRanges.length; ++i) {
-                var scriptRange = content.scriptRanges[i];
-                formattedScriptRange = {};
-                formattedScriptRange.start = sourceMapping.originalPositionToFormattedLocation(scriptRange.start.position);
-                formattedScriptRange.end = sourceMapping.originalPositionToFormattedLocation(scriptRange.end.position);
-                formattedScriptRange.sourceID = scriptRange.sourceID;
-                formattedScriptRanges.push(formattedScriptRange);
-            }
-            callback(new WebInspector.SourceFrameContent(result.text, sourceMapping, formattedScriptRanges));
+            callback(result.text, result.mapping);
         }
         this._formatChunks(chunks, 0, didFormatChunks.bind(this));
     },
@@ -186,48 +176,3 @@ WebInspector.ScriptFormatter.prototype = {
         task.callback(task.source, { original: [], formatted: [] });
     }
 }
-
-
-WebInspector.SourceMappingForFormattedScript = function(originalLineEndings, formattedLineEndings, mapping)
-{
-    WebInspector.SourceMapping.call(this);
-    this._originalLineEndings = originalLineEndings;
-    this._formattedLineEndings = formattedLineEndings;
-    this._mapping = mapping;
-}
-
-WebInspector.SourceMappingForFormattedScript.prototype = {
-    actualLocationToSourceLocation: function(lineNumber, columnNumber)
-    {
-        var position = WebInspector.ScriptFormatter.locationToPosition(this._originalLineEndings, lineNumber, columnNumber);
-        return this.originalPositionToFormattedLocation(position);
-    },
-
-    sourceLocationToActualLocation: function(lineNumber, columnNumber)
-    {
-        var formattedPosition = WebInspector.ScriptFormatter.locationToPosition(this._formattedLineEndings, lineNumber, columnNumber);
-        var position = this._convertPosition(this._mapping.formatted, this._mapping.original, formattedPosition);
-        return WebInspector.ScriptFormatter.positionToLocation(this._originalLineEndings, position);
-    },
-
-    originalPositionToFormattedLocation: function(position)
-    {
-        var formattedPosition = this._convertPosition(this._mapping.original, this._mapping.formatted, position);
-        var location = WebInspector.ScriptFormatter.positionToLocation(this._formattedLineEndings, formattedPosition);
-        location.position = formattedPosition;
-        return location;
-    },
-
-    _convertPosition: function(positions1, positions2, position)
-    {
-        var index = positions1.upperBound(position);
-        var range1 = positions1[index] - positions1[index - 1];
-        var range2 = positions2[index] - positions2[index - 1];
-        var position2 = positions2[index - 1];
-        if (range1)
-            position2 += Math.round((position - positions1[index - 1]) * range2 / range1);
-        return position2;
-    }
-}
-
-WebInspector.SourceMappingForFormattedScript.prototype.__proto__ = WebInspector.SourceMapping.prototype;
diff --git a/Source/WebCore/inspector/front-end/ScriptsPanel.js b/Source/WebCore/inspector/front-end/ScriptsPanel.js
index 2647cee..7547c36 100644
--- a/Source/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/Source/WebCore/inspector/front-end/ScriptsPanel.js
@@ -70,7 +70,7 @@ WebInspector.ScriptsPanel = function()
     this.formatButton.id = "format-script";
     this.formatButton.title = WebInspector.UIString("Format script.");
     this.formatButton.appendChild(document.createElement("img"));
-    this.formatButton.addEventListener("click", this._formatScript.bind(this), false);
+    this.formatButton.addEventListener("click", this._toggleFormatSourceFiles.bind(this), false);
     if (Preferences.debugMode)
         this.topStatusBar.appendChild(this.formatButton);
 
@@ -142,10 +142,10 @@ WebInspector.ScriptsPanel = function()
     this.sidebarPanes.watchExpressions = new WebInspector.WatchExpressionsSidebarPane();
     this.sidebarPanes.callstack = new WebInspector.CallStackSidebarPane(this._presentationModel);
     this.sidebarPanes.scopechain = new WebInspector.ScopeChainSidebarPane();
-    this.sidebarPanes.jsBreakpoints = new WebInspector.JavaScriptBreakpointsSidebarPane();
+    this.sidebarPanes.jsBreakpoints = new WebInspector.JavaScriptBreakpointsSidebarPane(this._presentationModel);
     if (Preferences.nativeInstrumentationEnabled) {
         this.sidebarPanes.domBreakpoints = WebInspector.createDOMBreakpointsSidebarPane();
-        this.sidebarPanes.xhrBreakpoints = WebInspector.createXHRBreakpointsSidebarPane();
+        this.sidebarPanes.xhrBreakpoints = new WebInspector.XHRBreakpointsSidebarPane();
         this.sidebarPanes.eventListenerBreakpoints = new WebInspector.EventListenerBreakpointsSidebarPane();
     }
 
@@ -185,14 +185,21 @@ WebInspector.ScriptsPanel = function()
 
     this.reset();
 
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ParsedScriptSource, this._parsedScriptSource, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.FailedToParseScriptSource, this._failedToParseScriptSource, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ScriptSourceChanged, this._scriptSourceChanged, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerPaused, this._debuggerPaused, this);
-    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerResumed, this._debuggerResumed, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerWasEnabled, this._debuggerWasEnabled, this);
+    WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.DebuggerWasDisabled, this._debuggerWasDisabled, this);
+
+    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.SourceFileAdded, this._sourceFileAdded, this)
+    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.SourceFileChanged, this._sourceFileChanged, this);
+    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.ConsoleMessageAdded, this._consoleMessageAdded, this);
     this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.BreakpointAdded, this._breakpointAdded, this);
     this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.BreakpointRemoved, this._breakpointRemoved, this);
+    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.DebuggerPaused, this._debuggerPaused, this);
+    this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.DebuggerResumed, this._debuggerResumed, this);
     this._presentationModel.addEventListener(WebInspector.DebuggerPresentationModel.Events.CallFrameSelected, this._callFrameSelected, this);
+
+    var enableDebugger = Preferences.debuggerAlwaysEnabled || WebInspector.settings.debuggerEnabled;
+    if (enableDebugger || InspectorFrontendHost.loadSessionSetting("debugger-enabled") === "true")
+        WebInspector.debuggerModel.enableDebugger();
 }
 
 // Keep these in sync with WebCore::ScriptDebugServer
@@ -244,115 +251,36 @@ WebInspector.ScriptsPanel.prototype = {
         return this.toggleBreakpointsButton.toggled;
     },
 
-    _parsedScriptSource: function(event)
-    {
-        this._addScript(event.data);
-    },
-
-    _failedToParseScriptSource: function(event)
-    {
-        this._addScript(event.data);
-    },
-
-    _scriptSourceChanged: function(event)
+    _sourceFileAdded: function(event)
     {
-        var sourceID = event.data.sourceID;
-        var oldSource = event.data.oldSource;
-
-        var script = WebInspector.debuggerModel.scriptForSourceID(sourceID);
-        if (script.resource) {
-            var revertHandle = WebInspector.debuggerModel.editScriptSource.bind(WebInspector.debuggerModel, sourceID, oldSource);
-            script.resource.setContent(script.source, revertHandle);
-        }
-
-        var sourceFileId = this._sourceFileIdForScript(script);
-        this._recreateSourceFrame(sourceFileId);
+        var sourceFile = event.data;
 
-        var callFrames = WebInspector.debuggerModel.callFrames;
-        if (callFrames.length)
-            this._debuggerPaused({ data: { callFrames: callFrames } });
-    },
-
-    _addScript: function(script)
-    {
-        if (!script.sourceURL) {
-            // Anonymous scripts are shown only when stepping.
+        if (!sourceFile.url) {
+            // Anonymous sources are shown only when stepping.
             return;
         }
 
-        var resource = this._resourceForURL(script.sourceURL);
-        if (resource) {
-            if (resource.finished) {
-                // Resource is finished, bind the script right away.
-                script.resource = resource;
-
-                // Add resource url to files select if not already added while debugging inlined scripts.
-                if (!(resource.url in this._sourceFileIdToFilesSelectOption))
-                    this._addOptionToFilesSelectAndShowSourceFrameIfNeeded(resource.url);
-            } else {
-                // Resource is not finished, bind the script later.
-                if (!resource._scriptsPendingResourceLoad) {
-                    resource._scriptsPendingResourceLoad = [];
-                    resource.addEventListener("finished", this._resourceLoadingFinished, this);
-                }
-                resource._scriptsPendingResourceLoad.push(script);
-
-                // Source frame content is outdated since we have new script parsed.
-                this._recreateSourceFrame(script.sourceURL);
-            }
-        } else if (!(script.sourceURL in this._sourceFileIdToFilesSelectOption)) {
-            // This is a dynamic script with "//@ sourceURL=" comment.
-            this._addOptionToFilesSelectAndShowSourceFrameIfNeeded(script.sourceURL);
-        }
-    },
-
-    _resourceForURL: function(url)
-    {
-        return WebInspector.networkManager.inflightResourceForURL(url) || WebInspector.resourceForURL(url);
-    },
-
-    _resourceLoadingFinished: function(e)
-    {
-        var resource = e.target;
-
-        // Bind scripts to resource.
-        for (var i = 0; i < resource._scriptsPendingResourceLoad.length; ++i) {
-            var script = resource._scriptsPendingResourceLoad[i];
-            script.resource = resource;
-        }
-        delete resource._scriptsPendingResourceLoad;
-
-        // Recreate source frame to show resource content.
-        this._recreateSourceFrame(resource.url);
-
-        // Add resource url to files select if not already added while debugging inlined scripts.
-        if (!(resource.url in this._sourceFileIdToFilesSelectOption))
-            this._addOptionToFilesSelectAndShowSourceFrameIfNeeded(resource.url);
-    },
-
-    _addOptionToFilesSelectAndShowSourceFrameIfNeeded: function(url)
-    {
-        this._addOptionToFilesSelect(url);
+        this._addOptionToFilesSelect(sourceFile.id);
 
         var lastViewedURL = WebInspector.settings.lastViewedScriptFile;
         if (this._filesSelectElement.length === 1) {
             // Option we just added is the only option in files select.
             // We have to show corresponding source frame immediately.
-            this._showSourceFrameAndAddToHistory(url);
+            this._showSourceFrameAndAddToHistory(sourceFile.id);
             // Restore original value of lastViewedScriptFile because
             // source frame was shown as a result of initial load.
             WebInspector.settings.lastViewedScriptFile = lastViewedURL;
-        } else if (url === lastViewedURL)
-            this._showSourceFrameAndAddToHistory(url);
+        } else if (sourceFile.url === lastViewedURL)
+            this._showSourceFrameAndAddToHistory(sourceFile.id);
     },
 
     _addOptionToFilesSelect: function(sourceFileId)
     {
-        var script = this._scriptForSourceFileId(sourceFileId);
+        var sourceFile = this._presentationModel.sourceFile(sourceFileId);
         var select = this._filesSelectElement;
         var option = document.createElement("option");
-        option.text = script.sourceURL ? WebInspector.displayNameForURL(script.sourceURL) : WebInspector.UIString("(program)");
-        if (script.worldType === WebInspector.Script.WorldType.EXTENSIONS_WORLD)
+        option.text = sourceFile.url ? WebInspector.displayNameForURL(sourceFile.url) : WebInspector.UIString("(program)");
+        if (sourceFile.isExtensionScript)
             option.addStyleClass("extension-script");
         function optionCompare(a, b)
         {
@@ -370,19 +298,37 @@ WebInspector.ScriptsPanel.prototype = {
         this._sourceFileIdToFilesSelectOption[sourceFileId] = option;
     },
 
+    setScriptSourceIsBeingEdited: function(sourceFileId, inEditMode)
+    {
+        var option = this._sourceFileIdToFilesSelectOption[sourceFileId];
+        if (!option)
+            return;
+        if (inEditMode)
+            option.text = option.text.replace(/[^*]$/, "$&*");
+        else
+            option.text = option.text.replace(/[*]$/, "");
+    },
+
     addConsoleMessage: function(message)
     {
-        this._messages.push(message);
-        var sourceFrame = this._sourceFileIdToSourceFrame[message.url];
-        if (sourceFrame)
-            sourceFrame.addMessage(message);
+        if (message.isErrorOrWarning() && message.message)
+            this._presentationModel.addConsoleMessage(message);
     },
 
     clearConsoleMessages: function()
     {
-        this._messages = [];
-        for (var url in this._sourceFileIdToSourceFrame)
-            this._sourceFileIdToSourceFrame[url].clearMessages();
+        this._presentationModel.clearConsoleMessages();
+        for (var sourceFileId in this._sourceFileIdToSourceFrame)
+            this._sourceFileIdToSourceFrame[sourceFileId].clearMessages();
+    },
+
+    _consoleMessageAdded: function(event)
+    {
+        var message = event.data;
+
+        var sourceFrame = this._sourceFileIdToSourceFrame[message.sourceFileId];
+        if (sourceFrame && sourceFrame.loaded)
+            sourceFrame.addMessageToSource(message.lineNumber, message.originalMessage);
     },
 
     _breakpointAdded: function(event)
@@ -392,6 +338,8 @@ WebInspector.ScriptsPanel.prototype = {
         var sourceFrame = this._sourceFileIdToSourceFrame[breakpoint.sourceFileId];
         if (sourceFrame && sourceFrame.loaded)
             sourceFrame.addBreakpoint(breakpoint.lineNumber, breakpoint.resolved, breakpoint.condition, breakpoint.enabled);
+
+        this.sidebarPanes.jsBreakpoints.addBreakpoint(breakpoint);
     },
 
     _breakpointRemoved: function(event)
@@ -401,25 +349,20 @@ WebInspector.ScriptsPanel.prototype = {
         var sourceFrame = this._sourceFileIdToSourceFrame[breakpoint.sourceFileId];
         if (sourceFrame && sourceFrame.loaded)
             sourceFrame.removeBreakpoint(breakpoint.lineNumber);
+
+        this.sidebarPanes.jsBreakpoints.removeBreakpoint(breakpoint.sourceFileId, breakpoint.lineNumber);
     },
 
     evaluateInSelectedCallFrame: function(code, objectGroup, includeCommandLineAPI, callback)
     {
         var selectedCallFrame = this._presentationModel.selectedCallFrame;
-        if (!this._paused || !selectedCallFrame)
-            return;
-
-        function updatingCallbackWrapper(result)
-        {
-            if (result)
-                callback(WebInspector.RemoteObject.fromPayload(result));
-        }
-        DebuggerAgent.evaluateOnCallFrame(selectedCallFrame.id, code, objectGroup, includeCommandLineAPI, updatingCallbackWrapper.bind(this));
+        selectedCallFrame.evaluate(code, objectGroup, includeCommandLineAPI, callback);
     },
 
     _debuggerPaused: function(event)
     {
         var callFrames = event.data.callFrames;
+        var details = event.data.details;
 
         this._paused = true;
         this._waitingToPause = false;
@@ -429,8 +372,32 @@ WebInspector.ScriptsPanel.prototype = {
 
         WebInspector.currentPanel = this;
 
-        this.sidebarPanes.callstack.update(event.data);
-        this.sidebarPanes.callstack.selectedCallFrame = callFrames[0];
+        this.sidebarPanes.callstack.update(callFrames, details);
+        this.sidebarPanes.callstack.selectedCallFrame = this._presentationModel.selectedCallFrame;
+
+        var status;
+        if (details.eventType === WebInspector.DebuggerEventTypes.NativeBreakpoint) {
+            if (details.eventData.breakpointType === WebInspector.BreakpointManager.BreakpointTypes.EventListener) {
+                var eventName = details.eventData.eventName;
+                this.sidebarPanes.eventListenerBreakpoints.highlightBreakpoint(details.eventData.eventName);
+                var eventNameForUI = WebInspector.EventListenerBreakpointsSidebarPane.eventNameForUI(eventName);
+                status = WebInspector.UIString("Paused on a \"%s\" Event Listener.", eventNameForUI);
+            } else if (details.eventData.breakpointType === WebInspector.BreakpointManager.BreakpointTypes.XHR) {
+                this.sidebarPanes.xhrBreakpoints.highlightBreakpoint(details.eventData.breakpointURL);
+                status = WebInspector.UIString("Paused on a XMLHttpRequest.");
+            }
+        } else {
+            function didGetSourceLocation(sourceFileId, lineNumber, columnNumber)
+            {
+                if (!sourceFileId || !this._presentationModel.findBreakpoint(sourceFileId, lineNumber))
+                    return;
+                this.sidebarPanes.jsBreakpoints.highlightBreakpoint(sourceFileId, lineNumber);
+                status = WebInspector.UIString("Paused on a JavaScript breakpoint.");
+            }
+            callFrames[0].sourceLocation(didGetSourceLocation.bind(this));
+        }
+        if (status)
+            this.sidebarPanes.callstack.setStatus(status);
 
         window.focus();
         InspectorFrontendHost.bringToFront();
@@ -438,8 +405,6 @@ WebInspector.ScriptsPanel.prototype = {
 
     _debuggerResumed: function()
     {
-        this._presentationModel.selectedCallFrame = null;
-
         this._paused = false;
         this._waitingToPause = false;
         this._stepping = false;
@@ -447,21 +412,24 @@ WebInspector.ScriptsPanel.prototype = {
         this._clearInterface();
     },
 
-    debuggerWasEnabled: function()
+    _debuggerWasEnabled: function()
     {
         this._setPauseOnExceptions(WebInspector.settings.pauseOnExceptionState);
 
         if (this._debuggerEnabled)
             return;
+
+        InspectorFrontendHost.saveSessionSetting("debugger-enabled", "true");
         this._debuggerEnabled = true;
         this.reset(true);
     },
 
-    debuggerWasDisabled: function()
+    _debuggerWasDisabled: function()
     {
         if (!this._debuggerEnabled)
             return;
 
+        InspectorFrontendHost.saveSessionSetting("debugger-enabled", "false");
         this._debuggerEnabled = false;
         this.reset(true);
     },
@@ -481,11 +449,11 @@ WebInspector.ScriptsPanel.prototype = {
 
         this._sourceFileIdToSourceFrame = {};
         this._sourceFileIdToFilesSelectOption = {};
-        this._messages = [];
         this._filesSelectElement.removeChildren();
         this.functionsSelectElement.removeChildren();
         this.viewsContainerElement.removeChildren();
 
+        this.sidebarPanes.jsBreakpoints.reset();
         this.sidebarPanes.watchExpressions.refreshExpressions();
         if (!preserveItems)
             this.sidebarPanes.workers.reset();
@@ -564,9 +532,9 @@ WebInspector.ScriptsPanel.prototype = {
         var sourceFrame = this._sourceFrameForSourceFileId(sourceFileId);
         this.visibleView = sourceFrame;
 
-        var script = this._scriptForSourceFileId(sourceFileId);
-        if (script.sourceURL)
-            WebInspector.settings.lastViewedScriptFile = script.sourceURL;
+        var sourceFile = this._presentationModel.sourceFile(sourceFileId);
+        if (sourceFile.url)
+            WebInspector.settings.lastViewedScriptFile = sourceFile.url;
 
         return sourceFrame;
     },
@@ -579,23 +547,24 @@ WebInspector.ScriptsPanel.prototype = {
 
     _createSourceFrame: function(sourceFileId)
     {
-        var script = this._scriptForSourceFileId(sourceFileId);
-        var delegate = new WebInspector.SourceFrameDelegateForScriptsPanel(script);
-        var sourceFrame = new WebInspector.SourceFrame(delegate, script.sourceURL);
+        var sourceFile = this._presentationModel.sourceFile(sourceFileId);
+        var delegate = new WebInspector.SourceFrameDelegateForScriptsPanel(this._presentationModel, sourceFileId);
+        var sourceFrame = new WebInspector.SourceFrame(delegate, sourceFile.url);
         sourceFrame._sourceFileId = sourceFileId;
         sourceFrame.addEventListener(WebInspector.SourceFrame.Events.Loaded, this._sourceFrameLoaded, this);
         this._sourceFileIdToSourceFrame[sourceFileId] = sourceFrame;
         return sourceFrame;
     },
 
-    _recreateSourceFrame: function(sourceFileId)
+    _sourceFileChanged: function(event)
     {
+        var sourceFileId = event.data.id;
+
         var oldSourceFrame = this._sourceFileIdToSourceFrame[sourceFileId];
         if (!oldSourceFrame)
             return;
         oldSourceFrame.removeEventListener(WebInspector.SourceFrame.Events.Loaded, this._sourceFrameLoaded, this);
         delete this._sourceFileIdToSourceFrame[sourceFileId];
-        oldSourceFrame.removeEventListener(WebInspector.SourceFrame.Events.Loaded, this._sourceFrameLoaded, this);
         if (this.visibleView !== oldSourceFrame)
             return;
 
@@ -608,11 +577,12 @@ WebInspector.ScriptsPanel.prototype = {
     {
         var sourceFrame = event.target;
         var sourceFileId = sourceFrame._sourceFileId;
+        var sourceFile = this._presentationModel.sourceFile(sourceFileId);
 
-        for (var i = 0; i < this._messages.length; ++i) {
-            var message = this._messages[i];
-            if (message.url === sourceFileId)
-                sourceFrame.addMessage(message);
+        var messages = sourceFile.messages;
+        for (var i = 0; i < messages.length; ++i) {
+            var message = messages[i];
+            sourceFrame.addMessageToSource(message.lineNumber, message.originalMessage);
         }
 
         var breakpoints = this._presentationModel.breakpointsForSourceFileId(sourceFileId);
@@ -620,28 +590,6 @@ WebInspector.ScriptsPanel.prototype = {
             var breakpoint = breakpoints[i];
             sourceFrame.addBreakpoint(breakpoint.lineNumber, breakpoint.resolved, breakpoint.condition, breakpoint.enabled);
         }
-
-        var selectedCallFrame = this._presentationModel.selectedCallFrame;
-        if (selectedCallFrame) {
-            if (selectedCallFrame.sourceLocation.sourceFileId === sourceFileId) {
-                sourceFrame.setExecutionLine(selectedCallFrame.sourceLocation.lineNumber);
-                this._executionSourceFrame = sourceFrame;
-            }
-        }
-    },
-
-    _sourceFileIdForScript: function(script)
-    {
-        return script.sourceURL || script.sourceID;
-    },
-
-    _scriptForSourceFileId: function(sourceFileId)
-    {
-        function filter(script)
-        {
-            return (script.sourceURL || script.sourceID) === sourceFileId;
-        }
-        return WebInspector.debuggerModel.queryScripts(filter)[0];
     },
 
     _clearCurrentExecutionLine: function()
@@ -662,19 +610,22 @@ WebInspector.ScriptsPanel.prototype = {
 
         this.sidebarPanes.scopechain.update(callFrame);
         this.sidebarPanes.watchExpressions.refreshExpressions();
+        this.sidebarPanes.callstack.selectedCallFrame = this._presentationModel.selectedCallFrame;
 
-        var sourceFileId = callFrame.sourceLocation.sourceFileId;
-        if (!(sourceFileId in this._sourceFileIdToFilesSelectOption)) {
-            // This happens in two cases:
-            // 1) Current call frame function is defined in anonymous script (anonymous scripts aren't added to files select by default)
-            // 2) We are debugging synchronously executed inlined script and there is no resource so far
-            this._addOptionToFilesSelect(sourceFileId);
-        }
-        var sourceFrame = this._showSourceFrameAndAddToHistory(sourceFileId);
-        if (sourceFrame.loaded) {
-            sourceFrame.setExecutionLine(callFrame.sourceLocation.lineNumber);
+        function didGetSourceLocation(sourceFileId, lineNumber, columnNumber)
+        {
+            if (!sourceFileId)
+                return;
+
+            if (!(sourceFileId in this._sourceFileIdToFilesSelectOption)) {
+                // Anonymous scripts are not added to files select by default.
+                this._addOptionToFilesSelect(sourceFileId);
+            }
+            var sourceFrame = this._showSourceFrameAndAddToHistory(sourceFileId);
+            sourceFrame.setExecutionLine(lineNumber);
             this._executionSourceFrame = sourceFrame;
         }
+        callFrame.sourceLocation(didGetSourceLocation.bind(this));
     },
 
     _filesSelectChanged: function()
@@ -721,8 +672,10 @@ WebInspector.ScriptsPanel.prototype = {
 
     _setPauseOnExceptions: function(pauseOnExceptionsState)
     {
-        function callback(pauseOnExceptionsState)
+        function callback(error)
         {
+            if (error)
+                return;
             if (pauseOnExceptionsState == WebInspector.ScriptsPanel.PauseOnExceptionsState.DontPauseOnExceptions)
                 this._pauseOnExceptionButton.title = WebInspector.UIString("Don't pause on exceptions.\nClick to Pause on all exceptions.");
             else if (pauseOnExceptionsState == WebInspector.ScriptsPanel.PauseOnExceptionsState.PauseOnAllExceptions)
@@ -786,6 +739,11 @@ WebInspector.ScriptsPanel.prototype = {
     {
         this.sidebarPanes.callstack.update(null);
         this.sidebarPanes.scopechain.update(null);
+        this.sidebarPanes.jsBreakpoints.clearBreakpointHighlight();
+        if (Preferences.nativeInstrumentationEnabled) {
+            this.sidebarPanes.eventListenerBreakpoints.clearBreakpointHighlight();
+            this.sidebarPanes.xhrBreakpoints.clearBreakpointHighlight();
+        }
 
         this._clearCurrentExecutionLine();
         this._updateDebuggerButtons();
@@ -813,10 +771,10 @@ WebInspector.ScriptsPanel.prototype = {
         this._updateBackAndForwardButtons();
     },
 
-    _formatScript: function()
+    _toggleFormatSourceFiles: function()
     {
-        if (this.visibleView)
-            this.visibleView.formatSource();
+        this.reset();
+        this._presentationModel.toggleFormatSourceFiles();
     },
 
     _enableDebugging: function()
@@ -895,11 +853,11 @@ WebInspector.ScriptsPanel.prototype = {
     {
         this.toggleBreakpointsButton.toggled = !this.toggleBreakpointsButton.toggled;
         if (this.toggleBreakpointsButton.toggled) {
-            DebuggerAgent.activateBreakpoints();
+            DebuggerAgent.setBreakpointsActive(true);
             this.toggleBreakpointsButton.title = WebInspector.UIString("Deactivate all breakpoints.");
             document.getElementById("main-panels").removeStyleClass("breakpoints-deactivated");
         } else {
-            DebuggerAgent.deactivateBreakpoints();
+            DebuggerAgent.setBreakpointsActive(false);
             this.toggleBreakpointsButton.title = WebInspector.UIString("Activate all breakpoints.");
             document.getElementById("main-panels").addStyleClass("breakpoints-deactivated");
         }
@@ -1039,119 +997,22 @@ WebInspector.ScriptsPanel.prototype = {
 WebInspector.ScriptsPanel.prototype.__proto__ = WebInspector.Panel.prototype;
 
 
-WebInspector.SourceFrameDelegateForScriptsPanel = function(script)
+WebInspector.SourceFrameDelegateForScriptsPanel = function(model, sourceFileId)
 {
     WebInspector.SourceFrameDelegate.call(this);
-    this._script = script;
+    this._model = model;
+    this._sourceFileId = sourceFileId;
     this._popoverObjectGroup = "popover";
 }
 
 WebInspector.SourceFrameDelegateForScriptsPanel.prototype = {
     requestContent: function(callback)
     {
-        function didGetTextAndScriptRanges(mimeType, text, scriptRanges)
-        {
-            this._content = new WebInspector.SourceFrameContent(text, new WebInspector.IdenticalSourceMapping(), scriptRanges);
-            callback(mimeType, this._content);
-        }
-
-        if (this._script.resource)
-            this._loadResourceContent(this._script.resource, didGetTextAndScriptRanges.bind(this));
-        else
-            this._loadAndConcatenateScriptsContent(didGetTextAndScriptRanges.bind(this));
-    },
-
-    _loadResourceContent: function(resource, callback)
-    {
-        function didRequestContent(text)
+        function didRequestSourceFileContent(mimeType, text)
         {
-            var mimeType = "text/javascript";
-            if (resource.type !== WebInspector.Resource.Type.Script) {
-                mimeType = "text/html";
-                // WebKit html lexer normalizes line endings and scripts are passed to VM with "\n" line endings.
-                // However, resource content has original line endings, so we have to normalize line endings here.
-                text = text.replace(/\r\n/g, "\n");
-            }
-            var scripts = this._scripts();
-            var scriptRanges = WebInspector.ScriptFormatter.findScriptRanges(text.lineEndings(), scripts);
-            callback(mimeType, text, scriptRanges);
+            callback(mimeType, { text: text });
         }
-        resource.requestContent(didRequestContent.bind(this));
-    },
-
-    _loadAndConcatenateScriptsContent: function(callback)
-    {
-        var scripts = this._scripts();
-        var scriptsLeft = scripts.length;
-        var sources = [];
-        function didRequestSource(index, source)
-        {
-            sources[index] = source;
-            if (--scriptsLeft)
-                return;
-            var result = this._buildSource(scripts, sources);
-            callback(result.mimeType, result.source, result.scriptRanges);
-        }
-        for (var i = 0; i < scripts.length; ++i)
-            scripts[i].requestSource(didRequestSource.bind(this, i));
-    },
-
-    _buildSource: function(scripts, sources)
-    {
-        var source = "";
-        var lineNumber = 0;
-        var columnNumber = 0;
-        var scriptRanges = [];
-        function appendChunk(chunk, script)
-        {
-            var start = { lineNumber: lineNumber, columnNumber: columnNumber };
-            source += chunk;
-            var lineEndings = chunk.lineEndings();
-            var lineCount = lineEndings.length;
-            if (lineCount === 1)
-                columnNumber += chunk.length;
-            else {
-                lineNumber += lineCount - 1;
-                columnNumber = lineEndings[lineCount - 1] - lineEndings[lineCount - 2] - 1;
-            }
-            var end = { lineNumber: lineNumber, columnNumber: columnNumber };
-            if (script)
-                scriptRanges.push({ start: start, end: end, sourceID: script.sourceID });
-        }
-
-        var mimeType;
-        if (scripts.length === 1 && !scripts[0].lineOffset && !scripts[0].columnOffset) {
-            // Single script source.
-            mimeType = "text/javascript";
-            appendChunk(sources[0], scripts[0]);
-        } else {
-            // Scripts inlined in html document.
-            mimeType = "text/html";
-            var scriptOpenTag = "<script>";
-            var scriptCloseTag = "</script>";
-            for (var i = 0; i < scripts.length; ++i) {
-                // Fill the gap with whitespace characters.
-                while (lineNumber < scripts[i].lineOffset)
-                    appendChunk("\n");
-                while (columnNumber < scripts[i].columnOffset - scriptOpenTag.length)
-                    appendChunk(" ");
-
-                // Add script tag.
-                appendChunk(scriptOpenTag);
-                appendChunk(sources[i], scripts[i]);
-                appendChunk(scriptCloseTag);
-            }
-        }
-        return { mimeType: mimeType, source: source, scriptRanges: scriptRanges };
-    },
-
-    _scripts: function()
-    {
-        var scripts = [this._script];
-        if (this._script.sourceURL)
-            scripts = WebInspector.debuggerModel.scriptsForURL(this._script.sourceURL);
-        scripts.sort(function(x, y) { return x.lineOffset - y.lineOffset || x.columnOffset - y.columnOffset; });
-        return scripts;
+        this._model.requestSourceFileContent(this._sourceFileId, didRequestSourceFileContent.bind(this));
     },
 
     debuggingSupported: function()
@@ -1161,62 +1022,45 @@ WebInspector.SourceFrameDelegateForScriptsPanel.prototype = {
 
     setBreakpoint: function(lineNumber, condition, enabled)
     {
-        var location = this._content.sourceFrameLineNumberToActualLocation(lineNumber);
-        if (this._script.sourceURL)
-            WebInspector.debuggerModel.setBreakpoint(this._script.sourceURL, location.lineNumber, location.columnNumber, condition, enabled);
-        else if (location.sourceID)
-            WebInspector.debuggerModel.setBreakpointBySourceId(location.sourceID, location.lineNumber, location.columnNumber, condition, enabled);
-        else
-            return;
+        this._model.setBreakpoint(this._sourceFileId, lineNumber, condition, enabled);
 
         if (!WebInspector.panels.scripts.breakpointsActivated)
             WebInspector.panels.scripts.toggleBreakpointsClicked();
     },
 
-    removeBreakpoint: function(breakpointId)
+    updateBreakpoint: function(lineNumber, condition, enabled)
     {
-        WebInspector.debuggerModel.removeBreakpoint(breakpointId);
+        this._model.updateBreakpoint(this._sourceFileId, lineNumber, condition, enabled);
     },
 
-    updateBreakpoint: function(breakpointId, condition, enabled)
+    removeBreakpoint: function(lineNumber)
     {
-        WebInspector.debuggerModel.updateBreakpoint(breakpointId, condition, enabled);
+        this._model.removeBreakpoint(this._sourceFileId, lineNumber);
     },
 
     findBreakpoint: function(lineNumber)
     {
-        var url = this._script.sourceURL;
-        var location = this._content.sourceFrameLineNumberToActualLocation(lineNumber);
-        function filter(breakpoint)
-        {
-            if (breakpoint.url) {
-                if (breakpoint.url !== url)
-                    return false;
-            } else {
-                if (breakpoint.sourceID !== location.sourceID)
-                    return false;
-            }
-            var lineNumber = breakpoint.locations.length ? breakpoint.locations[0].lineNumber : breakpoint.lineNumber;
-            return lineNumber === location.lineNumber;
-        }
-        return WebInspector.debuggerModel.queryBreakpoints(filter)[0];
+        return this._model.findBreakpoint(this._sourceFileId, lineNumber);
     },
 
     continueToLine: function(lineNumber)
     {
-        var location = this._content.sourceFrameLineNumberToActualLocation(lineNumber);
-        if (location.sourceID)
-            WebInspector.debuggerModel.continueToLocation(location.sourceID, location.lineNumber, location.columnNumber);
+        this._model.continueToLine(this._sourceFileId, lineNumber);
     },
 
     canEditScriptSource: function()
     {
-        return Preferences.canEditScriptSource && !this._script.lineOffset && !this._script.columnOffset;
+        return this._model.canEditScriptSource(this._sourceFileId);
+    },
+
+    editScriptSource: function(text, callback)
+    {
+        this._model.editScriptSource(this._sourceFileId, text, callback);
     },
 
-    editScriptSource: function(text)
+    setScriptSourceIsBeingEdited: function(inEditMode)
     {
-        WebInspector.debuggerModel.editScriptSource(this._script.sourceID, text);
+        WebInspector.panels.scripts.setScriptSourceIsBeingEdited(this._sourceFileId, inEditMode);
     },
 
     debuggerPaused: function()
@@ -1226,17 +1070,12 @@ WebInspector.SourceFrameDelegateForScriptsPanel.prototype = {
 
     evaluateInSelectedCallFrame: function(string, callback)
     {
-        function didEvaluateInSelectedCallFrame(result)
-        {
-            if (!result.isError() && this.debuggerPaused())
-                callback(result);
-        }
-        WebInspector.panels.scripts.evaluateInSelectedCallFrame(string, this._popoverObjectGroup, false, didEvaluateInSelectedCallFrame.bind(this));
+        WebInspector.panels.scripts.evaluateInSelectedCallFrame(string, this._popoverObjectGroup, false, callback);
     },
 
     releaseEvaluationResult: function()
     {
-        RuntimeAgent.releaseObjectGroup(0, this._popoverObjectGroup);
+        RuntimeAgent.releaseObjectGroup(this._popoverObjectGroup);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/Section.js b/Source/WebCore/inspector/front-end/Section.js
index 5caa78b..623e537 100644
--- a/Source/WebCore/inspector/front-end/Section.js
+++ b/Source/WebCore/inspector/front-end/Section.js
@@ -45,7 +45,7 @@ WebInspector.Section = function(title, subtitle)
     this.headerElement.appendChild(this.subtitleElement);
     this.headerElement.appendChild(this.titleElement);
 
-    this.headerElement.addEventListener("click", this.toggleExpanded.bind(this), false);
+    this.headerElement.addEventListener("click", this.handleClick.bind(this), false);
     this.element.appendChild(this.headerElement);
 
     this.title = title;
@@ -168,5 +168,11 @@ WebInspector.Section.prototype = {
     toggleExpanded: function()
     {
         this.expanded = !this.expanded;
+    },
+
+    handleClick: function(e)
+    {
+        this.toggleExpanded();
+        e.stopPropagation();
     }
 }
diff --git a/Source/WebCore/inspector/front-end/Settings.js b/Source/WebCore/inspector/front-end/Settings.js
index 68b81a5..9995ca2 100644
--- a/Source/WebCore/inspector/front-end/Settings.js
+++ b/Source/WebCore/inspector/front-end/Settings.js
@@ -44,7 +44,6 @@ var Preferences = {
     profilerAlwaysEnabled: false,
     onlineDetectionEnabled: true,
     nativeInstrumentationEnabled: false,
-    resourceExportEnabled: false,
     useDataURLForResourceImageIcons: true,
     showTimingTab: false,
     showCookiesTab: false,
@@ -58,6 +57,7 @@ WebInspector.Settings = function()
     this.installApplicationSetting("colorFormat", "hex");
     this.installApplicationSetting("consoleHistory", []);
     this.installApplicationSetting("debuggerEnabled", false);
+    this.installApplicationSetting("domWordWrap", true);
     this.installApplicationSetting("profilerEnabled", false);
     this.installApplicationSetting("eventListenersFilter", "all");
     this.installApplicationSetting("lastActivePanel", "elements");
@@ -71,6 +71,8 @@ WebInspector.Settings = function()
     this.installApplicationSetting("showUserAgentStyles", true);
     this.installApplicationSetting("watchExpressions", []);
     this.installApplicationSetting("breakpoints", []);
+    this.installApplicationSetting("eventListenerBreakpoints", []);
+    this.installApplicationSetting("xhrBreakpoints", []);
 
     this.installProjectSetting("nativeBreakpoints", []);
 }
@@ -112,6 +114,9 @@ WebInspector.Settings.prototype = {
     findSettingForAllProjects: function(key)
     {
         var result = {};
+        if (window.localStorage == null)
+            return result;
+
         var regexp = "^" + key + ":(.*)";
         for (var i = 0; i < window.localStorage.length; ++i) {
             var fullKey =  window.localStorage.key(i);
@@ -129,7 +134,7 @@ WebInspector.Settings.prototype = {
 
     _get: function(key, defaultValue)
     {
-        if (key in window.localStorage) {
+        if (window.localStorage != null && key in window.localStorage) {
             try {
                 return JSON.parse(window.localStorage[key]);
             } catch(e) {
@@ -141,7 +146,8 @@ WebInspector.Settings.prototype = {
 
     _set: function(key, value)
     {
-        window.localStorage[key] = JSON.stringify(value);
+        if (window.localStorage != null)
+            window.localStorage[key] = JSON.stringify(value);
     },
 
     _getProjectSetting: function(key, defaultValue)
diff --git a/Source/WebCore/inspector/front-end/ShortcutsHelp.js b/Source/WebCore/inspector/front-end/ShortcutsHelp.js
index 004ed48..ab395c8 100644
--- a/Source/WebCore/inspector/front-end/ShortcutsHelp.js
+++ b/Source/WebCore/inspector/front-end/ShortcutsHelp.js
@@ -125,7 +125,7 @@ WebInspector.ShortcutsSection.prototype = {
         for (var line = 0; line < this._lines.length; ++line) {
             var tr = parent.createChild("tr");
             tr.createChild("td", "help-key-cell").innerHTML = this._lines[line].key + " : ";
-            tr.createChild("td").innerText = this._lines[line].text;
+            tr.createChild("td").textContent = this._lines[line].text;
         }
     },
 
@@ -134,7 +134,7 @@ WebInspector.ShortcutsSection.prototype = {
         var trHead = parent.createChild("tr");
  
         trHead.createChild("th");
-        trHead.createChild("th").innerText = this.name;
+        trHead.createChild("th").textContent = this.name;
     },
 
     _renderSequence: function(sequence, delimiter)
diff --git a/Source/WebCore/inspector/front-end/SourceFile.js b/Source/WebCore/inspector/front-end/SourceFile.js
new file mode 100644
index 0000000..4f56c00
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/SourceFile.js
@@ -0,0 +1,311 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.SourceFile = function(id, script, contentChangedDelegate)
+{
+    this._scripts = [script];
+    this._contentChangedDelegate = contentChangedDelegate;
+    if (script.sourceURL)
+        this._resource = WebInspector.networkManager.inflightResourceForURL(script.sourceURL) || WebInspector.resourceForURL(script.sourceURL);
+    this._requestContentCallbacks = [];
+
+    this.id = id;
+    this.url = script.sourceURL;
+    this.isExtensionScript = script.worldType === WebInspector.Script.WorldType.EXTENSIONS_WORLD;
+    this.messages = [];
+    this.breakpoints = {};
+
+    if (this._hasPendingResource())
+        this._resource.addEventListener("finished", this.reload.bind(this));
+}
+
+WebInspector.SourceFile.prototype = {
+    addScript: function(script)
+    {
+        this._scripts.push(script);
+    },
+
+    requestContent: function(callback)
+    {
+        if (this._contentLoaded) {
+            callback(this._mimeType, this._content);
+            return;
+        }
+
+        this._requestContentCallbacks.push(callback);
+        this._requestContent();
+    },
+
+    get content()
+    {
+        return this._content;
+    },
+
+    requestSourceMapping: function(callback)
+    {
+        if (!this._mapping)
+            this._mapping = new WebInspector.SourceMapping(this._scripts);
+        callback(this._mapping);
+    },
+
+    forceLoadContent: function(script)
+    {
+        if (!this._hasPendingResource())
+            return;
+
+        if (!this._concatenatedScripts)
+            this._concatenatedScripts = {};
+        if (this._concatenatedScripts[script.sourceID])
+            return;
+        for (var i = 0; i < this._scripts.length; ++i)
+            this._concatenatedScripts[this._scripts[i].sourceID] = true;
+
+        this.reload();
+
+        if (!this._contentRequested) {
+            this._contentRequested = true;
+            this._loadAndConcatenateScriptsContent();
+        }
+    },
+
+    reload: function()
+    {
+        if (this._contentLoaded) {
+            this._contentLoaded = false;
+            this._contentChangedDelegate();
+        } else if (this._contentRequested)
+            this._reloadContent = true;
+        else if (this._requestContentCallbacks.length)
+            this._requestContent();
+    },
+
+    _requestContent: function()
+    {
+        if (this._contentRequested)
+            return;
+
+        this._contentRequested = true;
+        if (this._resource && this._resource.finished)
+            this._loadResourceContent(this._resource);
+        else if (!this._resource)
+            this._loadScriptContent();
+        else if (this._concatenatedScripts)
+            this._loadAndConcatenateScriptsContent();
+        else
+            this._contentRequested = false;
+    },
+
+    _loadResourceContent: function(resource)
+    {
+        function didRequestContent(text)
+        {
+            if (resource.type === WebInspector.Resource.Type.Script)
+                this._didRequestContent("text/javascript", text);
+            else {
+                // WebKit html lexer normalizes line endings and scripts are passed to VM with "\n" line endings.
+                // However, resource content has original line endings, so we have to normalize line endings here.
+                this._didRequestContent("text/html", text.replace(/\r\n/g, "\n"));
+            }
+        }
+        resource.requestContent(didRequestContent.bind(this));
+    },
+
+    _loadScriptContent: function()
+    {
+        this._scripts[0].requestSource(this._didRequestContent.bind(this, "text/javascript"));
+    },
+
+    _loadAndConcatenateScriptsContent: function()
+    {
+        var scripts = this._scripts.slice();
+        scripts.sort(function(x, y) { return x.lineOffset - y.lineOffset || x.columnOffset - y.columnOffset; });
+        var sources = [];
+        function didRequestSource(source)
+        {
+            sources.push(source);
+            if (sources.length === scripts.length)
+                this._concatenateScriptsContent(scripts, sources);
+        }
+        for (var i = 0; i < scripts.length; ++i)
+            scripts[i].requestSource(didRequestSource.bind(this));
+    },
+
+    _concatenateScriptsContent: function(scripts, sources)
+    {
+        var content = "";
+        var lineNumber = 0;
+        var columnNumber = 0;
+        var scriptRanges = [];
+        function appendChunk(chunk, script)
+        {
+            var start = { lineNumber: lineNumber, columnNumber: columnNumber };
+            content += chunk;
+            var lineEndings = chunk.lineEndings();
+            var lineCount = lineEndings.length;
+            if (lineCount === 1)
+                columnNumber += chunk.length;
+            else {
+                lineNumber += lineCount - 1;
+                columnNumber = lineEndings[lineCount - 1] - lineEndings[lineCount - 2] - 1;
+            }
+            var end = { lineNumber: lineNumber, columnNumber: columnNumber };
+            if (script)
+                scriptRanges.push({ start: start, end: end, sourceID: script.sourceID });
+        }
+
+        var scriptOpenTag = "<script>";
+        var scriptCloseTag = "</script>";
+        for (var i = 0; i < scripts.length; ++i) {
+            // Fill the gap with whitespace characters.
+            while (lineNumber < scripts[i].lineOffset)
+                appendChunk("\n");
+            while (columnNumber < scripts[i].columnOffset - scriptOpenTag.length)
+                appendChunk(" ");
+
+            // Add script tag.
+            appendChunk(scriptOpenTag);
+            appendChunk(sources[i], scripts[i]);
+            appendChunk(scriptCloseTag);
+        }
+
+        this._didRequestContent("text/html", content);
+    },
+
+    _didRequestContent: function(mimeType, content)
+    {
+        this._contentLoaded = true;
+        this._contentRequested = false;
+        this._mimeType = mimeType;
+        this._content = content;
+
+        for (var i = 0; i < this._requestContentCallbacks.length; ++i)
+            this._requestContentCallbacks[i](mimeType, content);
+        this._requestContentCallbacks = [];
+
+        if (this._reloadContent)
+            this.reload();
+    },
+
+    _hasPendingResource: function()
+    {
+        return this._resource && !this._resource.finished;
+    }
+}
+
+WebInspector.FormattedSourceFile = function(sourceFileId, script, contentChangedDelegate, formatter)
+{
+    WebInspector.SourceFile.call(this, sourceFileId, script, contentChangedDelegate);
+    this._formatter = formatter;
+}
+
+WebInspector.FormattedSourceFile.prototype = {
+    requestSourceMapping: function(callback)
+    {
+        function didRequestContent()
+        {
+            callback(this._mapping);
+        }
+        this.requestContent(didRequestContent.bind(this));
+    },
+
+    _didRequestContent: function(mimeType, text)
+    {
+        function didFormatContent(formattedText, mapping)
+        {
+            this._mapping = new WebInspector.FormattedSourceMapping(this._scripts, text, formattedText, mapping);
+            WebInspector.SourceFile.prototype._didRequestContent.call(this, mimeType, formattedText);
+        }
+        this._formatter.formatContent(text, this._scripts, didFormatContent.bind(this));
+    }
+}
+
+WebInspector.FormattedSourceFile.prototype.__proto__ = WebInspector.SourceFile.prototype;
+
+WebInspector.SourceMapping = function(sortedScripts)
+{
+    this._sortedScripts = sortedScripts;
+}
+
+WebInspector.SourceMapping.prototype = {
+    scriptLocationToSourceLocation: function(lineNumber, columnNumber)
+    {
+        return { lineNumber: lineNumber, columnNumber: columnNumber };
+    },
+
+    sourceLocationToScriptLocation: function(lineNumber, columnNumber)
+    {
+        var closestScript = this._sortedScripts[0];
+        for (var i = 1; i < this._sortedScripts.length; ++i) {
+            script = this._sortedScripts[i];
+            if (script.lineOffset > lineNumber || (script.lineOffset === lineNumber && script.columnOffset > columnNumber))
+                break;
+            closestScript = script;
+        }
+        return { scriptId: closestScript.sourceID, lineNumber: lineNumber, columnNumber: columnNumber };
+    }
+}
+
+WebInspector.FormattedSourceMapping = function(sortedScripts, originalText, formattedText, mapping)
+{
+    WebInspector.SourceMapping.call(this, sortedScripts);
+    this._originalLineEndings = originalText.lineEndings();
+    this._formattedLineEndings = formattedText.lineEndings();
+    this._mapping = mapping;
+}
+
+WebInspector.FormattedSourceMapping.prototype = {
+    scriptLocationToSourceLocation: function(lineNumber, columnNumber)
+    {
+        var originalPosition = WebInspector.ScriptFormatter.locationToPosition(this._originalLineEndings, lineNumber, columnNumber);
+        var formattedPosition = this._convertPosition(this._mapping.original, this._mapping.formatted, originalPosition);
+        return WebInspector.ScriptFormatter.positionToLocation(this._formattedLineEndings, formattedPosition);
+    },
+
+    sourceLocationToScriptLocation: function(lineNumber, columnNumber)
+    {
+        var formattedPosition = WebInspector.ScriptFormatter.locationToPosition(this._formattedLineEndings, lineNumber, columnNumber);
+        var originalPosition = this._convertPosition(this._mapping.formatted, this._mapping.original, formattedPosition);
+        var originalLocation = WebInspector.ScriptFormatter.positionToLocation(this._originalLineEndings, originalPosition);
+        return WebInspector.SourceMapping.prototype.sourceLocationToScriptLocation.call(this, originalLocation.lineNumber, originalLocation.columnNumber);
+    },
+
+    _convertPosition: function(positions1, positions2, position)
+    {
+        var index = positions1.upperBound(position);
+        var range1 = positions1[index] - positions1[index - 1];
+        var range2 = positions2[index] - positions2[index - 1];
+        var position2 = positions2[index - 1];
+        if (range1)
+            position2 += Math.round((position - positions1[index - 1]) * range2 / range1);
+        return position2;
+    }
+}
+
+WebInspector.FormattedSourceMapping.prototype.__proto__ = WebInspector.SourceMapping.prototype;
diff --git a/Source/WebCore/inspector/front-end/SourceFrame.js b/Source/WebCore/inspector/front-end/SourceFrame.js
index 3120159..7482f34 100644
--- a/Source/WebCore/inspector/front-end/SourceFrame.js
+++ b/Source/WebCore/inspector/front-end/SourceFrame.js
@@ -46,6 +46,9 @@ WebInspector.SourceFrame = function(delegate, url)
     this._messages = [];
     this._rowMessages = {};
     this._messageBubbles = {};
+
+    this._registerShortcuts();
+    this.element.addEventListener("keydown", this._handleKeyDown.bind(this), false);
 }
 
 WebInspector.SourceFrame.Events = {
@@ -116,12 +119,9 @@ WebInspector.SourceFrame.prototype = {
 
     addMessage: function(msg)
     {
-        // Don't add the message if there is no message or valid line or if the msg isn't an error or warning.
-        if (!msg.message || msg.line <= 0 || !msg.isErrorOrWarning())
-            return;
         this._messages.push(msg);
         if (this._textViewer)
-            this._addMessageToSource(msg);
+            this.addMessageToSource(msg.line - 1, msg);
     },
 
     clearMessages: function()
@@ -173,6 +173,11 @@ WebInspector.SourceFrame.prototype = {
 
     _startEditing: function()
     {
+        if (this._originalTextModelContent === undefined) {
+            this._originalTextModelContent = this._textModel.text;
+            this._delegate.setScriptSourceIsBeingEdited(true);
+        }
+
         WebInspector.searchController.cancelSearch();
         this.clearMessages();
     },
@@ -196,9 +201,12 @@ WebInspector.SourceFrame.prototype = {
             element.addEventListener("contextmenu", this._contextMenu.bind(this), true);
             element.addEventListener("mousedown", this._mouseDown.bind(this), true);
             element.addEventListener("mousemove", this._mouseMove.bind(this), true);
-            element.addEventListener("dblclick", this._doubleClick.bind(this), true);
             element.addEventListener("scroll", this._scroll.bind(this), true);
         }
+
+        if (this._delegate.canEditScriptSource())
+            element.addEventListener("dblclick", this._doubleClick.bind(this), true);
+
         this.element.appendChild(element);
 
         this._textViewer.beginUpdates();
@@ -206,6 +214,9 @@ WebInspector.SourceFrame.prototype = {
         this._textViewer.mimeType = mimeType;
         this._setTextViewerDecorations();
 
+        if ("_executionLineNumber" in this)
+            this.setExecutionLine(this._executionLineNumber);
+
         if (this._lineNumberToReveal) {
             this.revealLine(this._lineNumberToReveal);
             delete this._lineNumberToReveal;
@@ -357,13 +368,16 @@ WebInspector.SourceFrame.prototype = {
     setExecutionLine: function(lineNumber)
     {
         this._executionLineNumber = lineNumber;
-        this._textViewer.addDecoration(lineNumber, "webkit-execution-line");
-        this._textViewer.revealLine(lineNumber);
+        if (this._textViewer) {
+            this._textViewer.addDecoration(lineNumber, "webkit-execution-line");
+            this._textViewer.revealLine(lineNumber);
+        }
     },
 
     clearExecutionLine: function()
     {
-        this._textViewer.removeDecoration(this._executionLineNumber, "webkit-execution-line");
+        if (this._textViewer)
+            this._textViewer.removeDecoration(this._executionLineNumber, "webkit-execution-line");
         delete this._executionLineNumber;
     },
 
@@ -398,26 +412,26 @@ WebInspector.SourceFrame.prototype = {
     {
         var length = this._messages.length;
         for (var i = 0; i < length; ++i)
-            this._addMessageToSource(this._messages[i]);
+            this.addMessageToSource(this._messages[i].line - 1, this._messages[i]);
     },
 
-    _addMessageToSource: function(msg)
+    addMessageToSource: function(lineNumber, msg)
     {
-        if (msg.line > this._textModel.linesCount)
+        if (lineNumber >= this._textModel.linesCount)
             return;
 
-        var messageBubbleElement = this._messageBubbles[msg.line];
+        var messageBubbleElement = this._messageBubbles[lineNumber];
         if (!messageBubbleElement || messageBubbleElement.nodeType !== Node.ELEMENT_NODE || !messageBubbleElement.hasStyleClass("webkit-html-message-bubble")) {
             messageBubbleElement = document.createElement("div");
             messageBubbleElement.className = "webkit-html-message-bubble";
-            this._messageBubbles[msg.line] = messageBubbleElement;
-            this._textViewer.addDecoration(msg.line - 1, messageBubbleElement);
+            this._messageBubbles[lineNumber] = messageBubbleElement;
+            this._textViewer.addDecoration(lineNumber, messageBubbleElement);
         }
 
-        var rowMessages = this._rowMessages[msg.line];
+        var rowMessages = this._rowMessages[lineNumber];
         if (!rowMessages) {
             rowMessages = [];
-            this._rowMessages[msg.line] = rowMessages;
+            this._rowMessages[lineNumber] = rowMessages;
         }
 
         for (var i = 0; i < rowMessages.length; ++i) {
@@ -505,20 +519,20 @@ WebInspector.SourceFrame.prototype = {
             contextMenu.appendItem(WebInspector.UIString("Add Conditional Breakpoint…"), addConditionalBreakpoint.bind(this));
         } else {
             // This row has a breakpoint, we want to show edit and remove breakpoint, and either disable or enable.
-            contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), this._delegate.removeBreakpoint.bind(this._delegate, breakpoint.id));
+            contextMenu.appendItem(WebInspector.UIString("Remove Breakpoint"), this._delegate.removeBreakpoint.bind(this._delegate, lineNumber));
             function editBreakpointCondition()
             {
                 function didEditBreakpointCondition(committed, condition)
                 {
                     if (committed)
-                        this._delegate.updateBreakpoint(breakpoint.id, condition, breakpoint.enabled);
+                        this._delegate.updateBreakpoint(lineNumber, condition, breakpoint.enabled);
                 }
                 this._editBreakpointCondition(lineNumber, breakpoint.condition, didEditBreakpointCondition.bind(this));
             }
             contextMenu.appendItem(WebInspector.UIString("Edit Breakpoint…"), editBreakpointCondition.bind(this));
             function setBreakpointEnabled(enabled)
             {
-                this._delegate.updateBreakpoint(breakpoint.id, breakpoint.condition, enabled);
+                this._delegate.updateBreakpoint(lineNumber, breakpoint.condition, enabled);
             }
             if (breakpoint.enabled)
                 contextMenu.appendItem(WebInspector.UIString("Disable Breakpoint"), setBreakpointEnabled.bind(this, false));
@@ -547,9 +561,9 @@ WebInspector.SourceFrame.prototype = {
         var breakpoint = this._delegate.findBreakpoint(lineNumber);
         if (breakpoint) {
             if (event.shiftKey)
-                this._delegate.updateBreakpoint(breakpoint.id, breakpoint.condition, !breakpoint.enabled);
+                this._delegate.updateBreakpoint(lineNumber, breakpoint.condition, !breakpoint.enabled);
             else
-                this._delegate.removeBreakpoint(breakpoint.id);
+                this._delegate.removeBreakpoint(lineNumber);
         } else
             this._delegate.setBreakpoint(lineNumber, "", true);
         event.preventDefault();
@@ -648,6 +662,9 @@ WebInspector.SourceFrame.prototype = {
 
     _showPopup: function(element)
     {
+        if (!this._delegate.debuggerPaused())
+            return;
+
         function killHidePopupTimer()
         {
             if (this._hidePopupTimer) {
@@ -662,6 +679,9 @@ WebInspector.SourceFrame.prototype = {
 
         function showObjectPopup(result)
         {
+            if (result.isError() || !this._delegate.debuggerPaused())
+                return;
+
             var popupContentElement = null;
             if (result.type !== "object" && result.type !== "node" && result.type !== "array") {
                 popupContentElement = document.createElement("span");
@@ -763,6 +783,71 @@ WebInspector.SourceFrame.prototype = {
         formatter.formatContent(this._content, didFormat.bind(this))
     },
 
+    _registerShortcuts: function()
+    {
+        this._shortcuts = {};
+        var handleSaveCallback = this._handleSave.bind(this);
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey("s", WebInspector.KeyboardShortcut.Modifiers.CtrlOrMeta)] = handleSaveCallback;
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.Keys.Enter.code, WebInspector.KeyboardShortcut.Modifiers.CtrlOrMeta)] = handleSaveCallback;
+        this._shortcuts[WebInspector.KeyboardShortcut.makeKey(WebInspector.KeyboardShortcut.Keys.Esc.code)] = this._handleRevertEditing.bind(this);
+    },
+
+    _handleKeyDown: function(e)
+    {
+        var shortcutKey = WebInspector.KeyboardShortcut.makeKeyFromEvent(e);
+        var handler = this._shortcuts[shortcutKey];
+        if (handler && handler.call(this)) {
+            e.preventDefault();
+            e.stopPropagation();
+        }
+    },
+
+    _handleSave: function()
+    {
+        if (this._textViewer.readOnly || !this._delegate.canEditScriptSource())
+            return false;
+
+        if (this._originalTextModelContent === undefined) {
+            // No editing was actually done.
+            this._textViewer.readOnly = true;
+            this._delegate.setScriptSourceIsBeingEdited(false);
+            return true;
+        }
+
+        var originalTextModelContent = this._originalTextModelContent;
+        var newSource = this._textModel.text;
+
+        delete this._originalTextModelContent;
+        this._textViewer.readOnly = true;
+        this._delegate.setScriptSourceIsBeingEdited(false);
+
+        function didEditScriptSource(success, newBodyOrErrorMessage)
+        {
+            if (!success && this._originalTextModelContent === undefined && this._textModel.text === newSource) {
+                this._originalTextModelContent = originalTextModelContent;
+                this._textViewer.readOnly = false;
+                this._delegate.setScriptSourceIsBeingEdited(true);
+                WebInspector.log(newBodyOrErrorMessage, WebInspector.ConsoleMessage.MessageLevel.Error);
+                WebInspector.showConsole();
+            }
+        }
+        this._delegate.editScriptSource(newSource, didEditScriptSource.bind(this));
+        return true;
+    },
+
+    _handleRevertEditing: function()
+    {
+        if (this._textViewer.readOnly)
+            return false;
+
+        if (this._originalTextModelContent !== undefined)
+            this._textModel.setText(null, this._originalTextModelContent);
+        delete this._originalTextModelContent;
+        this._textViewer.readOnly = true;
+        this._delegate.setScriptSourceIsBeingEdited(false);
+        return true;
+    },
+
     _doubleClick: function(event)
     {
         if (!this._delegate.canEditScriptSource())
@@ -772,20 +857,10 @@ WebInspector.SourceFrame.prototype = {
         if (!lineRow)
             return;  // Do not trigger editing from line numbers.
 
-        this._textViewer.editLine(lineRow, this._didEditLine.bind(this, lineRow.lineNumber));
-    },
-
-    _didEditLine: function(lineNumber, newContent)
-    {
-        var lines = [];
-        var oldLines = this._content.text.split('\n');
-        for (var i = 0; i < oldLines.length; ++i) {
-            if (i === lineNumber)
-                lines.push(newContent);
-            else
-                lines.push(oldLines[i]);
+        if (this._textViewer.readOnly) {
+            this._textViewer.readOnly = false;
+            window.getSelection().collapseToStart();
         }
-        this._delegate.editScriptSource(lines.join("\n"));
     }
 }
 
@@ -812,12 +887,12 @@ WebInspector.SourceFrameDelegate.prototype = {
         // Should be implemented by subclasses.
     },
 
-    removeBreakpoint: function(breakpointId)
+    removeBreakpoint: function(lineNumber)
     {
         // Should be implemented by subclasses.
     },
 
-    updateBreakpoint: function(breakpointId, condition, enabled)
+    updateBreakpoint: function(lineNumber, condition, enabled)
     {
         // Should be implemented by subclasses.
     },
@@ -837,7 +912,12 @@ WebInspector.SourceFrameDelegate.prototype = {
         return false;
     },
 
-    editScriptSource: function(text)
+    editScriptSource: function(text, callback)
+    {
+        // Should be implemented by subclasses.
+    },
+
+    setScriptSourceIsBeingEdited: function(inEditMode)
     {
         // Should be implemented by subclasses.
     },
diff --git a/Source/WebCore/inspector/front-end/SourceFrameContent.js b/Source/WebCore/inspector/front-end/SourceFrameContent.js
index 91b397b..3f3a8e9 100644
--- a/Source/WebCore/inspector/front-end/SourceFrameContent.js
+++ b/Source/WebCore/inspector/front-end/SourceFrameContent.js
@@ -48,18 +48,7 @@ WebInspector.SourceFrameContent.prototype = {
 
     sourceFrameLineNumberToActualLocation: function(lineNumber)
     {
-        // Script content may start right after <script> tag without new line (e.g. "<script>function f()...").
-        // In that case, column number should be equal to script column offset.
-        var columnNumber = 0;
-        for (var i = 0; i < this._scriptRanges.length; ++i) {
-            var scriptRange = this._scriptRanges[i];
-            if (scriptRange.start.lineNumber < lineNumber)
-                continue;
-            if (scriptRange.start.lineNumber === lineNumber)
-                columnNumber = scriptRange.start.columnNumber;
-            break;
-        }
-        var location = this._mapping.sourceLocationToActualLocation(lineNumber, columnNumber);
+        var location = this._mapping.sourceLocationToActualLocation(lineNumber, 0);
         location.sourceID = this._sourceIDForSourceFrameLineNumber(lineNumber);
         return location;
     },
diff --git a/Source/WebCore/inspector/front-end/StylesSidebarPane.js b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
index c7d151a..29d0317 100644
--- a/Source/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -132,10 +132,10 @@ WebInspector.StylesSidebarPane.prototype = {
         if (!forceUpdate && (!node || node === this.node))
             refresh = true;
 
-        if (node && node.nodeType === Node.TEXT_NODE && node.parentNode)
+        if (node && node.nodeType() === Node.TEXT_NODE && node.parentNode)
             node = node.parentNode;
 
-        if (node && node.nodeType !== Node.ELEMENT_NODE)
+        if (node && node.nodeType() !== Node.ELEMENT_NODE)
             node = null;
 
         if (node)
@@ -244,7 +244,7 @@ WebInspector.StylesSidebarPane.prototype = {
         var styleAttributes = {};
         for (var name in styles.styleAttributes) {
             var attrStyle = { style: styles.styleAttributes[name], editable: false };
-            attrStyle.selectorText = WebInspector.panels.elements.treeOutline.nodeNameToCorrectCase(node.nodeName) + "[" + name;
+            attrStyle.selectorText = WebInspector.panels.elements.treeOutline.nodeNameToCorrectCase(node.nodeName()) + "[" + name;
             if (node.getAttribute(name))
                 attrStyle.selectorText += "=" + node.getAttribute(name);
             attrStyle.selectorText += "]";
@@ -252,7 +252,7 @@ WebInspector.StylesSidebarPane.prototype = {
         }
 
         // Show element's Style Attributes
-        if (styles.inlineStyle && node.nodeType === Node.ELEMENT_NODE) {
+        if (styles.inlineStyle && node.nodeType() === Node.ELEMENT_NODE) {
             var inlineStyle = { selectorText: "element.style", style: styles.inlineStyle, isAttribute: true };
             styleRules.push(inlineStyle);
         }
@@ -1964,6 +1964,9 @@ WebInspector.StylesSidebarPane.CSSPropertyPrompt.prototype = {
     _buildPropertyCompletions: function(wordRange, bestMatchOnly, completionsReadyCallback)
     {
         var prefix = wordRange.toString().toLowerCase();
+        if (!prefix && bestMatchOnly)
+            return;
+
         var results;
         if (bestMatchOnly) {
             results = [];
diff --git a/Source/WebCore/inspector/front-end/TextEditorHighlighter.js b/Source/WebCore/inspector/front-end/TextEditorHighlighter.js
index 9bdcc82..75453fa 100644
--- a/Source/WebCore/inspector/front-end/TextEditorHighlighter.js
+++ b/Source/WebCore/inspector/front-end/TextEditorHighlighter.js
@@ -35,17 +35,14 @@ WebInspector.TextEditorHighlighter = function(textModel, damageCallback)
     this._tokenizer = WebInspector.SourceTokenizer.Registry.getInstance().getTokenizer("text/html");
     this._damageCallback = damageCallback;
     this._highlightChunkLimit = 1000;
-    this.reset();
 }
 
 WebInspector.TextEditorHighlighter.prototype = {
     set mimeType(mimeType)
     {
         var tokenizer = WebInspector.SourceTokenizer.Registry.getInstance().getTokenizer(mimeType);
-        if (tokenizer) {
+        if (tokenizer)
             this._tokenizer = tokenizer;
-            this._tokenizerConditionStringified = JSON.stringify(this._tokenizer.initialCondition);
-        }
     },
 
     set highlightChunkLimit(highlightChunkLimit)
@@ -53,18 +50,14 @@ WebInspector.TextEditorHighlighter.prototype = {
         this._highlightChunkLimit = highlightChunkLimit;
     },
 
-    reset: function()
-    {
-        this._lastHighlightedLine = 0;
-        this._lastHighlightedColumn = 0;
-        this._tokenizerConditionStringified = JSON.stringify(this._tokenizer.initialCondition);
-    },
-
     highlight: function(endLine, opt_forceRun)
     {
         // First check if we have work to do.
-        if (endLine <= this._lastHighlightedLine)
+        var state = this._textModel.getAttribute(endLine - 1, "highlight");
+        if (state && state.postConditionStringified) {
+            // Last line is highlighted, just exit.
             return;
+        }
 
         this._requestedEndLine = endLine;
 
@@ -73,77 +66,63 @@ WebInspector.TextEditorHighlighter.prototype = {
             return;
         }
 
-        // Do small highlight synchronously. This will provide instant highlight on PageUp / PageDown, gentle scrolling.
-        this._highlightInChunks(endLine);
+        // We will be highlighting. First rewind to the last highlighted line to gain proper highlighter context.
+        var startLine = endLine;
+        while (startLine > 0) {
+            var state = this._textModel.getAttribute(startLine - 1, "highlight");
+            if (state && state.postConditionStringified)
+                break;
+            startLine--;
+        }
 
-        // Schedule tail highlight if necessary.
-        if (this._lastHighlightedLine < endLine)
-            this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, endLine), 100);
+        // Do small highlight synchronously. This will provide instant highlight on PageUp / PageDown, gentle scrolling.
+        this._highlightInChunks(startLine, endLine);
     },
 
     updateHighlight: function(startLine, endLine)
     {
-        if (this._lastHighlightedLine < startLine) {
-            // Highlighter did not reach this point yet, nothing to update. It will reach it on subsequent timer tick and do the job.
-            return false;
-        }
-
-        var savedLastHighlightedLine = this._lastHighlightedLine;
-        var savedLastHighlightedColumn = this._lastHighlightedColumn;
-        var savedTokenizerCondition = this._tokenizerConditionStringified;
-
-        this._lastHighlightedLine = startLine;
-        this._lastHighlightedColumn = 0;
-
-        // Restore highlighter context taken from the previous line.
-        var attributes = this._textModel.getAttribute(startLine - 1, "highlight") || {};
-        this._tokenizerConditionStringified = attributes.postConditionStringified || JSON.stringify(this._tokenizer.initialCondition);
-
-        // Try to update highlight synchronously.
-        this._highlightLines(endLine);
-
-        if (this._lastHighlightedLine >= this._textModel.linesCount) {
-            // All is done up to the end.
-            return true;
+        // Start line was edited, we should highlight everything until endLine.
+        this._clearHighlightState(startLine);
+
+        if (startLine) {
+            var state = this._textModel.getAttribute(startLine - 1, "highlight");
+            if (!state || !state.postConditionStringified) {
+                // Highlighter did not reach this point yet, nothing to update. It will reach it on subsequent timer tick and do the job.
+                return false;
+            }
         }
 
-        var attributes1 = this._textModel.getAttribute(this._lastHighlightedLine - 1, "highlight") || {};
-        var attributes2 = this._textModel.getAttribute(this._lastHighlightedLine, "highlight") || {};
-        if (this._lastHighlightedColumn === 0 && attributes2.preConditionStringified && attributes1.postConditionStringified === attributes2.preConditionStringified) {
-            // Highlighting ended ahead of time. Restore previously saved state, unless we have done more than it was before.
-            if (savedLastHighlightedLine >= this._lastHighlightedLine) {
-                this._lastHighlightedLine = savedLastHighlightedLine;
-                this._lastHighlightedColumn = savedLastHighlightedColumn;
-                this._tokenizerConditionStringified = savedTokenizerCondition;
-            }
-            return true;
-        } else {
-            // If failed to update highlight synchronously, invalidate highlight data for the subsequent lines.
-            if (this._lastHighlightedColumn === 0)
-                this._textModel.removeAttribute(this._lastHighlightedLine, "highlight");
-            for (var i = this._lastHighlightedLine + 1; i < this._textModel.linesCount; ++i)
+        var restored = this._highlightLines(startLine, endLine);
+        if (!restored) {
+            for (var i = this._lastHighlightedLine; i < this._textModel.linesCount; ++i) {
+                var state = this._textModel.getAttribute(i, "highlight");
+                if (!state && i > endLine)
+                    break;
+                this._textModel.setAttribute(i, "highlight-outdated", state);
                 this._textModel.removeAttribute(i, "highlight");
+            }
 
-            // Continue highlighting on subsequent timer ticks.
-            this._requestedEndLine = endLine;
-            if (!this._highlightTimer)
-                this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, endLine), 100);
-
-            return false;
+            if (this._highlightTimer) {
+                clearTimeout(this._highlightTimer);
+                this._requestedEndLine = endLine;
+                this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, this._lastHighlightedLine, this._requestedEndLine), 10);
+            }
         }
+        return restored;
     },
 
-    _highlightInChunks: function(endLine)
+    _highlightInChunks: function(startLine, endLine)
     {
         delete this._highlightTimer;
 
         // First we always check if we have work to do. Could be that user scrolled back and we can quit.
-        if (this._requestedEndLine <= this._lastHighlightedLine)
+        var state = this._textModel.getAttribute(this._requestedEndLine - 1, "highlight");
+        if (state && state.postConditionStringified)
             return;
 
         if (this._requestedEndLine !== endLine) {
             // User keeps updating the job in between of our timer ticks. Just reschedule self, don't eat CPU (they must be scrolling).
-            this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, this._requestedEndLine), 100);
+            this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, startLine, this._requestedEndLine), 100);
             return;
         }
 
@@ -151,58 +130,109 @@ WebInspector.TextEditorHighlighter.prototype = {
         if (this._requestedEndLine > this._textModel.linesCount)
             this._requestedEndLine = this._textModel.linesCount;
 
-        this._highlightLines(this._requestedEndLine);
+        this._highlightLines(startLine, this._requestedEndLine);
 
         // Schedule tail highlight if necessary.
         if (this._lastHighlightedLine < this._requestedEndLine)
-            this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, this._requestedEndLine), 10);
+            this._highlightTimer = setTimeout(this._highlightInChunks.bind(this, this._lastHighlightedLine, this._requestedEndLine), 10);
     },
 
-    _highlightLines: function(endLine)
+    _highlightLines: function(startLine, endLine)
     {
-        // Tokenizer is stateless and reused across viewers, restore its condition before highlight and save it after.
-        this._tokenizer.condition = JSON.parse(this._tokenizerConditionStringified);
-        var tokensCount = 0;
-        for (var lineNumber = this._lastHighlightedLine; lineNumber < endLine; ++lineNumber) {
-            var line = this._textModel.line(lineNumber);
-            this._tokenizer.line = line;
-
-            if (this._lastHighlightedColumn === 0) {
-                var attributes = {};
-                attributes.preConditionStringified = JSON.stringify(this._tokenizer.condition);
-                this._textModel.setAttribute(lineNumber, "highlight", attributes);
-            } else
-                var attributes = this._textModel.getAttribute(lineNumber, "highlight");
-
-            // Highlight line.
-            do {
-                var newColumn = this._tokenizer.nextToken(this._lastHighlightedColumn);
-                var tokenType = this._tokenizer.tokenType;
-                if (tokenType)
-                    attributes[this._lastHighlightedColumn] = { length: newColumn - this._lastHighlightedColumn, tokenType: tokenType };
-                this._lastHighlightedColumn = newColumn;
-                if (++tokensCount > this._highlightChunkLimit)
-                    break;
-            } while (this._lastHighlightedColumn < line.length);
+        // Restore highlighter context taken from previous line.
+        var state = this._textModel.getAttribute(startLine - 1, "highlight");
+        var postConditionStringified = state ? state.postConditionStringified : JSON.stringify(this._tokenizer.initialCondition);
 
-            if (this._lastHighlightedColumn < line.length) {
-                // Too much work for single chunk - exit.
-                break;
+        var tokensCount = 0;
+        for (var lineNumber = startLine; lineNumber < endLine; ++lineNumber) {
+            var state = this._selectHighlightState(lineNumber, postConditionStringified);
+            if (state.postConditionStringified) {
+                // This line is already highlighted.
+                postConditionStringified = state.postConditionStringified;
             } else {
-                this._lastHighlightedColumn = 0;
-                attributes.postConditionStringified = JSON.stringify(this._tokenizer.condition);
+                var lastHighlightedColumn = 0;
+                if (state.midConditionStringified) {
+                    lastHighlightedColumn = state.lastHighlightedColumn;
+                    postConditionStringified = state.midConditionStringified;
+                }
 
-                var nextAttributes = this._textModel.getAttribute(lineNumber + 1, "highlight") || {};
-                if (nextAttributes.preConditionStringified === attributes.postConditionStringified) {
-                    // Following lines are up to date, no need to re-highlight.
-                    ++lineNumber;
+                var line = this._textModel.line(lineNumber);
+                this._tokenizer.line = line;
+                this._tokenizer.condition = JSON.parse(postConditionStringified);
+
+                // Highlight line.
+                do {
+                    var newColumn = this._tokenizer.nextToken(lastHighlightedColumn);
+                    var tokenType = this._tokenizer.tokenType;
+                    if (tokenType)
+                        state[lastHighlightedColumn] = { length: newColumn - lastHighlightedColumn, tokenType: tokenType };
+                    lastHighlightedColumn = newColumn;
+                    if (++tokensCount > this._highlightChunkLimit)
+                        break;
+                } while (lastHighlightedColumn < line.length);
+
+                postConditionStringified = JSON.stringify(this._tokenizer.condition);
+
+                if (lastHighlightedColumn < line.length) {
+                    // Too much work for single chunk - exit.
+                    state.lastHighlightedColumn = lastHighlightedColumn;
+                    state.midConditionStringified = postConditionStringified;
                     break;
+                } else {
+                    delete state.lastHighlightedColumn;
+                    delete state.midConditionStringified;
+                    state.postConditionStringified = postConditionStringified;
+                }
+            }
+
+            var nextLineState = this._textModel.getAttribute(lineNumber + 1, "highlight");
+            if (nextLineState && nextLineState.preConditionStringified === state.postConditionStringified) {
+                // Following lines are up to date, no need re-highlight.
+                ++lineNumber;
+                this._damageCallback(startLine, lineNumber);
+
+                // Advance the "pointer" to the last highlighted line within the given chunk.
+                for (; lineNumber < endLine; ++lineNumber) {
+                    var state = this._textModel.getAttribute(lineNumber, "highlight");
+                    if (!state || !state.postConditionStringified)
+                        break;
                 }
+                this._lastHighlightedLine = lineNumber;
+                return true;
             }
         }
 
-        this._damageCallback(this._lastHighlightedLine, lineNumber);
-        this._tokenizerConditionStringified = JSON.stringify(this._tokenizer.condition);
+        this._damageCallback(startLine, lineNumber);
         this._lastHighlightedLine = lineNumber;
+        return false;
+    },
+
+    _selectHighlightState: function(lineNumber, preConditionStringified)
+    {
+        var state = this._textModel.getAttribute(lineNumber, "highlight");
+        if (state && state.preConditionStringified === preConditionStringified)
+            return state;
+
+        var outdatedState = this._textModel.getAttribute(lineNumber, "highlight-outdated");
+        if (outdatedState && outdatedState.preConditionStringified === preConditionStringified) {
+            // Swap states.
+            this._textModel.setAttribute(lineNumber, "highlight", outdatedState);
+            this._textModel.setAttribute(lineNumber, "highlight-outdated", state);
+            return outdatedState;
+        }
+
+        if (state)
+            this._textModel.setAttribute(lineNumber, "highlight-outdated", state);
+
+        state = {};
+        state.preConditionStringified = preConditionStringified;
+        this._textModel.setAttribute(lineNumber, "highlight", state);
+        return state;
+    },
+
+    _clearHighlightState: function(lineNumber)
+    {
+        this._textModel.removeAttribute(lineNumber, "highlight");
+        this._textModel.removeAttribute(lineNumber, "highlight-outdated");
     }
 }
diff --git a/Source/WebCore/inspector/front-end/TextEditorModel.js b/Source/WebCore/inspector/front-end/TextEditorModel.js
index f23ce76..b14a3b7 100644
--- a/Source/WebCore/inspector/front-end/TextEditorModel.js
+++ b/Source/WebCore/inspector/front-end/TextEditorModel.js
@@ -72,6 +72,11 @@ WebInspector.TextEditorModel.prototype = {
         return this._lines.length;
     },
 
+    get text()
+    {
+        return this._lines.join("\n");
+    },
+
     line: function(lineNumber)
     {
         if (lineNumber >= this._lines.length)
diff --git a/Source/WebCore/inspector/front-end/TextViewer.js b/Source/WebCore/inspector/front-end/TextViewer.js
index 65b4724..43b34f6 100644
--- a/Source/WebCore/inspector/front-end/TextViewer.js
+++ b/Source/WebCore/inspector/front-end/TextViewer.js
@@ -45,6 +45,11 @@ WebInspector.TextViewer = function(textModel, platform, url)
     this._gutterPanel = new WebInspector.TextEditorGutterPanel(this._textModel, syncDecorationsForLineListener);
     this.element.appendChild(this._mainPanel.element);
     this.element.appendChild(this._gutterPanel.element);
+
+    // Forward mouse wheel events from the unscrollable gutter to the main panel.
+    this._gutterPanel.element.addEventListener("mousewheel", function(e) {
+        this._mainPanel.element.dispatchEvent(e);
+    }.bind(this), false)
 }
 
 WebInspector.TextViewer.prototype = {
@@ -58,6 +63,11 @@ WebInspector.TextViewer.prototype = {
         this._mainPanel.readOnly = readOnly;
     },
 
+    get readOnly()
+    {
+        return this._mainPanel.readOnly;
+    },
+
     set startEditingListener(startEditingListener)
     {
         this._startEditingListener = startEditingListener;
@@ -111,11 +121,6 @@ WebInspector.TextViewer.prototype = {
         this._gutterPanel.freeCachedElements();
     },
 
-    editLine: function(lineRow, callback)
-    {
-        this._mainPanel.editLine(lineRow, callback);
-    },
-
     get scrollTop()
     {
         return this._mainPanel.element.scrollTop;
@@ -395,15 +400,19 @@ WebInspector.TextEditorChunkedPanel.prototype = {
         return this._textChunks[this._chunkNumberForLine(lineNumber)];
     },
 
-    _findVisibleChunks: function(visibleFrom, visibleTo)
+    _findFirstVisibleChunkNumber: function(visibleFrom)
     {
         function compareOffsetTops(value, chunk)
         {
             return value < chunk.offsetTop ? -1 : 1;
         }
         var insertBefore = insertionIndexForObjectInListSortedByFunction(visibleFrom, this._textChunks, compareOffsetTops);
+        return insertBefore - 1;
+    },
 
-        var from = insertBefore - 1;
+    _findVisibleChunks: function(visibleFrom, visibleTo)
+    {
+        var from = this._findFirstVisibleChunkNumber(visibleFrom);
         for (var to = from + 1; to < this._textChunks.length; ++to) {
             if (this._textChunks[to].offsetTop >= visibleTo)
                 break;
@@ -411,6 +420,26 @@ WebInspector.TextEditorChunkedPanel.prototype = {
         return { start: from, end: to };
     },
 
+    _findFirstVisibleLineNumber: function(visibleFrom)
+    {
+        var chunk = this._textChunks[this._findFirstVisibleChunkNumber(visibleFrom)];
+        if (!chunk.expanded)
+            return chunk.startLine;
+
+        var lineNumbers = [];
+        for (var i = 0; i < chunk.linesCount; ++i) {
+            lineNumbers.push(chunk.startLine + i);
+        }
+
+        function compareLineRowOffsetTops(value, lineNumber)
+        {
+            var lineRow = chunk.getExpandedLineRow(lineNumber);
+            return value < lineRow.offsetTop ? -1 : 1;
+        }
+        var insertBefore = insertionIndexForObjectInListSortedByFunction(visibleFrom, lineNumbers, compareLineRowOffsetTops);
+        return lineNumbers[insertBefore - 1];
+    },
+
     _repaintAll: function()
     {
         delete this._repaintAllTimer;
@@ -430,6 +459,17 @@ WebInspector.TextEditorChunkedPanel.prototype = {
         }
     },
 
+    _expandChunks: function(fromIndex, toIndex)
+    {
+        // First collapse chunks to collect the DOM elements into a cache to reuse them later.
+        for (var i = 0; i < fromIndex; ++i)
+            this._textChunks[i].expanded = false;
+        for (var i = toIndex; i < this._textChunks.length; ++i)
+            this._textChunks[i].expanded = false;
+        for (var i = fromIndex; i < toIndex; ++i)
+            this._textChunks[i].expanded = true;
+    },
+
     _totalHeight: function(firstElement, lastElement)
     {
         lastElement = (lastElement || firstElement).nextElementSibling;
@@ -484,12 +524,6 @@ WebInspector.TextEditorGutterPanel.prototype = {
         return new WebInspector.TextEditorGutterChunk(this, startLine, endLine);
     },
 
-    _expandChunks: function(fromIndex, toIndex)
-    {
-        for (var i = 0; i < this._textChunks.length; ++i)
-            this._textChunks[i].expanded = (fromIndex <= i && i < toIndex);
-    },
-
     textChanged: function(oldRange, newRange)
     {
         if (!this._textChunks) {
@@ -689,10 +723,6 @@ WebInspector.TextEditorMainPanel = function(textModel, url, syncScrollListener,
 
     this.element.addEventListener("scroll", this._scroll.bind(this), false);
 
-    // FIXME: Remove old live editing functionality and Preferences.sourceEditorEnabled flag.
-    if (!Preferences.sourceEditorEnabled)
-        this._container.addEventListener("keydown", this._handleKeyDown.bind(this), false);
-
     // In WebKit the DOMNodeRemoved event is fired AFTER the node is removed, thus it should be
     // attached to all DOM nodes that we want to track. Instead, we attach the DOMNodeRemoved
     // listeners only on the line rows, and use DOMSubtreeModified to track node removals inside
@@ -714,10 +744,6 @@ WebInspector.TextEditorMainPanel.prototype = {
 
     set readOnly(readOnly)
     {
-        // FIXME: Remove the Preferences.sourceEditorEnabled flag.
-        if (!Preferences.sourceEditorEnabled)
-            return;
-
         this.beginDomUpdates();
         this._readOnly = readOnly;
         if (this._readOnly)
@@ -727,6 +753,11 @@ WebInspector.TextEditorMainPanel.prototype = {
         this.endDomUpdates();
     },
 
+    get readOnly()
+    {
+        return this._readOnly;
+    },
+
     markAndRevealRange: function(range)
     {
         if (this._rangeToMark) {
@@ -768,58 +799,8 @@ WebInspector.TextEditorMainPanel.prototype = {
         this._cachedRows = [];
     },
 
-    _handleKeyDown: function()
-    {
-        if (this._editingLine || event.metaKey || event.shiftKey || event.ctrlKey || event.altKey)
-            return;
-
-        var scrollValue = 0;
-        if (event.keyCode === WebInspector.KeyboardShortcut.Keys.Up.code)
-            scrollValue = -1;
-        else if (event.keyCode == WebInspector.KeyboardShortcut.Keys.Down.code)
-            scrollValue = 1;
-
-        if (scrollValue) {
-            event.preventDefault();
-            event.stopPropagation();
-            this.element.scrollByLines(scrollValue);
-            return;
-        }
-
-        scrollValue = 0;
-        if (event.keyCode === WebInspector.KeyboardShortcut.Keys.Left.code)
-            scrollValue = -40;
-        else if (event.keyCode == WebInspector.KeyboardShortcut.Keys.Right.code)
-            scrollValue = 40;
-
-        if (scrollValue) {
-            event.preventDefault();
-            event.stopPropagation();
-            this.element.scrollLeft += scrollValue;
-        }
-    },
-
-    editLine: function(lineRow, callback)
-    {
-        var oldContent = lineRow.innerHTML;
-        function finishEditing(committed, e, newContent)
-        {
-            if (committed)
-                callback(newContent);
-            lineRow.innerHTML = oldContent;
-            delete this._editingLine;
-        }
-        this._editingLine = WebInspector.startEditing(lineRow, {
-            context: null,
-            commitHandler: finishEditing.bind(this, true),
-            cancelHandler: finishEditing.bind(this, false),
-            multiline: true
-        });
-    },
-
     _buildChunks: function()
     {
-        this._highlighter.reset();
         for (var i = 0; i < this._textModel.linesCount; ++i)
             this._textModel.removeAttribute(i, "highlight");
 
@@ -842,8 +823,8 @@ WebInspector.TextEditorMainPanel.prototype = {
         this._highlighter.highlight(lastVisibleLine);
         delete this._muteHighlightListener;
 
-        for (var i = 0; i < this._textChunks.length; ++i)
-            this._textChunks[i].expanded = (fromIndex <= i && i < toIndex);
+        this._restorePaintLinesOperationsCredit();
+        WebInspector.TextEditorChunkedPanel.prototype._expandChunks.call(this, fromIndex, toIndex);
 
         this._restoreSelection(selection);
     },
@@ -852,64 +833,118 @@ WebInspector.TextEditorMainPanel.prototype = {
     {
         if (this._muteHighlightListener)
             return;
+        this._restorePaintLinesOperationsCredit();
         this._paintLines(fromLine, toLine, true /*restoreSelection*/);
     },
 
-    _markSkippedPaintLines: function(startLine, endLine)
+    _schedulePaintLines: function(startLine, endLine)
     {
-        if (!this._skippedPaintLines)
-            this._skippedPaintLines = [ { startLine: startLine, endLine: endLine } ];
-        else {
-            for (var i = 0; i < this._skippedPaintLines.length; ++i) {
-                var chunk = this._skippedPaintLines[i];
+        if (startLine >= endLine)
+            return;
+
+        if (!this._scheduledPaintLines) {
+            this._scheduledPaintLines = [ { startLine: startLine, endLine: endLine } ];
+            this._paintScheduledLinesTimer = setTimeout(this._paintScheduledLines.bind(this), 10);
+        } else {
+            for (var i = 0; i < this._scheduledPaintLines.length; ++i) {
+                var chunk = this._scheduledPaintLines[i];
                 if (chunk.startLine <= endLine && chunk.endLine >= startLine) {
                     chunk.startLine = Math.min(chunk.startLine, startLine);
                     chunk.endLine = Math.max(chunk.endLine, endLine);
                     return;
                 }
+                if (chunk.startLine > endLine) {
+                    this._scheduledPaintLines.splice(i, 0, { startLine: startLine, endLine: endLine });
+                    return;
+                }
             }
-            this._skippedPaintLines.push({ startLine: startLine, endLine: endLine });
+            this._scheduledPaintLines.push({ startLine: startLine, endLine: endLine });
         }
     },
 
-    _paintSkippedLines: function()
+    _paintScheduledLines: function(skipRestoreSelection)
     {
-        if (!this._skippedPaintLines || this._dirtyLines)
+        if (this._paintScheduledLinesTimer)
+            clearTimeout(this._paintScheduledLinesTimer);
+        delete this._paintScheduledLinesTimer;
+
+        if (!this._scheduledPaintLines)
+            return;
+
+        // Reschedule the timer if we can not paint the lines yet, or the user is scrolling.
+        if (this._dirtyLines || this._repaintAllTimer) {
+            this._paintScheduledLinesTimer = setTimeout(this._paintScheduledLines.bind(this), 50);
             return;
-        for (var i = 0; i < this._skippedPaintLines.length; ++i) {
-            var chunk = this._skippedPaintLines[i];
-            this._paintLines(chunk.startLine, chunk.endLine);
         }
-        delete this._skippedPaintLines;
+
+        var scheduledPaintLines = this._scheduledPaintLines;
+        delete this._scheduledPaintLines;
+        
+        this._restorePaintLinesOperationsCredit();
+        this._paintLineChunks(scheduledPaintLines, !skipRestoreSelection);
+    },
+
+    _restorePaintLinesOperationsCredit: function()
+    {
+        this._paintLinesOperationsCredit = 250;
     },
 
     _paintLines: function(fromLine, toLine, restoreSelection)
     {
-        if (this._dirtyLines) {
-            this._markSkippedPaintLines(fromLine, toLine);
-            return;
-        }
+        this._paintLineChunks([ { startLine: fromLine, endLine: toLine } ], restoreSelection);
+    },
+
+    _paintLineChunks: function(lineChunks, restoreSelection)
+    {
+        // First, paint visible lines, so that in case of long lines we should start highlighting
+        // the visible area immediately, instead of waiting for the lines above the visible area.
+        var visibleFrom = this.element.scrollTop;
+        var firstVisibleLineNumber = this._findFirstVisibleLineNumber(visibleFrom);
 
+        var chunk;
         var selection;
-        var chunk = this.chunkForLine(fromLine);
-        for (var i = fromLine; i < toLine; ++i) {
-            if (i >= chunk.startLine + chunk.linesCount)
-                chunk = this.chunkForLine(i);
-            var lineRow = chunk.getExpandedLineRow(i);
-            if (!lineRow)
+        var invisibleLineRows = [];
+        for (var i = 0; i < lineChunks.length; ++i) {
+            var lineChunk = lineChunks[i];
+            if (this._dirtyLines || this._scheduledPaintLines) {
+                this._schedulePaintLines(lineChunk.startLine, lineChunk.endLine);
                 continue;
+            }
+            for (var lineNumber = lineChunk.startLine; lineNumber < lineChunk.endLine; ++lineNumber) {
+                if (!chunk || lineNumber < chunk.startLine || lineNumber >= chunk.startLine + chunk.linesCount)
+                    chunk = this.chunkForLine(lineNumber);
+                var lineRow = chunk.getExpandedLineRow(lineNumber);
+                if (!lineRow)
+                    continue;
+                if (lineNumber < firstVisibleLineNumber) {
+                    invisibleLineRows.push(lineRow);
+                    continue;
+                }
+                if (restoreSelection && !selection)
+                    selection = this._getSelection();
+                this._paintLine(lineRow);
+                if (this._paintLinesOperationsCredit < 0) {
+                    this._schedulePaintLines(lineNumber + 1, lineChunk.endLine);
+                    break;
+                }
+            }
+        }
+
+        for (var i = 0; i < invisibleLineRows.length; ++i) {
             if (restoreSelection && !selection)
                 selection = this._getSelection();
-            this._paintLine(lineRow, i);
+            this._paintLine(invisibleLineRows[i]);
         }
+
         if (restoreSelection)
             this._restoreSelection(selection);
     },
 
-    _paintLine: function(lineRow, lineNumber)
+    _paintLine: function(lineRow)
     {
-        if (this._dirtyLines) {
-            this._markSkippedPaintLines(lineNumber, lineNumber + 1);
+        var lineNumber = lineRow.lineNumber;
+        if (this._dirtyLines || this._scheduledPaintLines || this._paintLinesOperationsCredit < 0) {
+            this._schedulePaintLines(lineNumber, lineNumber + 1);
             return;
         }
 
@@ -944,13 +979,17 @@ WebInspector.TextEditorMainPanel.prototype = {
                     if (plainTextStart !== -1) {
                         this._appendTextNode(lineRow, line.substring(plainTextStart, j));
                         plainTextStart = -1;
+                        --this._paintLinesOperationsCredit;
                     }
                     this._appendSpan(lineRow, line.substring(j, j + attribute.length), attribute.tokenType);
                     j += attribute.length;
+                    --this._paintLinesOperationsCredit;
                 }
             }
-            if (plainTextStart !== -1)
+            if (plainTextStart !== -1) {
                 this._appendTextNode(lineRow, line.substring(plainTextStart, line.length));
+                --this._paintLinesOperationsCredit;
+            }
             if (this._rangeToMark && this._rangeToMark.startLine === lineNumber)
                 this._markedRangeElement = highlightSearchResult(lineRow, this._rangeToMark.startColumn, this._rangeToMark.endColumn - this._rangeToMark.startColumn);
             if (lineRow.decorationsElement)
@@ -1141,12 +1180,37 @@ WebInspector.TextEditorMainPanel.prototype = {
         if (this._readOnly)
             return;
 
-        var lineNumber = lineRow.lineNumber;
+        if (target === lineRow && e.type === "DOMNodeInserted") {
+            // Ensure that the newly inserted line row has no lineNumber.
+            delete lineRow.lineNumber;
+        }
+
+        var startLine = 0;
+        for (var row = lineRow; row; row = row.previousSibling) {
+            if (typeof row.lineNumber === "number") {
+                startLine = row.lineNumber;
+                break;
+            }
+        }
+
+        var endLine = startLine + 1;
+        for (var row = lineRow.nextSibling; row; row = row.nextSibling) {
+            if (typeof row.lineNumber === "number") {
+                endLine = row.lineNumber;
+                break;
+            }
+        }
+
+        if (target === lineRow && e.type === "DOMNodeRemoved") {
+            // Now this will no longer be valid.
+            delete lineRow.lineNumber;
+        }
+ 
         if (this._dirtyLines) {
-            this._dirtyLines.start = Math.min(this._dirtyLines.start, lineNumber);
-            this._dirtyLines.end = Math.max(this._dirtyLines.end, lineNumber + 1);
+            this._dirtyLines.start = Math.min(this._dirtyLines.start, startLine);
+            this._dirtyLines.end = Math.max(this._dirtyLines.end, endLine);
         } else {
-            this._dirtyLines = { start: lineNumber, end: lineNumber + 1 };
+            this._dirtyLines = { start: startLine, end: endLine };
             setTimeout(this._applyDomUpdates.bind(this), 0);
             // Remove marked ranges, if any.
             this.markAndRevealRange(null);
@@ -1227,7 +1291,7 @@ WebInspector.TextEditorMainPanel.prototype = {
         this._removeDecorationsInRange(oldRange);
         this._updateChunksForRanges(oldRange, newRange);
         this._updateHighlightsForRange(newRange);
-        this._paintSkippedLines();
+        this._paintScheduledLines(true);
         this.endDomUpdates();
 
         this._restoreSelection(selection);
@@ -1348,7 +1412,8 @@ WebInspector.TextEditorMainPanel.prototype = {
         var chunk = this._textChunks[result.end - 1];
         var lastVisibleLine = chunk.startLine + chunk.linesCount;
 
-        lastVisibleLine = Math.max(lastVisibleLine, range.endLine);
+        lastVisibleLine = Math.max(lastVisibleLine, range.endLine + 1);
+        lastVisibleLine = Math.min(lastVisibleLine, this._textModel.linesCount);
 
         var updated = this._highlighter.updateHighlight(range.startLine, lastVisibleLine);
         if (!updated) {
@@ -1479,7 +1544,7 @@ WebInspector.TextEditorMainChunk.prototype = {
 
         if (this.linesCount === 1) {
             if (expanded)
-                this._textViewer._paintLine(this.element, this.startLine);
+                this._textViewer._paintLine(this.element);
             return;
         }
 
@@ -1492,9 +1557,9 @@ WebInspector.TextEditorMainChunk.prototype = {
                 var lineRow = this._createRow(i);
                 parentElement.insertBefore(lineRow, this.element);
                 this._expandedLineRows.push(lineRow);
-                this._textViewer._paintLine(lineRow, i);
             }
             parentElement.removeChild(this.element);
+            this._textViewer._paintLines(this.startLine, this.startLine + this.linesCount);
         } else {
             var elementInserted = false;
             for (var i = 0; i < this._expandedLineRows.length; ++i) {
diff --git a/Source/WebCore/inspector/front-end/TimelineAgent.js b/Source/WebCore/inspector/front-end/TimelineAgent.js
index 97b8e42..5c5ca41 100644
--- a/Source/WebCore/inspector/front-end/TimelineAgent.js
+++ b/Source/WebCore/inspector/front-end/TimelineAgent.js
@@ -34,25 +34,30 @@ WebInspector.TimelineAgent = function() {
 
 // Must be kept in sync with TimelineItem.h
 WebInspector.TimelineAgent.RecordType = {
-    EventDispatch : 0,
-    Layout : 1,
-    RecalculateStyles : 2,
-    Paint : 3,
-    ParseHTML : 4,
-    TimerInstall : 5,
-    TimerRemove : 6,
-    TimerFire : 7,
-    XHRReadyStateChange : 8,
-    XHRLoad : 9,
-    EvaluateScript : 10,
-    MarkTimeline : 11,
-    ResourceSendRequest : 12,
-    ResourceReceiveResponse : 13,
-    ResourceFinish : 14,
-    FunctionCall : 15,
-    ResourceReceiveData: 16,
-    GCEvent : 17,
-    MarkDOMContentEventType : 18,
-    MarkLoadEventType : 19,
-    ScheduleResourceRequest : 20
+    EventDispatch: "EventDispatch",
+    Layout: "Layout",
+    RecalculateStyles: "RecalculateStyles",
+    Paint: "Paint",
+    ParseHTML: "ParseHTML",
+
+    TimerInstall: "TimerInstall",
+    TimerRemove: "TimerRemove",
+    TimerFire: "TimerFire",
+
+    XHRReadyStateChange: "XHRReadyStateChange",
+    XHRLoad: "XHRLoad",
+    EvaluateScript: "EvaluateScript",
+
+    MarkTimeline: "MarkTimeline",
+    MarkLoad: "MarkLoad",
+    MarkDOMContent: "MarkDOMContent",
+
+    ScheduleResourceRequest: "ScheduleResourceRequest",
+    ResourceSendRequest: "ResourceSendRequest",
+    ResourceReceiveResponse: "ResourceReceiveResponse",
+    ResourceReceivedData: "ResourceReceivedData",
+    ResourceFinish: "ResourceFinish",
+
+    FunctionCall: "FunctionCall",
+    GCEvent: "GCEvent"
 };
diff --git a/Source/WebCore/inspector/front-end/TimelinePanel.js b/Source/WebCore/inspector/front-end/TimelinePanel.js
index 62c5de0..2f30876 100644
--- a/Source/WebCore/inspector/front-end/TimelinePanel.js
+++ b/Source/WebCore/inspector/front-end/TimelinePanel.js
@@ -147,7 +147,7 @@ WebInspector.TimelinePanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.toggleFilterButton.element, this.toggleTimelineButton.element, this.clearButton.element, this._overviewPane.statusBarFilters];
+        return [this.toggleFilterButton.element, this.toggleTimelineButton.element, this.garbageCollectButton.element, this.clearButton.element, this._overviewPane.statusBarFilters];
     },
 
     get categories()
@@ -188,10 +188,10 @@ WebInspector.TimelinePanel.prototype = {
             recordStyles[recordTypes.ResourceReceiveResponse] = { title: WebInspector.UIString("Receive Response"), category: this.categories.loading };
             recordStyles[recordTypes.ResourceFinish] = { title: WebInspector.UIString("Finish Loading"), category: this.categories.loading };
             recordStyles[recordTypes.FunctionCall] = { title: WebInspector.UIString("Function Call"), category: this.categories.scripting };
-            recordStyles[recordTypes.ResourceReceiveData] = { title: WebInspector.UIString("Receive Data"), category: this.categories.loading };
+            recordStyles[recordTypes.ResourceReceivedData] = { title: WebInspector.UIString("Receive Data"), category: this.categories.loading };
             recordStyles[recordTypes.GCEvent] = { title: WebInspector.UIString("GC Event"), category: this.categories.scripting };
-            recordStyles[recordTypes.MarkDOMContentEventType] = { title: WebInspector.UIString("DOMContent event"), category: this.categories.scripting };
-            recordStyles[recordTypes.MarkLoadEventType] = { title: WebInspector.UIString("Load event"), category: this.categories.scripting };
+            recordStyles[recordTypes.MarkDOMContent] = { title: WebInspector.UIString("DOMContent event"), category: this.categories.scripting };
+            recordStyles[recordTypes.MarkLoad] = { title: WebInspector.UIString("Load event"), category: this.categories.scripting };
             recordStyles[recordTypes.ScheduleResourceRequest] = { title: WebInspector.UIString("Schedule Request"), category: this.categories.loading };
             this._recordStylesArray = recordStyles;
         }
@@ -209,6 +209,9 @@ WebInspector.TimelinePanel.prototype = {
         this.toggleFilterButton = new WebInspector.StatusBarButton(this._hideShortRecordsTitleText, "timeline-filter-status-bar-item");
         this.toggleFilterButton.addEventListener("click", this._toggleFilterButtonClicked.bind(this), false);
 
+        this.garbageCollectButton = new WebInspector.StatusBarButton(WebInspector.UIString("Collect Garbage"), "garbage-collect-status-bar-item");
+        this.garbageCollectButton.addEventListener("click", this._garbageCollectButtonClicked.bind(this), false);
+
         this.recordsCounter = document.createElement("span");
         this.recordsCounter.className = "timeline-records-counter";
     },
@@ -247,9 +250,9 @@ WebInspector.TimelinePanel.prototype = {
         eventDividerPadding.className = "resources-event-divider-padding";
         eventDividerPadding.title = record.title;
 
-        if (record.type === recordTypes.MarkDOMContentEventType)
+        if (record.type === recordTypes.MarkDOMContent)
             eventDivider.className += " resources-blue-divider";
-        else if (record.type === recordTypes.MarkLoadEventType)
+        else if (record.type === recordTypes.MarkLoad)
             eventDivider.className += " resources-red-divider";
         else if (record.type === recordTypes.MarkTimeline) {
             eventDivider.className += " resources-orange-divider";
@@ -284,6 +287,11 @@ WebInspector.TimelinePanel.prototype = {
         this.toggleFilterButton.element.title = this._calculator._showShortEvents ? this._hideShortRecordsTitleText : this._showShortRecordsTitleText;
         this._scheduleRefresh(true);
     },
+    
+    _garbageCollectButtonClicked: function()
+    {
+        ProfilerAgent.collectGarbage();
+    },
 
     _timelineProfilerWasStarted: function()
     {
@@ -317,7 +325,7 @@ WebInspector.TimelinePanel.prototype = {
         var parentRecord;
         if (record.type === recordTypes.ResourceReceiveResponse ||
             record.type === recordTypes.ResourceFinish ||
-            record.type === recordTypes.ResourceReceiveData)
+            record.type === recordTypes.ResourceReceivedData)
             parentRecord = this._sendRequestRecords[record.data.identifier];
         else if (record.type === recordTypes.TimerFire)
             parentRecord = this._timerRecords[record.data.timerId];
@@ -330,7 +338,7 @@ WebInspector.TimelinePanel.prototype = {
     {
         var connectedToOldRecord = false;
         var recordTypes = WebInspector.TimelineAgent.RecordType;
-        if (record.type === recordTypes.MarkDOMContentEventType || record.type === recordTypes.MarkLoadEventType)
+        if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad)
             parentRecord = null; // No bar entry for load events.
         else if (parentRecord === this._rootRecord) {
             var newParentRecord = this._findParentRecord(record);
@@ -352,7 +360,7 @@ WebInspector.TimelinePanel.prototype = {
 
         var formattedRecord = new WebInspector.TimelinePanel.FormattedRecord(record, parentRecord, this);
 
-        if (record.type === recordTypes.MarkDOMContentEventType || record.type === recordTypes.MarkLoadEventType) {
+        if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad) {
             this._markTimelineRecords.push(formattedRecord);
             return;
         }
@@ -649,17 +657,17 @@ WebInspector.TimelineDispatcher = function(timelinePanel)
 }
 
 WebInspector.TimelineDispatcher.prototype = {
-    timelineProfilerWasStarted: function()
+    started: function()
     {
         this._timelinePanel._timelineProfilerWasStarted();
     },
 
-    timelineProfilerWasStopped: function()
+    stopped: function()
     {
         this._timelinePanel._timelineProfilerWasStopped();
     },
 
-    addRecordToTimeline: function(record)
+    eventRecorded: function(record)
     {
         this._timelinePanel._addRecordToTimeline(record);
     }
@@ -853,7 +861,6 @@ WebInspector.TimelinePanel.FormattedRecord = function(record, parentRecord, pane
 {
     var recordTypes = WebInspector.TimelineAgent.RecordType;
     var style = panel._recordStyles[record.type];
-
     this.parent = parentRecord;
     if (parentRecord)
         parentRecord.children.push(this);
@@ -884,7 +891,7 @@ WebInspector.TimelinePanel.FormattedRecord = function(record, parentRecord, pane
             if (sendRequestRecord.parent !== panel._rootRecord && sendRequestRecord.parent.type === recordTypes.ScheduleResourceRequest)
                 sendRequestRecord.parent.details = this._getRecordDetails(sendRequestRecord, panel._sendRequestRecords);
         }
-    } else if (record.type === recordTypes.ResourceReceiveData) {
+    } else if (record.type === recordTypes.ResourceReceivedData) {
         var sendRequestRecord = panel._sendRequestRecords[record.data.identifier];
         if (sendRequestRecord) // False for main resource.
             record.data.url = sendRequestRecord.data.url;
@@ -968,7 +975,7 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
             case recordTypes.ScheduleResourceRequest:
             case recordTypes.ResourceSendRequest:
             case recordTypes.ResourceReceiveResponse:
-            case recordTypes.ResourceReceiveData:
+            case recordTypes.ResourceReceivedData:
             case recordTypes.ResourceFinish:
                 contentHelper._appendLinkRow(WebInspector.UIString("Resource"), this.data.url);
                 if (this.data.requestMethod)
@@ -977,8 +984,6 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
                     contentHelper._appendTextRow(WebInspector.UIString("Status Code"), this.data.statusCode);
                 if (this.data.mimeType)
                     contentHelper._appendTextRow(WebInspector.UIString("MIME Type"), this.data.mimeType);
-                if (typeof this.data.expectedContentLength === "number" && this.data.expectedContentLength !== -1)
-                    contentHelper._appendTextRow(WebInspector.UIString("Expected Content Length"), this.data.expectedContentLength);
                 break;
             case recordTypes.EvaluateScript:
                 if (this.data && this.data.url)
@@ -1035,7 +1040,7 @@ WebInspector.TimelinePanel.FormattedRecord.prototype = {
             case WebInspector.TimelineAgent.RecordType.XHRLoad:
             case WebInspector.TimelineAgent.RecordType.ScheduleResourceRequest:
             case WebInspector.TimelineAgent.RecordType.ResourceSendRequest:
-            case WebInspector.TimelineAgent.RecordType.ResourceReceiveData:
+            case WebInspector.TimelineAgent.RecordType.ResourceReceivedData:
             case WebInspector.TimelineAgent.RecordType.ResourceReceiveResponse:
             case WebInspector.TimelineAgent.RecordType.ResourceFinish:
                 return WebInspector.displayNameForURL(record.data.url);
diff --git a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
index bb3460d..23247fc 100644
--- a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -103,7 +103,7 @@ WebInspector.WatchExpressionsSection.prototype = {
             // last property, and then call the superclass's updateProperties() 
             // method to get all the properties refreshed at once.
             properties.push(property);
-            
+
             if (properties.length == propertyCount) {
                 this.updateProperties(properties, WebInspector.WatchExpressionTreeElement, WebInspector.WatchExpressionsSection.CompareProperties);
 
@@ -120,7 +120,7 @@ WebInspector.WatchExpressionsSection.prototype = {
         }
 
         // TODO: pass exact injected script id.
-        RuntimeAgent.releaseObjectGroup(0, this._watchObjectGroupId)
+        RuntimeAgent.releaseObjectGroup(this._watchObjectGroupId)
         var properties = [];
 
         // Count the properties, so we known when to call this.updateProperties()
diff --git a/Source/WebCore/inspector/front-end/WebKit.qrc b/Source/WebCore/inspector/front-end/WebKit.qrc
index 91d72d8..0777a19 100644
--- a/Source/WebCore/inspector/front-end/WebKit.qrc
+++ b/Source/WebCore/inspector/front-end/WebKit.qrc
@@ -32,6 +32,7 @@
     <file>DataGrid.js</file>
     <file>DebuggerModel.js</file>
     <file>DebuggerPresentationModel.js</file>
+    <file>SourceFile.js</file>
     <file>DOMAgent.js</file>
     <file>DOMStorage.js</file>
     <file>DOMStorageItemsView.js</file>
@@ -77,6 +78,7 @@
     <file>Resource.js</file>
     <file>ResourceCategory.js</file>
     <file>ResourceCookiesView.js</file>
+    <file>ResourceJSONView.js</file>
     <file>ResourceHeadersView.js</file>
     <file>ResourceTimingView.js</file>
     <file>ResourceTreeModel.js</file>
@@ -174,6 +176,7 @@
     <file>Images/focusButtonGlyph.png</file>
     <file>Images/forward.png</file>
     <file>Images/frame.png</file>
+    <file>Images/garbageCollectButtonGlyph.png</file>
     <file>Images/gearButtonGlyph.png</file>
     <file>Images/glossyHeader.png</file>
     <file>Images/glossyHeaderPressed.png</file>
@@ -285,6 +288,5 @@
     <file>Images/warningMediumIcon.png</file>
     <file>Images/warningOrangeDot.png</file>
     <file>Images/warningsErrors.png</file>
-    <file alias="DebuggerScript.js">../../bindings/v8/DebuggerScript.js</file>
 </qresource>
 </RCC>
diff --git a/Source/WebCore/inspector/front-end/WorkersSidebarPane.js b/Source/WebCore/inspector/front-end/WorkersSidebarPane.js
index efdb936..e70db44 100644
--- a/Source/WebCore/inspector/front-end/WorkersSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/WorkersSidebarPane.js
@@ -74,9 +74,9 @@ WebInspector.WorkersSidebarPane.prototype = {
 
     setInstrumentation: function(enabled)
     {
-        InspectorAgent.removeAllScriptsToEvaluateOnLoad();
+        PageAgent.removeAllScriptsToEvaluateOnLoad();
         if (enabled)
-            InspectorAgent.addScriptToEvaluateOnLoad("(" + InjectedFakeWorker + ")");
+            PageAgent.addScriptToEvaluateOnLoad("(" + InjectedFakeWorker + ")");
     },
 
     reset: function()
diff --git a/Source/WebCore/inspector/front-end/heapProfiler.css b/Source/WebCore/inspector/front-end/heapProfiler.css
index add02a1..ceeafca 100644
--- a/Source/WebCore/inspector/front-end/heapProfiler.css
+++ b/Source/WebCore/inspector/front-end/heapProfiler.css
@@ -207,6 +207,18 @@
     position: static;
 }
 
+.detailed-heapshot-view .console-formatted-string {
+    white-space: nowrap;
+}
+
+.detailed-heapshot-view .data-grid tr.selected * {
+    color: inherit;
+}
+
+.detailed-heapshot-view .data-grid:focus tr.selected * {
+    color: white;
+}
+
 .detailed-heapshot-view .delimiter {
     height: 24px;
     background-color: #d6dde5;
@@ -228,8 +240,15 @@
 }
 
 .detailed-heapshot-view .retaining-paths-view .title > span {
+    display: inline-block;
+    padding-top: 3px;
     vertical-align: middle;
     margin-left: 4px;
+    margin-right: 8px;
+}
+
+.detailed-heapshot-view .retaining-paths-to-windows {
+    
 }
 
 .heapshot-help-status-bar-item .glyph {
diff --git a/Source/WebCore/inspector/front-end/inspector.css b/Source/WebCore/inspector/front-end/inspector.css
index a7bd3b3..0311f22 100644
--- a/Source/WebCore/inspector/front-end/inspector.css
+++ b/Source/WebCore/inspector/front-end/inspector.css
@@ -872,6 +872,7 @@ body.platform-linux .monospace, body.platform-linux .source-code {
 
 .console-formatted-string, .console-formatted-regexp {
     color: rgb(196, 26, 22);
+    white-space: pre-wrap;
 }
 
 .console-formatted-null, .console-formatted-undefined {
@@ -1022,6 +1023,14 @@ body.platform-linux .monospace, body.platform-linux .source-code {
     bottom: 0;
 }
 
+#elements-content.nowrap {
+    white-space: nowrap;
+}
+
+#elements-content > ol {
+    display: inline-block;
+}
+
 #elements-sidebar {
     position: absolute;
     top: 0;
@@ -3926,6 +3935,10 @@ body.inactive li.selected .bubble.search-matches {
     background-color: rgb(66, 129, 235) !important;
 }
 
+.garbage-collect-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/garbageCollectButtonGlyph.png);
+}
+
 .timeline-records-counter, .storage-application-cache-status, .storage-application-cache-connectivity {
     font-size: 11px;
     text-shadow: white 0 1px 0;
@@ -4442,3 +4455,7 @@ a.worker-item:hover {
     font-weight: bold;
     z-index: 10000;
 }
+
+.resource-view.json {
+    padding: 5px;
+}
diff --git a/Source/WebCore/inspector/front-end/inspector.html b/Source/WebCore/inspector/front-end/inspector.html
index d6c810e..9ba1dca 100644
--- a/Source/WebCore/inspector/front-end/inspector.html
+++ b/Source/WebCore/inspector/front-end/inspector.html
@@ -122,6 +122,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ResourceHeadersView.js"></script>
     <script type="text/javascript" src="ResourceCookiesView.js"></script>
     <script type="text/javascript" src="ResourceTimingView.js"></script>
+    <script type="text/javascript" src="ResourceJSONView.js"></script>
     <script type="text/javascript" src="NetworkItemView.js"></script>
     <script type="text/javascript" src="ScriptFormatter.js"></script>
     <script type="text/javascript" src="DOMSyntaxHighlighter.js"></script>
@@ -146,6 +147,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="DetailedHeapshotView.js"></script>
     <script type="text/javascript" src="DebuggerModel.js"></script>
     <script type="text/javascript" src="DebuggerPresentationModel.js"></script>
+    <script type="text/javascript" src="SourceFile.js"></script>
     <script type="text/javascript" src="DOMAgent.js"></script>
     <script type="text/javascript" src="TimelineAgent.js"></script>
     <script type="text/javascript" src="TimelinePanel.js"></script>
diff --git a/Source/WebCore/inspector/front-end/inspector.js b/Source/WebCore/inspector/front-end/inspector.js
index b4c3fda..59171db 100644
--- a/Source/WebCore/inspector/front-end/inspector.js
+++ b/Source/WebCore/inspector/front-end/inspector.js
@@ -141,7 +141,7 @@ var WebInspector = {
     resetFocusElement: function()
     {
         this.currentFocusElement = null;
-        this._previousFocusElement = null;        
+        this._previousFocusElement = null;
     },
 
     get currentPanel()
@@ -182,17 +182,6 @@ var WebInspector = {
         return pane;
     },
 
-    createXHRBreakpointsSidebarPane: function()
-    {
-        var pane = new WebInspector.XHRBreakpointsSidebarPane();
-        function breakpointAdded(event)
-        {
-            pane.addBreakpointItem(new WebInspector.BreakpointItem(event.data));
-        }
-        WebInspector.breakpointManager.addEventListener(WebInspector.BreakpointManager.Events.XHRBreakpointAdded, breakpointAdded);
-        return pane;
-    },
-
     _createPanels: function()
     {
         var hiddenPanels = (InspectorFrontendHost.hiddenPanels() || "").split(',');
@@ -206,16 +195,8 @@ var WebInspector = {
             this.panels.scripts = new WebInspector.ScriptsPanel();
         if (hiddenPanels.indexOf("timeline") === -1)
             this.panels.timeline = new WebInspector.TimelinePanel();
-        if (hiddenPanels.indexOf("profiles") === -1) {
+        if (hiddenPanels.indexOf("profiles") === -1)
             this.panels.profiles = new WebInspector.ProfilesPanel();
-            this.panels.profiles.registerProfileType(new WebInspector.CPUProfileType());
-            if (Preferences.heapProfilerPresent) {
-                if (!Preferences.detailedHeapProfiles)
-                    this.panels.profiles.registerProfileType(new WebInspector.HeapSnapshotProfileType());
-                else
-                    this.panels.profiles.registerProfileType(new WebInspector.DetailedHeapshotProfileType());
-            }
-        }
         if (hiddenPanels.indexOf("audits") === -1)
             this.panels.audits = new WebInspector.AuditsPanel();
         if (hiddenPanels.indexOf("console") === -1)
@@ -247,7 +228,7 @@ var WebInspector = {
             dockToggleButton.title = WebInspector.UIString("Dock to main window.");
         }
 
-        // This may be called before onLoadedDone, hence the bulk of inspector objects may 
+        // This may be called before onLoadedDone, hence the bulk of inspector objects may
         // not be created yet.
         if (WebInspector.searchController)
             WebInspector.searchController.updateSearchLabel();
@@ -347,9 +328,9 @@ var WebInspector = {
 
         this._highlightedDOMNodeId = nodeId;
         if (nodeId)
-            InspectorAgent.highlightDOMNode(nodeId);
+            DOMAgent.highlightDOMNode(nodeId);
         else
-            InspectorAgent.hideDOMNodeHighlight();
+            DOMAgent.hideDOMNodeHighlight();
     },
 
     highlightDOMNodeForTwoSeconds: function(nodeId)
@@ -458,11 +439,12 @@ WebInspector.doLoadedDone = function()
     this.drawer = new WebInspector.Drawer();
     this.console = new WebInspector.ConsoleView(this.drawer);
     this.drawer.visibleView = this.console;
+    this.networkManager = new WebInspector.NetworkManager();
     this.resourceTreeModel = new WebInspector.ResourceTreeModel();
-    this.networkManager = new WebInspector.NetworkManager(this.resourceTreeModel);
     this.domAgent = new WebInspector.DOMAgent();
 
     InspectorBackend.registerDomainDispatcher("Inspector", this);
+    InspectorBackend.registerDomainDispatcher("Page", this);
 
     this.resourceCategories = {
         documents: new WebInspector.ResourceCategory("documents", WebInspector.UIString("Documents"), "rgb(47,102,236)"),
@@ -522,25 +504,16 @@ WebInspector.doLoadedDone = function()
 
     this.extensionServer.initExtensions();
 
-    function onPopulateScriptObjects()
-    {
-        if (!WebInspector.currentPanel)
-            WebInspector.showPanel(WebInspector.settings.lastActivePanel);
-    }
-    InspectorAgent.populateScriptObjects(onPopulateScriptObjects);
-
-    if (Preferences.debuggerAlwaysEnabled || WebInspector.settings.debuggerEnabled)
-        this.debuggerModel.enableDebugger();
-    if (Preferences.profilerAlwaysEnabled || WebInspector.settings.profilerEnabled)
-        InspectorAgent.enableProfiler();
     if (WebInspector.settings.monitoringXHREnabled)
         ConsoleAgent.setMonitoringXHREnabled(true);
+    ConsoleAgent.enable(this.console.setConsoleMessageExpiredCount.bind(this.console));
 
-    ConsoleAgent.setConsoleMessagesEnabled(true);
+    WebInspector.showPanel(WebInspector.settings.lastActivePanel);
 
-    function propertyNamesCallback(names)
+    function propertyNamesCallback(error, names)
     {
-        WebInspector.cssNameCompletions = new WebInspector.CSSCompletions(names);
+        if (!error)
+            WebInspector.cssNameCompletions = new WebInspector.CSSCompletions(names);
     }
     // As a DOMAgent method, this needs to happen after the frontend has loaded and the agent is available.
     CSSAgent.getSupportedCSSProperties(propertyNamesCallback);
@@ -702,7 +675,7 @@ WebInspector.openResource = function(resourceURL, inResourcesPanel)
         WebInspector.panels.resources.showResource(resource);
         WebInspector.showPanel("resources");
     } else
-        InspectorAgent.openInInspectedWindow(resource ? resource.url : resourceURL);
+        PageAgent.openInInspectedWindow(resource ? resource.url : resourceURL);
 }
 
 WebInspector._registerShortcuts = function()
@@ -826,13 +799,13 @@ WebInspector.documentKeyDown = function(event)
 
         case "U+0052": // R key
             if ((event.metaKey && isMac) || (event.ctrlKey && !isMac)) {
-                InspectorAgent.reloadPage(event.shiftKey);
+                PageAgent.reloadPage(event.shiftKey);
                 event.preventDefault();
             }
             break;
         case "F5":
             if (!isMac)
-                InspectorAgent.reloadPage(event.ctrlKey || event.shiftKey);
+                PageAgent.reloadPage(event.ctrlKey || event.shiftKey);
             break;
     }
 }
@@ -1013,6 +986,12 @@ WebInspector.showPanel = function(panel)
     this.currentPanel = this.panels[panel];
 }
 
+WebInspector.startUserInitiatedDebugging = function()
+{
+    this.currentPanel = this.panels.scripts;
+    WebInspector.debuggerModel.enableDebugger();
+}
+
 WebInspector.domContentEventFired = function(time)
 {
     this.panels.audits.mainResourceDOMContentTime = time;
@@ -1070,6 +1049,18 @@ WebInspector.inspectedURLChanged = function(url)
     this.extensionServer.notifyInspectedURLChanged();
 }
 
+WebInspector.didCreateWorker = function()
+{
+    var workersPane = WebInspector.panels.scripts.sidebarPanes.workers;
+    workersPane.addWorker.apply(workersPane, arguments);
+}
+
+WebInspector.didDestroyWorker = function()
+{
+    var workersPane = WebInspector.panels.scripts.sidebarPanes.workers;
+    workersPane.removeWorker.apply(workersPane, arguments);
+}
+
 WebInspector.log = function(message, messageLevel)
 {
     // remember 'this' for setInterval() callback
@@ -1185,13 +1176,16 @@ WebInspector.drawLoadingPieChart = function(canvas, percent) {
     g.fill();
 }
 
-WebInspector.inspect = function(objectId, hints)
+WebInspector.inspect = function(payload, hints)
 {
-    var object = WebInspector.RemoteObject.fromPayload(objectId);
+    var object = WebInspector.RemoteObject.fromPayload(payload);
     if (object.type === "node") {
         // Request node from backend and focus it.
-        object.pushNodeToFrontend(WebInspector.updateFocusedNode.bind(WebInspector));
-    } else if (hints.databaseId) {
+        object.pushNodeToFrontend(WebInspector.updateFocusedNode.bind(WebInspector), object.release.bind(object));
+        return;
+    }
+
+    if (hints.databaseId) {
         WebInspector.currentPanel = WebInspector.panels.resources;
         WebInspector.panels.resources.selectDatabase(hints.databaseId);
     } else if (hints.domStorageId) {
@@ -1199,7 +1193,7 @@ WebInspector.inspect = function(objectId, hints)
         WebInspector.panels.resources.selectDOMStorage(hints.domStorageId);
     }
 
-    RuntimeAgent.releaseObject(objectId);
+    object.release();
 }
 
 WebInspector.updateFocusedNode = function(nodeId)
@@ -1416,6 +1410,8 @@ WebInspector.addMainEventListeners = function(doc)
 WebInspector.frontendReused = function()
 {
     this.networkManager.frontendReused();
+    this.resourceTreeModel.frontendReused();
+    WebInspector.panels.network.clear();
     this.reset();
 }
 
@@ -1541,7 +1537,7 @@ WebInspector.startEditing = function(element, config)
         var isMetaOrCtrl = WebInspector.isMac() ?
             event.metaKey && !event.shiftKey && !event.ctrlKey && !event.altKey :
             event.ctrlKey && !event.shiftKey && !event.metaKey && !event.altKey;
-        if (isEnterKey(event) && (!config.multiline || isMetaOrCtrl))
+        if (isEnterKey(event) && (event.isMetaOrCtrlForTest || !config.multiline || isMetaOrCtrl))
             return "commit";
         else if (event.keyCode === WebInspector.KeyboardShortcut.Keys.Esc.code)
             return "cancel";
diff --git a/Source/WebCore/inspector/front-end/utilities.js b/Source/WebCore/inspector/front-end/utilities.js
index 31a5f0c..fbfdfbb 100644
--- a/Source/WebCore/inspector/front-end/utilities.js
+++ b/Source/WebCore/inspector/front-end/utilities.js
@@ -156,19 +156,7 @@ Node.prototype.rangeBoundaryForOffset = function(offset)
 
 Element.prototype.removeStyleClass = function(className) 
 {
-    // Test for the simple case first.
-    if (this.className === className) {
-        this.className = "";
-        return;
-    }
-
-    var index = this.className.indexOf(className);
-    if (index === -1)
-        return;
-
-    this.className = this.className.split(" ").filter(function(s) {
-        return s && s !== className;
-    }).join(" ");
+    this.classList.remove(className);
 }
 
 Element.prototype.removeMatchingStyleClasses = function(classNameRegex)
@@ -180,23 +168,12 @@ Element.prototype.removeMatchingStyleClasses = function(classNameRegex)
 
 Element.prototype.addStyleClass = function(className) 
 {
-    if (className && !this.hasStyleClass(className))
-        this.className += (this.className.length ? " " + className : className);
+    this.classList.add(className);
 }
 
 Element.prototype.hasStyleClass = function(className) 
 {
-    if (!className)
-        return false;
-    // Test for the simple case
-    if (this.className === className)
-        return true;
-
-    var index = this.className.indexOf(className);
-    if (index === -1)
-        return false;
-    var toTest = " " + this.className + " ";
-    return toTest.indexOf(" " + className + " ", index) !== -1;
+    return this.classList.contains(className);
 }
 
 Element.prototype.positionAt = function(x, y)
@@ -380,7 +357,6 @@ Node.prototype.isAncestor = function(node)
 Node.prototype.isDescendant = isDescendantNode;
 Node.prototype.traverseNextNode = traverseNextNode;
 Node.prototype.traversePreviousNode = traversePreviousNode;
-Node.prototype.onlyTextChild = onlyTextChild;
 
 String.prototype.hasSubstring = function(string, caseInsensitive)
 {
@@ -616,19 +592,6 @@ function traversePreviousNode(stayWithin)
     return this.parentNode;
 }
 
-function onlyTextChild()
-{
-    if (!this)
-        return null;
-
-    var firstChild = this.firstChild;
-    if (!firstChild || firstChild.nodeType !== Node.TEXT_NODE)
-        return null;
-
-    var sibling = firstChild.nextSibling;
-    return sibling ? null : firstChild;
-}
-
 function appropriateSelectorForNode(node, justSelector)
 {
     if (!node)
@@ -822,31 +785,44 @@ Array.convert = function(list)
     return Array.prototype.slice.call(list);
 }
 
-function insertionIndexForObjectInListSortedByFunction(anObject, aList, aFunction)
+function binarySearch(object, array, comparator)
 {
     var first = 0;
-    var last = aList.length - 1;
-    var floor = Math.floor;
-    var mid, c;
+    var last = array.length - 1;
 
     while (first <= last) {
-        mid = floor((first + last) / 2);
-        c = aFunction(anObject, aList[mid]);
-
+        var mid = (first + last) >> 1;
+        var c = comparator(object, array[mid]);
         if (c > 0)
             first = mid + 1;
         else if (c < 0)
             last = mid - 1;
-        else {
-            // Return the first occurance of an item in the list.
-            while (mid > 0 && aFunction(anObject, aList[mid - 1]) === 0)
-                mid--;
-            first = mid;
-            break;
-        }
+        else
+            return mid;
     }
 
-    return first;
+    // Return the nearest lesser index, "-1" means "0, "-2" means "1", etc.
+    return -(first + 1);
+}
+
+Object.defineProperty(Array.prototype, "binaryIndexOf", { value: function(value, comparator)
+{
+    var result = binarySearch(value, this, comparator);
+    return result >= 0 ? result : -1;
+}});
+
+function insertionIndexForObjectInListSortedByFunction(anObject, aList, aFunction)
+{
+    var index = binarySearch(anObject, aList, aFunction);
+    if (index < 0)
+        // See binarySearch implementation.
+        return -index - 1;
+    else {
+        // Return the first occurance of an item in the list.
+        while (index > 0 && aFunction(anObject, aList[index - 1]) === 0)
+            index--;
+        return index;        
+    }
 }
 
 String.sprintf = function(format)
diff --git a/Source/WebCore/inspector/generate-inspector-idl b/Source/WebCore/inspector/generate-inspector-idl
new file mode 100755
index 0000000..f2f0e35
--- /dev/null
+++ b/Source/WebCore/inspector/generate-inspector-idl
@@ -0,0 +1,125 @@
+#!/usr/bin/env python
+# Copyright (c) 2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import os.path
+import sys
+
+program_name = os.path.basename(__file__)
+if len(sys.argv) < 4 or sys.argv[1] != "-o":
+    sys.stderr.write("Usage: %s -o OUTPUT_FILE INPUT_FILE\n" % program_name)
+    exit(1)
+
+output_path = sys.argv[2]
+input_path = sys.argv[3]
+
+input_file = open(input_path, "r")
+json_string = input_file.read()
+json_string = json_string.replace(": true", ": True")
+json_string = json_string.replace(": false", ": false")
+json_api = eval(json_string)
+
+output_file = open(output_path, "w")
+output_file.write("""/*
+ * Copyright (C) 2011 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+module core {""")
+
+type_traits = {
+    "string": "String",
+    "integer": "int",
+    "number": "double",
+    "boolean": "boolean",
+    "array": "Array",
+    "object": "Object"
+}
+
+macro_traits = {
+    "Database": "DATABASE",
+    "DOMStorage": "DOM_STORAGE",
+    "ApplicationCache": "OFFLINE_WEB_APPLICATIONS",
+    "Debugger": "JAVASCRIPT_DEBUGGER",
+    "BrowserDebugger": "JAVASCRIPT_DEBUGGER",
+    "Profiler": "JAVASCRIPT_DEBUGGER"
+}
+
+def param_type(param):
+    if "type" in param:
+        return type_traits[param["type"]];
+    if "$ref" in param:
+        return "Object"
+
+for domain in json_api:
+    domain_name = domain["domain"]
+    if domain_name in macro_traits:
+        output_file.write("\n#if defined(ENABLE_%s) && ENABLE_%s" % (macro_traits[domain_name], macro_traits[domain_name]))
+    output_file.write("\n    interface [Conditional=INSPECTOR] %s {" % domain_name)
+    if "commands" in domain:
+        for command in domain["commands"]:
+            params = [];
+            if ("parameters" in command):
+                for in_param in command["parameters"]:
+                    params.append("in %s %s" % (param_type(in_param), in_param["name"]))
+            if ("returns" in command):
+                for out_param in command["returns"]:
+                    params.append("out %s %s" % (param_type(out_param), out_param["name"]))
+            output_file.write("\n        void %s(%s);" % (command["name"], ", ".join(params)))
+    if "events" in domain:
+        for event in domain["events"]:
+            params = [];
+            if ("parameters" in event):
+                for in_param in event["parameters"]:
+                    params.append("out %s %s" % (param_type(in_param), in_param["name"]))
+            output_file.write("\n        [event] void %s(%s);" % (event["name"], ", ".join(params)))
+    output_file.write("\n    };")
+    if domain["domain"] in macro_traits:
+        output_file.write("\n#endif // ENABLE_%s" % macro_traits[domain["domain"]])
+output_file.write("\n}\n")
+output_file.close()
diff --git a/Source/WebCore/inspector/xxd.pl b/Source/WebCore/inspector/xxd.pl
index 42cf4a2..5ee08a5 100644
--- a/Source/WebCore/inspector/xxd.pl
+++ b/Source/WebCore/inspector/xxd.pl
@@ -1,45 +1,45 @@
-#! /usr/bin/perl

-

-# Copyright (C) 2010 Google Inc. All rights reserved.

-#

-# Redistribution and use in source and binary forms, with or without

-# modification, are permitted provided that the following conditions are

-# met:

-#

-#    # Redistributions of source code must retain the above copyright

-# notice, this list of conditions and the following disclaimer.

-#    # Redistributions in binary form must reproduce the above

-# copyright notice, this list of conditions and the following disclaimer

-# in the documentation and/or other materials provided with the

-# distribution.

-#    # Neither the name of Google Inc. nor the names of its

-# contributors may be used to endorse or promote products derived from

-# this software without specific prior written permission.

-#

-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

-#

-

-$varname = shift;

-$fname = shift;

-$output = shift;

-

-open($input, '<', $fname) or die "Can't open file for read: $fname $!";

-$/ = undef;

-$text = <$input>;

-close($input);

-

-$text = join(', ', map('0x' . unpack("H*", $_), split(undef, $text)));

-

-open($output, '>', $output) or die "Can't open file for write: $output $!";

-print $output "unsigned char $varname\[\] = {\n$text\n};\n";

-close($output);

+#! /usr/bin/perl
+
+# Copyright (C) 2010-2011 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    # Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    # Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    # Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+$varname = shift;
+$fname = shift;
+$output = shift;
+
+open($input, '<', $fname) or die "Can't open file for read: $fname $!";
+$/ = undef;
+$text = <$input>;
+close($input);
+
+$text = join(', ', map('0x' . unpack("H*", $_), split(undef, $text)));
+
+open($output, '>', $output) or die "Can't open file for write: $output $!";
+print $output "const unsigned char $varname\[\] = {\n$text\n};\n";
+close($output);
diff --git a/Source/WebCore/loader/DocumentLoader.cpp b/Source/WebCore/loader/DocumentLoader.cpp
index e223765..121045b 100644
--- a/Source/WebCore/loader/DocumentLoader.cpp
+++ b/Source/WebCore/loader/DocumentLoader.cpp
@@ -112,6 +112,10 @@ FrameLoader* DocumentLoader::frameLoader() const
 DocumentLoader::~DocumentLoader()
 {
     ASSERT(!m_frame || frameLoader()->activeDocumentLoader() != this || !frameLoader()->isLoading());
+    if (m_iconLoadDecisionCallback)
+        m_iconLoadDecisionCallback->invalidate();
+    if (m_iconDataCallback)
+        m_iconDataCallback->invalidate();
 }
 
 PassRefPtr<SharedBuffer> DocumentLoader::mainResourceData() const
@@ -836,7 +840,41 @@ void DocumentLoader::transferLoadingResourcesFromPage(Page* oldPage)
 void DocumentLoader::iconLoadDecisionAvailable()
 {
     if (m_frame)
-        m_frame->loader()->iconLoadDecisionAvailable();
+        m_frame->loader()->iconLoadDecisionReceived(iconDatabase().synchronousLoadDecisionForIconURL(KURL(frameLoader()->iconURL()), this));
 }
 
+static void iconLoadDecisionCallback(IconLoadDecision decision, void* context)
+{
+    static_cast<DocumentLoader*>(context)->continueIconLoadWithDecision(decision);
+}
+
+void DocumentLoader::getIconLoadDecisionForIconURL(const String& urlString)
+{
+    if (m_iconLoadDecisionCallback)
+        m_iconLoadDecisionCallback->invalidate();
+    m_iconLoadDecisionCallback = IconLoadDecisionCallback::create(this, iconLoadDecisionCallback);
+    iconDatabase().loadDecisionForIconURL(urlString, m_iconLoadDecisionCallback);
+}
+
+void DocumentLoader::continueIconLoadWithDecision(IconLoadDecision decision)
+{
+    ASSERT(m_iconLoadDecisionCallback);
+    m_iconLoadDecisionCallback = 0;
+    if (m_frame)
+        m_frame->loader()->continueIconLoadWithDecision(decision);
+}
+
+static void iconDataCallback(SharedBuffer*, void*)
+{
+    // FIXME: Implement this once we know what parts of WebCore actually need the icon data returned.
 }
+
+void DocumentLoader::getIconDataForIconURL(const String& urlString)
+{   
+    if (m_iconDataCallback)
+        m_iconDataCallback->invalidate();
+    m_iconDataCallback = IconDataCallback::create(this, iconDataCallback);
+    iconDatabase().iconDataForIconURL(urlString, m_iconDataCallback);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/loader/DocumentLoader.h b/Source/WebCore/loader/DocumentLoader.h
index 8e9ab8f..1f88272 100644
--- a/Source/WebCore/loader/DocumentLoader.h
+++ b/Source/WebCore/loader/DocumentLoader.h
@@ -31,6 +31,7 @@
 
 #include "DocumentLoadTiming.h"
 #include "DocumentWriter.h"
+#include "IconDatabaseBase.h"
 #include "NavigationAction.h"
 #include "ResourceError.h"
 #include "ResourceRequest.h"
@@ -182,7 +183,7 @@ namespace WebCore {
         String clientRedirectDestinationForHistory() const { return urlForHistory(); }
         void setClientRedirectSourceForHistory(const String& clientedirectSourceForHistory) { m_clientRedirectSourceForHistory = clientedirectSourceForHistory; }
         
-        String serverRedirectSourceForHistory() const { return urlForHistory() == url() ? String() : urlForHistory(); } // null if no server redirect occurred.
+        String serverRedirectSourceForHistory() const { return urlForHistory() == url() ? String() : urlForHistory().string(); } // null if no server redirect occurred.
         String serverRedirectDestinationForHistory() const { return url(); }
 
         bool didCreateGlobalHistoryEntry() const { return m_didCreateGlobalHistoryEntry; }
@@ -193,8 +194,14 @@ namespace WebCore {
         bool startLoadingMainResource(unsigned long identifier);
         void cancelMainResourceLoad(const ResourceError&);
         
+        // Support iconDatabase in synchronous mode.
         void iconLoadDecisionAvailable();
         
+        // Support iconDatabase in asynchronous mode.
+        void continueIconLoadWithDecision(IconLoadDecision);
+        void getIconLoadDecisionForIconURL(const String&);
+        void getIconDataForIconURL(const String&);
+        
         bool isLoadingMainResource() const;
         bool isLoadingSubresources() const;
         bool isLoadingPlugIns() const;
@@ -326,6 +333,9 @@ namespace WebCore {
         bool m_didCreateGlobalHistoryEntry;
 
         DocumentLoadTiming m_documentLoadTiming;
+    
+        RefPtr<IconLoadDecisionCallback> m_iconLoadDecisionCallback;
+        RefPtr<IconDataCallback> m_iconDataCallback;
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         friend class ApplicationCacheHost;  // for substitute resource delivery
diff --git a/Source/WebCore/loader/DocumentThreadableLoader.cpp b/Source/WebCore/loader/DocumentThreadableLoader.cpp
index 732a84e..73c3e80 100644
--- a/Source/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/Source/WebCore/loader/DocumentThreadableLoader.cpp
@@ -51,27 +51,30 @@ namespace WebCore {
 void DocumentThreadableLoader::loadResourceSynchronously(Document* document, const ResourceRequest& request, ThreadableLoaderClient& client, const ThreadableLoaderOptions& options)
 {
     // The loader will be deleted as soon as this function exits.
-    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, &client, LoadSynchronously, request, options));
+    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, &client, LoadSynchronously, request, options, String()));
     ASSERT(loader->hasOneRef());
 }
 
-PassRefPtr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, const ThreadableLoaderOptions& options)
+PassRefPtr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, const ThreadableLoaderOptions& options, const String& optionalOutgoingReferrer)
 {
-    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, client, LoadAsynchronously, request, options));
+    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, client, LoadAsynchronously, request, options, optionalOutgoingReferrer));
     if (!loader->m_loader)
         loader = 0;
     return loader.release();
 }
 
-DocumentThreadableLoader::DocumentThreadableLoader(Document* document, ThreadableLoaderClient* client, BlockingBehavior blockingBehavior, const ResourceRequest& request, const ThreadableLoaderOptions& options)
+DocumentThreadableLoader::DocumentThreadableLoader(Document* document, ThreadableLoaderClient* client, BlockingBehavior blockingBehavior, const ResourceRequest& request, const ThreadableLoaderOptions& options, const String& optionalOutgoingReferrer)
     : m_client(client)
     , m_document(document)
     , m_options(options)
+    , m_optionalOutgoingReferrer(optionalOutgoingReferrer)
     , m_sameOriginRequest(document->securityOrigin()->canRequest(request.url()))
     , m_async(blockingBehavior == LoadAsynchronously)
 {
     ASSERT(document);
     ASSERT(client);
+    // Setting an outgoing referer is only supported in the async code path.
+    ASSERT(m_async || m_optionalOutgoingReferrer.isEmpty());
 
     if (m_sameOriginRequest || m_options.crossOriginRequestPolicy == AllowCrossOriginRequests) {
         loadRequest(request, DoSecurityCheck);
@@ -346,7 +349,8 @@ void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, Secur
 
         // Clear the loader so that any callbacks from SubresourceLoader::create will not have the old loader.
         m_loader = 0;
-        m_loader = resourceLoadScheduler()->scheduleSubresourceLoad(m_document->frame(), this, request, ResourceLoadPriorityMedium, securityCheck, sendLoadCallbacks, sniffContent);
+        m_loader = resourceLoadScheduler()->scheduleSubresourceLoad(m_document->frame(), this, request, ResourceLoadPriorityMedium, securityCheck, sendLoadCallbacks,
+                                                                    sniffContent, m_optionalOutgoingReferrer);
         return;
     }
     
diff --git a/Source/WebCore/loader/DocumentThreadableLoader.h b/Source/WebCore/loader/DocumentThreadableLoader.h
index 94884ce..c511306 100644
--- a/Source/WebCore/loader/DocumentThreadableLoader.h
+++ b/Source/WebCore/loader/DocumentThreadableLoader.h
@@ -39,6 +39,7 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
     class Document;
@@ -50,7 +51,7 @@ namespace WebCore {
         WTF_MAKE_FAST_ALLOCATED;
     public:
         static void loadResourceSynchronously(Document*, const ResourceRequest&, ThreadableLoaderClient&, const ThreadableLoaderOptions&);
-        static PassRefPtr<DocumentThreadableLoader> create(Document*, ThreadableLoaderClient*, const ResourceRequest&, const ThreadableLoaderOptions&);
+        static PassRefPtr<DocumentThreadableLoader> create(Document*, ThreadableLoaderClient*, const ResourceRequest&, const ThreadableLoaderOptions&, const String& optionalOutgoingReferrer = String());
         virtual ~DocumentThreadableLoader();
 
         virtual void cancel();
@@ -69,7 +70,7 @@ namespace WebCore {
             LoadAsynchronously
         };
 
-        DocumentThreadableLoader(Document*, ThreadableLoaderClient*, BlockingBehavior blockingBehavior, const ResourceRequest&, const ThreadableLoaderOptions& options);
+        DocumentThreadableLoader(Document*, ThreadableLoaderClient*, BlockingBehavior, const ResourceRequest&, const ThreadableLoaderOptions&, const String& optionalOutgoingReferrer);
 
         virtual void willSendRequest(SubresourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
         virtual void didSendData(SubresourceLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
@@ -97,6 +98,7 @@ namespace WebCore {
         ThreadableLoaderClient* m_client;
         Document* m_document;
         ThreadableLoaderOptions m_options;
+        String m_optionalOutgoingReferrer;
         bool m_sameOriginRequest;
         bool m_async;
         OwnPtr<ResourceRequest> m_actualRequest;  // non-null during Access Control preflight checks
diff --git a/Source/WebCore/loader/DocumentThreadableLoaderClient.h b/Source/WebCore/loader/DocumentThreadableLoaderClient.h
index 4551b84..146a166 100644
--- a/Source/WebCore/loader/DocumentThreadableLoaderClient.h
+++ b/Source/WebCore/loader/DocumentThreadableLoaderClient.h
@@ -45,6 +45,9 @@ public:
     virtual bool isDocumentThreadableLoaderClient() { return true; }
 
     virtual void willSendRequest(ResourceRequest& /*newRequest*/, const ResourceResponse& /*redirectResponse*/) { }
+
+protected:
+    DocumentThreadableLoaderClient() { }
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/loader/EmptyClients.h b/Source/WebCore/loader/EmptyClients.h
index 41a5df7..cabb4ae 100644
--- a/Source/WebCore/loader/EmptyClients.h
+++ b/Source/WebCore/loader/EmptyClients.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Eric Seidel (eric@webkit.org)
- * Copyright (C) 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  *
  * Redistribution and use in source and binary forms, with or without
@@ -165,7 +165,7 @@ public:
     virtual void invalidateContentsForSlowScroll(const IntRect&, bool) {};
     virtual void scroll(const IntSize&, const IntRect&, const IntRect&) { }
 #if ENABLE(TILED_BACKING_STORE)
-    virtual void delegatedScrollRequested(const IntSize&) { }
+    virtual void delegatedScrollRequested(const IntPoint&) { }
 #endif
 #if ENABLE(REQUEST_ANIMATION_FRAME)
     virtual void scheduleAnimation() { }
@@ -374,7 +374,7 @@ public:
     virtual void showMediaPlayerProxyPlugin(Widget*) { }
 #endif
 
-    virtual ObjectContentType objectContentType(const KURL&, const String&) { return ObjectContentType(); }
+    virtual ObjectContentType objectContentType(const KURL&, const String&, bool) { return ObjectContentType(); }
     virtual String overrideMediaType() const { return String(); }
 
     virtual void redirectDataToPlugin(Widget*) { }
@@ -414,7 +414,7 @@ public:
     virtual String getAutoCorrectSuggestionForMisspelledWord(const String&) { return String(); }
     virtual void checkGrammarOfString(const UChar*, int, Vector<GrammarDetail>&, int*, int*) { }
 
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(UNIFIED_TEXT_CHECKING)
     virtual void checkTextOfParagraph(const UChar*, int, uint64_t, Vector<TextCheckingResult>&) { };
 #endif
 
@@ -519,9 +519,9 @@ public:
     TextCheckerClient* textChecker() { return &m_textCheckerClient; }
 
 #if SUPPORT_AUTOCORRECTION_PANEL
-    virtual void showCorrectionPanel(CorrectionPanelInfo::PanelType, const FloatRect&, const String&, const String&, const Vector<String>&, Editor*) { }
+    virtual void showCorrectionPanel(CorrectionPanelInfo::PanelType, const FloatRect&, const String&, const String&, const Vector<String>&) { }
     virtual void dismissCorrectionPanel(ReasonForDismissingCorrectionPanel) { }
-    virtual bool isShowingCorrectionPanel() { return false; }
+    virtual String dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanel) { return String(); }
     virtual void recordAutocorrectionResponse(AutocorrectionResponseType, const String&, const String&) { }
 #endif
     virtual void updateSpellingUIWithGrammarString(const String&, const GrammarDetail&) { }
diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
index 61f421f..6819e71 100644
--- a/Source/WebCore/loader/FrameLoader.cpp
+++ b/Source/WebCore/loader/FrameLoader.cpp
@@ -1,9 +1,10 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
+ * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -40,6 +41,7 @@
 #include "CachedPage.h"
 #include "CachedResourceLoader.h"
 #include "Chrome.h"
+#include "ContentSecurityPolicy.h"
 #include "DOMImplementation.h"
 #include "DOMWindow.h"
 #include "Document.h"
@@ -83,6 +85,7 @@
 #include "ResourceHandle.h"
 #include "ResourceRequest.h"
 #include "SchemeRegistry.h"
+#include "ScrollAnimator.h"
 #include "ScriptController.h"
 #include "ScriptSourceCode.h"
 #include "SecurityOrigin.h"
@@ -130,9 +133,9 @@ using namespace SVGNames;
 #endif
 
 #if ENABLE(XHTMLMP)
-static const char defaultAcceptHeader[] = "application/xml,application/vnd.wap.xhtml+xml,application/xhtml+xml;profile='http://www.wapforum.org/xhtml',text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
+static const char defaultAcceptHeader[] = "application/vnd.wap.xhtml+xml,application/xhtml+xml;profile='http://www.wapforum.org/xhtml',text/html,application/xml;q=0.9,*/*;q=0.8";
 #else
-static const char defaultAcceptHeader[] = "application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
+static const char defaultAcceptHeader[] = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8";
 #endif
 
 static double storedTimeOfLastCompletedLoad;
@@ -258,13 +261,6 @@ void FrameLoader::setDefersLoading(bool defers)
         m_frame->navigationScheduler()->startTimer();
         startCheckCompleteTimer();
     }
-
-    // This code is not logically part of load deferring, but we do not want JS code executed beneath modal
-    // windows or sheets, which is exactly when PageGroupLoadDeferrer is used.
-    if (defers)
-        m_frame->document()->suspendScheduledTasks();
-    else
-        m_frame->document()->resumeScheduledTasks();
 }
 
 bool FrameLoader::canHandleRequest(const ResourceRequest& request)
@@ -691,12 +687,13 @@ void FrameLoader::didEndDocument()
     m_isLoadingMainResource = false;
 }
 
-void FrameLoader::iconLoadDecisionAvailable()
+// Callback for the old-style synchronous IconDatabase interface.
+void FrameLoader::iconLoadDecisionReceived(IconLoadDecision iconLoadDecision)
 {
     if (!m_mayLoadIconLater)
         return;
     LOG(IconDatabase, "FrameLoader %p was told a load decision is available for its icon", this);
-    startIconLoader();
+    continueIconLoadWithDecision(iconLoadDecision);
     m_mayLoadIconLater = false;
 }
 
@@ -715,48 +712,77 @@ void FrameLoader::startIconLoader()
     if (urlString.isEmpty())
         return;
 
-    // If we're not reloading and the icon database doesn't say to load now then bail before we actually start the load
-    if (loadType() != FrameLoadTypeReload && loadType() != FrameLoadTypeReloadFromOrigin) {
-        IconLoadDecision decision = iconDatabase().loadDecisionForIconURL(urlString, m_documentLoader.get());
-        if (decision == IconLoadNo) {
-            LOG(IconDatabase, "FrameLoader::startIconLoader() - Told not to load this icon, committing iconURL %s to database for pageURL mapping", urlString.ascii().data());
-            commitIconURLToIconDatabase(url);
-            
-            // We were told not to load this icon - that means this icon is already known by the database
-            // If the icon data hasn't been read in from disk yet, kick off the read of the icon from the database to make sure someone
-            // has done it.  This is after registering for the notification so the WebView can call the appropriate delegate method.
-            // Otherwise if the icon data *is* available, notify the delegate
-            if (!iconDatabase().iconDataKnownForIconURL(urlString)) {
-                LOG(IconDatabase, "Told not to load icon %s but icon data is not yet available - registering for notification and requesting load from disk", urlString.ascii().data());
-                m_client->registerForIconNotification();
-                iconDatabase().iconForPageURL(m_frame->document()->url().string(), IntSize(0, 0));
-                iconDatabase().iconForPageURL(originalRequestURL().string(), IntSize(0, 0));
-            } else
-                m_client->dispatchDidReceiveIcon();
-                
-            return;
-        } 
-        
-        if (decision == IconLoadUnknown) {
-            // In this case, we may end up loading the icon later, but we still want to commit the icon url mapping to the database
-            // just in case we don't end up loading later - if we commit the mapping a second time after the load, that's no big deal
-            // We also tell the client to register for the notification that the icon is received now so it isn't missed in case the 
-            // icon is later read in from disk
-            LOG(IconDatabase, "FrameLoader %p might load icon %s later", this, urlString.ascii().data());
-            m_mayLoadIconLater = true;    
-            m_client->registerForIconNotification();
-            commitIconURLToIconDatabase(url);
-            return;
-        }
-    }
-
     // People who want to avoid loading images generally want to avoid loading all images.
     // Now that we've accounted for URL mapping, avoid starting the network load if images aren't set to display automatically.
     Settings* settings = m_frame->settings();
     if (settings && !settings->loadsImagesAutomatically())
         return;
 
-    // This is either a reload or the icon database said "yes, load the icon", so kick off the load!
+    // If we're reloading the page, always start the icon load now.
+    if (loadType() == FrameLoadTypeReload && loadType() == FrameLoadTypeReloadFromOrigin) {
+        continueIconLoadWithDecision(IconLoadYes);
+        return;
+    }
+
+    if (iconDatabase().supportsAsynchronousMode()) {
+        m_documentLoader->getIconLoadDecisionForIconURL(urlString);
+        // Commit the icon url mapping to the database just in case we don't end up loading later.
+        commitIconURLToIconDatabase(url);
+        return;
+    }
+    
+    IconLoadDecision decision = iconDatabase().synchronousLoadDecisionForIconURL(urlString, m_documentLoader.get());
+
+    if (decision == IconLoadUnknown) {
+        // In this case, we may end up loading the icon later, but we still want to commit the icon url mapping to the database
+        // just in case we don't end up loading later - if we commit the mapping a second time after the load, that's no big deal
+        // We also tell the client to register for the notification that the icon is received now so it isn't missed in case the 
+        // icon is later read in from disk
+        LOG(IconDatabase, "FrameLoader %p might load icon %s later", this, urlString.ascii().data());
+        m_mayLoadIconLater = true;    
+        m_client->registerForIconNotification();
+        commitIconURLToIconDatabase(url);
+        return;
+    }
+
+    continueIconLoadWithDecision(decision);
+}
+
+void FrameLoader::continueIconLoadWithDecision(IconLoadDecision iconLoadDecision)
+{
+    ASSERT(iconLoadDecision != IconLoadUnknown);
+    
+    //  FIXME (<rdar://problem/9168605>) - We should support in-memory-only private browsing icons in asynchronous icon database mode.
+    if (iconDatabase().supportsAsynchronousMode() && m_frame->page()->settings()->privateBrowsingEnabled())
+        return;
+        
+    if (iconLoadDecision == IconLoadNo) {
+        KURL url(iconURL());
+        String urlString(url.string());
+        
+        LOG(IconDatabase, "FrameLoader::startIconLoader() - Told not to load this icon, committing iconURL %s to database for pageURL mapping", urlString.ascii().data());
+        commitIconURLToIconDatabase(url);
+        
+        if (iconDatabase().supportsAsynchronousMode()) {
+            m_documentLoader->getIconDataForIconURL(urlString);
+            return;
+        }
+        
+        // We were told not to load this icon - that means this icon is already known by the database
+        // If the icon data hasn't been read in from disk yet, kick off the read of the icon from the database to make sure someone
+        // has done it. This is after registering for the notification so the WebView can call the appropriate delegate method.
+        // Otherwise if the icon data *is* available, notify the delegate
+        if (!iconDatabase().synchronousIconDataKnownForIconURL(urlString)) {
+            LOG(IconDatabase, "Told not to load icon %s but icon data is not yet available - registering for notification and requesting load from disk", urlString.ascii().data());
+            m_client->registerForIconNotification();
+            iconDatabase().synchronousIconForPageURL(m_frame->document()->url().string(), IntSize(0, 0));
+            iconDatabase().synchronousIconForPageURL(originalRequestURL().string(), IntSize(0, 0));
+        } else
+            m_client->dispatchDidReceiveIcon();
+            
+        return;
+    } 
+    
     if (!m_iconLoader)
         m_iconLoader = IconLoader::create(m_frame);
         
@@ -966,7 +992,7 @@ void FrameLoader::loadArchive(PassRefPtr<Archive> prpArchive)
 }
 #endif // ENABLE(WEB_ARCHIVE)
 
-ObjectContentType FrameLoader::defaultObjectContentType(const KURL& url, const String& mimeTypeIn)
+ObjectContentType FrameLoader::defaultObjectContentType(const KURL& url, const String& mimeTypeIn, bool shouldPreferPlugInsForImages)
 {
     String mimeType = mimeTypeIn;
     String extension = url.path().substring(url.path().reverseFind('.') + 1);
@@ -983,13 +1009,17 @@ ObjectContentType FrameLoader::defaultObjectContentType(const KURL& url, const S
     if (mimeType.isEmpty())
         return ObjectContentFrame; // Go ahead and hope that we can display the content.
 
+#if !PLATFORM(MAC) && !PLATFORM(CHROMIUM) && !PLATFORM(EFL) // Mac has no PluginDatabase, nor does Chromium or EFL
+    bool plugInSupportsMIMEType = PluginDatabase::installedPlugins()->isMIMETypeRegistered(mimeType);
+#else
+    bool plugInSupportsMIMEType = false;
+#endif
+
     if (MIMETypeRegistry::isSupportedImageMIMEType(mimeType))
-        return WebCore::ObjectContentImage;
+        return shouldPreferPlugInsForImages && plugInSupportsMIMEType ? WebCore::ObjectContentNetscapePlugin : WebCore::ObjectContentImage;
 
-#if !PLATFORM(MAC) && !PLATFORM(CHROMIUM) && !PLATFORM(EFL) // Mac has no PluginDatabase, nor does Chromium or EFL
-    if (PluginDatabase::installedPlugins()->isMIMETypeRegistered(mimeType))
+    if (plugInSupportsMIMEType)
         return WebCore::ObjectContentNetscapePlugin;
-#endif
 
     if (MIMETypeRegistry::isSupportedNonImageMIMEType(mimeType))
         return WebCore::ObjectContentFrame;
@@ -1392,7 +1422,7 @@ void FrameLoader::load(const ResourceRequest& request, const SubstituteData& sub
     m_loadType = FrameLoadTypeStandard;
     RefPtr<DocumentLoader> loader = m_client->createDocumentLoader(request, substituteData);
     if (lockHistory && m_documentLoader)
-        loader->setClientRedirectSourceForHistory(m_documentLoader->didCreateGlobalHistoryEntry() ? m_documentLoader->urlForHistory() : m_documentLoader->clientRedirectSourceForHistory());
+        loader->setClientRedirectSourceForHistory(m_documentLoader->didCreateGlobalHistoryEntry() ? m_documentLoader->urlForHistory().string() : m_documentLoader->clientRedirectSourceForHistory());
     load(loader.get());
 }
 
@@ -1416,7 +1446,7 @@ void FrameLoader::loadWithNavigationAction(const ResourceRequest& request, const
 {
     RefPtr<DocumentLoader> loader = m_client->createDocumentLoader(request, SubstituteData());
     if (lockHistory && m_documentLoader)
-        loader->setClientRedirectSourceForHistory(m_documentLoader->didCreateGlobalHistoryEntry() ? m_documentLoader->urlForHistory() : m_documentLoader->clientRedirectSourceForHistory());
+        loader->setClientRedirectSourceForHistory(m_documentLoader->didCreateGlobalHistoryEntry() ? m_documentLoader->urlForHistory().string() : m_documentLoader->clientRedirectSourceForHistory());
 
     loader->setTriggeringAction(action);
     if (m_documentLoader)
@@ -1530,7 +1560,7 @@ bool FrameLoader::willLoadMediaElementURL(KURL& url)
     unsigned long identifier;
     ResourceError error;
     requestFromDelegate(request, identifier, error);
-    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, ResourceResponse(url, String(), -1, String(), String()), -1, error);
+    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, ResourceResponse(url, String(), -1, String(), String()), -1, -1, error);
 
     url = request.url();
 
@@ -1947,7 +1977,7 @@ void FrameLoader::commitProvisionalLoad()
             // FIXME: If we get a resource with more than 2B bytes, this code won't do the right thing.
             // However, with today's computers and networking speeds, this won't happen in practice.
             // Could be an issue with a giant local file.
-            notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, response, static_cast<int>(response.expectedContentLength()), error);
+            notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, response, static_cast<int>(response.expectedContentLength()), 0, error);
         }
         
         pageCache()->remove(history()->currentItem());
@@ -1967,6 +1997,9 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
     if (m_state != FrameStateProvisional)
         return;
 
+    if (m_frame->view())
+        m_frame->view()->scrollAnimator()->cancelAnimations();
+
     m_client->setCopiesOnScroll();
     history()->updateForCommit();
 
@@ -2178,8 +2211,11 @@ void FrameLoader::open(CachedFrameBase& cachedFrame)
     view->setWasScrolledByUser(false);
 
     // Use the current ScrollView's frame rect.
-    if (m_frame->view())
-        view->setFrameRect(m_frame->view()->frameRect());
+    if (m_frame->view()) {
+        IntRect rect = m_frame->view()->frameRect();
+        view->setFrameRect(rect);
+        view->setBoundsSize(rect.size());
+    }
     m_frame->setView(view);
     
     m_frame->setDocument(document);
@@ -2338,12 +2374,9 @@ CachePolicy FrameLoader::subresourceCachePolicy() const
             return parentCachePolicy;
     }
 
-    // FIXME: POST documents are always Reloads, but their subresources should still be Revalidate.
-    // If we bring the CachePolicy.h and ResourceRequest cache policy enums in sync with each other and
-    // remember "Revalidate" in ResourceRequests, we can remove this "POST" check and return either "Reload" 
-    // or "Revalidate" if the DocumentLoader was requested with either.
     const ResourceRequest& request(documentLoader()->request());
-    if (request.cachePolicy() == ReloadIgnoringCacheData && !equalIgnoringCase(request.httpMethod(), "post"))
+    Settings* settings = m_frame->settings();
+    if (settings && settings->useQuickLookResourceCachingQuirks() && request.cachePolicy() == ReloadIgnoringCacheData && !equalIgnoringCase(request.httpMethod(), "post"))
         return CachePolicyRevalidate;
 
     if (m_loadType == FrameLoadTypeReload)
@@ -2382,16 +2415,15 @@ void FrameLoader::checkLoadCompleteForThisFrame()
                 
             // Only reset if we aren't already going to a new provisional item.
             bool shouldReset = !history()->provisionalItem();
-            if (!(pdl->isLoadingInAPISense() && !pdl->isStopping())) {
+            if (!pdl->isLoadingInAPISense() || pdl->isStopping()) {
                 m_delegateIsHandlingProvisionalLoadError = true;
                 m_client->dispatchDidFailProvisionalLoad(error);
                 m_delegateIsHandlingProvisionalLoadError = false;
 
-                // FIXME: can stopping loading here possibly have any effect, if isLoading is false,
-                // which it must be to be in this branch of the if? And is it OK to just do a full-on
-                // stopAllLoaders instead of stopLoadingSubframes?
-                stopLoadingSubframes(ShouldNotClearProvisionalItem);
-                pdl->stopLoading();
+                ASSERT(!pdl->isLoading());
+                ASSERT(!pdl->isLoadingMainResource());
+                ASSERT(!pdl->isLoadingSubresources());
+                ASSERT(!pdl->isLoadingPlugIns());
 
                 // If we're in the middle of loading multipart data, we need to restore the document loader.
                 if (isReplacing() && !m_documentLoader.get())
@@ -2741,12 +2773,6 @@ void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String
 {
     RefPtr<FormState> formState = prpFormState;
 
-    // When posting, use the NSURLRequestReloadIgnoringCacheData load flag.
-    // This prevents a potential bug which may cause a page with a form that uses itself
-    // as an action to be returned from the cache without submitting.
-
-    // FIXME: Where's the code that implements what the comment above says?
-
     // Previously when this method was reached, the original FrameLoadRequest had been deconstructed to build a 
     // bunch of parameters that would come in here and then be built back up to a ResourceRequest.  In case
     // any caller depends on the immutability of the original ResourceRequest, I'm rebuilding a ResourceRequest
@@ -2813,8 +2839,7 @@ unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& requ
         }
 #endif
     }
-
-    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, response, data.size(), error);
+    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, response, data.size(), static_cast<int>(response.expectedContentLength()), error);
     return identifier;
 }
 
@@ -3007,7 +3032,7 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
     if (!m_frame->page())
         return;
 
-#if ENABLE(JAVASCRIPT_DEBUGGER) && USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER) && USE(JSC) && ENABLE(INSPECTOR)
     if (Page* page = m_frame->page()) {
         if (page->mainFrame() == m_frame)
             m_frame->page()->inspectorController()->resume();
@@ -3107,7 +3132,7 @@ void FrameLoader::loadedResourceFromMemoryCache(const CachedResource* resource)
     ResourceError error;
     requestFromDelegate(request, identifier, error);
     InspectorInstrumentation::markResourceAsCached(page, identifier);
-    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, resource->response(), resource->encodedSize(), error);
+    notifier()->sendRemainingDelegateMessages(m_documentLoader.get(), identifier, resource->response(), resource->encodedSize(), 0, error);
 }
 
 void FrameLoader::applyUserAgent(ResourceRequest& request)
diff --git a/Source/WebCore/loader/FrameLoader.h b/Source/WebCore/loader/FrameLoader.h
index d59eb16..1fb9e3c 100644
--- a/Source/WebCore/loader/FrameLoader.h
+++ b/Source/WebCore/loader/FrameLoader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  *
@@ -35,6 +35,7 @@
 #include "FrameLoaderStateMachine.h"
 #include "FrameLoaderTypes.h"
 #include "HistoryController.h"
+#include "IconDatabaseBase.h"
 #include "PolicyChecker.h"
 #include "ResourceLoadNotifier.h"
 #include "SubframeLoader.h"
@@ -289,13 +290,13 @@ public:
 
     FrameLoaderStateMachine* stateMachine() const { return &m_stateMachine; }
 
-    void iconLoadDecisionAvailable();
+    void startIconLoader();
+    void iconLoadDecisionReceived(IconLoadDecision);
+    void continueIconLoadWithDecision(IconLoadDecision);
 
     bool shouldAllowNavigation(Frame* targetFrame) const;
     Frame* findFrameForNavigation(const AtomicString& name);
 
-    void startIconLoader();
-
     void applyUserAgent(ResourceRequest& request);
 
     bool shouldInterruptLoadForXFrameOptions(const String&, const KURL&);
@@ -322,7 +323,7 @@ public:
     
     bool suppressOpenerInNewFrame() const { return m_suppressOpenerInNewFrame; }
 
-    static ObjectContentType defaultObjectContentType(const KURL& url, const String& mimeType);
+    static ObjectContentType defaultObjectContentType(const KURL&, const String& mimeType, bool shouldPreferPlugInsForImages);
 
     void clear(bool clearWindowProperties = true, bool clearScriptObjects = true, bool clearFrameView = true);
 
diff --git a/Source/WebCore/loader/FrameLoaderClient.h b/Source/WebCore/loader/FrameLoaderClient.h
index 4a0bcbf..e89056d 100644
--- a/Source/WebCore/loader/FrameLoaderClient.h
+++ b/Source/WebCore/loader/FrameLoaderClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -259,7 +259,7 @@ namespace WebCore {
         virtual void showMediaPlayerProxyPlugin(Widget*) = 0;
 #endif
 
-        virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType) = 0;
+        virtual ObjectContentType objectContentType(const KURL&, const String& mimeType, bool shouldPreferPlugInsForImages) = 0;
         virtual String overrideMediaType() const = 0;
 
         virtual void dispatchDidClearWindowObjectInWorld(DOMWrapperWorld*) = 0;
diff --git a/Source/WebCore/loader/FrameLoaderTypes.h b/Source/WebCore/loader/FrameLoaderTypes.h
index 79c05dc..d13f375 100644
--- a/Source/WebCore/loader/FrameLoaderTypes.h
+++ b/Source/WebCore/loader/FrameLoaderTypes.h
@@ -42,7 +42,7 @@ namespace WebCore {
     enum PolicyAction {
         PolicyUse,
         PolicyDownload,
-        PolicyIgnore,
+        PolicyIgnore
     };
 
     // NOTE: Keep in sync with WebKit/mac/WebView/WebFramePrivate.h and WebKit/win/Interfaces/IWebFramePrivate.idl
diff --git a/Source/WebCore/loader/MainResourceLoader.cpp b/Source/WebCore/loader/MainResourceLoader.cpp
index c3c8d62..0cdbc21 100644
--- a/Source/WebCore/loader/MainResourceLoader.cpp
+++ b/Source/WebCore/loader/MainResourceLoader.cpp
@@ -118,7 +118,9 @@ ResourceError MainResourceLoader::interruptionForPolicyChangeError() const
 
 void MainResourceLoader::stopLoadingForPolicyChange()
 {
-    cancel(interruptionForPolicyChangeError());
+    ResourceError error = interruptionForPolicyChangeError();
+    error.setIsCancellation(true);
+    cancel(error);
 }
 
 void MainResourceLoader::callContinueAfterNavigationPolicy(void* argument, const ResourceRequest& request, PassRefPtr<FormState>, bool shouldContinue)
diff --git a/Source/WebCore/loader/PolicyCallback.cpp b/Source/WebCore/loader/PolicyCallback.cpp
index 4ec2c84..45fdbb0 100644
--- a/Source/WebCore/loader/PolicyCallback.cpp
+++ b/Source/WebCore/loader/PolicyCallback.cpp
@@ -42,6 +42,7 @@ PolicyCallback::PolicyCallback()
     : m_navigationFunction(0)
     , m_newWindowFunction(0)
     , m_contentFunction(0)
+    , m_argument(0)
 {
 }
 
diff --git a/Source/WebCore/loader/ResourceLoadNotifier.cpp b/Source/WebCore/loader/ResourceLoadNotifier.cpp
index c928557..3a02aa3 100644
--- a/Source/WebCore/loader/ResourceLoadNotifier.cpp
+++ b/Source/WebCore/loader/ResourceLoadNotifier.cpp
@@ -74,12 +74,12 @@ void ResourceLoadNotifier::didReceiveResponse(ResourceLoader* loader, const Reso
     dispatchDidReceiveResponse(loader->documentLoader(), loader->identifier(), r);
 }
 
-void ResourceLoadNotifier::didReceiveData(ResourceLoader* loader, const char* data, int length, int lengthReceived)
+void ResourceLoadNotifier::didReceiveData(ResourceLoader* loader, const char* data, int dataLength, int lengthReceived)
 {
     if (Page* page = m_frame->page())
-        page->progress()->incrementProgress(loader->identifier(), data, length);
+        page->progress()->incrementProgress(loader->identifier(), data, dataLength);
 
-    dispatchDidReceiveContentLength(loader->documentLoader(), loader->identifier(), lengthReceived);
+    dispatchDidReceiveContentLength(loader->documentLoader(), loader->identifier(), dataLength, lengthReceived);
 }
 
 void ResourceLoadNotifier::didFinishLoad(ResourceLoader* loader, double finishTime)
@@ -103,8 +103,6 @@ void ResourceLoadNotifier::didFailToLoad(ResourceLoader* loader, const ResourceE
 void ResourceLoadNotifier::assignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
 {
     m_frame->loader()->client()->assignIdentifierToInitialRequest(identifier, loader, request);
-
-    InspectorInstrumentation::identifierForInitialRequest(m_frame, identifier, loader, request);
 }
 
 void ResourceLoadNotifier::dispatchWillSendRequest(DocumentLoader* loader, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
@@ -118,7 +116,7 @@ void ResourceLoadNotifier::dispatchWillSendRequest(DocumentLoader* loader, unsig
     if (!request.isNull() && oldRequestURL != request.url().string().impl())
         m_frame->loader()->documentLoader()->didTellClientAboutLoad(request.url());
 
-    InspectorInstrumentation::willSendRequest(m_frame, identifier, request, redirectResponse);
+    InspectorInstrumentation::willSendRequest(m_frame, identifier, loader, request, redirectResponse);
 
     // Report WebTiming for all frames.
     if (loader && !request.isNull() && request.url() == loader->requestURL())
@@ -132,11 +130,11 @@ void ResourceLoadNotifier::dispatchDidReceiveResponse(DocumentLoader* loader, un
     InspectorInstrumentation::didReceiveResourceResponse(cookie, identifier, loader, r);
 }
 
-void ResourceLoadNotifier::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int length)
+void ResourceLoadNotifier::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int dataLength, int lengthReceived)
 {
-    m_frame->loader()->client()->dispatchDidReceiveContentLength(loader, identifier, length);
+    m_frame->loader()->client()->dispatchDidReceiveContentLength(loader, identifier, dataLength);
 
-    InspectorInstrumentation::didReceiveContentLength(m_frame, identifier, length);
+    InspectorInstrumentation::didReceiveContentLength(m_frame, identifier, dataLength, lengthReceived);
 }
 
 void ResourceLoadNotifier::dispatchDidFinishLoading(DocumentLoader* loader, unsigned long identifier, double finishTime)
@@ -154,13 +152,13 @@ void ResourceLoadNotifier::dispatchTransferLoadingResourceFromPage(unsigned long
     oldPage->progress()->completeProgress(identifier);
 }
 
-void ResourceLoadNotifier::sendRemainingDelegateMessages(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& response, int length, const ResourceError& error)
+void ResourceLoadNotifier::sendRemainingDelegateMessages(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& response, int dataLength, int lengthReceived, const ResourceError& error)
 {
     if (!response.isNull())
         dispatchDidReceiveResponse(loader, identifier, response);
 
-    if (length > 0)
-        dispatchDidReceiveContentLength(loader, identifier, length);
+    if (dataLength > 0)
+        dispatchDidReceiveContentLength(loader, identifier, dataLength, lengthReceived);
 
     if (error.isNull())
         dispatchDidFinishLoading(loader, identifier, 0);
diff --git a/Source/WebCore/loader/ResourceLoadNotifier.h b/Source/WebCore/loader/ResourceLoadNotifier.h
index a6d92fb..5753c28 100644
--- a/Source/WebCore/loader/ResourceLoadNotifier.h
+++ b/Source/WebCore/loader/ResourceLoadNotifier.h
@@ -53,18 +53,18 @@ public:
 
     void willSendRequest(ResourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
     void didReceiveResponse(ResourceLoader*, const ResourceResponse&);
-    void didReceiveData(ResourceLoader*, const char*, int, int lengthReceived);
+    void didReceiveData(ResourceLoader*, const char*, int dataLength, int lengthReceived);
     void didFinishLoad(ResourceLoader*, double finishTime);
     void didFailToLoad(ResourceLoader*, const ResourceError&);
 
     void assignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
     void dispatchWillSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
     void dispatchDidReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse&);
-    void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int length);
+    void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int dataLength, int lengthReceived);
     void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier, double finishTime);
     void dispatchTransferLoadingResourceFromPage(unsigned long, DocumentLoader*, const ResourceRequest&, Page*);
 
-    void sendRemainingDelegateMessages(DocumentLoader*, unsigned long identifier, const ResourceResponse&, int length, const ResourceError&);
+    void sendRemainingDelegateMessages(DocumentLoader*, unsigned long identifier, const ResourceResponse&, int dataLength, int lengthReceived, const ResourceError&);
 
 private:
     Frame* m_frame;
diff --git a/Source/WebCore/loader/ResourceLoadScheduler.cpp b/Source/WebCore/loader/ResourceLoadScheduler.cpp
index dbb6914..7cceff7 100644
--- a/Source/WebCore/loader/ResourceLoadScheduler.cpp
+++ b/Source/WebCore/loader/ResourceLoadScheduler.cpp
@@ -83,12 +83,13 @@ ResourceLoadScheduler::ResourceLoadScheduler()
 #endif
 }
 
-PassRefPtr<SubresourceLoader> ResourceLoadScheduler::scheduleSubresourceLoad(Frame* frame, SubresourceLoaderClient* client, const ResourceRequest& request, ResourceLoadPriority priority, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks, bool shouldContentSniff)
+PassRefPtr<SubresourceLoader> ResourceLoadScheduler::scheduleSubresourceLoad(Frame* frame, SubresourceLoaderClient* client, const ResourceRequest& request, ResourceLoadPriority priority, SecurityCheckPolicy securityCheck,
+                                                                             bool sendResourceLoadCallbacks, bool shouldContentSniff, const String& optionalOutgoingReferrer)
 {
-    PassRefPtr<SubresourceLoader> loader = SubresourceLoader::create(frame, client, request, securityCheck, sendResourceLoadCallbacks, shouldContentSniff);
+    RefPtr<SubresourceLoader> loader = SubresourceLoader::create(frame, client, request, securityCheck, sendResourceLoadCallbacks, shouldContentSniff, optionalOutgoingReferrer);
     if (loader)
         scheduleLoad(loader.get(), priority);
-    return loader;
+    return loader.release();
 }
 
 PassRefPtr<NetscapePlugInStreamLoader> ResourceLoadScheduler::schedulePluginStreamLoad(Frame* frame, NetscapePlugInStreamLoaderClient* client, const ResourceRequest& request)
diff --git a/Source/WebCore/loader/ResourceLoadScheduler.h b/Source/WebCore/loader/ResourceLoadScheduler.h
index f2e627f..49a4546 100644
--- a/Source/WebCore/loader/ResourceLoadScheduler.h
+++ b/Source/WebCore/loader/ResourceLoadScheduler.h
@@ -32,6 +32,7 @@
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
@@ -49,7 +50,7 @@ class ResourceLoadScheduler {
 public:
     friend ResourceLoadScheduler* resourceLoadScheduler();
 
-    PassRefPtr<SubresourceLoader> scheduleSubresourceLoad(Frame*, SubresourceLoaderClient*, const ResourceRequest&, ResourceLoadPriority = ResourceLoadPriorityLow, SecurityCheckPolicy = DoSecurityCheck, bool sendResourceLoadCallbacks = true, bool shouldContentSniff = true);
+    PassRefPtr<SubresourceLoader> scheduleSubresourceLoad(Frame*, SubresourceLoaderClient*, const ResourceRequest&, ResourceLoadPriority = ResourceLoadPriorityLow, SecurityCheckPolicy = DoSecurityCheck, bool sendResourceLoadCallbacks = true, bool shouldContentSniff = true, const String& optionalOutgoingReferrer = String());
     PassRefPtr<NetscapePlugInStreamLoader> schedulePluginStreamLoad(Frame*, NetscapePlugInStreamLoaderClient*, const ResourceRequest&);
     void addMainResourceLoad(ResourceLoader*);
     void remove(ResourceLoader*);
diff --git a/Source/WebCore/loader/ResourceLoader.h b/Source/WebCore/loader/ResourceLoader.h
index e5c5d3f..339b130 100644
--- a/Source/WebCore/loader/ResourceLoader.h
+++ b/Source/WebCore/loader/ResourceLoader.h
@@ -88,6 +88,9 @@ namespace WebCore {
         void willStopBufferingData(const char*, int);
         virtual void didFinishLoading(double finishTime);
         virtual void didFail(const ResourceError&);
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+        virtual void didReceiveDataArray(CFArrayRef dataArray);
+#endif
 
         virtual bool shouldUseCredentialStorage();
         virtual void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
@@ -111,6 +114,9 @@ namespace WebCore {
         virtual bool shouldUseCredentialStorage(ResourceHandle*) { return shouldUseCredentialStorage(); }
         virtual void didReceiveAuthenticationChallenge(ResourceHandle*, const AuthenticationChallenge& challenge) { didReceiveAuthenticationChallenge(challenge); } 
         virtual void didCancelAuthenticationChallenge(ResourceHandle*, const AuthenticationChallenge& challenge) { didCancelAuthenticationChallenge(challenge); } 
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+        virtual void didReceiveDataArray(ResourceHandle*, CFArrayRef dataArray);
+#endif
 #if USE(PROTECTION_SPACE_AUTH_CALLBACK)
         virtual bool canAuthenticateAgainstProtectionSpace(ResourceHandle*, const ProtectionSpace& protectionSpace) { return canAuthenticateAgainstProtectionSpace(protectionSpace); }
 #endif
diff --git a/Source/WebCore/loader/SubframeLoader.cpp b/Source/WebCore/loader/SubframeLoader.cpp
index 8bfd474..e7f851f 100644
--- a/Source/WebCore/loader/SubframeLoader.cpp
+++ b/Source/WebCore/loader/SubframeLoader.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
@@ -88,17 +88,35 @@ bool SubframeLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const Str
     return true;
 }
     
-bool SubframeLoader::resourceWillUsePlugin(const String& url, const String& mimeType)
+bool SubframeLoader::resourceWillUsePlugin(const String& url, const String& mimeType, bool shouldPreferPlugInsForImages)
 {
     KURL completedURL;
     if (!url.isEmpty())
         completedURL = completeURL(url);
+
     bool useFallback;
-    return shouldUsePlugin(completedURL, mimeType, false, useFallback);
+    return shouldUsePlugin(completedURL, mimeType, shouldPreferPlugInsForImages, false, useFallback);
 }
 
-bool SubframeLoader::requestObject(HTMLPlugInImageElement* ownerElement, const String& url, const AtomicString& frameName,
-    const String& mimeType, const Vector<String>& paramNames, const Vector<String>& paramValues)
+bool SubframeLoader::requestPlugin(HTMLPlugInImageElement* ownerElement, const KURL& url, const String& mimeType, const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback)
+{
+    Settings* settings = m_frame->settings();
+    if ((!allowPlugins(AboutToInstantiatePlugin)
+         // Application plug-ins are plug-ins implemented by the user agent, for example Qt plug-ins,
+         // as opposed to third-party code such as Flash. The user agent decides whether or not they are
+         // permitted, rather than WebKit.
+         && !MIMETypeRegistry::isApplicationPluginMIMEType(mimeType))
+        || (!settings->isJavaEnabled() && MIMETypeRegistry::isJavaAppletMIMEType(mimeType)))
+        return false;
+
+    if (m_frame->document() && m_frame->document()->securityOrigin()->isSandboxed(SandboxPlugins))
+        return false;
+
+    ASSERT(ownerElement->hasTagName(objectTag) || ownerElement->hasTagName(embedTag));
+    return loadPlugin(ownerElement, url, mimeType, paramNames, paramValues, useFallback);
+}
+ 
+bool SubframeLoader::requestObject(HTMLPlugInImageElement* ownerElement, const String& url, const AtomicString& frameName, const String& mimeType, const Vector<String>& paramNames, const Vector<String>& paramValues)
 {
     if (url.isEmpty() && mimeType.isEmpty())
         return false;
@@ -114,23 +132,8 @@ bool SubframeLoader::requestObject(HTMLPlugInImageElement* ownerElement, const S
         completedURL = completeURL(url);
 
     bool useFallback;
-    if (shouldUsePlugin(completedURL, mimeType, renderer->hasFallbackContent(), useFallback)) {
-        Settings* settings = m_frame->settings();
-        if ((!allowPlugins(AboutToInstantiatePlugin)
-             // Application plugins are plugins implemented by the user agent, for example Qt plugins,
-             // as opposed to third-party code such as flash. The user agent decides whether or not they are
-             // permitted, rather than WebKit.
-             && !MIMETypeRegistry::isApplicationPluginMIMEType(mimeType))
-            || (!settings->isJavaEnabled() && MIMETypeRegistry::isJavaAppletMIMEType(mimeType)))
-            return false;
-        if (m_frame->document() && m_frame->document()->securityOrigin()->isSandboxed(SandboxPlugins))
-            return false;
-
-        ASSERT(ownerElement->hasTagName(objectTag) || ownerElement->hasTagName(embedTag));
-        HTMLPlugInImageElement* pluginElement = static_cast<HTMLPlugInImageElement*>(ownerElement);
-
-        return loadPlugin(pluginElement, completedURL, mimeType, paramNames, paramValues, useFallback);
-    }
+    if (shouldUsePlugin(completedURL, mimeType, ownerElement->shouldPreferPlugInsForImages(), renderer->hasFallbackContent(), useFallback))
+        return requestPlugin(ownerElement, completedURL, mimeType, paramNames, paramValues, useFallback);
 
     // If the plug-in element already contains a subframe, loadOrRedirectSubframe will re-use it. Otherwise,
     // it will create a new frame and set it as the RenderPart's widget, causing what was previously 
@@ -289,7 +292,7 @@ bool SubframeLoader::allowPlugins(ReasonForCallingAllowPlugins reason)
     return allowed;
 }
 
-bool SubframeLoader::shouldUsePlugin(const KURL& url, const String& mimeType, bool hasFallback, bool& useFallback)
+bool SubframeLoader::shouldUsePlugin(const KURL& url, const String& mimeType, bool shouldPreferPlugInsForImages, bool hasFallback, bool& useFallback)
 {
     if (m_frame->loader()->client()->shouldUsePluginDocument(mimeType)) {
         useFallback = false;
@@ -305,7 +308,7 @@ bool SubframeLoader::shouldUsePlugin(const KURL& url, const String& mimeType, bo
             return true;
     }
         
-    ObjectContentType objectType = m_frame->loader()->client()->objectContentType(url, mimeType);
+    ObjectContentType objectType = m_frame->loader()->client()->objectContentType(url, mimeType, shouldPreferPlugInsForImages);
     // If an object's content can't be handled and it has no fallback, let
     // it be handled as a plugin to show the broken plugin icon.
     useFallback = objectType == ObjectContentNone && hasFallback;
diff --git a/Source/WebCore/loader/SubframeLoader.h b/Source/WebCore/loader/SubframeLoader.h
index ba63a5c..01c59e6 100644
--- a/Source/WebCore/loader/SubframeLoader.h
+++ b/Source/WebCore/loader/SubframeLoader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  *
@@ -77,15 +77,16 @@ public:
 
     bool containsPlugins() const { return m_containsPlugins; }
     
-    bool resourceWillUsePlugin(const String& url, const String& mimeType);
+    bool resourceWillUsePlugin(const String& url, const String& mimeType, bool shouldPreferPlugInsForImages);
 
 private:
+    bool requestPlugin(HTMLPlugInImageElement*, const KURL&, const String& serviceType, const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback);
     Frame* loadOrRedirectSubframe(HTMLFrameOwnerElement*, const KURL&, const AtomicString& frameName, bool lockHistory, bool lockBackForwardList);
     Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
     bool loadPlugin(HTMLPlugInImageElement*, const KURL&, const String& mimeType,
         const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback);
 
-    bool shouldUsePlugin(const KURL&, const String& mimeType, bool hasFallback, bool& useFallback);
+    bool shouldUsePlugin(const KURL&, const String& mimeType, bool shouldPreferPlugInsForImages, bool hasFallback, bool& useFallback);
 
     Document* document() const;
 
diff --git a/Source/WebCore/loader/SubresourceLoader.cpp b/Source/WebCore/loader/SubresourceLoader.cpp
index f948ec3..cfe8d0a 100644
--- a/Source/WebCore/loader/SubresourceLoader.cpp
+++ b/Source/WebCore/loader/SubresourceLoader.cpp
@@ -60,7 +60,7 @@ SubresourceLoader::~SubresourceLoader()
 #endif
 }
 
-PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, SubresourceLoaderClient* client, const ResourceRequest& request, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks, bool shouldContentSniff)
+PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, SubresourceLoaderClient* client, const ResourceRequest& request, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks, bool shouldContentSniff, const String& optionalOutgoingReferrer)
 {
     if (!frame)
         return 0;
@@ -75,12 +75,22 @@ PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, Subresourc
         FrameLoader::reportLocalLoadFailed(frame, request.url().string());
         return 0;
     }
-    
-    if (SecurityOrigin::shouldHideReferrer(request.url(), fl->outgoingReferrer()))
+
+    String outgoingReferrer;
+    String outgoingOrigin;
+    if (optionalOutgoingReferrer.isNull()) {
+        outgoingReferrer = fl->outgoingReferrer();
+        outgoingOrigin = fl->outgoingOrigin();
+    } else {
+        outgoingReferrer = optionalOutgoingReferrer;
+        outgoingOrigin = SecurityOrigin::createFromString(outgoingReferrer)->toString();
+    }
+
+    if (SecurityOrigin::shouldHideReferrer(request.url(), outgoingReferrer))
         newRequest.clearHTTPReferrer();
     else if (!request.httpReferrer())
-        newRequest.setHTTPReferrer(fl->outgoingReferrer());
-    FrameLoader::addHTTPOriginIfNeeded(newRequest, fl->outgoingOrigin());
+        newRequest.setHTTPReferrer(outgoingReferrer);
+    FrameLoader::addHTTPOriginIfNeeded(newRequest, outgoingOrigin);
 
     fl->addExtraFieldsToSubresourceRequest(newRequest);
 
diff --git a/Source/WebCore/loader/SubresourceLoader.h b/Source/WebCore/loader/SubresourceLoader.h
index cb7ed81..b3aefb6 100644
--- a/Source/WebCore/loader/SubresourceLoader.h
+++ b/Source/WebCore/loader/SubresourceLoader.h
@@ -31,6 +31,8 @@
 
 #include "FrameLoaderTypes.h"
 #include "ResourceLoader.h"
+
+#include <wtf/text/WTFString.h>
  
 namespace WebCore {
 
@@ -39,7 +41,7 @@ namespace WebCore {
     
     class SubresourceLoader : public ResourceLoader {
     public:
-        static PassRefPtr<SubresourceLoader> create(Frame*, SubresourceLoaderClient*, const ResourceRequest&, SecurityCheckPolicy = DoSecurityCheck, bool sendResourceLoadCallbacks = true, bool shouldContentSniff = true);
+        static PassRefPtr<SubresourceLoader> create(Frame*, SubresourceLoaderClient*, const ResourceRequest&, SecurityCheckPolicy = DoSecurityCheck, bool sendResourceLoadCallbacks = true, bool shouldContentSniff = true, const String& optionalOutgoingReferrer = String());
 
         void clearClient() { m_client = 0; }
 
@@ -59,6 +61,11 @@ namespace WebCore {
         virtual void receivedCancellation(const AuthenticationChallenge&);        
         virtual void didCancel(const ResourceError&);
 
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+        virtual bool supportsDataArray() { return true; }
+        virtual void didReceiveDataArray(CFArrayRef);
+#endif
+
         SubresourceLoaderClient* m_client;
         bool m_loadingMultipartContent;
     };
diff --git a/Source/WebCore/loader/ThreadableLoaderClientWrapper.h b/Source/WebCore/loader/ThreadableLoaderClientWrapper.h
index 664e0b3..d765fa0 100644
--- a/Source/WebCore/loader/ThreadableLoaderClientWrapper.h
+++ b/Source/WebCore/loader/ThreadableLoaderClientWrapper.h
@@ -38,85 +38,85 @@
 
 namespace WebCore {
 
-    class ThreadableLoaderClientWrapper : public ThreadSafeShared<ThreadableLoaderClientWrapper> {
-    public:
-        static PassRefPtr<ThreadableLoaderClientWrapper> create(ThreadableLoaderClient* client)
-        {
-            return adoptRef(new ThreadableLoaderClientWrapper(client));
-        }
-
-        void clearClient()
-        {
-            m_done = true;
-            m_client = 0;
-        }
-
-        bool done() const
-        {
-            return m_done;
-        }
-
-        void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
-        {
-            if (m_client)
-                m_client->didSendData(bytesSent, totalBytesToBeSent);
-        }
-
-        void didReceiveResponse(const ResourceResponse& response)
-        {
-            if (m_client)
-                m_client->didReceiveResponse(response);
-        }
-
-        void didReceiveData(const char* data, int dataLength)
-        {
-            if (m_client)
-                m_client->didReceiveData(data, dataLength);
-        }
-
-        void didReceiveCachedMetadata(const char* data, int dataLength)
-        {
-            if (m_client)
-                m_client->didReceiveCachedMetadata(data, dataLength);
-        }
-
-        void didFinishLoading(unsigned long identifier, double finishTime)
-        {
-            m_done = true;
-            if (m_client)
-                m_client->didFinishLoading(identifier, finishTime);
-        }
-
-        void didFail(const ResourceError& error)
-        {
-            m_done = true;
-            if (m_client)
-                m_client->didFail(error);
-        }
-
-        void didFailRedirectCheck()
-        {
-            m_done = true;
-            if (m_client)
-                m_client->didFailRedirectCheck();
-        }
-
-        void didReceiveAuthenticationCancellation(const ResourceResponse& response)
-        {
-            if (m_client)
-                m_client->didReceiveResponse(response);
-        }
-
-    protected:
-        ThreadableLoaderClientWrapper(ThreadableLoaderClient* client)
-            : m_client(client)
-            , m_done(false)
-        {
-        }
-
-        ThreadableLoaderClient* m_client;
-        bool m_done;
-    };
+class ThreadableLoaderClientWrapper : public ThreadSafeRefCounted<ThreadableLoaderClientWrapper> {
+public:
+    static PassRefPtr<ThreadableLoaderClientWrapper> create(ThreadableLoaderClient* client)
+    {
+        return adoptRef(new ThreadableLoaderClientWrapper(client));
+    }
+
+    void clearClient()
+    {
+        m_done = true;
+        m_client = 0;
+    }
+
+    bool done() const
+    {
+        return m_done;
+    }
+
+    void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+    {
+        if (m_client)
+            m_client->didSendData(bytesSent, totalBytesToBeSent);
+    }
+
+    void didReceiveResponse(const ResourceResponse& response)
+    {
+        if (m_client)
+            m_client->didReceiveResponse(response);
+    }
+
+    void didReceiveData(const char* data, int dataLength)
+    {
+        if (m_client)
+            m_client->didReceiveData(data, dataLength);
+    }
+
+    void didReceiveCachedMetadata(const char* data, int dataLength)
+    {
+        if (m_client)
+            m_client->didReceiveCachedMetadata(data, dataLength);
+    }
+
+    void didFinishLoading(unsigned long identifier, double finishTime)
+    {
+        m_done = true;
+        if (m_client)
+            m_client->didFinishLoading(identifier, finishTime);
+    }
+
+    void didFail(const ResourceError& error)
+    {
+        m_done = true;
+        if (m_client)
+            m_client->didFail(error);
+    }
+
+    void didFailRedirectCheck()
+    {
+        m_done = true;
+        if (m_client)
+            m_client->didFailRedirectCheck();
+    }
+
+    void didReceiveAuthenticationCancellation(const ResourceResponse& response)
+    {
+        if (m_client)
+            m_client->didReceiveResponse(response);
+    }
+
+protected:
+    ThreadableLoaderClientWrapper(ThreadableLoaderClient* client)
+        : m_client(client)
+        , m_done(false)
+    {
+    }
+
+    ThreadableLoaderClient* m_client;
+    bool m_done;
+};
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/loader/WorkerThreadableLoader.cpp b/Source/WebCore/loader/WorkerThreadableLoader.cpp
index 6c61318..d753ecb 100644
--- a/Source/WebCore/loader/WorkerThreadableLoader.cpp
+++ b/Source/WebCore/loader/WorkerThreadableLoader.cpp
@@ -34,6 +34,8 @@
 
 #include "WorkerThreadableLoader.h"
 
+#include "Document.h"
+#include "DocumentThreadableLoader.h"
 #include "CrossThreadTask.h"
 #include "ResourceError.h"
 #include "ResourceRequest.h"
@@ -55,7 +57,7 @@ static const char loadResourceSynchronouslyMode[] = "loadResourceSynchronouslyMo
 WorkerThreadableLoader::WorkerThreadableLoader(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, const ThreadableLoaderOptions& options)
     : m_workerContext(workerContext)
     , m_workerClientWrapper(ThreadableLoaderClientWrapper::create(client))
-    , m_bridge(*(new MainThreadBridge(m_workerClientWrapper, m_workerContext->thread()->workerLoaderProxy(), taskMode, request, options)))
+    , m_bridge(*(new MainThreadBridge(m_workerClientWrapper, m_workerContext->thread()->workerLoaderProxy(), taskMode, request, options, workerContext->url().strippedForUseAsReferrer())))
 {
 }
 
@@ -87,32 +89,30 @@ void WorkerThreadableLoader::cancel()
 }
 
 WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, WorkerLoaderProxy& loaderProxy, const String& taskMode,
-                                                           const ResourceRequest& request, const ThreadableLoaderOptions& options)
+                                                           const ResourceRequest& request, const ThreadableLoaderOptions& options, const String& outgoingReferrer)
     : m_workerClientWrapper(workerClientWrapper)
     , m_loaderProxy(loaderProxy)
     , m_taskMode(taskMode.crossThreadString())
 {
     ASSERT(m_workerClientWrapper.get());
-    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, options));
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, options, outgoingReferrer));
 }
 
 WorkerThreadableLoader::MainThreadBridge::~MainThreadBridge()
 {
 }
 
-void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, PassOwnPtr<CrossThreadResourceRequestData> requestData, ThreadableLoaderOptions options)
+void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, PassOwnPtr<CrossThreadResourceRequestData> requestData, ThreadableLoaderOptions options, const String& outgoingReferrer)
 {
     ASSERT(isMainThread());
     ASSERT(context->isDocument());
+    Document* document = static_cast<Document*>(context);
 
-    // FIXME: the created loader has no knowledge of the origin of the worker doing the load request.
-    // Basically every setting done in SubresourceLoader::create (including the contents of addExtraFieldsToRequest)
-    // needs to be examined for how it should take into account a different originator.
     OwnPtr<ResourceRequest> request(ResourceRequest::adopt(requestData));
     // FIXME: If the a site requests a local resource, then this will return a non-zero value but the sync path
     // will return a 0 value.  Either this should return 0 or the other code path should do a callback with
     // a failure.
-    thisPtr->m_mainThreadLoader = ThreadableLoader::create(context, thisPtr, *request, options);
+    thisPtr->m_mainThreadLoader = DocumentThreadableLoader::create(document, thisPtr, *request, options, outgoingReferrer);
     ASSERT(thisPtr->m_mainThreadLoader);
 }
 
diff --git a/Source/WebCore/loader/WorkerThreadableLoader.h b/Source/WebCore/loader/WorkerThreadableLoader.h
index 2477f19..7685eed 100644
--- a/Source/WebCore/loader/WorkerThreadableLoader.h
+++ b/Source/WebCore/loader/WorkerThreadableLoader.h
@@ -98,7 +98,7 @@ namespace WebCore {
         class MainThreadBridge : public ThreadableLoaderClient {
         public:
             // All executed on the worker context's thread.
-            MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerLoaderProxy&, const String& taskMode, const ResourceRequest&, const ThreadableLoaderOptions&);
+            MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerLoaderProxy&, const String& taskMode, const ResourceRequest&, const ThreadableLoaderOptions&, const String& outgoingReferrer);
             void cancel();
             void destroy();
 
@@ -110,7 +110,7 @@ namespace WebCore {
             static void mainThreadDestroy(ScriptExecutionContext*, MainThreadBridge*);
             ~MainThreadBridge();
 
-            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, PassOwnPtr<CrossThreadResourceRequestData>, ThreadableLoaderOptions);
+            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, PassOwnPtr<CrossThreadResourceRequestData>, ThreadableLoaderOptions, const String& outgoingReferrer);
             static void mainThreadCancel(ScriptExecutionContext*, MainThreadBridge*);
             virtual void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
             virtual void didReceiveResponse(const ResourceResponse&);
diff --git a/Source/WebCore/loader/appcache/ApplicationCache.cpp b/Source/WebCore/loader/appcache/ApplicationCache.cpp
index 450fa10..f3479b4 100644
--- a/Source/WebCore/loader/appcache/ApplicationCache.cpp
+++ b/Source/WebCore/loader/appcache/ApplicationCache.cpp
@@ -32,6 +32,7 @@
 #include "ApplicationCacheResource.h"
 #include "ApplicationCacheStorage.h"
 #include "ResourceRequest.h"
+#include "SecurityOrigin.h"
 #include <wtf/text/CString.h>
 #include <stdio.h>
 
@@ -182,7 +183,29 @@ void ApplicationCache::clearStorageID()
     ResourceMap::const_iterator end = m_resources.end();
     for (ResourceMap::const_iterator it = m_resources.begin(); it != end; ++it)
         it->second->clearStorageID();
-}    
+}
+    
+void ApplicationCache::deleteCacheForOrigin(SecurityOrigin* origin)
+{
+    Vector<KURL> urls;
+    if (!cacheStorage().manifestURLs(&urls)) {
+        LOG_ERROR("Failed to retrieve ApplicationCache manifest URLs");
+        return;
+    }
+
+    KURL originURL(KURL(), origin->toString());
+
+    size_t count = urls.size();
+    for (size_t i = 0; i < count; ++i) {
+        if (protocolHostAndPortAreEqual(urls[i], originURL)) {
+            ApplicationCacheGroup* group = cacheStorage().findInMemoryCacheGroup(urls[i]);
+            if (group)
+                group->makeObsolete();
+            else
+                cacheStorage().deleteCacheGroup(urls[i]);
+        }
+    }
+}
     
 #ifndef NDEBUG
 void ApplicationCache::dump()
diff --git a/Source/WebCore/loader/appcache/ApplicationCache.h b/Source/WebCore/loader/appcache/ApplicationCache.h
index f073499..9d20361 100644
--- a/Source/WebCore/loader/appcache/ApplicationCache.h
+++ b/Source/WebCore/loader/appcache/ApplicationCache.h
@@ -42,12 +42,16 @@ class ApplicationCacheResource;
 class DocumentLoader;
 class KURL;
 class ResourceRequest;
+class SecurityOrigin;
 
 typedef Vector<std::pair<KURL, KURL> > FallbackURLVector;
 
 class ApplicationCache : public RefCounted<ApplicationCache> {
 public:
     static PassRefPtr<ApplicationCache> create() { return adoptRef(new ApplicationCache); }
+    
+    static void deleteCacheForOrigin(SecurityOrigin*);
+    
     ~ApplicationCache();
 
     void addResource(PassRefPtr<ApplicationCacheResource> resource);
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index 514ef19..aab8927 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -474,9 +474,8 @@ PassRefPtr<ResourceHandle> ApplicationCacheGroup::createResourceHandle(const KUR
     // Because willSendRequest only gets called during redirects, we initialize
     // the identifier and the first willSendRequest here.
     m_currentResourceIdentifier = m_frame->page()->progress()->createUniqueIdentifier();
-    InspectorInstrumentation::identifierForInitialRequest(m_frame, m_currentResourceIdentifier, m_frame->loader()->documentLoader(), handle->firstRequest());
     ResourceResponse redirectResponse = ResourceResponse();
-    InspectorInstrumentation::willSendRequest(m_frame, m_currentResourceIdentifier, request, redirectResponse);
+    InspectorInstrumentation::willSendRequest(m_frame, m_currentResourceIdentifier, m_frame->loader()->documentLoader(), request, redirectResponse);
 #endif
     return handle;
 }
@@ -512,7 +511,7 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
     if (m_newestCache && response.httpStatusCode() == 304) { // Not modified.
         ApplicationCacheResource* newestCachedResource = m_newestCache->resourceForURL(url);
         if (newestCachedResource) {
-            m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data()));
+            m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data(), newestCachedResource->path()));
             m_pendingEntries.remove(m_currentHandle->firstRequest().url());
             m_currentHandle->cancel();
             m_currentHandle = 0;
@@ -540,7 +539,7 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
             ASSERT(m_newestCache);
             ApplicationCacheResource* newestCachedResource = m_newestCache->resourceForURL(handle->firstRequest().url());
             ASSERT(newestCachedResource);
-            m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data()));
+            m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data(), newestCachedResource->path()));
             m_pendingEntries.remove(m_currentHandle->firstRequest().url());
             m_currentHandle->cancel();
             m_currentHandle = 0;
@@ -555,8 +554,10 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
 
 void ApplicationCacheGroup::didReceiveData(ResourceHandle* handle, const char* data, int length, int lengthReceived)
 {
+    UNUSED_PARAM(lengthReceived);
+
 #if ENABLE(INSPECTOR)
-    InspectorInstrumentation::didReceiveContentLength(m_frame, m_currentResourceIdentifier, lengthReceived);
+    InspectorInstrumentation::didReceiveContentLength(m_frame, m_currentResourceIdentifier, length, 0);
 #endif
 
     if (handle == m_manifestHandle) {
@@ -642,7 +643,7 @@ void ApplicationCacheGroup::didFail(ResourceHandle* handle, const ResourceError&
         ASSERT(m_newestCache);
         ApplicationCacheResource* newestCachedResource = m_newestCache->resourceForURL(url);
         ASSERT(newestCachedResource);
-        m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data()));
+        m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data(), newestCachedResource->path()));
         // Load the next resource, if any.
         startLoadingEntry();
     }
@@ -866,7 +867,7 @@ void ApplicationCacheGroup::checkIfLoadIsComplete()
         }
 
         ApplicationCacheStorage::FailureReason failureReason;
-        RefPtr<ApplicationCache> oldNewestCache = (m_newestCache == m_cacheBeingUpdated) ? 0 : m_newestCache;
+        RefPtr<ApplicationCache> oldNewestCache = (m_newestCache == m_cacheBeingUpdated) ? RefPtr<ApplicationCache>() : m_newestCache;
         setNewestCache(m_cacheBeingUpdated.release());
         if (cacheStorage().storeNewestCache(this, oldNewestCache.get(), failureReason)) {
             // New cache stored, now remove the old cache.
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheHost.h b/Source/WebCore/loader/appcache/ApplicationCacheHost.h
index a1f2841..56a5f57 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheHost.h
+++ b/Source/WebCore/loader/appcache/ApplicationCacheHost.h
@@ -156,6 +156,11 @@ namespace WebCore {
         CacheInfo applicationCacheInfo();
 #endif
 
+#if !PLATFORM(CHROMIUM)
+        bool shouldLoadResourceFromApplicationCache(const ResourceRequest&, ApplicationCacheResource*&);
+        bool getApplicationCacheFallbackResource(const ResourceRequest&, ApplicationCacheResource*&, ApplicationCache* = 0);
+#endif
+
     private:
         bool isApplicationCacheEnabled();
         DocumentLoader* documentLoader() const { return m_documentLoader; }
@@ -182,8 +187,6 @@ namespace WebCore {
         friend class ApplicationCacheStorage;
 
         bool scheduleLoadFallbackResourceFromApplicationCache(ResourceLoader*, ApplicationCache* = 0);
-        bool shouldLoadResourceFromApplicationCache(const ResourceRequest&, ApplicationCacheResource*&);
-        bool getApplicationCacheFallbackResource(const ResourceRequest&, ApplicationCacheResource*&, ApplicationCache* = 0);
         void setCandidateApplicationCacheGroup(ApplicationCacheGroup* group);
         ApplicationCacheGroup* candidateApplicationCacheGroup() const { return m_candidateApplicationCacheGroup; }
         void setApplicationCache(PassRefPtr<ApplicationCache> applicationCache);
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheResource.cpp b/Source/WebCore/loader/appcache/ApplicationCacheResource.cpp
index 03c5c83..c0df573 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheResource.cpp
+++ b/Source/WebCore/loader/appcache/ApplicationCacheResource.cpp
@@ -31,11 +31,12 @@
 
 namespace WebCore {
 
-ApplicationCacheResource::ApplicationCacheResource(const KURL& url, const ResourceResponse& response, unsigned type, PassRefPtr<SharedBuffer> data)
+ApplicationCacheResource::ApplicationCacheResource(const KURL& url, const ResourceResponse& response, unsigned type, PassRefPtr<SharedBuffer> data, const String& path)
     : SubstituteResource(url, response, data)
     , m_type(type)
     , m_storageID(0)
     , m_estimatedSizeInStorage(0)
+    , m_path(path)
 {
 }
 
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheResource.h b/Source/WebCore/loader/appcache/ApplicationCacheResource.h
index 2ca7846..6633c6c 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheResource.h
+++ b/Source/WebCore/loader/appcache/ApplicationCacheResource.h
@@ -42,10 +42,10 @@ public:
         Fallback = 1 << 4
     };
         
-    static PassRefPtr<ApplicationCacheResource> create(const KURL& url, const ResourceResponse& response, unsigned type, PassRefPtr<SharedBuffer> buffer = SharedBuffer::create())
+    static PassRefPtr<ApplicationCacheResource> create(const KURL& url, const ResourceResponse& response, unsigned type, PassRefPtr<SharedBuffer> buffer = SharedBuffer::create(), const String& path = String())
     {
         ASSERT(!url.hasFragmentIdentifier());
-        return adoptRef(new ApplicationCacheResource(url, response, type, buffer));
+        return adoptRef(new ApplicationCacheResource(url, response, type, buffer, path));
     }
 
     unsigned type() const { return m_type; }
@@ -56,16 +56,20 @@ public:
     void clearStorageID() { m_storageID = 0; }
     int64_t estimatedSizeInStorage();
 
+    const String& path() const { return m_path; }
+    void setPath(const String& path) { m_path = path; }
+
 #ifndef NDEBUG
     static void dumpType(unsigned type);
 #endif
     
 private:
-    ApplicationCacheResource(const KURL& url, const ResourceResponse& response, unsigned type, PassRefPtr<SharedBuffer> buffer);
+    ApplicationCacheResource(const KURL&, const ResourceResponse&, unsigned type, PassRefPtr<SharedBuffer>, const String& path);
 
     unsigned m_type;
     unsigned m_storageID;
     int64_t m_estimatedSizeInStorage;
+    String m_path;
 };
     
 } // namespace WebCore
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp b/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp
index 5c6937e..a126f8a 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp
+++ b/Source/WebCore/loader/appcache/ApplicationCacheStorage.cpp
@@ -38,6 +38,7 @@
 #include "SQLiteStatement.h"
 #include "SQLiteTransaction.h"
 #include "SecurityOrigin.h"
+#include "UUID.h"
 #include <wtf/text/CString.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/StringExtras.h>
@@ -46,6 +47,8 @@ using namespace std;
 
 namespace WebCore {
 
+static const char flatFileSubdirectory[] = "ApplicationCache";
+
 template <class T>
 class StorageIDJournal {
 public:  
@@ -90,7 +93,7 @@ static unsigned urlHostHash(const KURL& url)
     unsigned hostStart = url.hostStart();
     unsigned hostEnd = url.hostEnd();
     
-    return AlreadyHashed::avoidDeletedValue(WTF::StringHasher::createHash(url.string().characters() + hostStart, hostEnd - hostStart));
+    return AlreadyHashed::avoidDeletedValue(StringHasher::computeHash(url.string().characters() + hostStart, hostEnd - hostStart));
 }
 
 ApplicationCacheGroup* ApplicationCacheStorage::loadCacheGroup(const KURL& manifestURL)
@@ -153,6 +156,11 @@ ApplicationCacheGroup* ApplicationCacheStorage::findOrCreateCacheGroup(const KUR
     return group;
 }
 
+ApplicationCacheGroup* ApplicationCacheStorage::findInMemoryCacheGroup(const KURL& manifestURL) const
+{
+    return m_cachesInMemory.get(manifestURL);
+}
+
 void ApplicationCacheStorage::loadManifestHostHashes()
 {
     static bool hasLoadedHashes = false;
@@ -389,7 +397,7 @@ int64_t ApplicationCacheStorage::spaceNeeded(int64_t cacheToSave)
     if (!getFileSize(m_cacheFile, fileSize))
         return 0;
 
-    int64_t currentSize = fileSize;
+    int64_t currentSize = fileSize + flatFileAreaSize();
 
     // Determine the amount of free space we have available.
     int64_t totalAvailableSize = 0;
@@ -555,7 +563,7 @@ bool ApplicationCacheStorage::executeSQLCommand(const String& sql)
 // Update the schemaVersion when the schema of any the Application Cache
 // SQLite tables changes. This allows the database to be rebuilt when
 // a new, incompatible change has been introduced to the database schema.
-static const int schemaVersion = 6;
+static const int schemaVersion = 7;
     
 void ApplicationCacheStorage::verifySchemaVersion()
 {
@@ -563,7 +571,7 @@ void ApplicationCacheStorage::verifySchemaVersion()
     if (version == schemaVersion)
         return;
 
-    m_database.clearAllTables();
+    deleteTables();
 
     // Update user version.
     SQLiteTransaction setDatabaseVersion(m_database);
@@ -613,7 +621,8 @@ void ApplicationCacheStorage::openDatabase(bool createIfDoesNotExist)
     executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheEntries (cache INTEGER NOT NULL ON CONFLICT FAIL, type INTEGER, resource INTEGER NOT NULL)");
     executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheResources (id INTEGER PRIMARY KEY AUTOINCREMENT, url TEXT NOT NULL ON CONFLICT FAIL, "
                       "statusCode INTEGER NOT NULL, responseURL TEXT NOT NULL, mimeType TEXT, textEncodingName TEXT, headers TEXT, data INTEGER NOT NULL ON CONFLICT FAIL)");
-    executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheResourceData (id INTEGER PRIMARY KEY AUTOINCREMENT, data BLOB)");
+    executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheResourceData (id INTEGER PRIMARY KEY AUTOINCREMENT, data BLOB, path TEXT)");
+    executeSQLCommand("CREATE TABLE IF NOT EXISTS DeletedCacheResources (id INTEGER PRIMARY KEY AUTOINCREMENT, path TEXT)");
     executeSQLCommand("CREATE TABLE IF NOT EXISTS Origins (origin TEXT UNIQUE ON CONFLICT IGNORE, quota INTEGER NOT NULL ON CONFLICT FAIL)");
 
     // When a cache is deleted, all its entries and its whitelist should be deleted.
@@ -636,6 +645,15 @@ void ApplicationCacheStorage::openDatabase(bool createIfDoesNotExist)
                       " FOR EACH ROW BEGIN"
                       "  DELETE FROM CacheResourceData WHERE id = OLD.data;"
                       " END");
+    
+    // When a cache resource is deleted, if it contains a non-empty path, that path should
+    // be added to the DeletedCacheResources table so the flat file at that path can
+    // be deleted at a later time.
+    executeSQLCommand("CREATE TRIGGER IF NOT EXISTS CacheResourceDataDeleted AFTER DELETE ON CacheResourceData"
+                      " FOR EACH ROW"
+                      " WHEN OLD.path NOT NULL BEGIN"
+                      "  INSERT INTO DeletedCacheResources (path) values (OLD.path);"
+                      " END");
 }
 
 bool ApplicationCacheStorage::executeStatement(SQLiteStatement& statement)
@@ -767,15 +785,43 @@ bool ApplicationCacheStorage::store(ApplicationCacheResource* resource, unsigned
         return false;
 
     // First, insert the data
-    SQLiteStatement dataStatement(m_database, "INSERT INTO CacheResourceData (data) VALUES (?)");
+    SQLiteStatement dataStatement(m_database, "INSERT INTO CacheResourceData (data, path) VALUES (?, ?)");
     if (dataStatement.prepare() != SQLResultOk)
         return false;
     
-    if (resource->data()->size())
-        dataStatement.bindBlob(1, resource->data()->data(), resource->data()->size());
+
+    String fullPath;
+    if (!resource->path().isEmpty())
+        dataStatement.bindText(2, pathGetFileName(resource->path()));
+    else if (shouldStoreResourceAsFlatFile(resource)) {
+        // First, check to see if creating the flat file would violate the maximum total quota. We don't need
+        // to check the per-origin quota here, as it was already checked in storeNewestCache().
+        if (m_database.totalSize() + flatFileAreaSize() + resource->data()->size() > m_maximumSize) {
+            m_isMaximumSizeReached = true;
+            return false;
+        }
+        
+        String flatFileDirectory = pathByAppendingComponent(m_cacheDirectory, flatFileSubdirectory);
+        makeAllDirectories(flatFileDirectory);
+        String path;
+        if (!writeDataToUniqueFileInDirectory(resource->data(), flatFileDirectory, path))
+            return false;
+        
+        fullPath = pathByAppendingComponent(flatFileDirectory, path);
+        resource->setPath(fullPath);
+        dataStatement.bindText(2, path);
+    } else {
+        if (resource->data()->size())
+            dataStatement.bindBlob(1, resource->data()->data(), resource->data()->size());
+    }
     
-    if (!dataStatement.executeCommand())
+    if (!dataStatement.executeCommand()) {
+        // Clean up the file which we may have written to:
+        if (!fullPath.isEmpty())
+            deleteFile(fullPath);
+
         return false;
+    }
 
     unsigned dataId = static_cast<unsigned>(m_database.lastInsertRowID());
 
@@ -826,6 +872,12 @@ bool ApplicationCacheStorage::store(ApplicationCacheResource* resource, unsigned
     if (!executeStatement(entryStatement))
         return false;
     
+    // Did we successfully write the resource data to a file? If so,
+    // release the resource's data and free up a potentially large amount
+    // of memory:
+    if (!fullPath.isEmpty())
+        resource->data()->clear();
+
     resource->setStorageID(resourceId);
     return true;
 }
@@ -856,7 +908,7 @@ bool ApplicationCacheStorage::store(ApplicationCacheResource* resource, Applicat
         return false;
  
     m_isMaximumSizeReached = false;
-    m_database.setMaximumSize(m_maximumSize);
+    m_database.setMaximumSize(m_maximumSize - flatFileAreaSize());
 
     SQLiteTransaction storeResourceTransaction(m_database);
     storeResourceTransaction.begin();
@@ -903,7 +955,7 @@ bool ApplicationCacheStorage::storeNewestCache(ApplicationCacheGroup* group, App
         return false;
 
     m_isMaximumSizeReached = false;
-    m_database.setMaximumSize(m_maximumSize);
+    m_database.setMaximumSize(m_maximumSize - flatFileAreaSize());
 
     SQLiteTransaction storeCacheTransaction(m_database);
     
@@ -1003,7 +1055,7 @@ static inline void parseHeaders(const String& headers, ResourceResponse& respons
 PassRefPtr<ApplicationCache> ApplicationCacheStorage::loadCache(unsigned storageID)
 {
     SQLiteStatement cacheStatement(m_database, 
-                                   "SELECT url, type, mimeType, textEncodingName, headers, CacheResourceData.data FROM CacheEntries INNER JOIN CacheResources ON CacheEntries.resource=CacheResources.id "
+                                   "SELECT url, type, mimeType, textEncodingName, headers, CacheResourceData.data, CacheResourceData.path FROM CacheEntries INNER JOIN CacheResources ON CacheEntries.resource=CacheResources.id "
                                    "INNER JOIN CacheResourceData ON CacheResourceData.id=CacheResources.data WHERE CacheEntries.cache=?");
     if (cacheStatement.prepare() != SQLResultOk) {
         LOG_ERROR("Could not prepare cache statement, error \"%s\"", m_database.lastErrorMsg());
@@ -1013,7 +1065,9 @@ PassRefPtr<ApplicationCache> ApplicationCacheStorage::loadCache(unsigned storage
     cacheStatement.bindInt64(1, storageID);
 
     RefPtr<ApplicationCache> cache = ApplicationCache::create();
-    
+
+    String flatFileDirectory = pathByAppendingComponent(m_cacheDirectory, flatFileSubdirectory);
+
     int result;
     while ((result = cacheStatement.step()) == SQLResultRow) {
         KURL url(ParsedURLString, cacheStatement.getColumnText(0));
@@ -1025,15 +1079,24 @@ PassRefPtr<ApplicationCache> ApplicationCacheStorage::loadCache(unsigned storage
         
         RefPtr<SharedBuffer> data = SharedBuffer::adoptVector(blob);
         
+        String path = cacheStatement.getColumnText(6);
+        long long size = 0;
+        if (path.isEmpty())
+            size = data->size();
+        else {
+            path = pathByAppendingComponent(flatFileDirectory, path);
+            getFileSize(path, size);
+        }
+        
         String mimeType = cacheStatement.getColumnText(2);
         String textEncodingName = cacheStatement.getColumnText(3);
         
-        ResourceResponse response(url, mimeType, data->size(), textEncodingName, "");
+        ResourceResponse response(url, mimeType, size, textEncodingName, "");
 
         String headers = cacheStatement.getColumnText(4);
         parseHeaders(headers, response);
         
-        RefPtr<ApplicationCacheResource> resource = ApplicationCacheResource::create(url, response, type, data.release());
+        RefPtr<ApplicationCacheResource> resource = ApplicationCacheResource::create(url, response, type, data.release(), path);
 
         if (type & ApplicationCacheResource::Manifest)
             cache->setManifestResource(resource.release());
@@ -1127,6 +1190,8 @@ void ApplicationCacheStorage::remove(ApplicationCache* cache)
 
         cache->group()->clearStorageID();
     }
+    
+    checkForDeletedResources();
 }    
 
 void ApplicationCacheStorage::empty()
@@ -1147,7 +1212,51 @@ void ApplicationCacheStorage::empty()
     CacheGroupMap::const_iterator end = m_cachesInMemory.end();
     for (CacheGroupMap::const_iterator it = m_cachesInMemory.begin(); it != end; ++it)
         it->second->clearStorageID();
-}    
+    
+    checkForDeletedResources();
+}
+    
+void ApplicationCacheStorage::deleteTables()
+{
+    empty();
+    m_database.clearAllTables();
+}
+    
+bool ApplicationCacheStorage::shouldStoreResourceAsFlatFile(ApplicationCacheResource* resource)
+{
+    return resource->response().mimeType().startsWith("audio/", false) 
+        || resource->response().mimeType().startsWith("video/", false);
+}
+    
+bool ApplicationCacheStorage::writeDataToUniqueFileInDirectory(SharedBuffer* data, const String& directory, String& path)
+{
+    String fullPath;
+    
+    do {
+        path = encodeForFileName(createCanonicalUUIDString());
+        // Guard against the above function being called on a platform which does not implement
+        // createCanonicalUUIDString().
+        ASSERT(!path.isEmpty());
+        if (path.isEmpty())
+            return false;
+        
+        fullPath = pathByAppendingComponent(directory, path);
+    } while (directoryName(fullPath) != directory || fileExists(fullPath));
+    
+    PlatformFileHandle handle = openFile(fullPath, OpenForWrite);
+    if (!handle)
+        return false;
+    
+    int64_t writtenBytes = writeToFile(handle, data->data(), data->size());
+    closeFile(handle);
+    
+    if (writtenBytes != static_cast<int64_t>(data->size())) {
+        deleteFile(fullPath);
+        return false;
+    }
+    
+    return true;
+}
 
 bool ApplicationCacheStorage::storeCopyOfCache(const String& cacheDirectory, ApplicationCacheHost* cacheHost)
 {
@@ -1166,7 +1275,7 @@ bool ApplicationCacheStorage::storeCopyOfCache(const String& cacheDirectory, App
     for (ApplicationCache::ResourceMap::const_iterator it = cache->begin(); it != end; ++it) {
         ApplicationCacheResource* resource = it->second.get();
         
-        RefPtr<ApplicationCacheResource> resourceCopy = ApplicationCacheResource::create(resource->url(), resource->response(), resource->type(), resource->data());
+        RefPtr<ApplicationCacheResource> resourceCopy = ApplicationCacheResource::create(resource->url(), resource->response(), resource->type(), resource->data(), resource->path());
         
         cacheCopy->addResource(resourceCopy.release());
     }
@@ -1274,6 +1383,9 @@ bool ApplicationCacheStorage::deleteCacheGroup(const String& manifestURL)
     }
 
     deleteTransaction.commit();
+    
+    checkForDeletedResources();
+    
     return true;
 }
 
@@ -1291,25 +1403,73 @@ void ApplicationCacheStorage::checkForMaxSizeReached()
     if (m_database.lastError() == SQLResultFull)
         m_isMaximumSizeReached = true;
 }
-
-void ApplicationCacheStorage::getOriginsWithCache(HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash>& origins)
+    
+void ApplicationCacheStorage::checkForDeletedResources()
 {
-    Vector<KURL> urls;
-    if (!manifestURLs(&urls)) {
-        LOG_ERROR("Failed to retrieve ApplicationCache manifest URLs");
+    openDatabase(false);
+    if (!m_database.isOpen())
         return;
+
+    // Select only the paths in DeletedCacheResources that do not also appear in CacheResourceData:
+    SQLiteStatement selectPaths(m_database, "SELECT DeletedCacheResources.path "
+        "FROM DeletedCacheResources "
+        "LEFT JOIN CacheResourceData "
+        "ON DeletedCacheResources.path = CacheResourceData.path "
+        "WHERE (SELECT DeletedCacheResources.path == CacheResourceData.path) IS NULL");
+    
+    if (selectPaths.prepare() != SQLResultOk)
+        return;
+    
+    if (selectPaths.step() != SQLResultRow)
+        return;
+    
+    do {
+        String path = selectPaths.getColumnText(0);
+        if (path.isEmpty())
+            continue;
+        
+        String flatFileDirectory = pathByAppendingComponent(m_cacheDirectory, flatFileSubdirectory);
+        String fullPath = pathByAppendingComponent(flatFileDirectory, path);
+        
+        // Don't exit the flatFileDirectory! This should only happen if the "path" entry contains a directory 
+        // component, but protect against it regardless.
+        if (directoryName(fullPath) != flatFileDirectory)
+            continue;
+        
+        deleteFile(fullPath);
+    } while (selectPaths.step() == SQLResultRow);
+    
+    executeSQLCommand("DELETE FROM DeletedCacheResources");
+}
+    
+long long ApplicationCacheStorage::flatFileAreaSize()
+{
+    openDatabase(false);
+    if (!m_database.isOpen())
+        return 0;
+    
+    SQLiteStatement selectPaths(m_database, "SELECT path FROM CacheResourceData WHERE path NOT NULL");
+
+    if (selectPaths.prepare() != SQLResultOk) {
+        LOG_ERROR("Could not load flat file cache resource data, error \"%s\"", m_database.lastErrorMsg());
+        return 0;
     }
 
-    // Multiple manifest URLs might share the same SecurityOrigin, so we might be creating extra, wasted origins here.
-    // The current schema doesn't allow for a more efficient way of building this list.
-    size_t count = urls.size();
-    for (size_t i = 0; i < count; ++i) {
-        RefPtr<SecurityOrigin> origin = SecurityOrigin::create(urls[i]);
-        origins.add(origin);
+    long long totalSize = 0;
+    String flatFileDirectory = pathByAppendingComponent(m_cacheDirectory, flatFileSubdirectory);
+    while (selectPaths.step() == SQLResultRow) {
+        String path = selectPaths.getColumnText(0);
+        String fullPath = pathByAppendingComponent(flatFileDirectory, path);
+        long long pathSize = 0;
+        if (!getFileSize(fullPath, pathSize))
+            continue;
+        totalSize += pathSize;
     }
+    
+    return totalSize;
 }
 
-void ApplicationCacheStorage::deleteEntriesForOrigin(SecurityOrigin* origin)
+void ApplicationCacheStorage::getOriginsWithCache(HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash>& origins)
 {
     Vector<KURL> urls;
     if (!manifestURLs(&urls)) {
@@ -1318,12 +1478,11 @@ void ApplicationCacheStorage::deleteEntriesForOrigin(SecurityOrigin* origin)
     }
 
     // Multiple manifest URLs might share the same SecurityOrigin, so we might be creating extra, wasted origins here.
-    // The current schema doesn't allow for a more efficient way of deleting by origin.
+    // The current schema doesn't allow for a more efficient way of building this list.
     size_t count = urls.size();
     for (size_t i = 0; i < count; ++i) {
-        RefPtr<SecurityOrigin> manifestOrigin = SecurityOrigin::create(urls[i]);
-        if (manifestOrigin->isSameSchemeHostPort(origin))
-            deleteCacheGroup(urls[i]);
+        RefPtr<SecurityOrigin> origin = SecurityOrigin::create(urls[i]);
+        origins.add(origin);
     }
 }
 
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheStorage.h b/Source/WebCore/loader/appcache/ApplicationCacheStorage.h
index f283670..3136b52 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheStorage.h
+++ b/Source/WebCore/loader/appcache/ApplicationCacheStorage.h
@@ -74,6 +74,7 @@ public:
     ApplicationCacheGroup* fallbackCacheGroupForURL(const KURL&); // Cache that has a fallback entry to load a main resource from if normal loading fails.
 
     ApplicationCacheGroup* findOrCreateCacheGroup(const KURL& manifestURL);
+    ApplicationCacheGroup* findInMemoryCacheGroup(const KURL& manifestURL) const;
     void cacheGroupDestroyed(ApplicationCacheGroup*);
     void cacheGroupMadeObsolete(ApplicationCacheGroup*);
         
@@ -95,7 +96,6 @@ public:
     void vacuumDatabaseFile();
 
     void getOriginsWithCache(HashSet<RefPtr<SecurityOrigin>, SecurityOriginHash>&);
-    void deleteEntriesForOrigin(SecurityOrigin*);
     void deleteAllEntries();
 
     static int64_t unknownQuota() { return -1; }
@@ -113,6 +113,9 @@ private:
     bool store(ApplicationCacheResource*, unsigned cacheStorageID);
 
     bool ensureOriginRecord(const SecurityOrigin*);
+    bool shouldStoreResourceAsFlatFile(ApplicationCacheResource*);
+    void deleteTables();
+    bool writeDataToUniqueFileInDirectory(SharedBuffer*, const String& directory, String& outFilename);
 
     void loadManifestHostHashes();
     
@@ -124,6 +127,8 @@ private:
     bool executeSQLCommand(const String&);
 
     void checkForMaxSizeReached();
+    void checkForDeletedResources();
+    long long flatFileAreaSize();
     
     String m_cacheDirectory;
     String m_cacheFile;
diff --git a/Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp b/Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp
index 7979423..6e0a1eb 100644
--- a/Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp
+++ b/Source/WebCore/loader/archive/cf/LegacyWebArchive.cpp
@@ -546,9 +546,9 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString
 
     // Add favicon if one exists for this page, if we are archiving the entire page.
     if (nodesSize && nodes[0]->isDocumentNode() && iconDatabase().isEnabled()) {
-        const String& iconURL = iconDatabase().iconURLForPageURL(responseURL);
-        if (!iconURL.isEmpty() && iconDatabase().iconDataKnownForIconURL(iconURL)) {
-            if (Image* iconImage = iconDatabase().iconForPageURL(responseURL, IntSize(16, 16))) {
+        const String& iconURL = iconDatabase().synchronousIconURLForPageURL(responseURL);
+        if (!iconURL.isEmpty() && iconDatabase().synchronousIconDataKnownForIconURL(iconURL)) {
+            if (Image* iconImage = iconDatabase().synchronousIconForPageURL(responseURL, IntSize(16, 16))) {
                 if (RefPtr<ArchiveResource> resource = ArchiveResource::create(iconImage->data(), KURL(ParsedURLString, iconURL), "image/x-icon", "", ""))
                     subresources.append(resource.release());
             }
diff --git a/Source/WebCore/loader/cache/CachedFont.cpp b/Source/WebCore/loader/cache/CachedFont.cpp
index 19eb3ba..ea2ee14 100644
--- a/Source/WebCore/loader/cache/CachedFont.cpp
+++ b/Source/WebCore/loader/cache/CachedFont.cpp
@@ -117,7 +117,7 @@ bool CachedFont::ensureCustomFontData()
     return m_fontData;
 }
 
-FontPlatformData CachedFont::platformDataFromCustomData(float size, bool bold, bool italic, FontOrientation orientation, FontWidthVariant widthVariant, FontRenderingMode renderingMode)
+FontPlatformData CachedFont::platformDataFromCustomData(float size, bool bold, bool italic, FontOrientation orientation, TextOrientation textOrientation, FontWidthVariant widthVariant, FontRenderingMode renderingMode)
 {
 #if ENABLE(SVG_FONTS)
     if (m_externalSVGDocument)
@@ -125,7 +125,7 @@ FontPlatformData CachedFont::platformDataFromCustomData(float size, bool bold, b
 #endif
 #ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
     ASSERT(m_fontData);
-    return m_fontData->fontPlatformData(static_cast<int>(size), bold, italic, orientation, widthVariant, renderingMode);
+    return m_fontData->fontPlatformData(static_cast<int>(size), bold, italic, orientation, textOrientation, widthVariant, renderingMode);
 #else
     return FontPlatformData();
 #endif
diff --git a/Source/WebCore/loader/cache/CachedFont.h b/Source/WebCore/loader/cache/CachedFont.h
index cdc32ba..d677f7b 100644
--- a/Source/WebCore/loader/cache/CachedFont.h
+++ b/Source/WebCore/loader/cache/CachedFont.h
@@ -30,6 +30,7 @@
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
 #include "FontWidthVariant.h"
+#include "TextOrientation.h"
 #include <wtf/Vector.h>
 
 #if ENABLE(SVG_FONTS)
@@ -64,7 +65,7 @@ public:
     void beginLoadIfNeeded(CachedResourceLoader* dl);
 
     bool ensureCustomFontData();
-    FontPlatformData platformDataFromCustomData(float size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
+    FontPlatformData platformDataFromCustomData(float size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
 #if ENABLE(SVG_FONTS)
     bool isSVGFont() const { return m_isSVGFont; }
diff --git a/Source/WebCore/loader/cache/CachedImage.cpp b/Source/WebCore/loader/cache/CachedImage.cpp
index b309ae6..cc49415 100644
--- a/Source/WebCore/loader/cache/CachedImage.cpp
+++ b/Source/WebCore/loader/cache/CachedImage.cpp
@@ -325,16 +325,6 @@ void CachedImage::error(CachedResource::Status status)
     checkNotify();
 }
 
-void CachedImage::checkNotify()
-{
-    if (isLoading())
-        return;
-
-    CachedResourceClientWalker w(m_clients);
-    while (CachedResourceClient* c = w.next())
-        c->notifyFinished(this);
-}
-
 void CachedImage::destroyDecodedData()
 {
     bool canDeleteImage = !m_image || (m_image->hasOneRef() && m_image->isBitmapImage());
diff --git a/Source/WebCore/loader/cache/CachedImage.h b/Source/WebCore/loader/cache/CachedImage.h
index 3242409..42c7814 100644
--- a/Source/WebCore/loader/cache/CachedImage.h
+++ b/Source/WebCore/loader/cache/CachedImage.h
@@ -71,8 +71,6 @@ public:
     // For compatibility, images keep loading even if there are HTTP errors.
     virtual bool shouldIgnoreHTTPStatusCodeErrors() const { return true; }
 
-    void checkNotify();
-    
     virtual bool isImage() const { return true; }
 
     void clear();
diff --git a/Source/WebCore/loader/cache/CachedResource.cpp b/Source/WebCore/loader/cache/CachedResource.cpp
index 0f9ff45..9413472 100644
--- a/Source/WebCore/loader/cache/CachedResource.cpp
+++ b/Source/WebCore/loader/cache/CachedResource.cpp
@@ -93,8 +93,8 @@ CachedResource::CachedResource(const String& url, Type type)
     , m_loading(false)
     , m_type(type)
     , m_status(Pending)
-    , m_deleted(false)
 #ifndef NDEBUG
+    , m_deleted(false)
     , m_lruIndex(0)
 #endif
     , m_nextInAllResourcesList(0)
@@ -118,13 +118,8 @@ CachedResource::~CachedResource()
     ASSERT(!m_deleted);
     ASSERT(url().isNull() || memoryCache()->resourceForURL(KURL(ParsedURLString, url())) != this);
     
-    if (m_deleted) {
-        // FIXME: Remove when http://webkit.org/b/53045 is fixed.
-        CRASH();
-    }
-    
-    m_deleted = true;
 #ifndef NDEBUG
+    m_deleted = true;
     cachedResourceLeakCounter.decrement();
 #endif
 
@@ -139,15 +134,33 @@ void CachedResource::load(CachedResourceLoader* cachedResourceLoader, bool incre
     m_loading = true;
 }
 
+void CachedResource::checkNotify()
+{
+    if (isLoading())
+        return;
+
+    CachedResourceClientWalker w(m_clients);
+    while (CachedResourceClient* c = w.next())
+        c->notifyFinished(this);
+}
+
 void CachedResource::data(PassRefPtr<SharedBuffer>, bool allDataReceived)
 {
     if (!allDataReceived)
         return;
     
     setLoading(false);
-    CachedResourceClientWalker w(m_clients);
-    while (CachedResourceClient* c = w.next())
-        c->notifyFinished(this);
+    checkNotify();
+}
+
+void CachedResource::error(CachedResource::Status status)
+{
+    setStatus(status);
+    ASSERT(errorOccurred());
+    m_data.clear();
+
+    setLoading(false);
+    checkNotify();
 }
 
 void CachedResource::finish()
diff --git a/Source/WebCore/loader/cache/CachedResource.h b/Source/WebCore/loader/cache/CachedResource.h
index 3379f8c..16920a5 100644
--- a/Source/WebCore/loader/cache/CachedResource.h
+++ b/Source/WebCore/loader/cache/CachedResource.h
@@ -86,7 +86,7 @@ public:
     virtual void setEncoding(const String&) { }
     virtual String encoding() const { return String(); }
     virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived);
-    virtual void error(CachedResource::Status) { }
+    virtual void error(CachedResource::Status);
 
     virtual bool shouldIgnoreHTTPStatusCodeErrors() const { return false; }
 
@@ -217,6 +217,8 @@ public:
     void updateResponseAfterRevalidation(const ResourceResponse& validatingResponse);
 
 protected:
+    void checkNotify();
+
     void setEncodedSize(unsigned);
     void setDecodedSize(unsigned);
     void didAccessDecodedData(double timeStamp);
@@ -266,9 +268,8 @@ private:
     unsigned m_type : 3; // Type
     unsigned m_status : 3; // Status
 
-    // FIXME: Move m_deleted back inside NDEBUG when http://webkit.org/b/53045 is fixed.
-    bool m_deleted;
 #ifndef NDEBUG
+    bool m_deleted;
     unsigned m_lruIndex;
 #endif
 
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.cpp b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
index 56715c6..3b6a0b2 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.cpp
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
@@ -34,6 +34,7 @@
 #include "CachedScript.h"
 #include "CachedXSLStyleSheet.h"
 #include "Console.h"
+#include "ContentSecurityPolicy.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "Frame.h"
@@ -41,7 +42,6 @@
 #include "FrameLoaderClient.h"
 #include "HTMLElement.h"
 #include "Logging.h"
-#include "NestingLevelIncrementer.h"
 #include "MemoryCache.h"
 #include "PingLoader.h"
 #include "ResourceLoadScheduler.h"
@@ -85,21 +85,18 @@ CachedResourceLoader::CachedResourceLoader(Document* document)
     , m_autoLoadImages(true)
     , m_loadFinishing(false)
     , m_allowStaleResources(false)
+<<<<<<< HEAD
 #ifdef ANDROID_BLOCK_NETWORK_IMAGE
     , m_blockNetworkImage(false)
 #endif
     , m_isInMethod(0)
+=======
+>>>>>>> webkit.org at r82507
 {
 }
 
 CachedResourceLoader::~CachedResourceLoader()
 {
-    // Try to catch https://bugs.webkit.org/show_bug.cgi?id=54486
-    // Crashes under CachedResourceLoader::revalidateResource
-    // FIXME: Remove this and the related code when it has served its purpose.
-    if (m_isInMethod)
-        CRASH();
-
     m_document = 0;
 
     cancelRequests();
@@ -131,7 +128,6 @@ Frame* CachedResourceLoader::frame() const
 
 CachedImage* CachedResourceLoader::requestImage(const String& url)
 {
-    NestingLevelIncrementer debugIncrementer(m_isInMethod);
     if (Frame* f = frame()) {
         Settings* settings = f->settings();
         if (!f->loader()->client()->allowImages(!settings || settings->areImagesEnabled()))
@@ -169,7 +165,6 @@ CachedCSSStyleSheet* CachedResourceLoader::requestCSSStyleSheet(const String& ur
 
 CachedCSSStyleSheet* CachedResourceLoader::requestUserCSSStyleSheet(const String& requestURL, const String& charset)
 {
-    NestingLevelIncrementer debugIncrementer(m_isInMethod);
     KURL url = MemoryCache::removeFragmentIdentifierIfNeeded(KURL(KURL(), requestURL));
 
     if (CachedResource* existing = memoryCache()->resourceForURL(url)) {
@@ -235,9 +230,6 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
         }
         break;
 #endif
-    default:
-        ASSERT_NOT_REACHED();
-        break;
     }
 
     // Given that the load is allowed by the same-origin policy, we should
@@ -271,17 +263,17 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
         // Prefetch cannot affect the current document.
         break;
 #endif
-    default:
-        ASSERT_NOT_REACHED();
-        break;
     }
     // FIXME: Consider letting the embedder block mixed content loads.
+
+    if (type == CachedResource::Script && !m_document->contentSecurityPolicy()->allowScriptFromSource(url))
+        return false;
+
     return true;
 }
 
 CachedResource* CachedResourceLoader::requestResource(CachedResource::Type type, const String& resourceURL, const String& charset, ResourceLoadPriority priority, bool forPreload)
 {
-    NestingLevelIncrementer debugIncrementer(m_isInMethod);
     KURL url = m_document->completeURL(resourceURL);
     
     LOG(ResourceLoading, "CachedResourceLoader::requestResource '%s', charset '%s', priority=%d, forPreload=%u", url.string().latin1().data(), charset.latin1().data(), priority, forPreload);
@@ -348,7 +340,8 @@ CachedResource* CachedResourceLoader::revalidateResource(CachedResource* resourc
     ASSERT(resource->canUseCacheValidator());
     ASSERT(!resource->resourceToRevalidate());
     
-    const String& url = resource->url();
+    // Copy the URL out of the resource to be revalidated in case it gets deleted by the remove() call below.
+    String url = resource->url();
     CachedResource* newResource = createResource(resource->type(), KURL(ParsedURLString, url), resource->encoding());
     
     LOG(ResourceLoading, "Resource %p created to revalidate %p", newResource, resource);
@@ -489,7 +482,6 @@ void CachedResourceLoader::printAccessDeniedMessage(const KURL& url) const
 
 void CachedResourceLoader::setAutoLoadImages(bool enable)
 {
-    NestingLevelIncrementer debugIncrementer(m_isInMethod);
     if (enable == m_autoLoadImages)
         return;
 
@@ -566,7 +558,6 @@ void CachedResourceLoader::removeCachedResource(CachedResource* resource) const
 
 void CachedResourceLoader::load(CachedResource* resource, bool incremental, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks)
 {
-    NestingLevelIncrementer debugIncrementer(m_isInMethod);
     incrementRequestCount(resource);
 
     RefPtr<CachedResourceRequest> request = CachedResourceRequest::load(this, resource, incremental, securityCheck, sendResourceLoadCallbacks);
@@ -576,7 +567,6 @@ void CachedResourceLoader::load(CachedResource* resource, bool incremental, Secu
 
 void CachedResourceLoader::loadDone(CachedResourceRequest* request)
 {
-    NestingLevelIncrementer debugIncrementer(m_isInMethod);
     m_loadFinishing = false;
     RefPtr<CachedResourceRequest> protect(request);
     if (request)
@@ -653,7 +643,6 @@ int CachedResourceLoader::requestCount()
     
 void CachedResourceLoader::preload(CachedResource::Type type, const String& url, const String& charset, bool referencedFromBody)
 {
-    NestingLevelIncrementer debugIncrementer(m_isInMethod);
     bool hasRendering = m_document->body() && m_document->body()->renderer();
     if (!hasRendering && (referencedFromBody || type == CachedResource::ImageResource)) {
         // Don't preload images or body resources before we have something to draw. This prevents
@@ -680,7 +669,6 @@ void CachedResourceLoader::checkForPendingPreloads()
 
 void CachedResourceLoader::requestPreload(CachedResource::Type type, const String& url, const String& charset)
 {
-    NestingLevelIncrementer debugIncrementer(m_isInMethod);
     String encoding;
     if (type == CachedResource::Script || type == CachedResource::CSSStyleSheet)
         encoding = charset.isEmpty() ? m_document->charset() : charset;
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.h b/Source/WebCore/loader/cache/CachedResourceLoader.h
index 0302010..a68ebd3 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.h
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.h
@@ -153,12 +153,15 @@ private:
     bool m_autoLoadImages : 1;
     bool m_loadFinishing : 1;
     bool m_allowStaleResources : 1;
+<<<<<<< HEAD
 #ifdef ANDROID_BLOCK_NETWORK_IMAGE
     bool m_blockNetworkImage : 1;
 #endif
     
     // FIME: For debugging, remove.
     unsigned m_isInMethod;
+=======
+>>>>>>> webkit.org at r82507
 };
 
 }
diff --git a/Source/WebCore/loader/cache/CachedScript.cpp b/Source/WebCore/loader/cache/CachedScript.cpp
index bfd39c5..e1a8a32 100644
--- a/Source/WebCore/loader/cache/CachedScript.cpp
+++ b/Source/WebCore/loader/cache/CachedScript.cpp
@@ -88,6 +88,8 @@ const String& CachedScript::script()
         m_script += m_decoder->flush();
         setDecodedSize(m_script.length() * sizeof(UChar));
     }
+    m_decodedDataDeletionTimer.startOneShot(0);
+    
     return m_script;
 }
 
@@ -102,16 +104,6 @@ void CachedScript::data(PassRefPtr<SharedBuffer> data, bool allDataReceived)
     checkNotify();
 }
 
-void CachedScript::checkNotify()
-{
-    if (isLoading())
-        return;
-
-    CachedResourceClientWalker w(m_clients);
-    while (CachedResourceClient* c = w.next())
-        c->notifyFinished(this);
-}
-
 void CachedScript::error(CachedResource::Status status)
 {
     setStatus(status);
@@ -125,7 +117,7 @@ void CachedScript::destroyDecodedData()
     m_script = String();
     unsigned extraSize = 0;
 #if USE(JSC)
-    if (m_sourceProviderCache)
+    if (m_sourceProviderCache && m_clients.isEmpty())
         m_sourceProviderCache->clear();
 
     extraSize = m_sourceProviderCache ? m_sourceProviderCache->byteSize() : 0;
diff --git a/Source/WebCore/loader/cache/CachedScript.h b/Source/WebCore/loader/cache/CachedScript.h
index 85c3805..a4ea453 100644
--- a/Source/WebCore/loader/cache/CachedScript.h
+++ b/Source/WebCore/loader/cache/CachedScript.h
@@ -55,8 +55,6 @@ namespace WebCore {
         virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived);
         virtual void error(Status);
 
-        void checkNotify();
-
         virtual void destroyDecodedData();
 #if USE(JSC)        
         // Allows JSC to cache additional information about the source.
diff --git a/Source/WebCore/loader/cf/SubresourceLoaderCF.cpp b/Source/WebCore/loader/cf/SubresourceLoaderCF.cpp
new file mode 100644
index 0000000..f6ce93f
--- /dev/null
+++ b/Source/WebCore/loader/cf/SubresourceLoaderCF.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SubresourceLoader.h"
+
+#include "SubresourceLoaderClient.h"
+
+namespace WebCore {
+
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+void SubresourceLoader::didReceiveDataArray(CFArrayRef dataArray)
+{
+    // Reference the object in this method since the additional processing can do
+    // anything including removing the last reference to this object; one example of this is 3266216.
+    RefPtr<SubresourceLoader> protect(this);
+
+    ResourceLoader::didReceiveDataArray(dataArray);
+
+    // A subresource loader does not load multipart sections progressively.
+    // So don't deliver any data to the loader yet.
+    if (!m_loadingMultipartContent && m_client) {
+        CFIndex arrayCount = CFArrayGetCount(dataArray);
+        for (CFIndex i = 0; i < arrayCount; ++i)  {
+            CFDataRef data = reinterpret_cast<CFDataRef>(CFArrayGetValueAtIndex(dataArray, i));
+            m_client->didReceiveData(this, reinterpret_cast<const char *>(CFDataGetBytePtr(data)), static_cast<int>(CFDataGetLength(data)));
+        }
+    }
+}
+#endif
+
+}
diff --git a/Source/WebCore/loader/icon/IconDatabase.cpp b/Source/WebCore/loader/icon/IconDatabase.cpp
index 26f3bb7..e5578e0 100644
--- a/Source/WebCore/loader/icon/IconDatabase.cpp
+++ b/Source/WebCore/loader/icon/IconDatabase.cpp
@@ -58,7 +58,6 @@
 
 namespace WebCore {
 
-static IconDatabase* sharedIconDatabase = 0;
 static int databaseCleanupCounter = 0;
 
 // This version number is in the DB and marks the current generation of the schema
@@ -85,21 +84,22 @@ static String urlForLogging(const String& url)
 }
 #endif
 
+class DefaultIconDatabaseClient : public IconDatabaseClient {
+public:
+    virtual bool performImport() { return true; }
+    virtual void didImportIconURLForPageURL(const String&) { } 
+    virtual void didImportIconDataForPageURL(const String&) { }
+    virtual void didChangeIconForPageURL(const String&) { }
+    virtual void didRemoveAllIcons() { }
+    virtual void didFinishURLImport() { }
+};
+
 static IconDatabaseClient* defaultClient() 
 {
-    static IconDatabaseClient* defaultClient = new IconDatabaseClient();
+    static IconDatabaseClient* defaultClient = new DefaultIconDatabaseClient();
     return defaultClient;
 }
 
-IconDatabase& iconDatabase()
-{
-    if (!sharedIconDatabase) {
-        ScriptController::initializeThreading();
-        sharedIconDatabase = new IconDatabase;
-    }
-    return *sharedIconDatabase;
-}
-
 // ************************
 // *** Main Thread Only ***
 // ************************
@@ -117,7 +117,7 @@ void IconDatabase::setClient(IconDatabaseClient* client)
     m_client = client;
 }
 
-bool IconDatabase::open(const String& databasePath)
+bool IconDatabase::open(const String& directory, const String& filename)
 {
     ASSERT_NOT_SYNC_THREAD();
 
@@ -129,10 +129,10 @@ bool IconDatabase::open(const String& databasePath)
         return false;
     }
 
-    m_databaseDirectory = databasePath.crossThreadString();
+    m_databaseDirectory = directory.crossThreadString();
 
     // Formulate the full path for the database file
-    m_completeDatabasePath = pathByAppendingComponent(m_databaseDirectory, defaultDatabaseFilename());
+    m_completeDatabasePath = pathByAppendingComponent(m_databaseDirectory, filename);
 
     // Lock here as well as first thing in the thread so the thread doesn't actually commence until the createThread() call 
     // completes and m_syncThreadRunning is properly set
@@ -217,7 +217,7 @@ void IconDatabase::removeAllIcons()
     wakeSyncThread();
 }
 
-Image* IconDatabase::iconForPageURL(const String& pageURLOriginal, const IntSize& size)
+Image* IconDatabase::synchronousIconForPageURL(const String& pageURLOriginal, const IntSize& size)
 {   
     ASSERT_NOT_SYNC_THREAD();
 
@@ -301,10 +301,10 @@ void IconDatabase::readIconForPageURLFromDisk(const String& pageURL)
     // The effect of asking for an Icon for a pageURL automatically queues it to be read from disk
     // if it hasn't already been set in memory.  The special IntSize (0, 0) is a special way of telling 
     // that method "I don't care about the actual Image, i just want you to make sure you're getting it from disk.
-    iconForPageURL(pageURL, IntSize(0,0));
+    synchronousIconForPageURL(pageURL, IntSize(0, 0));
 }
 
-String IconDatabase::iconURLForPageURL(const String& pageURLOriginal)
+String IconDatabase::synchronousIconURLForPageURL(const String& pageURLOriginal)
 {    
     ASSERT_NOT_SYNC_THREAD(); 
         
@@ -565,7 +565,7 @@ void IconDatabase::setIconDataForIconURL(PassRefPtr<SharedBuffer> dataOriginal,
 
         for (unsigned i = 0; i < pageURLs.size(); ++i) {
             LOG(IconDatabase, "Dispatching notification that retaining pageURL %s has a new icon", urlForLogging(pageURLs[i]).ascii().data());
-            m_client->dispatchDidAddIconForPageURL(pageURLs[i]);
+            m_client->didChangeIconForPageURL(pageURLs[i]);
 
             pool.cycle();
         }
@@ -637,11 +637,11 @@ void IconDatabase::setIconURLForPageURL(const String& iconURLOriginal, const Str
         
         LOG(IconDatabase, "Dispatching notification that we changed an icon mapping for url %s", urlForLogging(pageURL).ascii().data());
         AutodrainedPool pool;
-        m_client->dispatchDidAddIconForPageURL(pageURL);
+        m_client->didChangeIconForPageURL(pageURL);
     }
 }
 
-IconLoadDecision IconDatabase::loadDecisionForIconURL(const String& iconURL, DocumentLoader* notificationDocumentLoader)
+IconLoadDecision IconDatabase::synchronousLoadDecisionForIconURL(const String& iconURL, DocumentLoader* notificationDocumentLoader)
 {
     ASSERT_NOT_SYNC_THREAD();
 
@@ -667,12 +667,13 @@ IconLoadDecision IconDatabase::loadDecisionForIconURL(const String& iconURL, Doc
     // Otherwise - since we refuse to perform I/O on the main thread to find out for sure - we return the answer that says
     // "You might be asked to load this later, so flag that"
     LOG(IconDatabase, "Don't know if we should load %s or not - adding %p to the set of document loaders waiting on a decision", iconURL.ascii().data(), notificationDocumentLoader);
-    m_loadersPendingDecision.add(notificationDocumentLoader);    
+    if (notificationDocumentLoader)
+        m_loadersPendingDecision.add(notificationDocumentLoader);    
 
     return IconLoadUnknown;
 }
 
-bool IconDatabase::iconDataKnownForIconURL(const String& iconURL)
+bool IconDatabase::synchronousIconDataKnownForIconURL(const String& iconURL)
 {
     ASSERT_NOT_SYNC_THREAD();
     
@@ -775,6 +776,7 @@ IconDatabase::IconDatabase()
     , m_imported(false)
     , m_isImportedSet(false)
 {
+    LOG(IconDatabase, "Creating IconDatabase %p", this);
     ASSERT(isMainThread());
 }
 
@@ -1257,7 +1259,7 @@ void IconDatabase::performURLImport()
         {
             MutexLocker locker(m_pendingReadingLock);
             if (m_pageURLsPendingImport.contains(pageURL)) {
-                m_client->dispatchDidAddIconForPageURL(pageURL);
+                dispatchDidImportIconURLForPageURLOnMainThread(pageURL);
                 m_pageURLsPendingImport.remove(pageURL);
             
                 pool.cycle();
@@ -1292,7 +1294,6 @@ void IconDatabase::performURLImport()
     // Loop through the urls pending import
     // Remove unretained ones if database cleanup is allowed
     // Keep a set of ones that are retained and pending notification
-    
     {
         MutexLocker locker(m_urlAndIconLock);
         
@@ -1331,13 +1332,16 @@ void IconDatabase::performURLImport()
     // Now that we don't hold any locks, perform the actual notifications
     for (unsigned i = 0; i < urlsToNotify.size(); ++i) {
         LOG(IconDatabase, "Notifying icon info known for pageURL %s", urlsToNotify[i].ascii().data());
-        m_client->dispatchDidAddIconForPageURL(urlsToNotify[i]);
+        dispatchDidImportIconURLForPageURLOnMainThread(urlsToNotify[i]);
         if (shouldStopThreadActivity())
             return;
 
         pool.cycle();
     }
     
+    // Notify the client that the URL import is complete in case it's managing its own pending notifications.
+    dispatchDidFinishURLImportOnMainThread();
+    
     // Notify all DocumentLoaders that were waiting for an icon load decision on the main thread
     callOnMainThread(notifyPendingLoadDecisionsOnMainThread, this);
 }
@@ -1540,7 +1544,7 @@ bool IconDatabase::readFromDatabase()
         HashSet<String>::iterator end = urlsToNotify.end();
         for (unsigned iteration = 0; iter != end; ++iter, ++iteration) {
             LOG(IconDatabase, "Notifying icon received for pageURL %s", urlForLogging(*iter).ascii().data());
-            m_client->dispatchDidAddIconForPageURL(*iter);
+            dispatchDidImportIconDataForPageURLOnMainThread(*iter);
             if (shouldStopThreadActivity())
                 return didAnyWork;
             
@@ -1738,7 +1742,7 @@ void IconDatabase::removeAllIconsOnThread()
     createDatabaseTables(m_syncDB);
     
     LOG(IconDatabase, "Dispatching notification that we removed all icons");
-    m_client->dispatchDidRemoveAllIcons();    
+    dispatchDidRemoveAllIconsOnMainThread();    
 }
 
 void IconDatabase::deleteAllPreparedStatements()
@@ -2111,6 +2115,132 @@ void IconDatabase::setWasExcludedFromBackup()
     SQLiteStatement(m_syncDB, "INSERT INTO IconDatabaseInfo (key, value) VALUES ('ExcludedFromBackup', 1)").executeCommand();
 }
 
+class ClientWorkItem {
+public:
+    ClientWorkItem(IconDatabaseClient* client)
+        : m_client(client)
+    { }
+    virtual void performWork() = 0;
+    virtual ~ClientWorkItem() { }
+
+protected:
+    IconDatabaseClient* m_client;
+};
+
+class ImportedIconURLForPageURLWorkItem : public ClientWorkItem {
+public:
+    ImportedIconURLForPageURLWorkItem(IconDatabaseClient* client, const String& pageURL)
+        : ClientWorkItem(client)
+        , m_pageURL(new String(pageURL.threadsafeCopy()))
+    { }
+    
+    virtual ~ImportedIconURLForPageURLWorkItem()
+    {
+        delete m_pageURL;
+    }
+
+    virtual void performWork()
+    {
+        ASSERT(m_client);
+        m_client->didImportIconURLForPageURL(*m_pageURL);
+        m_client = 0;
+    }
+    
+private:
+    String* m_pageURL;
+};
+
+class ImportedIconDataForPageURLWorkItem : public ClientWorkItem {
+public:
+    ImportedIconDataForPageURLWorkItem(IconDatabaseClient* client, const String& pageURL)
+        : ClientWorkItem(client)
+        , m_pageURL(new String(pageURL.threadsafeCopy()))
+    { }
+    
+    virtual ~ImportedIconDataForPageURLWorkItem()
+    {
+        delete m_pageURL;
+    }
+
+    virtual void performWork()
+    {
+        ASSERT(m_client);
+        m_client->didImportIconDataForPageURL(*m_pageURL);
+        m_client = 0;
+    }
+    
+private:
+    String* m_pageURL;
+};
+
+class RemovedAllIconsWorkItem : public ClientWorkItem {
+public:
+    RemovedAllIconsWorkItem(IconDatabaseClient* client)
+        : ClientWorkItem(client)
+    { }
+
+    virtual void performWork()
+    {
+        ASSERT(m_client);
+        m_client->didRemoveAllIcons();
+        m_client = 0;
+    }
+};
+
+class FinishedURLImport : public ClientWorkItem {
+public:
+    FinishedURLImport(IconDatabaseClient* client)
+        : ClientWorkItem(client)
+    { }
+
+    virtual void performWork()
+    {
+        ASSERT(m_client);
+        m_client->didFinishURLImport();
+        m_client = 0;
+    }
+};
+
+static void performWorkItem(void* context)
+{
+    ClientWorkItem* item = static_cast<ClientWorkItem*>(context);
+    item->performWork();
+    delete item;
+}
+
+void IconDatabase::dispatchDidImportIconURLForPageURLOnMainThread(const String& pageURL)
+{
+    ASSERT_ICON_SYNC_THREAD();
+
+    ImportedIconURLForPageURLWorkItem* work = new ImportedIconURLForPageURLWorkItem(m_client, pageURL);
+    callOnMainThread(performWorkItem, work);
+}
+
+void IconDatabase::dispatchDidImportIconDataForPageURLOnMainThread(const String& pageURL)
+{
+    ASSERT_ICON_SYNC_THREAD();
+
+    ImportedIconDataForPageURLWorkItem* work = new ImportedIconDataForPageURLWorkItem(m_client, pageURL);
+    callOnMainThread(performWorkItem, work);
+}
+
+void IconDatabase::dispatchDidRemoveAllIconsOnMainThread()
+{
+    ASSERT_ICON_SYNC_THREAD();
+
+    RemovedAllIconsWorkItem* work = new RemovedAllIconsWorkItem(m_client);
+    callOnMainThread(performWorkItem, work);
+}
+
+void IconDatabase::dispatchDidFinishURLImportOnMainThread()
+{
+    ASSERT_ICON_SYNC_THREAD();
+
+    FinishedURLImport* work = new FinishedURLImport(m_client);
+    callOnMainThread(performWorkItem, work);
+}
+
+
 } // namespace WebCore
 
 #endif // ENABLE(ICONDATABASE)
diff --git a/Source/WebCore/loader/icon/IconDatabase.h b/Source/WebCore/loader/icon/IconDatabase.h
index 8617430..7392245 100644
--- a/Source/WebCore/loader/icon/IconDatabase.h
+++ b/Source/WebCore/loader/icon/IconDatabase.h
@@ -27,17 +27,20 @@
 #ifndef IconDatabase_h
 #define IconDatabase_h
 
+#include "IconDatabaseBase.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
 
 #if ENABLE(ICONDATABASE)
 #include "SQLiteDatabase.h"
 #include <wtf/Threading.h>
-#endif
+#endif // ENABLE(ICONDATABASE)
 
 namespace WebCore { 
 
@@ -56,41 +59,48 @@ class SharedBuffer;
 class SQLTransaction;
 #endif
 
-enum IconLoadDecision {
-    IconLoadYes,
-    IconLoadNo,
-    IconLoadUnknown
+#if !ENABLE(ICONDATABASE)
+// For builds with IconDatabase disabled, they'll just use a default derivation of IconDatabaseBase. Which does nothing.
+class IconDatabase : public IconDatabaseBase {
+public:
+    static void delayDatabaseCleanup() { }
+    static String defaultDatabaseFilename() { return "WebpageIcons.db"; }
 };
+#else 
 
-class IconDatabase {
-    WTF_MAKE_NONCOPYABLE(IconDatabase); WTF_MAKE_FAST_ALLOCATED;
+class IconDatabase : public IconDatabaseBase {
+    WTF_MAKE_FAST_ALLOCATED;
+    
 // *** Main Thread Only ***
 public:
-    void setClient(IconDatabaseClient*);
+    static PassOwnPtr<IconDatabase> create() { return new IconDatabase; }
+    ~IconDatabase();
+
+    virtual void setClient(IconDatabaseClient*);
 
-    bool open(const String& path);
-    void close();
+    virtual bool open(const String& directory, const String& filename);
+    virtual void close();
             
-    void removeAllIcons();
+    virtual void removeAllIcons();
 
-    Image* iconForPageURL(const String&, const IntSize&);
     void readIconForPageURLFromDisk(const String&);
-    String iconURLForPageURL(const String&);
-    Image* defaultIcon(const IntSize&);
 
-    void retainIconForPageURL(const String&);
-    void releaseIconForPageURL(const String&);
+    virtual Image* defaultIcon(const IntSize&);
 
-    void setIconDataForIconURL(PassRefPtr<SharedBuffer> data, const String&);
-    void setIconURLForPageURL(const String& iconURL, const String& pageURL);
+    virtual void retainIconForPageURL(const String&);
+    virtual void releaseIconForPageURL(const String&);
+    virtual void setIconDataForIconURL(PassRefPtr<SharedBuffer> data, const String&);
+    virtual void setIconURLForPageURL(const String& iconURL, const String& pageURL);
 
-    IconLoadDecision loadDecisionForIconURL(const String&, DocumentLoader*);
-    bool iconDataKnownForIconURL(const String&);
+    virtual Image* synchronousIconForPageURL(const String&, const IntSize&);
+    virtual String synchronousIconURLForPageURL(const String&);
+    virtual bool synchronousIconDataKnownForIconURL(const String&);
+    virtual IconLoadDecision synchronousLoadDecisionForIconURL(const String&, DocumentLoader*);    
     
-    void setEnabled(bool enabled);
-    bool isEnabled() const;
+    virtual void setEnabled(bool);
+    virtual bool isEnabled() const;
     
-    void setPrivateBrowsingEnabled(bool flag);
+    virtual void setPrivateBrowsingEnabled(bool flag);
     bool isPrivateBrowsingEnabled() const;
     
     static void delayDatabaseCleanup();
@@ -98,17 +108,15 @@ public:
     static void checkIntegrityBeforeOpening();
         
     // Support for WebCoreStatistics in WebKit
-    size_t pageURLMappingCount();
-    size_t retainedPageURLCount();
-    size_t iconRecordCount();
-    size_t iconRecordCountWithData();
+    virtual size_t pageURLMappingCount();
+    virtual size_t retainedPageURLCount();
+    virtual size_t iconRecordCount();
+    virtual size_t iconRecordCountWithData();
 
 private:
     IconDatabase();
-    ~IconDatabase();
-    friend IconDatabase& iconDatabase();
+    friend IconDatabaseBase& iconDatabase();
 
-#if ENABLE(ICONDATABASE)
     static void notifyPendingLoadDecisionsOnMainThread(void*);
     void notifyPendingLoadDecisions();
 
@@ -123,15 +131,13 @@ private:
     HashSet<RefPtr<DocumentLoader> > m_loadersPendingDecision;
 
     RefPtr<IconRecord> m_defaultIconRecord;
-#endif // ENABLE(ICONDATABASE)
 
 // *** Any Thread ***
 public:
-    bool isOpen() const;
-    String databasePath() const;
+    virtual bool isOpen() const;
+    virtual String databasePath() const;
     static String defaultDatabaseFilename();
 
-#if ENABLE(ICONDATABASE)
 private:
     PassRefPtr<IconRecord> getOrCreateIconRecord(const String& iconURL);
     PageURLRecord* getOrCreatePageURLRecord(const String& pageURL);
@@ -166,17 +172,15 @@ private:
     HashSet<String> m_pageURLsPendingImport;
     HashSet<String> m_pageURLsInterestedInIcons;
     HashSet<IconRecord*> m_iconsPendingReading;
-#endif // ENABLE(ICONDATABASE)
 
 // *** Sync Thread Only ***
 public:
     // Should be used only on the sync thread and only by the Safari 2 Icons import procedure
-    void importIconURLForPageURL(const String& iconURL, const String& pageURL);
-    void importIconDataForIconURL(PassRefPtr<SharedBuffer> data, const String& iconURL);
+    virtual void importIconURLForPageURL(const String& iconURL, const String& pageURL);
+    virtual void importIconDataForIconURL(PassRefPtr<SharedBuffer> data, const String& iconURL);
     
-    bool shouldStopThreadActivity() const;
+    virtual bool shouldStopThreadActivity() const;
 
-#if ENABLE(ICONDATABASE)
 private:    
     static void* iconDatabaseSyncThreadStart(void *);
     void* iconDatabaseSyncThread();
@@ -213,6 +217,12 @@ private:
     void removeIconFromSQLDatabase(const String& iconURL);
     void writeIconSnapshotToSQLDatabase(const IconSnapshot&);    
     
+    // Methods to dispatch client callbacks on the main thread
+    void dispatchDidImportIconURLForPageURLOnMainThread(const String&);
+    void dispatchDidImportIconDataForPageURLOnMainThread(const String&);
+    void dispatchDidRemoveAllIconsOnMainThread();
+    void dispatchDidFinishURLImportOnMainThread();
+    
     // The client is set by the main thread before the thread starts, and from then on is only used by the sync thread
     IconDatabaseClient* m_client;
     
@@ -236,11 +246,9 @@ private:
     OwnPtr<SQLiteStatement> m_updateIconDataStatement;
     OwnPtr<SQLiteStatement> m_setIconInfoStatement;
     OwnPtr<SQLiteStatement> m_setIconDataStatement;
-#endif // ENABLE(ICONDATABASE)
 };
 
-// Function to obtain the global icon database.
-IconDatabase& iconDatabase();
+#endif // !ENABLE(ICONDATABASE)
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/mac/SSLKeyGeneratorMac.mm b/Source/WebCore/loader/icon/IconDatabaseBase.cpp
index dd76b59..f552412 100644
--- a/Source/WebCore/platform/mac/SSLKeyGeneratorMac.mm
+++ b/Source/WebCore/loader/icon/IconDatabaseBase.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,27 +23,47 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#import "config.h"
-#import "SSLKeyGenerator.h"
+#include "config.h"
+#include "IconDatabaseBase.h"
 
-#import "KURL.h"
-#import "WebCoreKeyGenerator.h"
+#include "IconDatabase.h"
+#include "SharedBuffer.h"
 
 namespace WebCore {
 
-void getSupportedKeySizes(Vector<String>& supportedKeySizes)
-{ 
-    NSEnumerator *enumerator = [[[WebCoreKeyGenerator sharedGenerator] strengthMenuItemTitles] objectEnumerator];
-    NSString *string;
-    while ((string = [enumerator nextObject]) != nil)
-        supportedKeySizes.append(string);
+String IconDatabaseBase::synchronousIconURLForPageURL(const String&)
+{
+    return String();
 }
 
-String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String& challengeString, const KURL& url)
-{   
-    return [[WebCoreKeyGenerator sharedGenerator] signedPublicKeyAndChallengeStringWithStrengthIndex:keySizeIndex 
-                                                                                           challenge:challengeString
-                                                                                             pageURL:url];
+String IconDatabaseBase::databasePath() const
+{
+    return String();
 }
 
+bool IconDatabaseBase::open(const String&, const String&)
+{
+    return false;
 }
+
+static IconDatabaseBase* globalDatabase = 0;
+
+// Functions to get/set the global icon database.
+IconDatabaseBase& iconDatabase()
+{
+    if (globalDatabase)
+        return *globalDatabase;
+
+    static IconDatabaseBase* defaultDatabase = 0;        
+    if (!defaultDatabase)
+        defaultDatabase = new IconDatabase;
+
+    return *defaultDatabase;
+}
+
+void setGlobalIconDatabase(IconDatabaseBase* newGlobalDatabase)
+{
+    globalDatabase = newGlobalDatabase;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/loader/icon/IconDatabaseBase.h b/Source/WebCore/loader/icon/IconDatabaseBase.h
new file mode 100644
index 0000000..bc665ba
--- /dev/null
+++ b/Source/WebCore/loader/icon/IconDatabaseBase.h
@@ -0,0 +1,221 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef IconDatabaseBase_h
+#define IconDatabaseBase_h
+
+#include "SharedBuffer.h"
+
+#include <wtf/Forward.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore { 
+
+class DocumentLoader;
+class IconDatabaseClient;
+class Image;
+class IntSize;
+
+enum IconLoadDecision {
+    IconLoadYes,
+    IconLoadNo,
+    IconLoadUnknown
+};
+
+class CallbackBase : public RefCounted<CallbackBase> {
+public:
+    virtual ~CallbackBase()
+    {
+    }
+
+    uint64_t callbackID() const { return m_callbackID; }
+
+protected:
+    CallbackBase(void* context)
+        : m_context(context)
+        , m_callbackID(generateCallbackID())
+    {
+    }
+
+    void* context() const { return m_context; }
+
+private:
+    static uint64_t generateCallbackID()
+    {
+        static uint64_t uniqueCallbackID = 1;
+        return uniqueCallbackID++;
+    }
+
+    void* m_context;
+    uint64_t m_callbackID;
+};
+
+template<typename EnumType> 
+class EnumCallback : public CallbackBase {
+public:
+    typedef void (*CallbackFunction)(EnumType, void*);
+
+    static PassRefPtr<EnumCallback> create(void* context, CallbackFunction callback)
+    {
+        return adoptRef(new EnumCallback(context, callback));
+    }
+
+    virtual ~EnumCallback()
+    {
+        ASSERT(!m_callback);
+    }
+
+    void performCallback(EnumType result)
+    {
+        if (!m_callback)
+            return;
+        m_callback(result, context());
+        m_callback = 0;
+    }
+    
+    void invalidate()
+    {
+        m_callback = 0;
+    }
+
+private:
+    EnumCallback(void* context, CallbackFunction callback)
+        : CallbackBase(context)
+        , m_callback(callback)
+    {
+        ASSERT(m_callback);
+    }
+
+    CallbackFunction m_callback;
+};
+
+template<typename ObjectType> 
+class ObjectCallback : public CallbackBase {
+public:
+    typedef void (*CallbackFunction)(ObjectType, void*);
+
+    static PassRefPtr<ObjectCallback> create(void* context, CallbackFunction callback)
+    {
+        return adoptRef(new ObjectCallback(context, callback));
+    }
+
+    virtual ~ObjectCallback()
+    {
+        ASSERT(!m_callback);
+    }
+
+    void performCallback(ObjectType result)
+    {
+        if (!m_callback)
+            return;
+        m_callback(result, context());
+        m_callback = 0;
+    }
+    
+    void invalidate()
+    {
+        m_callback = 0;
+    }
+
+private:
+    ObjectCallback(void* context, CallbackFunction callback)
+        : CallbackBase(context)
+        , m_callback(callback)
+    {
+        ASSERT(m_callback);
+    }
+
+    CallbackFunction m_callback;
+};
+
+typedef EnumCallback<IconLoadDecision> IconLoadDecisionCallback;
+typedef ObjectCallback<SharedBuffer*> IconDataCallback;
+
+class IconDatabaseBase {
+    WTF_MAKE_NONCOPYABLE(IconDatabaseBase);
+
+protected:
+    IconDatabaseBase() { }
+
+public:
+    virtual ~IconDatabaseBase() { }
+
+    // Used internally by WebCore
+    virtual bool isEnabled() const { return false; }
+        
+    virtual void retainIconForPageURL(const String&) { }
+    virtual void releaseIconForPageURL(const String&) { }
+
+    virtual void setIconURLForPageURL(const String&, const String&) { }
+    virtual void setIconDataForIconURL(PassRefPtr<SharedBuffer>, const String&) { }
+
+    // Synchronous calls used internally by WebCore.
+    // Usage should be replaced by asynchronous calls.
+    virtual String synchronousIconURLForPageURL(const String&);
+    virtual bool synchronousIconDataKnownForIconURL(const String&) { return false; }
+    virtual IconLoadDecision synchronousLoadDecisionForIconURL(const String&, DocumentLoader*) { return IconLoadNo; }
+    virtual Image* synchronousIconForPageURL(const String&, const IntSize&) { return 0; }
+    
+    // Asynchronous calls we should use to replace the above when supported.
+    virtual bool supportsAsynchronousMode() { return false; }
+    virtual void loadDecisionForIconURL(const String&, PassRefPtr<IconLoadDecisionCallback>) { }
+    virtual void iconDataForIconURL(const String&, PassRefPtr<IconDataCallback>) { }
+    
+
+    // Used within one or more WebKit ports.
+    // We should try to remove these dependencies from the IconDatabaseBase class.
+    virtual void setEnabled(bool) { }
+
+    virtual Image* defaultIcon(const IntSize&) { return 0; }
+
+    virtual size_t pageURLMappingCount() { return 0; }
+    virtual size_t retainedPageURLCount() { return 0; }
+    virtual size_t iconRecordCount() { return 0; }
+    virtual size_t iconRecordCountWithData() { return 0; }
+
+    virtual void importIconURLForPageURL(const String&, const String&) { }
+    virtual void importIconDataForIconURL(PassRefPtr<SharedBuffer>, const String&) { }
+    virtual bool shouldStopThreadActivity() const { return true; }
+
+    virtual bool open(const String& directory, const String& filename);
+    virtual void close() { }
+    virtual void removeAllIcons() { }
+
+    virtual void setPrivateBrowsingEnabled(bool) { }
+    virtual void setClient(IconDatabaseClient*) { }
+    
+    virtual bool isOpen() const { return false; }
+    virtual String databasePath() const;
+
+};
+
+// Functions to get/set the global icon database.
+IconDatabaseBase& iconDatabase();
+void setGlobalIconDatabase(IconDatabaseBase*);
+
+} // namespace WebCore
+
+#endif // IconDatabaseBase_h
diff --git a/Source/WebCore/loader/icon/IconDatabaseClient.h b/Source/WebCore/loader/icon/IconDatabaseClient.h
index f97a2a8..3d5f349 100644
--- a/Source/WebCore/loader/icon/IconDatabaseClient.h
+++ b/Source/WebCore/loader/icon/IconDatabaseClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,23 +29,20 @@
 #ifndef IconDatabaseClient_h
 #define IconDatabaseClient_h
 
-#include <wtf/FastAllocBase.h>
 #include <wtf/Forward.h>
-#include <wtf/Noncopyable.h>
-
-// All of these client methods will be called from a non-main thread
-// Take appropriate measures
  
 namespace WebCore {
 
 class IconDatabaseClient {
-    WTF_MAKE_NONCOPYABLE(IconDatabaseClient); WTF_MAKE_FAST_ALLOCATED;
 public:
-    IconDatabaseClient() { }
     virtual ~IconDatabaseClient() { }
-    virtual bool performImport() { return true; }
-    virtual void dispatchDidRemoveAllIcons() { }
-    virtual void dispatchDidAddIconForPageURL(const String& /*pageURL*/) { }
+
+    virtual bool performImport() = 0;
+    virtual void didImportIconURLForPageURL(const String&) = 0;
+    virtual void didImportIconDataForPageURL(const String&) = 0;
+    virtual void didChangeIconForPageURL(const String&) = 0;
+    virtual void didRemoveAllIcons() = 0;
+    virtual void didFinishURLImport() = 0;
 };
  
 } // namespace WebCore 
diff --git a/Source/WebCore/loader/icon/IconDatabaseNone.cpp b/Source/WebCore/loader/icon/IconDatabaseNone.cpp
deleted file mode 100644
index de28cdd..0000000
--- a/Source/WebCore/loader/icon/IconDatabaseNone.cpp
+++ /dev/null
@@ -1,218 +0,0 @@
-/*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "IconDatabase.h"
-
-#if !ENABLE(ICONDATABASE)
-
-#include "PlatformString.h"
-#include "SharedBuffer.h"
-#include <wtf/StdLibExtras.h>
-
-namespace WebCore {
-
-static IconDatabase* sharedIconDatabase = 0;
-
-// This version number is in the DB and marks the current generation of the schema
-// Theoretically once the switch is flipped this should never change
-// Currently, an out-of-date schema causes the DB to be wiped and reset.  This isn't 
-// so bad during development but in the future, we would need to write a conversion
-// function to advance older released schemas to "current"
-const int currentDatabaseVersion = 5;
-
-// Icons expire once a day
-const int iconExpirationTime = 60*60*24; 
-// Absent icons are rechecked once a week
-const int missingIconExpirationTime = 60*60*24*7; 
-
-const int updateTimerDelay = 5; 
-
-String IconDatabase::defaultDatabaseFilename()
-{
-    DEFINE_STATIC_LOCAL(String, defaultDatabaseFilename, ("Icons.db"));
-    return defaultDatabaseFilename.threadsafeCopy();
-}
-
-IconDatabase& iconDatabase()
-{
-    if (!sharedIconDatabase)
-        sharedIconDatabase = new IconDatabase;
-    return *sharedIconDatabase;
-}
-
-IconDatabase::IconDatabase()
-{
-}
-
-bool IconDatabase::open(const String& /*databasePath*/)
-{
-    return false;
-}
-
-bool IconDatabase::isOpen() const
-{
-    return false;
-}
-
-void IconDatabase::close()
-{
-}
-
-String IconDatabase::databasePath() const
-{
-    return String();
-}
-
-void IconDatabase::removeAllIcons()
-{
-}
-
-void IconDatabase::setPrivateBrowsingEnabled(bool /*flag*/)
-{
-}
-
-bool IconDatabase::isPrivateBrowsingEnabled() const
-{
-    return false;
-}
-
-void IconDatabase::readIconForPageURLFromDisk(const String&)
-{
-
-}
-
-Image* IconDatabase::iconForPageURL(const String& /*pageURL*/, const IntSize& size)
-{
-    return defaultIcon(size);
-}
-
-
-IconLoadDecision IconDatabase::loadDecisionForIconURL(const String&, DocumentLoader*)
-{
-    return IconLoadNo;
-}
-
-bool IconDatabase::iconDataKnownForIconURL(const String&)
-{
-    return false;
-}
-
-String IconDatabase::iconURLForPageURL(const String& /*pageURL*/)
-{
-    return String();
-}
-
-Image* IconDatabase::defaultIcon(const IntSize& /*size*/)
-{
-    return 0;
-}
-
-void IconDatabase::retainIconForPageURL(const String& /*pageURL*/)
-{
-}
-
-void IconDatabase::releaseIconForPageURL(const String& /*pageURL*/)
-{
-}
-
-void IconDatabase::setIconDataForIconURL(PassRefPtr<SharedBuffer> /*data*/, const String& /*iconURL*/)
-{
-}
-
-void IconDatabase::setIconURLForPageURL(const String& /*iconURL*/, const String& /*pageURL*/)
-{
-}
-
-void IconDatabase::setEnabled(bool /*enabled*/)
-{
-}
-
-bool IconDatabase::isEnabled() const
-{
-    return false;
-}
-
-IconDatabase::~IconDatabase()
-{
-    ASSERT_NOT_REACHED();
-}
-
-void IconDatabase::checkIntegrityBeforeOpening()
-{
-}
-
-void IconDatabase::delayDatabaseCleanup()
-{
-}
-
-void IconDatabase::allowDatabaseCleanup()
-{
-}
-
-size_t IconDatabase::pageURLMappingCount()
-{
-    return 0;
-}
-
-size_t IconDatabase::retainedPageURLCount()
-{
-    return 0;
-}
-
-size_t IconDatabase::iconRecordCount()
-{
-    return 0;
-}
-
-size_t IconDatabase::iconRecordCountWithData()
-{
-    return 0;
-}
-
-void IconDatabase::setClient(IconDatabaseClient*)
-{
-}
-
-// ************************
-// *** Sync Thread Only ***
-// ************************
-
-void IconDatabase::importIconURLForPageURL(const String&, const String&)
-{
-}
-
-void IconDatabase::importIconDataForIconURL(PassRefPtr<SharedBuffer>, const String&)
-{
-}
-
-bool IconDatabase::shouldStopThreadActivity() const
-{
-    return true;
-}
-
-} // namespace WebCore
-
-#endif // !ENABLE(ICONDATABASE)
diff --git a/Source/WebCore/loader/mac/ResourceLoaderMac.mm b/Source/WebCore/loader/mac/ResourceLoaderMac.mm
index 3835517..b42f8e0 100644
--- a/Source/WebCore/loader/mac/ResourceLoaderMac.mm
+++ b/Source/WebCore/loader/mac/ResourceLoaderMac.mm
@@ -35,6 +35,10 @@
 #include "FrameLoaderClient.h"
 #include "ResourceHandle.h"
 
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+#include "InspectorInstrumentation.h"
+#endif
+
 namespace WebCore {
 
 NSCachedURLResponse* ResourceLoader::willCacheResponse(ResourceHandle*, NSCachedURLResponse* response)
@@ -44,6 +48,44 @@ NSCachedURLResponse* ResourceLoader::willCacheResponse(ResourceHandle*, NSCached
     return frameLoader()->client()->willCacheResponse(documentLoader(), identifier(), response);
 }
 
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+
+void ResourceLoader::didReceiveDataArray(CFArrayRef dataArray)
+{
+    // Protect this in this delegate method since the additional processing can do
+    // anything including possibly derefing this; one example of this is Radar 3266216.
+    RefPtr<ResourceLoader> protector(this);
+
+    if (!m_shouldBufferData)
+        return;
+
+    if (!m_resourceData)
+        m_resourceData = SharedBuffer::create();
+
+    CFIndex arrayCount = CFArrayGetCount(dataArray);
+    for (CFIndex i = 0; i < arrayCount; ++i) {
+        CFDataRef data = static_cast<CFDataRef>(CFArrayGetValueAtIndex(dataArray, i));
+        int dataLen = static_cast<int>(CFDataGetLength(data));
+
+        m_resourceData->append(data);
+
+        // FIXME: If we get a resource with more than 2B bytes, this code won't do the right thing.
+        // However, with today's computers and networking speeds, this won't happen in practice.
+        // Could be an issue with a giant local file.
+        if (m_sendResourceLoadCallbacks && m_frame)
+            frameLoader()->notifier()->didReceiveData(this, reinterpret_cast<const char*>(CFDataGetBytePtr(data)), dataLen, dataLen);
+    }
+}
+
+void ResourceLoader::didReceiveDataArray(ResourceHandle*, CFArrayRef dataArray)
+{
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willReceiveResourceData(m_frame.get(), identifier());
+    didReceiveDataArray(dataArray);
+    InspectorInstrumentation::didReceiveResourceData(cookie);
+}
+
+#endif
+
 }
 
 #endif // !USE(CFNETWORK)
diff --git a/Source/WebCore/manual-tests/autocorrection/close-window-when-correction-is-shown.html b/Source/WebCore/manual-tests/autocorrection/close-window-when-correction-is-shown.html
new file mode 100644
index 0000000..5c82a20
--- /dev/null
+++ b/Source/WebCore/manual-tests/autocorrection/close-window-when-correction-is-shown.html
@@ -0,0 +1,48 @@
+<html>
+<head>
+
+<style>
+.editing {
+    border: 2px solid red;
+    padding: 12px;
+    font-size: 24px;
+}
+</style>
+<script src=../../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
+
+<script>
+function editingTest() {
+    typeCharacterCommand('t');
+    typeCharacterCommand('h');
+    typeCharacterCommand('e');
+    typeCharacterCommand(' ');
+    typeCharacterCommand('m');
+    typeCharacterCommand('e');
+    typeCharacterCommand('s');
+    typeCharacterCommand('a');
+    typeCharacterCommand('e');
+    typeCharacterCommand('g');
+    typeCharacterCommand('e');
+    typeCharacterCommand('e');
+    typeCharacterCommand(' ');
+    execMoveSelectionBackwardByCharacterCommand();
+}
+
+</script>
+
+<title>Testing closing window when correction suggestion is shown</title>
+</head>
+<body>
+<div><p>This test verifies that when correction suggestion is visible, closing window doesn't hang or crash.</p>
+<p>After seeing the panel with multiple candidates, close the window.</p>
+<div contenteditable id="root" class="editing">
+<span id="test"></span>
+</div>
+
+
+<script>
+runEditingTest();
+</script>
+
+</body>
+</html>
diff --git a/Source/WebCore/manual-tests/database-callback-deferred.html b/Source/WebCore/manual-tests/database-callback-deferred.html
deleted file mode 100644
index cf3d03a..0000000
--- a/Source/WebCore/manual-tests/database-callback-deferred.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<html>
-<script>
-function test() {
-    function transactionCallback()
-    {
-        document.getElementById("result").innerHTML = "Callback was called. Test passed";
-    }
-    var db = openDatabase("DatabaseCallbackDeferred", "1.0", "", 1);
-    db.transaction(function(tx) { tx.executeSql("CREATE TABLE IF NOT EXISTS CallbackDeferredTest (randomData)", []); }, transactionCallback, transactionCallback);
-
-    alert("Wait for a few seconds and close it");
-}
-</script>
-<body onload="test()">
-<p id="result">Wait...</p>
-</body>
-</html>
diff --git a/Source/WebCore/manual-tests/input-number-localization.html b/Source/WebCore/manual-tests/input-number-localization.html
index 4647aa5..294022a 100644
--- a/Source/WebCore/manual-tests/input-number-localization.html
+++ b/Source/WebCore/manual-tests/input-number-localization.html
@@ -12,9 +12,9 @@
 <body>
 <div id="console"></div>
 
-<p>Output test: The following text field should have a localized representation for "-1234.56".
-e.g. "-1,234.56" for en_US locale, "-1.234,56" for fr_FR locale.</p>
-<div><input type=number value="-1234.56" step=any></div>
+<p>Output test: The following text field should have a localized representation for "-1234.5678".
+e.g. "-1,234.5678" for en_US locale, "-1.234,5678" for fr_FR locale.</p>
+<div><input type=number value="-1234.5678" step=any></div>
 
 <p>Input test: Type a localized representation of a number into the following text field.
 You'll see an equivalent number in the standard format on the bottom of the text field.</p>
diff --git a/Source/WebCore/manual-tests/media-default-playback-rate.html b/Source/WebCore/manual-tests/media-default-playback-rate.html
new file mode 100644
index 0000000..b980edc
--- /dev/null
+++ b/Source/WebCore/manual-tests/media-default-playback-rate.html
@@ -0,0 +1,90 @@
+
+<html>
+    <head>
+        <!-- LayoutTests location is hard-coded to avoid duplication of code. -->
+        <script src="http://svn.webkit.org/repository/webkit/trunk/LayoutTests/media/media-file.js"></script>
+        <script src="http://svn.webkit.org/repository/webkit/trunk/LayoutTests/media/video-test.js"></script>
+
+        <script>
+            var expectedRates = { "defaultPlaybackRate" : 1, "playbackRate" : 1};
+            var playingFromScript = false;
+            var changedRate = false;
+
+            function absoluteUrl(url)
+            {
+                var a = document.createElement('a');
+                a.href = url;
+                return a.href;
+            }
+
+            function testRates()
+            {
+                consoleWrite("");
+                var playWithControllerButton = !changedRate && !playingFromScript;
+                testExpected("video.playbackRate", playWithControllerButton ? expectedRates['defaultPlaybackRate'] : expectedRates['playbackRate']);
+                testExpected("video.defaultPlaybackRate", expectedRates['defaultPlaybackRate']);
+                changedRate = false;
+            }
+
+            function playing()
+            {
+                consoleWrite("<br>'playing' event");
+                expectedRates['playbackRate'] = playingFromScript ? video.playbackRate : video.defaultPlaybackRate;
+                testRates();
+                playingFromScript = false;
+            }
+
+            function ratechange()
+            {
+                consoleWrite("<br>'ratechange' event");
+                testRates();
+            }
+
+            function start()
+            {
+                findMediaElement();
+                video.addEventListener('ratechange', ratechange);
+                video.addEventListener('playing', playing);
+
+                // Use the video file from the svn repository to avoid duplicating the file.
+                video.src = absoluteUrl(findMediaFile('video', 'http://svn.webkit.org/repository/webkit/trunk/LayoutTests/media/content/test'));
+                testRates();
+            }
+
+            function play()
+            {
+                playingFromScript = true;
+                video.play();
+            }
+
+            function setRate(which, rate)
+            {
+                changedRate = true;
+                video[which] = rate;
+                expectedRates[which] = rate;
+            }
+
+        </script>
+    </head>
+
+    <body onload="start()">
+        
+        <video controls > </video>
+        <ul>
+            <li>The current 'playbackRate' and 'defaultPlaybackRate' should be logged every time either changes.</li>
+            <li>'playbackRate' should be set to 'defaultPlaybackRate' when the Play button in the built-in controls is pressed</li>
+            <li>'playbackRate' should NOT when play() is called from script.</li>
+        </ul>
+        <div>
+            <button id="controls" onclick="setRate('defaultPlaybackRate', 2)">defaultPlaybackRate = 2</button>
+            <button id="controls" onclick="setRate('defaultPlaybackRate', 1)">defaultPlaybackRate = 1</button>
+            <button id="controls" onclick="setRate('playbackRate', 2)">playbackRate = 2</button>
+            <button id="controls" onclick="setRate('playbackRate', 1)">playbackRate = 1</button>
+        </div>
+        <div>
+            <button id="controls" onclick="play()">play()</button>
+            <button id="controls" onclick="video.pause()">pause()</button>
+        </div>
+        <br>
+    </body>
+</html>
diff --git a/Source/WebCore/manual-tests/print-after-window-close.html b/Source/WebCore/manual-tests/print-after-window-close.html
new file mode 100644
index 0000000..f7467e1
--- /dev/null
+++ b/Source/WebCore/manual-tests/print-after-window-close.html
@@ -0,0 +1,8 @@
+<script>
+function crash() {
+    var w = window.open("data:text/html,foo");
+    w.print();
+    w.close();
+}
+</script>
+<button onclick="crash()">Crash</button>
diff --git a/Source/WebCore/manual-tests/selection-start-after-inserting-line-break-in-textarea.html b/Source/WebCore/manual-tests/selection-start-after-inserting-line-break-in-textarea.html
new file mode 100644
index 0000000..0203199
--- /dev/null
+++ b/Source/WebCore/manual-tests/selection-start-after-inserting-line-break-in-textarea.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>This tests selectionStart is updated properly when inserting LF into textarea. To test, press Enter several times inside textarea and click the log button. This bug does not reproduce when new lines are added by execCommand or eventSender.</p>
+<textarea cols="20" rows="20"></textarea>
+<button id="button" onclick="verify()">verify</button>
+<div id="console"></div>
+<script>
+
+function verify() {
+    var console = document.getElementById('console');
+    if (textarea.value.match(/[^\n]/))
+        console.innerHTML = 'textarea contains unexpected character. You can only type LF in this test.';
+    else if (textarea.selectionStart != textarea.value.length)
+        console.innerHTML = 'FAIL: expected ' + textarea.value.length + ' but got ' + textarea.selectionStart;
+    else
+        console.innerHTML = 'PASS: ' + textarea.value.length + ' LFs';
+}
+
+var textarea = document.getElementsByTagName('textarea')[0];
+textarea.focus();
+
+</script>
+</body>
+</html>
diff --git a/Source/WebCore/page/Chrome.cpp b/Source/WebCore/page/Chrome.cpp
index 26ea33b..5881d5e 100644
--- a/Source/WebCore/page/Chrome.cpp
+++ b/Source/WebCore/page/Chrome.cpp
@@ -88,9 +88,9 @@ void Chrome::scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, con
 }
 
 #if ENABLE(TILED_BACKING_STORE)
-void Chrome::delegatedScrollRequested(const IntSize& scrollDelta)
+void Chrome::delegatedScrollRequested(const IntPoint& scrollPoint)
 {
-    m_client->delegatedScrollRequested(scrollDelta);
+    m_client->delegatedScrollRequested(scrollPoint);
 }
 #endif
 
diff --git a/Source/WebCore/page/Chrome.h b/Source/WebCore/page/Chrome.h
index 4d16214..9984a7c 100644
--- a/Source/WebCore/page/Chrome.h
+++ b/Source/WebCore/page/Chrome.h
@@ -71,7 +71,7 @@ namespace WebCore {
         virtual void invalidateContentsForSlowScroll(const IntRect&, bool);
         virtual void scroll(const IntSize&, const IntRect&, const IntRect&);
 #if ENABLE(TILED_BACKING_STORE)
-        virtual void delegatedScrollRequested(const IntSize& scrollDelta);
+        virtual void delegatedScrollRequested(const IntPoint& scrollPoint);
 #endif
         virtual IntPoint screenToWindow(const IntPoint&) const;
         virtual IntRect windowToScreen(const IntRect&) const;
diff --git a/Source/WebCore/page/ChromeClient.h b/Source/WebCore/page/ChromeClient.h
index 7fcec2e..73fe904 100644
--- a/Source/WebCore/page/ChromeClient.h
+++ b/Source/WebCore/page/ChromeClient.h
@@ -49,6 +49,7 @@ namespace WebCore {
     class FloatRect;
     class Frame;
     class Geolocation;
+    class GraphicsLayer;
     class HitTestResult;
     class IntRect;
     class NavigationAction;
@@ -143,7 +144,7 @@ namespace WebCore {
         virtual void invalidateContentsForSlowScroll(const IntRect&, bool) = 0;
         virtual void scroll(const IntSize&, const IntRect&, const IntRect&) = 0;
 #if ENABLE(TILED_BACKING_STORE)
-        virtual void delegatedScrollRequested(const IntSize&) = 0;
+        virtual void delegatedScrollRequested(const IntPoint&) = 0;
 #endif
         virtual IntPoint screenToWindow(const IntPoint&) const = 0;
         virtual IntRect windowToScreen(const IntRect&) const = 0;
@@ -263,10 +264,11 @@ namespace WebCore {
         virtual bool requiresFullscreenForVideoPlayback() { return false; } 
 
 #if ENABLE(FULLSCREEN_API)
-        virtual bool supportsFullScreenForElement(const Element*) { return false; }
+        virtual bool supportsFullScreenForElement(const Element*, bool) { return false; }
         virtual void enterFullScreenForElement(Element*) { }
         virtual void exitFullScreenForElement(Element*) { }
         virtual void fullScreenRendererChanged(RenderBox*) { }
+        virtual void setRootFullScreenLayer(GraphicsLayer*) { }
 #endif
         
 #if ENABLE(TILED_BACKING_STORE)
diff --git a/Source/WebCore/page/ContentSecurityPolicy.cpp b/Source/WebCore/page/ContentSecurityPolicy.cpp
index 97cd447..6bcf99c 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.cpp
+++ b/Source/WebCore/page/ContentSecurityPolicy.cpp
@@ -25,28 +25,390 @@
 
 #include "config.h"
 #include "ContentSecurityPolicy.h"
+
 #include "Document.h"
+#include "NotImplemented.h"
+#include "SecurityOrigin.h"
 
 namespace WebCore {
 
-class CSPDirective {
+// Normally WebKit uses "static" for internal linkage, but using "static" for
+// these functions causes a compile error because these functions are used as
+// template parameters.
+namespace {
+
+bool isDirectiveNameCharacter(UChar c)
+{
+    return isASCIIAlphanumeric(c) || c == '-';
+}
+
+bool isDirectiveValueCharacter(UChar c)
+{
+    return isASCIISpace(c) || (c >= 0x21 && c <= 0x7e); // Whitespace + VCHAR
+}
+
+bool isSourceCharacter(UChar c)
+{
+    return !isASCIISpace(c);
+}
+
+bool isHostCharacter(UChar c)
+{
+    return isASCIIAlphanumeric(c) || c == '-';
+}
+
+bool isSchemeContinuationCharacter(UChar c)
+{
+    return isASCIIAlphanumeric(c) || c == '+' || c == '-' || c == '.';
+}
+
+} // namespace
+
+static bool skipExactly(const UChar*& position, const UChar* end, UChar delimiter)
+{
+    if (position < end && *position == delimiter) {
+        ++position;
+        return true;
+    }
+    return false;
+}
+
+template<bool characterPredicate(UChar)>
+static bool skipExactly(const UChar*& position, const UChar* end)
+{
+    if (position < end && characterPredicate(*position)) {
+        ++position;
+        return true;
+    }
+    return false;
+}
+
+static void skipUtil(const UChar*& position, const UChar* end, UChar delimiter)
+{
+    while (position < end && *position != delimiter)
+        ++position;
+}
+
+template<bool characterPredicate(UChar)>
+static void skipWhile(const UChar*& position, const UChar* end)
+{
+    while (position < end && characterPredicate(*position))
+        ++position;
+}
+
+class CSPSource {
 public:
-    explicit CSPDirective(const String& value)
-        : m_value(value)
+    CSPSource(const String& scheme, const String& host, int port, bool hostHasWildcard, bool portHasWildcard)
+        : m_scheme(scheme)
+        , m_host(host)
+        , m_port(port)
+        , m_hostHasWildcard(hostHasWildcard)
+        , m_portHasWildcard(portHasWildcard)
+    {
+    }
+
+    bool matches(const KURL& url) const
+    {
+        if (!schemeMatches(url))
+            return false;
+        if (isSchemeOnly())
+            return true;
+        return hostMatches(url) && portMatches(url);
+    }
+
+private:
+    bool schemeMatches(const KURL& url) const
+    {
+        return equalIgnoringCase(url.protocol(), m_scheme);
+    }
+
+    bool hostMatches(const KURL& url) const
     {
+        if (m_hostHasWildcard)
+            notImplemented();
+
+        return equalIgnoringCase(url.host(), m_host);
     }
 
-    bool allows(const KURL&)
+    bool portMatches(const KURL& url) const
     {
+        if (m_portHasWildcard)
+            return true;
+
+        // FIXME: Handle explicit default ports correctly.
+        return url.port() == m_port;
+    }
+
+    bool isSchemeOnly() const { return m_host.isEmpty(); }
+
+    String m_scheme;
+    String m_host;
+    int m_port;
+
+    bool m_hostHasWildcard;
+    bool m_portHasWildcard;
+};
+
+class CSPSourceList {
+public:
+    explicit CSPSourceList(SecurityOrigin*);
+
+    void parse(const String&);
+    bool matches(const KURL&);
+
+private:
+    void parse(const UChar* begin, const UChar* end);
+
+    bool parseSource(const UChar* begin, const UChar* end, String& scheme, String& host, int& port, bool& hostHasWildcard, bool& portHasWildcard);
+    bool parseScheme(const UChar* begin, const UChar* end, String& scheme);
+    bool parseHost(const UChar* begin, const UChar* end, String& host, bool& hostHasWildcard);
+    bool parsePort(const UChar* begin, const UChar* end, int& port, bool& portHasWildcard);
+
+    void addSourceSelf();
+
+    SecurityOrigin* m_origin;
+    Vector<CSPSource> m_list;
+};
+
+CSPSourceList::CSPSourceList(SecurityOrigin* origin)
+    : m_origin(origin)
+{
+}
+
+void CSPSourceList::parse(const String& value)
+{
+    parse(value.characters(), value.characters() + value.length());
+}
+
+bool CSPSourceList::matches(const KURL& url)
+{
+    for (size_t i = 0; i < m_list.size(); ++i) {
+        if (m_list[i].matches(url))
+            return true;
+    }
+    return false;
+}
+
+// source-list       = *WSP [ source *( 1*WSP source ) *WSP ]
+//                   / *WSP "'none'" *WSP
+//
+void CSPSourceList::parse(const UChar* begin, const UChar* end)
+{
+    const UChar* position = begin;
+
+    bool isFirstSourceInList = true;
+    while (position < end) {
+        skipWhile<isASCIISpace>(position, end);
+        const UChar* beginSource = position;
+        skipWhile<isSourceCharacter>(position, end);
+
+        if (isFirstSourceInList && equalIgnoringCase("'none'", beginSource, position - beginSource))
+            return; // We represent 'none' as an empty m_list.
+        isFirstSourceInList = false;
+
+        String scheme, host;
+        int port = 0;
+        bool hostHasWildcard = false;
+        bool portHasWildcard = false;
+
+        if (parseSource(beginSource, position, scheme, host, port, hostHasWildcard, portHasWildcard)) {
+            if (scheme.isEmpty())
+                scheme = m_origin->protocol();
+            m_list.append(CSPSource(scheme, host, port, hostHasWildcard, portHasWildcard));
+        }
+
+        ASSERT(position == end || isASCIISpace(*position));
+     }
+}
+
+// source            = scheme ":"
+//                   / ( [ scheme "://" ] host [ port ] )
+//                   / "'self'"
+//
+bool CSPSourceList::parseSource(const UChar* begin, const UChar* end,
+                                String& scheme, String& host, int& port,
+                                bool& hostHasWildcard, bool& portHasWildcard)
+{
+    if (begin == end)
+        return false;
+
+    if (equalIgnoringCase("'self'", begin, end - begin)) {
+        addSourceSelf();
         return false;
     }
 
+    const UChar* position = begin;
+
+    const UChar* beginHost = begin;
+    skipUtil(position, end, ':');
+
+    if (position == end) {
+        // This must be a host-only source.
+        if (!parseHost(beginHost, position, host, hostHasWildcard))
+            return false;
+        return true;
+    }
+
+    if (end - position == 1) {
+        ASSERT(*position == ':');
+        // This must be a scheme-only source.
+        if (!parseScheme(begin, position, scheme))
+            return false;
+        return true;
+    }
+
+    ASSERT(end - position >= 2);
+    if (position[1] == '/') {
+        if (!parseScheme(begin, position, scheme)
+            || !skipExactly(position, end, ':')
+            || !skipExactly(position, end, '/')
+            || !skipExactly(position, end, '/'))
+            return false;
+        beginHost = position;
+        skipUtil(position, end, ':');
+    }
+
+    if (position == beginHost)
+        return false;
+
+    if (!parseHost(beginHost, position, host, hostHasWildcard))
+        return false;
+
+    if (position == end) {
+        port = 0;
+        return true;
+    }
+
+    if (!skipExactly(position, end, ':'))
+        ASSERT_NOT_REACHED();
+
+    if (!parsePort(position, end, port, portHasWildcard))
+        return false;
+
+    return true;
+}
+
+//                     ; <scheme> production from RFC 3986
+// scheme      = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )
+//
+bool CSPSourceList::parseScheme(const UChar* begin, const UChar* end, String& scheme)
+{
+    ASSERT(begin <= end);
+    ASSERT(scheme.isEmpty());
+
+    if (begin == end)
+        return false;
+
+    const UChar* position = begin;
+
+    if (!skipExactly<isASCIIAlpha>(position, end))
+        return false;
+
+    skipWhile<isSchemeContinuationCharacter>(position, end);
+
+    if (position != end)
+        return false;
+
+    scheme = String(begin, end - begin);
+    return true;
+}
+
+// host              = [ "*." ] 1*host-char *( "." 1*host-char )
+//                   / "*"
+// host-char         = ALPHA / DIGIT / "-"
+//
+bool CSPSourceList::parseHost(const UChar* begin, const UChar* end, String& host, bool& hostHasWildcard)
+{
+    ASSERT(begin <= end);
+    ASSERT(host.isEmpty());
+    ASSERT(!hostHasWildcard);
+
+    if (begin == end)
+        return false;
+
+    const UChar* position = begin;
+
+    if (skipExactly(position, end, '*')) {
+        hostHasWildcard = true;
+
+        if (position == end)
+            return true;
+
+        if (!skipExactly(position, end, '.'))
+            return false;
+    }
+
+    const UChar* hostBegin = position;
+
+    while (position < end) {
+        if (!skipExactly<isHostCharacter>(position, end))
+            return false;
+
+        skipWhile<isHostCharacter>(position, end);
+
+        if (position < end && !skipExactly(position, end, '.'))
+            return false;
+    }
+
+    ASSERT(position == end);
+    host = String(hostBegin, end - hostBegin);
+    return true;
+}
+
+// port              = ":" ( 1*DIGIT / "*" )
+//
+bool CSPSourceList::parsePort(const UChar* begin, const UChar* end, int& port, bool& portHasWildcard)
+{
+    ASSERT(begin <= end);
+    ASSERT(!port);
+    ASSERT(!portHasWildcard);
+
+    if (begin == end)
+        return false;
+
+    if (end - begin == 1 && *begin == '*') {
+        port = 0;
+        portHasWildcard = true;
+        return true;
+    }
+
+    const UChar* position = begin;
+    skipWhile<isASCIIDigit>(position, end);
+
+    if (position != end)
+        return false;
+
+    bool ok;
+    port = charactersToIntStrict(begin, end - begin, &ok);
+    return ok;
+}
+
+void CSPSourceList::addSourceSelf()
+{
+    // FIXME: Inherit the scheme, host, and port from the current URL.
+    notImplemented();
+}
+
+class CSPDirective {
+public:
+    CSPDirective(const String& value, SecurityOrigin* origin)
+        : m_sourceList(origin)
+    {
+        m_sourceList.parse(value);
+    }
+
+    bool allows(const KURL& url)
+    {
+        return m_sourceList.matches(url);
+    }
+
 private:
-    String m_value;
+    CSPSourceList m_sourceList;
 };
 
-ContentSecurityPolicy::ContentSecurityPolicy()
+ContentSecurityPolicy::ContentSecurityPolicy(SecurityOrigin* origin)
     : m_havePolicy(false)
+    , m_origin(origin)
 {
 }
 
@@ -68,11 +430,19 @@ bool ContentSecurityPolicy::allowJavaScriptURLs() const
     return !m_scriptSrc;
 }
 
-bool ContentSecurityPolicy::canLoadExternalScriptFromSrc(const String& url) const
+bool ContentSecurityPolicy::allowInlineEventHandlers() const
+{
+    return !m_scriptSrc;
+}
+
+bool ContentSecurityPolicy::allowScriptFromSource(const KURL& url) const
 {
-    return !m_scriptSrc || m_scriptSrc->allows(KURL(ParsedURLString, url));
+    return !m_scriptSrc || m_scriptSrc->allows(url);
 }
 
+// policy            = directive-list
+// directive-list    = [ directive *( ";" [ directive ] ) ]
+//
 void ContentSecurityPolicy::parse(const String& policy)
 {
     ASSERT(!m_havePolicy);
@@ -80,75 +450,75 @@ void ContentSecurityPolicy::parse(const String& policy)
     if (policy.isEmpty())
         return;
 
-    const UChar* pos = policy.characters();
-    const UChar* end = pos + policy.length();
+    const UChar* position = policy.characters();
+    const UChar* end = position + policy.length();
 
-    while (pos < end) {
-        Vector<UChar, 32> name;
-        Vector<UChar, 64> value;
+    while (position < end) {
+        const UChar* directiveBegin = position;
+        skipUtil(position, end, ';');
 
-        parseDirective(pos, end, name, value);
-        if (name.isEmpty())
-            continue;
+        String name, value;
+        if (parseDirective(directiveBegin, position, name, value)) {
+            ASSERT(!name.isEmpty());
+            addDirective(name, value);
+        }
 
-        // We use a copy here instead of String::adopt because we expect
-        // the name and the value to be relatively short, so the copy will
-        // be cheaper than the extra malloc.
-        emitDirective(String(name), String(value));
+        ASSERT(position == end || *position == ';');
+        skipExactly(position, end, ';');
     }
 }
 
-void ContentSecurityPolicy::parseDirective(const UChar*& pos, const UChar* end, Vector<UChar, 32>& name, Vector<UChar, 64>& value)
+// directive         = *WSP [ directive-name [ WSP directive-value ] ]
+// directive-name    = 1*( ALPHA / DIGIT / "-" )
+// directive-value   = *( WSP / <VCHAR except ";"> )
+//
+bool ContentSecurityPolicy::parseDirective(const UChar* begin, const UChar* end, String& name, String& value)
 {
-    ASSERT(pos < end);
     ASSERT(name.isEmpty());
     ASSERT(value.isEmpty());
 
-    enum {
-        BeforeDirectiveName,
-        DirectiveName,
-        AfterDirectiveName,
-        DirectiveValue,
-    } state = BeforeDirectiveName;
-
-    while (pos < end) {
-        UChar currentCharacter = *pos++;
-        switch (state) {
-        case BeforeDirectiveName:
-            if (isASCIISpace(currentCharacter))
-                continue;
-            state = DirectiveName;
-            // Fall through.
-        case DirectiveName:
-            if (!isASCIISpace(currentCharacter)) {
-                name.append(currentCharacter);
-                continue;
-            }
-            state = AfterDirectiveName;
-            // Fall through.
-        case AfterDirectiveName:
-            if (isASCIISpace(currentCharacter))
-                continue;
-            state = DirectiveValue;
-            // Fall through.
-        case DirectiveValue:
-            if (currentCharacter != ';') {
-                value.append(currentCharacter);
-                continue;
-            }
-            return;
-        }
-    }
+    const UChar* position = begin;
+    skipWhile<isASCIISpace>(position, end);
+
+    const UChar* nameBegin = position;
+    skipWhile<isDirectiveNameCharacter>(position, end);
+
+    // The directive-name must be non-empty.
+    if (nameBegin == position)
+        return false;
+
+    name = String(nameBegin, position - nameBegin);
+
+    if (position == end)
+        return true;
+
+    if (!skipExactly<isASCIISpace>(position, end))
+        return false;
+
+    skipWhile<isASCIISpace>(position, end);
+
+    const UChar* valueBegin = position;
+    skipWhile<isDirectiveValueCharacter>(position, end);
+
+    if (position != end)
+        return false;
+
+    // The directive-value may be empty.
+    if (valueBegin == position)
+        return true;
+
+    value = String(valueBegin, position - valueBegin);
+    return true;
 }
 
-void ContentSecurityPolicy::emitDirective(const String& name, const String& value)
+void ContentSecurityPolicy::addDirective(const String& name, const String& value)
 {
     DEFINE_STATIC_LOCAL(String, scriptSrc, ("script-src"));
 
     ASSERT(!name.isEmpty());
 
     if (!m_scriptSrc && equalIgnoringCase(name, scriptSrc))
-        m_scriptSrc = adoptPtr(new CSPDirective(value));
+        m_scriptSrc = adoptPtr(new CSPDirective(value, m_origin.get()));
 }
 
 }
diff --git a/Source/WebCore/page/ContentSecurityPolicy.h b/Source/WebCore/page/ContentSecurityPolicy.h
index 0eebd05..a7cd216 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.h
+++ b/Source/WebCore/page/ContentSecurityPolicy.h
@@ -32,26 +32,32 @@
 namespace WebCore {
 
 class CSPDirective;
+class KURL;
+class SecurityOrigin;
 
 class ContentSecurityPolicy : public RefCounted<ContentSecurityPolicy> {
 public:
-    static PassRefPtr<ContentSecurityPolicy> create() { return adoptRef(new ContentSecurityPolicy); }
+    static PassRefPtr<ContentSecurityPolicy> create(SecurityOrigin* origin = 0)
+    {
+        return adoptRef(new ContentSecurityPolicy(origin));
+    }
     ~ContentSecurityPolicy();
 
     void didReceiveHeader(const String&);
 
     bool allowJavaScriptURLs() const;
-    // FIXME: Rename canLoadExternalScriptFromSrc to allowScriptFromURL.
-    bool canLoadExternalScriptFromSrc(const String& url) const;
+    bool allowInlineEventHandlers() const;
+    bool allowScriptFromSource(const KURL&) const;
 
 private:
-    ContentSecurityPolicy();
+    explicit ContentSecurityPolicy(SecurityOrigin*);
 
     void parse(const String&);
-    void parseDirective(const UChar*& pos, const UChar* end, Vector<UChar, 32>& name, Vector<UChar, 64>& value);
-    void emitDirective(const String& name, const String& value);
+    bool parseDirective(const UChar* begin, const UChar* end, String& name, String& value);
+    void addDirective(const String& name, const String& value);
 
     bool m_havePolicy;
+    RefPtr<SecurityOrigin> m_origin;
     OwnPtr<CSPDirective> m_scriptSrc;
 };
 
diff --git a/Source/WebCore/page/ContextMenuController.cpp b/Source/WebCore/page/ContextMenuController.cpp
index c807d7a..a0e64b8 100644
--- a/Source/WebCore/page/ContextMenuController.cpp
+++ b/Source/WebCore/page/ContextMenuController.cpp
@@ -63,6 +63,7 @@
 #include "SelectionController.h"
 #include "Settings.h"
 #include "TextIterator.h"
+#include "UserTypingGestureIndicator.h"
 #include "WindowFeatures.h"
 #include "markup.h"
 #include <wtf/unicode/Unicode.h>
@@ -259,10 +260,10 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
         frame->loader()->reload();
         break;
     case ContextMenuItemTagCut:
-        frame->editor()->cut();
+        frame->editor()->command("Cut").execute();
         break;
     case ContextMenuItemTagPaste:
-        frame->editor()->paste();
+        frame->editor()->command("Paste").execute();
         break;
 #if PLATFORM(GTK)
     case ContextMenuItemTagDelete:
@@ -632,6 +633,14 @@ static bool selectionContainsPossibleWord(Frame* frame)
     return false;
 }
 
+#if PLATFORM(MAC)
+#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
+#define INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM 1
+#else
+#define INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM 0
+#endif
+#endif
+
 void ContextMenuController::populate()
 {
     ContextMenuItem OpenLinkItem(ActionType, ContextMenuItemTagOpenLink, contextMenuItemTagOpenLink());
@@ -667,8 +676,6 @@ void ContextMenuController::populate()
 #if PLATFORM(MAC)
     ContextMenuItem SearchSpotlightItem(ActionType, ContextMenuItemTagSearchInSpotlight, 
         contextMenuItemTagSearchInSpotlight());
-    ContextMenuItem LookInDictionaryItem(ActionType, ContextMenuItemTagLookUpInDictionary, 
-        contextMenuItemTagLookUpInDictionary());
 #endif
 #if !PLATFORM(GTK)
     ContextMenuItem SearchWebItem(ActionType, ContextMenuItemTagSearchWeb, contextMenuItemTagSearchWeb());
@@ -758,20 +765,31 @@ void ContextMenuController::populate()
             if (m_hitTestResult.isSelected()) {
                 if (selectionContainsPossibleWord(frame)) {
 #if PLATFORM(MAC)
+                    String selectedString = frame->displayStringModifiedByEncoding(frame->editor()->selectedText());
+                    ContextMenuItem LookUpInDictionaryItem(ActionType, ContextMenuItemTagLookUpInDictionary, contextMenuItemTagLookUpInDictionary(selectedString));
+
+#if INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM
                     appendItem(SearchSpotlightItem, m_contextMenu.get());
+#else
+                    appendItem(LookUpInDictionaryItem, m_contextMenu.get());
+#endif
 #endif
+
 #if !PLATFORM(GTK)
                     appendItem(SearchWebItem, m_contextMenu.get());
                     appendItem(*separatorItem(), m_contextMenu.get());
 #endif
-#if PLATFORM(MAC)
-                    appendItem(LookInDictionaryItem, m_contextMenu.get());
+
+#if PLATFORM(MAC) && INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM
+                    appendItem(LookUpInDictionaryItem, m_contextMenu.get());
                     appendItem(*separatorItem(), m_contextMenu.get());
 #endif
                 }
+
                 appendItem(CopyItem, m_contextMenu.get());
 #if PLATFORM(MAC)
                 appendItem(*separatorItem(), m_contextMenu.get());
+
                 ContextMenuItem SpeechMenuItem(SubmenuType, ContextMenuItemTagSpeechMenu, contextMenuItemTagSpeechMenu());
                 createAndAppendSpeechSubMenu(SpeechMenuItem);
                 appendItem(SpeechMenuItem, m_contextMenu.get());
@@ -813,7 +831,7 @@ void ContextMenuController::populate()
         SelectionController* selection = frame->selection();
         bool inPasswordField = selection->isInPasswordField();
         bool spellCheckingEnabled = frame->editor()->isSpellCheckingEnabledFor(node);
-        
+
         if (!inPasswordField && spellCheckingEnabled) {
             // Consider adding spelling-related or grammar-related context menu items (never both, since a single selected range
             // is never considered a misspelling and bad grammar at the same time)
@@ -873,15 +891,23 @@ void ContextMenuController::populate()
 
         if (m_hitTestResult.isSelected() && !inPasswordField && selectionContainsPossibleWord(frame)) {
 #if PLATFORM(MAC)
+            String selectedString = frame->displayStringModifiedByEncoding(frame->editor()->selectedText());
+            ContextMenuItem LookUpInDictionaryItem(ActionType, ContextMenuItemTagLookUpInDictionary, contextMenuItemTagLookUpInDictionary(selectedString));
+
+#if INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM
             appendItem(SearchSpotlightItem, m_contextMenu.get());
+#else
+            appendItem(LookUpInDictionaryItem, m_contextMenu.get());
+#endif
 #endif
+
 #if !PLATFORM(GTK)
             appendItem(SearchWebItem, m_contextMenu.get());
             appendItem(*separatorItem(), m_contextMenu.get());
 #endif
-     
-#if PLATFORM(MAC)
-            appendItem(LookInDictionaryItem, m_contextMenu.get());
+
+#if PLATFORM(MAC) && INCLUDE_SPOTLIGHT_CONTEXT_MENU_ITEM
+            appendItem(LookUpInDictionaryItem, m_contextMenu.get());
             appendItem(*separatorItem(), m_contextMenu.get());
 #endif
         }
diff --git a/Source/WebCore/page/DOMSelection.cpp b/Source/WebCore/page/DOMSelection.cpp
index 67c87d2..31ab956 100644
--- a/Source/WebCore/page/DOMSelection.cpp
+++ b/Source/WebCore/page/DOMSelection.cpp
@@ -101,7 +101,7 @@ Node* DOMSelection::anchorNode() const
         return 0;
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
         return shadowAncestor->parentNodeGuaranteedHostFree();
-    return anchorPosition(visibleSelection()).deprecatedNode();
+    return anchorPosition(visibleSelection()).containerNode();
 }
 
 int DOMSelection::anchorOffset() const
@@ -110,7 +110,7 @@ int DOMSelection::anchorOffset() const
         return 0;
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
         return shadowAncestor->nodeIndex();
-    return anchorPosition(visibleSelection()).deprecatedEditingOffset();
+    return anchorPosition(visibleSelection()).offsetInContainerNode();
 }
 
 Node* DOMSelection::focusNode() const
@@ -119,7 +119,7 @@ Node* DOMSelection::focusNode() const
         return 0;
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
         return shadowAncestor->parentNodeGuaranteedHostFree();
-    return focusPosition(visibleSelection()).deprecatedNode();
+    return focusPosition(visibleSelection()).containerNode();
 }
 
 int DOMSelection::focusOffset() const
@@ -128,7 +128,7 @@ int DOMSelection::focusOffset() const
         return 0;
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
         return shadowAncestor->nodeIndex();
-    return focusPosition(visibleSelection()).deprecatedEditingOffset();
+    return focusPosition(visibleSelection()).offsetInContainerNode();
 }
 
 Node* DOMSelection::baseNode() const
@@ -137,7 +137,7 @@ Node* DOMSelection::baseNode() const
         return 0;
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
         return shadowAncestor->parentNodeGuaranteedHostFree();
-    return basePosition(visibleSelection()).deprecatedNode();
+    return basePosition(visibleSelection()).containerNode();
 }
 
 int DOMSelection::baseOffset() const
@@ -146,7 +146,7 @@ int DOMSelection::baseOffset() const
         return 0;
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
         return shadowAncestor->nodeIndex();
-    return basePosition(visibleSelection()).deprecatedEditingOffset();
+    return basePosition(visibleSelection()).offsetInContainerNode();
 }
 
 Node* DOMSelection::extentNode() const
@@ -155,7 +155,7 @@ Node* DOMSelection::extentNode() const
         return 0;
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
         return shadowAncestor->parentNodeGuaranteedHostFree();
-    return extentPosition(visibleSelection()).deprecatedNode();
+    return extentPosition(visibleSelection()).containerNode();
 }
 
 int DOMSelection::extentOffset() const
@@ -164,7 +164,7 @@ int DOMSelection::extentOffset() const
         return 0;
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame))
         return shadowAncestor->nodeIndex();
-    return extentPosition(visibleSelection()).deprecatedEditingOffset();
+    return extentPosition(visibleSelection()).offsetInContainerNode();
 }
 
 bool DOMSelection::isCollapsed() const
diff --git a/Source/WebCore/page/DOMTimer.cpp b/Source/WebCore/page/DOMTimer.cpp
index eaca8f2..0a94e7e 100644
--- a/Source/WebCore/page/DOMTimer.cpp
+++ b/Source/WebCore/page/DOMTimer.cpp
@@ -30,6 +30,7 @@
 #include "InspectorInstrumentation.h"
 #include "ScheduledAction.h"
 #include "ScriptExecutionContext.h"
+#include "UserGestureIndicator.h"
 #include <wtf/HashSet.h>
 #include <wtf/StdLibExtras.h>
 
@@ -37,29 +38,41 @@ using namespace std;
 
 namespace WebCore {
 
+static const int maxIntervalForUserGestureForwarding = 1000; // One second matches Gecko.
 static const int maxTimerNestingLevel = 5;
 static const double oneMillisecond = 0.001;
 double DOMTimer::s_minDefaultTimerInterval = 0.010; // 10 milliseconds
 
 static int timerNestingLevel = 0;
-
-DOMTimer::DOMTimer(ScriptExecutionContext* context, PassOwnPtr<ScheduledAction> action, int timeout, bool singleShot)
-    : SuspendableTimer(context)
-    , m_action(action)
-    , m_originalTimeout(timeout)
+    
+static int timeoutId()
 {
     static int lastUsedTimeoutId = 0;
     ++lastUsedTimeoutId;
     // Avoid wraparound going negative on us.
     if (lastUsedTimeoutId <= 0)
         lastUsedTimeoutId = 1;
-    m_timeoutId = lastUsedTimeoutId;
-
-    m_nestingLevel = timerNestingLevel + 1;
+    return lastUsedTimeoutId;
+}
+    
+static inline bool shouldForwardUserGesture(int interval, int nestingLevel)
+{
+    return UserGestureIndicator::processingUserGesture()
+        && interval <= maxIntervalForUserGestureForwarding
+        && nestingLevel == 1; // Gestures should not be forwarded to nested timers.
+}
 
+DOMTimer::DOMTimer(ScriptExecutionContext* context, PassOwnPtr<ScheduledAction> action, int interval, bool singleShot)
+    : SuspendableTimer(context)
+    , m_timeoutId(timeoutId())
+    , m_nestingLevel(timerNestingLevel + 1)
+    , m_action(action)
+    , m_originalInterval(interval)
+    , m_shouldForwardUserGesture(shouldForwardUserGesture(interval, m_nestingLevel))
+{
     scriptExecutionContext()->addTimeout(m_timeoutId, this);
 
-    double intervalMilliseconds = intervalClampedToMinimum(timeout, context->minimumTimerInterval());
+    double intervalMilliseconds = intervalClampedToMinimum(interval, context->minimumTimerInterval());
     if (singleShot)
         startOneShot(intervalMilliseconds);
     else
@@ -101,6 +114,11 @@ void DOMTimer::fired()
 {
     ScriptExecutionContext* context = scriptExecutionContext();
     timerNestingLevel = m_nestingLevel;
+    
+    UserGestureIndicator gestureIndicator(m_shouldForwardUserGesture ? DefinitelyProcessingUserGesture : PossiblyProcessingUserGesture);
+    
+    // Only the first execution of a multi-shot timer should get an affirmative user gesture indicator.
+    m_shouldForwardUserGesture = false;
 
     InspectorInstrumentationCookie cookie = InspectorInstrumentation::willFireTimer(context, m_timeoutId);
 
@@ -155,14 +173,14 @@ void DOMTimer::adjustMinimumTimerInterval(double oldMinimumTimerInterval)
         return;
 
     double newMinimumInterval = scriptExecutionContext()->minimumTimerInterval();
-    double newClampedInterval = intervalClampedToMinimum(m_originalTimeout, newMinimumInterval);
+    double newClampedInterval = intervalClampedToMinimum(m_originalInterval, newMinimumInterval);
 
     if (repeatInterval()) {
         augmentRepeatInterval(newClampedInterval - repeatInterval());
         return;
     }
 
-    double previousClampedInterval = intervalClampedToMinimum(m_originalTimeout, oldMinimumTimerInterval);
+    double previousClampedInterval = intervalClampedToMinimum(m_originalInterval, oldMinimumTimerInterval);
     augmentFireInterval(newClampedInterval - previousClampedInterval);
 }
 
diff --git a/Source/WebCore/page/DOMTimer.h b/Source/WebCore/page/DOMTimer.h
index ba260e0..b917406 100644
--- a/Source/WebCore/page/DOMTimer.h
+++ b/Source/WebCore/page/DOMTimer.h
@@ -55,7 +55,7 @@ namespace WebCore {
         void adjustMinimumTimerInterval(double oldMinimumTimerInterval);
 
     private:
-        DOMTimer(ScriptExecutionContext*, PassOwnPtr<ScheduledAction>, int timeout, bool singleShot);
+        DOMTimer(ScriptExecutionContext*, PassOwnPtr<ScheduledAction>, int interval, bool singleShot);
         virtual void fired();
 
         double intervalClampedToMinimum(int timeout, double minimumTimerInterval) const;
@@ -68,7 +68,8 @@ namespace WebCore {
         int m_timeoutId;
         int m_nestingLevel;
         OwnPtr<ScheduledAction> m_action;
-        int m_originalTimeout;
+        int m_originalInterval;
+        bool m_shouldForwardUserGesture;
         static double s_minDefaultTimerInterval;
     };
 
diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
index 269c109..90458ff 100644
--- a/Source/WebCore/page/DOMWindow.cpp
+++ b/Source/WebCore/page/DOMWindow.cpp
@@ -394,6 +394,7 @@ bool DOMWindow::canShowModalDialogNow(const Frame* frame)
 DOMWindow::DOMWindow(Frame* frame)
     : m_shouldPrintWhenFinishedLoading(false)
     , m_frame(frame)
+    , m_printTimer(this, &DOMWindow::printTimerFired)
 {
 }
 
@@ -711,6 +712,13 @@ void DOMWindow::pageDestroyed()
 #endif
 }
 
+void DOMWindow::resetGeolocation()
+{
+    // Geolocation should cancel activities and permission requests when the page is detached.
+    if (m_navigator)
+        m_navigator->resetGeolocation();
+}
+
 #if ENABLE(INDEXED_DATABASE)
 IDBFactory* DOMWindow::webkitIndexedDB() const
 {
@@ -755,14 +763,14 @@ void DOMWindow::requestFileSystem(int type, long long size, PassRefPtr<FileSyste
     LocalFileSystem::localFileSystem().requestFileSystem(document, fileSystemType, size, FileSystemCallbacks::create(successCallback, errorCallback, document), false);
 }
 
-void DOMWindow::resolveLocalFileSystemURI(const String& uri, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+void DOMWindow::resolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
     Document* document = this->document();
     if (!document)
         return;
 
     SecurityOrigin* securityOrigin = document->securityOrigin();
-    KURL completedURL = document->completeURL(uri);
+    KURL completedURL = document->completeURL(url);
     if (!AsyncFileSystem::isAvailable() || !securityOrigin->canAccessFileSystem() || !securityOrigin->canRequest(completedURL)) {
         DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::SECURITY_ERR));
         return;
@@ -771,7 +779,7 @@ void DOMWindow::resolveLocalFileSystemURI(const String& uri, PassRefPtr<EntryCal
     AsyncFileSystem::Type type;
     String filePath;
     if (!completedURL.isValid() || !DOMFileSystemBase::crackFileSystemURL(completedURL, type, filePath)) {
-        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::SYNTAX_ERR));
+        DOMFileSystem::scheduleCallback(document, errorCallback, FileError::create(FileError::ENCODING_ERR));
         return;
     }
 
@@ -943,6 +951,12 @@ void DOMWindow::print()
     page->chrome()->print(m_frame);
 }
 
+void DOMWindow::printTimerFired(Timer<DOMWindow>* timer)
+{
+    ASSERT_UNUSED(timer, timer == &m_printTimer);
+    print();
+}
+
 void DOMWindow::stop()
 {
     if (!m_frame)
@@ -1571,11 +1585,8 @@ void DOMWindow::dispatchLoadEvent()
     // This is a DOM extension and is independent of bubbling/capturing rules of
     // the DOM.
     Element* ownerElement = m_frame ? m_frame->ownerElement() : 0;
-    if (ownerElement) {
-        RefPtr<Event> ownerEvent = Event::create(eventNames().loadEvent, false, false);
-        ownerEvent->setTarget(ownerElement);
-        ownerElement->dispatchGenericEvent(ownerEvent.release());
-    }
+    if (ownerElement)
+        ownerElement->dispatchEvent(Event::create(eventNames().loadEvent, false, false));
 
     InspectorInstrumentation::loadEventFired(frame(), url());
 }
@@ -1636,7 +1647,9 @@ void DOMWindow::finishedLoading()
 {
     if (m_shouldPrintWhenFinishedLoading) {
         m_shouldPrintWhenFinishedLoading = false;
-        print();
+
+        m_printTimer.stop();
+        m_printTimer.startOneShot(0);
     }
 }
 
diff --git a/Source/WebCore/page/DOMWindow.h b/Source/WebCore/page/DOMWindow.h
index b365f53..404f40f 100644
--- a/Source/WebCore/page/DOMWindow.h
+++ b/Source/WebCore/page/DOMWindow.h
@@ -30,6 +30,7 @@
 #include "KURL.h"
 #include "MessagePort.h"
 #include "SecurityOrigin.h"
+#include "Timer.h"
 
 namespace WebCore {
 
@@ -222,6 +223,7 @@ namespace WebCore {
         String crossDomainAccessErrorMessage(DOMWindow* activeWindow);
 
         void pageDestroyed();
+        void resetGeolocation();
 
         void postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
         // FIXME: remove this when we update the ObjC bindings (bug #28774).
@@ -391,7 +393,7 @@ namespace WebCore {
             PERSISTENT,
         };
         void requestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback>, PassRefPtr<ErrorCallback>);
-        void resolveLocalFileSystemURI(const String&, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
+        void resolveLocalFileSystemURL(const String&, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
 #endif
 
 #if ENABLE(INDEXED_DATABASE)
@@ -436,6 +438,8 @@ namespace WebCore {
         virtual EventTargetData* eventTargetData();
         virtual EventTargetData* ensureEventTargetData();
 
+        void printTimerFired(Timer<DOMWindow>*);
+
         static Frame* createWindow(const String& urlString, const AtomicString& frameName, const WindowFeatures&,
             DOMWindow* activeWindow, Frame* firstFrame, Frame* openerFrame,
             PrepareDialogFunction = 0, void* functionContext = 0);
@@ -461,6 +465,8 @@ namespace WebCore {
         mutable RefPtr<Location> m_location;
         mutable RefPtr<StyleMedia> m_media;
 
+        Timer<DOMWindow> m_printTimer;
+
         EventTargetData m_eventTargetData;
 
         String m_status;
diff --git a/Source/WebCore/page/DOMWindow.idl b/Source/WebCore/page/DOMWindow.idl
index 530c4ad..8c6e929 100644
--- a/Source/WebCore/page/DOMWindow.idl
+++ b/Source/WebCore/page/DOMWindow.idl
@@ -195,7 +195,7 @@ module window {
         const unsigned short TEMPORARY = 0;
         const unsigned short PERSISTENT = 1;
         [EnabledAtRuntime=FileSystem] void requestFileSystem(in unsigned short type, in long long size, in [Callback, Optional] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
-        [EnabledAtRuntime=FileSystem] void resolveLocalFileSystemURI(in DOMString uri, in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [EnabledAtRuntime=FileSystem] void resolveLocalFileSystemURL(in DOMString url, in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
 
         attribute [EnabledAtRuntime=FileSystem] FlagsConstructor Flags;
 #endif
@@ -491,15 +491,15 @@ module window {
         attribute CanvasGradientConstructor CanvasGradient;
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
         attribute ImageDataConstructor ImageData;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLActiveInfoConstructor WebGLActiveInfo;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLBufferConstructor WebGLBuffer;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLFramebufferConstructor WebGLFramebuffer;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLProgramConstructor WebGLProgram;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLRenderbufferConstructor WebGLRenderbuffer;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLRenderingContextConstructor WebGLRenderingContext;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLShaderConstructor WebGLShader;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLTextureConstructor WebGLTexture;
-        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLUniformLocationConstructor WebGLUniformLocation;
+        attribute [Conditional=WEBGL] WebGLActiveInfoConstructor WebGLActiveInfo;
+        attribute [Conditional=WEBGL] WebGLBufferConstructor WebGLBuffer;
+        attribute [Conditional=WEBGL] WebGLFramebufferConstructor WebGLFramebuffer;
+        attribute [Conditional=WEBGL] WebGLProgramConstructor WebGLProgram;
+        attribute [Conditional=WEBGL] WebGLRenderbufferConstructor WebGLRenderbuffer;
+        attribute [Conditional=WEBGL] WebGLRenderingContextConstructor WebGLRenderingContext;
+        attribute [Conditional=WEBGL] WebGLShaderConstructor WebGLShader;
+        attribute [Conditional=WEBGL] WebGLTextureConstructor WebGLTexture;
+        attribute [Conditional=WEBGL] WebGLUniformLocationConstructor WebGLUniformLocation;
         attribute TextMetricsConstructor TextMetrics;
 
         attribute DOMStringMapConstructor DOMStringMap;
@@ -606,6 +606,9 @@ module window {
         attribute [Conditional=VIDEO, EnabledAtRuntime] MediaErrorConstructor MediaError;
         attribute [Conditional=VIDEO, EnabledAtRuntime] TimeRangesConstructor TimeRanges;
 
+        attribute WebKitAnimationConstructor WebKitAnimation;
+        attribute WebKitAnimationListConstructor WebKitAnimationList;
+
 #if defined(ENABLE_XPATH) && ENABLE_XPATH
         attribute XPathEvaluatorConstructor XPathEvaluator;
         attribute XPathResultConstructor XPathResult;
@@ -721,7 +724,7 @@ module window {
         attribute SVGSetElementConstructor SVGSetElement;
 #endif
 
-#if ENABLE_SVG_FONTS && ENABLE_SVG_FONTS
+#if defined(ENABLE_SVG_FONTS) && ENABLE_SVG_FONTS
 //      attribute SVGAltGlyphDefElementConstructor SVGAltGlyphDefElement;
         attribute SVGAltGlyphElementConstructor SVGAltGlyphElement;
 //      attribute SVGAltGlyphItemElementConstructor SVGAltGlyphItemElement;
diff --git a/Source/WebCore/page/DragController.cpp b/Source/WebCore/page/DragController.cpp
index 6a4bb70..342ad19 100644
--- a/Source/WebCore/page/DragController.cpp
+++ b/Source/WebCore/page/DragController.cpp
@@ -353,7 +353,7 @@ DragOperation DragController::operationForLoad(DragData* dragData)
 {
     ASSERT(dragData);
     Document* doc = m_page->mainFrame()->documentAtPoint(dragData->clientPosition());
-    if (doc && (m_didInitiateDrag || doc->isPluginDocument() || doc->inDesignMode()))
+    if (doc && (m_didInitiateDrag || doc->isPluginDocument() || doc->rendererIsEditable()))
         return DragOperationNone;
     return dragOperation(dragData);
 }
@@ -371,6 +371,7 @@ static bool setSelectionToDragCaret(Frame* frame, VisibleSelection& dragCaret, R
 
 bool DragController::dispatchTextInputEventFor(Frame* innerFrame, DragData* dragData)
 {
+    ASSERT(!m_page->dragCaretController()->isNone());
     VisibleSelection dragCaret(m_page->dragCaretController()->selection());
     String text = dragCaret.isContentRichlyEditable() ? "" : dragData->asPlainText(innerFrame);
     Node* target = innerFrame->editor()->findEventTargetFrom(dragCaret);
@@ -393,7 +394,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
     Frame* innerFrame = element->ownerDocument()->frame();
     ASSERT(innerFrame);
 
-    if (!dispatchTextInputEventFor(innerFrame, dragData))
+    if (!m_page->dragCaretController()->isNone() && !dispatchTextInputEventFor(innerFrame, dragData))
         return true;
 
     if (dragData->containsColor()) {
@@ -510,7 +511,7 @@ bool DragController::canProcessDrag(DragData* dragData)
     if (dragData->containsFiles() && asFileInput(result.innerNonSharedNode()))
         return true;
 
-    if (!result.innerNonSharedNode()->isContentEditable())
+    if (!result.innerNonSharedNode()->rendererIsEditable())
         return false;
 
     if (m_didInitiateDrag && m_documentUnderMouse == m_dragInitiator && result.isSelected())
diff --git a/Source/WebCore/page/DragController.h b/Source/WebCore/page/DragController.h
index 0f176b1..693189a 100644
--- a/Source/WebCore/page/DragController.h
+++ b/Source/WebCore/page/DragController.h
@@ -66,7 +66,6 @@ namespace WebCore {
         void setIsHandlingDrag(bool handling) { m_isHandlingDrag = handling; }
         bool isHandlingDrag() const { return m_isHandlingDrag; }
         DragOperation sourceDragOperation() const { return m_sourceDragOperation; }
-        void setDraggingImageURL(const KURL& url) { m_draggingImageURL = url; }
         const KURL& draggingImageURL() const { return m_draggingImageURL; }
         void setDragOffset(const IntPoint& offset) { m_dragOffset = offset; }
         const IntPoint& dragOffset() const { return m_dragOffset; }
diff --git a/Source/WebCore/page/EditorClient.h b/Source/WebCore/page/EditorClient.h
index d5de6a4..aeda844 100644
--- a/Source/WebCore/page/EditorClient.h
+++ b/Source/WebCore/page/EditorClient.h
@@ -158,14 +158,15 @@ public:
 
     virtual TextCheckerClient* textChecker() = 0;
 
-#if SUPPORT_AUTOCORRECTION_PANEL
     enum AutocorrectionResponseType {
         AutocorrectionEdited,
         AutocorrectionReverted
     };
-    virtual void showCorrectionPanel(CorrectionPanelInfo::PanelType, const FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacmentString, const Vector<String>& alternativeReplacementStrings, Editor*) = 0;
+
+#if SUPPORT_AUTOCORRECTION_PANEL
+    virtual void showCorrectionPanel(CorrectionPanelInfo::PanelType, const FloatRect& boundingBoxOfReplacedString, const String& replacedString, const String& replacmentString, const Vector<String>& alternativeReplacementStrings) = 0;
     virtual void dismissCorrectionPanel(ReasonForDismissingCorrectionPanel) = 0;
-    virtual bool isShowingCorrectionPanel() = 0;
+    virtual String dismissCorrectionPanelSoon(ReasonForDismissingCorrectionPanel) = 0;
     virtual void recordAutocorrectionResponse(AutocorrectionResponseType, const String& replacedString, const String& replacementString) = 0;
 #endif
 
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index ef2ffb3..f05e8b2 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -98,8 +98,13 @@
 #include "TouchEvent.h"
 #endif
 
+<<<<<<< HEAD
 #if defined(ANDROID_PLUGINS)
 #include "WebViewCore.h"
+=======
+#if ENABLE(GESTURE_RECOGNIZER)
+#include "PlatformGestureRecognizer.h"
+>>>>>>> webkit.org at r82507
 #endif
 
 namespace WebCore {
@@ -209,6 +214,9 @@ EventHandler::EventHandler(Frame* frame)
 #if ENABLE(TOUCH_EVENTS)
     , m_touchPressed(false)
 #endif
+#if ENABLE(GESTURE_RECOGNIZER)
+    , m_gestureRecognizer(PlatformGestureRecognizer::create())
+#endif
 {
 }
 
@@ -260,6 +268,20 @@ void EventHandler::clear()
 #endif
 }
 
+static void setSelectionIfNeeded(SelectionController* selection, const VisibleSelection& newSelection)
+{
+    ASSERT(selection);
+    if (selection->selection() != newSelection && selection->shouldChangeSelection(newSelection))
+        selection->setSelection(newSelection);
+}
+
+static void setNonDirectionalSelectionIfNeeded(SelectionController* selection, const VisibleSelection& newSelection, TextGranularity granularity)
+{
+    ASSERT(selection);
+    if (selection->selection() != newSelection && selection->shouldChangeSelection(newSelection))
+        selection->setSelection(newSelection, granularity, MakeNonDirectionalSelection);
+}
+
 void EventHandler::selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults& result)
 {
     Node* innerNode = result.targetNode();
@@ -279,9 +301,8 @@ void EventHandler::selectClosestWordFromMouseEvent(const MouseEventWithHitTestRe
             if (result.event().clickCount() == 2 && m_frame->editor()->isSelectTrailingWhitespaceEnabled()) 
                 newSelection.appendTrailingWhitespace();            
         }
-        
-        if (m_frame->selection()->shouldChangeSelection(newSelection))
-            m_frame->selection()->setSelection(newSelection, granularity, MakeNonDirectionalSelection);
+
+        setNonDirectionalSelectionIfNeeded(m_frame->selection(), newSelection, granularity);
     }
 }
 
@@ -305,8 +326,7 @@ void EventHandler::selectClosestWordOrLinkFromMouseEvent(const MouseEventWithHit
             m_beganSelectingText = true;
         }
 
-        if (m_frame->selection()->shouldChangeSelection(newSelection))
-            m_frame->selection()->setSelection(newSelection, granularity, MakeNonDirectionalSelection);
+        setNonDirectionalSelectionIfNeeded(m_frame->selection(), newSelection, granularity);
     }
 }
 
@@ -349,9 +369,8 @@ bool EventHandler::handleMousePressEventTripleClick(const MouseEventWithHitTestR
         granularity = ParagraphGranularity;
         m_beganSelectingText = true;
     }
-    
-    if (m_frame->selection()->shouldChangeSelection(newSelection))
-        m_frame->selection()->setSelection(newSelection, granularity, MakeNonDirectionalSelection);
+
+    setNonDirectionalSelectionIfNeeded(m_frame->selection(), newSelection, granularity);
 
     return true;
 }
@@ -416,9 +435,8 @@ bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestR
         m_beganSelectingText = true;
     } else
         newSelection = VisibleSelection(visiblePos);
-    
-    if (m_frame->selection()->shouldChangeSelection(newSelection))
-        m_frame->selection()->setSelection(newSelection, granularity, MakeNonDirectionalSelection);
+
+    setNonDirectionalSelectionIfNeeded(m_frame->selection(), newSelection, granularity);
 
     return true;
 }
@@ -555,7 +573,13 @@ bool EventHandler::handleMouseDraggedEvent(const MouseEventWithHitTestResults& e
         
         m_mouseDownMayStartAutoscroll = false;
     }
-    
+
+    if (!m_beganSelectingText) {
+        HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+        HitTestResult result(m_mouseDownPos);
+        m_frame->document()->renderView()->layer()->hitTest(request, result);
+        updateSelectionForMouseDrag(result.innerNode(), result.localPoint());
+    }
     updateSelectionForMouseDrag(targetNode, event.localPoint());
     return true;
 }
@@ -653,10 +677,7 @@ void EventHandler::updateSelectionForMouseDrag(Node* targetNode, const IntPoint&
     if (m_frame->selection()->granularity() != CharacterGranularity)
         newSelection.expandUsingGranularity(m_frame->selection()->granularity());
 
-    if (m_frame->selection()->shouldChangeSelection(newSelection)) {
-        m_frame->selection()->setIsDirectional(false);
-        m_frame->selection()->setSelection(newSelection, m_frame->selection()->granularity(), MakeNonDirectionalSelection);
-    }
+    setNonDirectionalSelectionIfNeeded(m_frame->selection(), newSelection, m_frame->selection()->granularity());
 }
 #endif // ENABLE(DRAG_SUPPORT)
 
@@ -713,12 +734,12 @@ bool EventHandler::handleMouseReleaseEvent(const MouseEventWithHitTestResults& e
         VisibleSelection newSelection;
         Node* node = event.targetNode();
         bool caretBrowsing = m_frame->settings()->caretBrowsingEnabled();
-        if (node && (caretBrowsing || node->isContentEditable()) && node->renderer()) {
+        if (node && (caretBrowsing || node->rendererIsEditable()) && node->renderer()) {
             VisiblePosition pos = node->renderer()->positionForPoint(event.localPoint());
             newSelection = VisibleSelection(pos);
         }
-        if (m_frame->selection()->shouldChangeSelection(newSelection))
-            m_frame->selection()->setSelection(newSelection);
+
+        setSelectionIfNeeded(m_frame->selection(), newSelection);
 
         handled = true;
     }
@@ -1165,7 +1186,7 @@ Cursor EventHandler::selectCursor(const MouseEventWithHitTestResults& event, Scr
 
     switch (style ? style->cursor() : CURSOR_AUTO) {
     case CURSOR_AUTO: {
-        bool editable = (node && node->isContentEditable());
+        bool editable = (node && node->rendererIsEditable());
         bool editableLinkEnabled = false;
 
         // If the link is editable, then we need to check the settings to see whether or not the link should be followed
@@ -1456,6 +1477,22 @@ bool EventHandler::handleMouseDoubleClickEvent(const PlatformMouseEvent& mouseEv
     return swallowMouseUpEvent || swallowClickEvent || swallowMouseReleaseEvent;
 }
 
+static RenderLayer* layerForNode(Node* node)
+{
+    if (!node)
+        return 0;
+
+    RenderObject* renderer = node->renderer();
+    if (!renderer)
+        return 0;
+
+    RenderLayer* layer = renderer->enclosingLayer();
+    if (!layer)
+        return 0;
+
+    return layer;
+}
+
 bool EventHandler::mouseMoved(const PlatformMouseEvent& event)
 {
     HitTestResult hoveredNode = HitTestResult(IntPoint());
@@ -1465,6 +1502,11 @@ bool EventHandler::mouseMoved(const PlatformMouseEvent& event)
     if (!page)
         return result;
 
+    if (RenderLayer* layer = layerForNode(hoveredNode.innerNode())) {
+        if (page->containsScrollableArea(layer))
+            layer->scrollAnimator()->mouseMovedInContentArea();
+    }
+
     if (FrameView* frameView = m_frame->view())
         frameView->scrollAnimator()->mouseMovedInContentArea();  
 
@@ -1889,21 +1931,32 @@ void EventHandler::updateMouseEventTargetNode(Node* targetNode, const PlatformMo
 
     // Fire mouseout/mouseover if the mouse has shifted to a different node.
     if (fireMouseOverOut) {
-        // FIXME: This code will only correctly handle transitions between frames with scrollbars,
-        // not transitions between overflow regions, or transitions between two frames
-        // that don't have scrollbars contained within a frame that does.
+        RenderLayer* layerForLastNode = layerForNode(m_lastNodeUnderMouse.get());
+        RenderLayer* layerForNodeUnderMouse = layerForNode(m_nodeUnderMouse.get());
+        Page* page = m_frame->page();
+
         if (m_lastNodeUnderMouse && (!m_nodeUnderMouse || m_nodeUnderMouse->document() != m_frame->document())) {
+            // The mouse has moved between frames.
             if (Frame* frame = m_lastNodeUnderMouse->document()->frame()) {
                 if (FrameView* frameView = frame->view())
                     frameView->scrollAnimator()->mouseExitedContentArea();
             }
+        } else if (page && (layerForLastNode && (!layerForNodeUnderMouse || layerForNodeUnderMouse != layerForLastNode))) {
+            // The mouse has moved between layers.
+            if (page->containsScrollableArea(layerForLastNode))
+                layerForLastNode->scrollAnimator()->mouseExitedContentArea();
         }
         
         if (m_nodeUnderMouse && (!m_lastNodeUnderMouse || m_lastNodeUnderMouse->document() != m_frame->document())) {
+            // The mouse has moved between frames.
             if (Frame* frame = m_nodeUnderMouse->document()->frame()) {
                 if (FrameView* frameView = frame->view())
                     frameView->scrollAnimator()->mouseEnteredContentArea();
             }
+        } else if (page && (layerForNodeUnderMouse && (!layerForLastNode || layerForNodeUnderMouse != layerForLastNode))) {
+            // The mouse has moved between layers.
+            if (page->containsScrollableArea(layerForNodeUnderMouse))
+                layerForNodeUnderMouse->scrollAnimator()->mouseEnteredContentArea();
         }
         
         if (m_lastNodeUnderMouse && m_lastNodeUnderMouse->document() != m_frame->document()) {
@@ -2360,6 +2413,8 @@ bool EventHandler::needsKeyboardEventDisambiguationQuirks() const
 
 bool EventHandler::keyEvent(const PlatformKeyboardEvent& initialKeyEvent)
 {
+    RefPtr<FrameView> protector(m_frame->view()); 
+
 #if ENABLE(PAN_SCROLLING)
     if (Page* page = m_frame->page()) {
         if (page->mainFrame()->eventHandler()->panScrollInProgress() || m_autoscrollInProgress) {
@@ -3123,6 +3178,11 @@ bool EventHandler::handleTouchEvent(const PlatformTouchEvent& event)
         }
     }
 
+#if ENABLE(GESTURE_RECOGNIZER)
+    if (m_gestureRecognizer)
+        m_gestureRecognizer->processTouchEventForGesture(event, this, defaultPrevented);
+#endif
+
     return defaultPrevented;
 }
 #endif
diff --git a/Source/WebCore/page/EventHandler.h b/Source/WebCore/page/EventHandler.h
index e20e43c..70d6194 100644
--- a/Source/WebCore/page/EventHandler.h
+++ b/Source/WebCore/page/EventHandler.h
@@ -34,6 +34,7 @@
 #include "TextEventInputType.h"
 #include "Timer.h"
 #include <wtf/Forward.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 
 #if PLATFORM(MAC) && !defined(__OBJC__)
@@ -76,6 +77,10 @@ class Widget;
 class PlatformGestureEvent;
 #endif
 
+#if ENABLE(GESTURE_RECOGNIZER)
+class PlatformGestureRecognizer;
+#endif
+
 #if ENABLE(DRAG_SUPPORT)
 extern const int LinkDragHysteresis;
 extern const int ImageDragHysteresis;
@@ -456,6 +461,9 @@ private:
     RefPtr<Node> m_capturingTouchEventsNode;
 #endif
 #endif
+#if ENABLE(GESTURE_RECOGNIZER)
+    OwnPtr<PlatformGestureRecognizer> m_gestureRecognizer;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/FocusController.cpp b/Source/WebCore/page/FocusController.cpp
index 10901c5..41cfee4 100644
--- a/Source/WebCore/page/FocusController.cpp
+++ b/Source/WebCore/page/FocusController.cpp
@@ -301,7 +301,7 @@ bool FocusController::advanceFocusInDocumentOrder(FocusDirection direction, Keyb
 static bool relinquishesEditingFocus(Node *node)
 {
     ASSERT(node);
-    ASSERT(node->isContentEditable());
+    ASSERT(node->rendererIsEditable());
 
     Node* root = node->rootEditableElement();
     Frame* frame = node->document()->frame();
@@ -410,11 +410,16 @@ void FocusController::setActive(bool active)
             view->updateLayoutAndStyleIfNeededRecursive();
             view->updateControlTints();
         }
-        // FIXME: This should propogate to all ScrollableAreas.
-        if (!active)
-            view->scrollAnimator()->contentAreaDidHide();
-        else
-            view->scrollAnimator()->contentAreaDidShow();
+
+        if (const HashSet<ScrollableArea*>* scrollableAreas = m_page->scrollableAreaSet()) {
+            HashSet<ScrollableArea*>::const_iterator end = scrollableAreas->end(); 
+            for (HashSet<ScrollableArea*>::const_iterator it = scrollableAreas->begin(); it != end; ++it) {
+                if (!active)
+                    (*it)->scrollAnimator()->contentAreaDidHide();
+                else
+                    (*it)->scrollAnimator()->contentAreaDidShow();
+            }
+        }
     }
 
     focusedOrMainFrame()->selection()->pageActivationChanged();
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index 9a562a1..3652c9a 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -690,8 +690,10 @@ void Frame::pageDestroyed()
     if (Frame* parent = tree()->parent())
         parent->loader()->checkLoadComplete();
 
-    if (m_domWindow)
+    if (m_domWindow) {
+        m_domWindow->resetGeolocation();
         m_domWindow->pageDestroyed();
+    }
 
     // FIXME: It's unclear as to why this is called more than once, but it is,
     // so page() could be NULL.
@@ -736,6 +738,13 @@ void Frame::transferChildFrameToNewDocument()
              m_page->decrementFrameCount();
         }
 
+        // FIXME: We should ideally allow existing Geolocation activities to continue
+        // when the Geolocation's iframe is reparented.
+        // See https://bugs.webkit.org/show_bug.cgi?id=55577
+        // and https://bugs.webkit.org/show_bug.cgi?id=52877
+        if (m_domWindow)
+            m_domWindow->resetGeolocation();
+
         m_page = newPage;
 
         if (newPage)
@@ -901,7 +910,7 @@ Color Frame::tiledBackingStoreBackgroundColor() const
 }
 #endif
 
-String Frame::layerTreeAsText() const
+String Frame::layerTreeAsText(bool showDebugInfo) const
 {
 #if USE(ACCELERATED_COMPOSITING)
     document()->updateLayout();
@@ -909,7 +918,7 @@ String Frame::layerTreeAsText() const
     if (!contentRenderer())
         return String();
 
-    return contentRenderer()->compositor()->layerTreeAsText();
+    return contentRenderer()->compositor()->layerTreeAsText(showDebugInfo);
 #else
     return String();
 #endif
diff --git a/Source/WebCore/page/Frame.h b/Source/WebCore/page/Frame.h
index 25f8aac..f22fcb8 100644
--- a/Source/WebCore/page/Frame.h
+++ b/Source/WebCore/page/Frame.h
@@ -127,7 +127,7 @@ namespace WebCore {
 
         void injectUserScripts(UserScriptInjectionTime);
         
-        String layerTreeAsText() const;
+        String layerTreeAsText(bool showDebugInfo = false) const;
 
         // Unlike most accessors in this class, domWindow() always creates a new DOMWindow if m_domWindow is null.
         // Callers that don't need a new DOMWindow to be created should use existingDOMWindow().
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index 8ab19ab..9cf2c57 100644
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -141,13 +141,19 @@ FrameView::FrameView(Frame* frame)
     , m_shouldUpdateWhileOffscreen(true)
     , m_deferSetNeedsLayouts(0)
     , m_setNeedsLayoutWasDeferred(false)
-    , m_isRestoringFromBackForward(false)
     , m_scrollCorner(0)
 #if ENABLE(ANDROID_OVERFLOW_SCROLL)
     , m_hasOverflowScroll(false)
 #endif
 {
     init();
+
+    if (m_frame) {
+        if (Page* page = m_frame->page()) {
+            m_page = page;
+            m_page->addScrollableArea(this);
+        }
+    }
 }
 
 PassRefPtr<FrameView> FrameView::create(Frame* frame)
@@ -188,6 +194,9 @@ FrameView::~FrameView()
     ASSERT(!m_scrollCorner);
     ASSERT(m_actionScheduler->isEmpty());
 
+    if (m_page)
+        m_page->removeScrollableArea(this);
+
     if (m_frame) {
         ASSERT(m_frame->view() != this || !m_frame->contentRenderer());
         RenderPart* renderer = m_frame->ownerRenderer();
@@ -229,7 +238,6 @@ void FrameView::reset()
     m_isPainting = false;
     m_isVisuallyNonEmpty = false;
     m_firstVisuallyNonEmptyLayoutCallbackPending = true;
-    m_isRestoringFromBackForward = false;
     m_maintainScrollPositionAnchor = 0;
 }
 
@@ -255,6 +263,15 @@ void FrameView::resetScrollbars()
     setScrollbarsSuppressed(false);
 }
 
+void FrameView::resetScrollbarsAndClearContentsSize()
+{
+    resetScrollbars();
+
+    setScrollbarsSuppressed(true);
+    setContentsSize(IntSize());
+    setScrollbarsSuppressed(false);
+}
+
 void FrameView::init()
 {
     reset();
@@ -854,12 +871,7 @@ void FrameView::layout(bool allowSubtree)
 
         if (m_firstLayout || (hMode != currentHMode || vMode != currentVMode)) {
             if (m_firstLayout) {
-                if (!m_isRestoringFromBackForward)
-                    setScrollbarsSuppressed(true);
-                else {
-                    setScrollbarsSuppressed(false);
-                    m_isRestoringFromBackForward = false;
-                }
+                setScrollbarsSuppressed(true);
 
                 m_firstLayout = false;
                 m_firstLayoutCallbackPending = true;
@@ -931,8 +943,10 @@ void FrameView::layout(bool allowSubtree)
     // Now update the positions of all layers.
     beginDeferredRepaints();
     IntPoint cachedOffset;
-    layer->updateLayerPositions((m_doFullRepaint ? RenderLayer::DoFullRepaint : 0)
-                                | RenderLayer::CheckForRepaint
+    if (m_doFullRepaint)
+        root->view()->repaint(); // FIXME: This isn't really right, since the RenderView doesn't fully encompass the visibleContentRect(). It just happens
+                                 // to work out most of the time, since first layouts and printing don't have you scrolled anywhere.
+    layer->updateLayerPositions((m_doFullRepaint ? 0 : RenderLayer::CheckForRepaint)
                                 | RenderLayer::IsCompositingUpdateRoot
                                 | RenderLayer::UpdateCompositingLayers,
                                 subtree ? 0 : &cachedOffset);
@@ -2125,6 +2139,28 @@ void FrameView::didCompleteRubberBand(const IntSize& initialOverhang) const
     return page->chrome()->client()->didCompleteRubberBandForMainFrame(initialOverhang);
 }
 
+void FrameView::scrollbarStyleChanged()
+{
+    m_frame->page()->setNeedsRecalcStyleInAllFrames();
+}
+
+bool FrameView::shouldSuspendScrollAnimations() const
+{
+    return m_frame->loader()->state() != FrameStateComplete;
+}
+
+void FrameView::notifyPageThatContentAreaWillPaint() const
+{
+    Page* page = m_frame->page();
+    const HashSet<ScrollableArea*>* scrollableAreas = page->scrollableAreaSet();
+    if (!scrollableAreas)
+        return;
+
+    HashSet<ScrollableArea*>::const_iterator end = scrollableAreas->end(); 
+    for (HashSet<ScrollableArea*>::const_iterator it = scrollableAreas->begin(); it != end; ++it)
+        (*it)->scrollAnimator()->contentAreaWillPaint();
+}
+
 #if ENABLE(DASHBOARD_SUPPORT)
 void FrameView::updateDashboardRegions()
 {
@@ -2339,8 +2375,12 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
 
     // m_nodeToDraw is used to draw only one element (and its descendants)
     RenderObject* eltRenderer = m_nodeToDraw ? m_nodeToDraw->renderer() : 0;
+    RenderLayer* rootLayer = contentRenderer->layer();
 
-    contentRenderer->layer()->paint(p, rect, m_paintBehavior, eltRenderer);
+    rootLayer->paint(p, rect, m_paintBehavior, eltRenderer);
+
+    if (rootLayer->containsDirtyOverlayScrollbars())
+        rootLayer->paintOverlayScrollbars(p, rect, m_paintBehavior, eltRenderer);
 
     m_isPainting = false;
 
@@ -2468,7 +2508,6 @@ void FrameView::forceLayoutForPagination(const FloatSize& pageSize, float maximu
             root->setLogicalWidth(flooredPageLogicalWidth);
             root->setNeedsLayoutAndPrefWidthsRecalc();
             forceLayout();
-            root->clearLayoutOverflow();
             int docLogicalHeight = root->style()->isHorizontalWritingMode() ? root->docHeight() : root->docWidth();
             int docLogicalTop = root->style()->isHorizontalWritingMode() ? root->docTop() : root->docLeft();
             int docLogicalRight = root->style()->isHorizontalWritingMode() ? root->docRight() : root->docBottom();
@@ -2478,6 +2517,7 @@ void FrameView::forceLayoutForPagination(const FloatSize& pageSize, float maximu
             IntRect overflow(clippedLogicalLeft, docLogicalTop, flooredPageLogicalWidth, docLogicalHeight);
             if (!root->style()->isHorizontalWritingMode())
                 overflow = overflow.transposedRect();
+            root->clearLayoutOverflow();
             root->addLayoutOverflow(overflow); // This is how we clip in case we overflow again.
         }
     }
diff --git a/Source/WebCore/page/FrameView.h b/Source/WebCore/page/FrameView.h
index 8e79a3a..9af0552 100644
--- a/Source/WebCore/page/FrameView.h
+++ b/Source/WebCore/page/FrameView.h
@@ -138,6 +138,7 @@ public:
     void willMoveOffscreen();
 
     void resetScrollbars();
+    void resetScrollbarsAndClearContentsSize();
     void detachCustomScrollbars();
 
     void clear();
@@ -213,6 +214,7 @@ public:
     void setPaintBehavior(PaintBehavior);
     PaintBehavior paintBehavior() const;
     bool isPainting() const;
+    bool hasEverPainted() const { return m_lastPaintTime; }
     void setNodeToDraw(Node*);
 
     virtual void paintOverhangAreas(GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
@@ -274,8 +276,7 @@ public:
     // FIXME: Remove this method once plugin loading is decoupled from layout.
     void flushAnyPendingPostLayoutTasks();
 
-    void setIsRestoringFromBackForward(bool isRestoring) { m_isRestoringFromBackForward = isRestoring; }
-    bool isRestoringFromBackForward() const { return m_isRestoringFromBackForward; }
+    virtual bool shouldSuspendScrollAnimations() const;
 
 protected:
     virtual bool scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
@@ -322,6 +323,10 @@ private:
     virtual void getTickmarks(Vector<IntRect>&) const;
     virtual void scrollTo(const IntSize&);
     virtual void didCompleteRubberBand(const IntSize&) const;
+    virtual void scrollbarStyleChanged();
+
+    virtual void notifyPageThatContentAreaWillPaint() const;
+    virtual void disconnectFromPage() { m_page = 0; }
 
     void deferredRepaintTimerFired(Timer<FrameView>*);
     void doDeferredRepaints();
@@ -415,13 +420,13 @@ private:
     bool m_isVisuallyNonEmpty;
     bool m_firstVisuallyNonEmptyLayoutCallbackPending;
 
-    bool m_isRestoringFromBackForward;
-
     RefPtr<Node> m_maintainScrollPositionAnchor;
 
     // Renderer to hold our custom scroll corner.
     RenderScrollbarPart* m_scrollCorner;
 
+    Page* m_page;
+
     static double s_deferredRepaintDelay;
     static double s_initialDeferredRepaintDelayDuringLoading;
     static double s_maxDeferredRepaintDelayDuringLoading;
diff --git a/Source/WebCore/page/Geolocation.cpp b/Source/WebCore/page/Geolocation.cpp
index 354dde3..f0dd76a 100644
--- a/Source/WebCore/page/Geolocation.cpp
+++ b/Source/WebCore/page/Geolocation.cpp
@@ -231,19 +231,35 @@ Geolocation::Geolocation(Frame* frame)
 
 Geolocation::~Geolocation()
 {
+    ASSERT(m_allowGeolocation != InProgress);
+    ASSERT(!m_frame);
 }
 
-void Geolocation::disconnectFrame()
+Page* Geolocation::page() const
+{
+    return m_frame ? m_frame->page() : 0;
+}
+
+void Geolocation::reset()
 {
-    if (m_frame && m_frame->page() && m_allowGeolocation == InProgress) {
+    Page* page = this->page();
+    if (page && m_allowGeolocation == InProgress) {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
-        m_frame->page()->geolocationController()->cancelPermissionRequest(this);
+        page->geolocationController()->cancelPermissionRequest(this);
 #else
-        m_frame->page()->chrome()->cancelGeolocationPermissionRequestForFrame(m_frame, this);
+        page->chrome()->cancelGeolocationPermissionRequestForFrame(m_frame, this);
 #endif
     }
+    // The frame may be moving to a new page and we want to get the permissions from the new page's client.
+    m_allowGeolocation = Unknown;
     cancelAllRequests();
     stopUpdating();
+}
+
+void Geolocation::disconnectFrame()
+{
+    // Once we are disconnected from the Frame, it is no longer possible to perform any operations.
+    reset();
     if (m_frame && m_frame->document())
         m_frame->document()->setUsingGeolocation(false);
     m_frame = 0;
@@ -252,10 +268,7 @@ void Geolocation::disconnectFrame()
 Geoposition* Geolocation::lastPosition()
 {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
-    if (!m_frame)
-        return 0;
-
-    Page* page = m_frame->page();
+    Page* page = this->page();
     if (!page)
         return 0;
 
@@ -594,10 +607,7 @@ void Geolocation::requestPermission()
     if (m_allowGeolocation > Unknown)
         return;
 
-    if (!m_frame)
-        return;
-
-    Page* page = m_frame->page();
+    Page* page = this->page();
     if (!page)
         return;
 
@@ -691,10 +701,7 @@ void Geolocation::geolocationServiceErrorOccurred(GeolocationService* service)
 bool Geolocation::startUpdating(GeoNotifier* notifier)
 {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
-    if (!m_frame)
-        return false;
-
-    Page* page = m_frame->page();
+    Page* page = this->page();
     if (!page)
         return false;
 
@@ -720,10 +727,7 @@ bool Geolocation::startUpdating(GeoNotifier* notifier)
 void Geolocation::stopUpdating()
 {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
-    if (!m_frame)
-        return;
-
-    Page* page = m_frame->page();
+    Page* page = this->page();
     if (!page)
         return;
 
@@ -764,6 +768,8 @@ namespace WebCore {
 
 void Geolocation::clearWatch(int) {}
 
+void Geolocation::reset() {}
+
 void Geolocation::disconnectFrame() {}
 
 Geolocation::Geolocation(Frame*) {}
diff --git a/Source/WebCore/page/Geolocation.h b/Source/WebCore/page/Geolocation.h
index 7c06ae4..b52ad45 100644
--- a/Source/WebCore/page/Geolocation.h
+++ b/Source/WebCore/page/Geolocation.h
@@ -58,6 +58,7 @@ public:
 
     ~Geolocation();
 
+    void reset();
     void disconnectFrame();
     
     void getCurrentPosition(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
@@ -86,6 +87,8 @@ private:
     
     Geolocation(Frame*);
 
+    Page* page() const;
+
     class GeoNotifier : public RefCounted<GeoNotifier> {
     public:
         static PassRefPtr<GeoNotifier> create(Geolocation* geolocation, PassRefPtr<PositionCallback> positionCallback, PassRefPtr<PositionErrorCallback> positionErrorCallback, PassRefPtr<PositionOptions> options) { return adoptRef(new GeoNotifier(geolocation, positionCallback, positionErrorCallback, options)); }
diff --git a/Source/WebCore/page/GeolocationController.cpp b/Source/WebCore/page/GeolocationController.cpp
index 764b913..b9533ca 100644
--- a/Source/WebCore/page/GeolocationController.cpp
+++ b/Source/WebCore/page/GeolocationController.cpp
@@ -41,12 +41,10 @@ GeolocationController::GeolocationController(Page* page, GeolocationClient* clie
 
 GeolocationController::~GeolocationController()
 {
-    if (m_client) {
-        if (!m_observers.isEmpty())
-            m_client->stopUpdating();
+    ASSERT(m_observers.isEmpty());
 
+    if (m_client)
         m_client->geolocationDestroyed();
-    }
 }
 
 void GeolocationController::addObserver(Geolocation* observer, bool enableHighAccuracy)
diff --git a/Source/WebCore/page/Navigator.cpp b/Source/WebCore/page/Navigator.cpp
index 53563b4..9526536 100644
--- a/Source/WebCore/page/Navigator.cpp
+++ b/Source/WebCore/page/Navigator.cpp
@@ -61,6 +61,12 @@ Navigator::~Navigator()
     disconnectFrame();
 }
 
+void Navigator::resetGeolocation()
+{
+    if (m_geolocation)
+        m_geolocation->reset();
+}
+
 void Navigator::disconnectFrame()
 {
     if (m_plugins) {
diff --git a/Source/WebCore/page/Navigator.h b/Source/WebCore/page/Navigator.h
index f7dc543..8514279 100644
--- a/Source/WebCore/page/Navigator.h
+++ b/Source/WebCore/page/Navigator.h
@@ -49,6 +49,7 @@ public:
     static PassRefPtr<Navigator> create(Frame* frame) { return adoptRef(new Navigator(frame)); }
     virtual ~Navigator();
 
+    void resetGeolocation();
     void disconnectFrame();
     Frame* frame() const { return m_frame; }
 
diff --git a/Source/WebCore/page/NavigatorBase.cpp b/Source/WebCore/page/NavigatorBase.cpp
index ca51a29..3ff195a 100644
--- a/Source/WebCore/page/NavigatorBase.cpp
+++ b/Source/WebCore/page/NavigatorBase.cpp
@@ -57,7 +57,7 @@
 #endif // ifndef WEBCORE_NAVIGATOR_PRODUCT_SUB
 
 #ifndef WEBCORE_NAVIGATOR_VENDOR
-#define WEBCORE_NAVIGATOR_VENDOR "Apple Computer, Inc."
+#define WEBCORE_NAVIGATOR_VENDOR "Apple Inc."
 #endif // ifndef WEBCORE_NAVIGATOR_VENDOR
 
 #ifndef WEBCORE_NAVIGATOR_VENDOR_SUB
diff --git a/Source/WebCore/page/Page.cpp b/Source/WebCore/page/Page.cpp
index f8d6168..63227e4 100644
--- a/Source/WebCore/page/Page.cpp
+++ b/Source/WebCore/page/Page.cpp
@@ -177,6 +177,7 @@ Page::Page(const PageClients& pageClients)
     , m_canStartMedia(true)
     , m_viewMode(ViewModeWindowed)
     , m_minimumTimerInterval(Settings::defaultMinDOMTimerInterval())
+    , m_isEditable(false)
 {
     if (!allPages) {
         allPages = new HashSet<Page*>;
@@ -209,6 +210,12 @@ Page::~Page()
     for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext())
         frame->pageDestroyed();
 
+    if (m_scrollableAreaSet) {
+        ScrollableAreaSet::const_iterator end = m_scrollableAreaSet->end(); 
+        for (ScrollableAreaSet::const_iterator it = m_scrollableAreaSet->begin(); it != end; ++it)
+            (*it)->disconnectFromPage();
+    }
+
     m_editorClient->pageDestroyed();
 
     InspectorInstrumentation::inspectedPageDestroyed(this);
@@ -402,6 +409,12 @@ void Page::scheduleForcedStyleRecalcForAllPages()
             frame->document()->scheduleForcedStyleRecalc();
 }
 
+void Page::setNeedsRecalcStyleInAllFrames()
+{
+    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext())
+        frame->document()->styleSelectorChanged(DeferRecalcStyle);
+}
+
 void Page::updateViewportArguments()
 {
     if (!mainFrame() || !mainFrame()->document() || mainFrame()->document()->viewportArguments() == m_viewportArguments)
@@ -910,6 +923,27 @@ void Page::didStopPlugin(HaltablePlugin* obj)
         m_pluginHalter->didStopPlugin(obj);
 }
 
+void Page::addScrollableArea(ScrollableArea* scrollableArea)
+{
+    if (!m_scrollableAreaSet)
+        m_scrollableAreaSet = adoptPtr(new ScrollableAreaSet);
+    m_scrollableAreaSet->add(scrollableArea);
+}
+
+void Page::removeScrollableArea(ScrollableArea* scrollableArea)
+{
+    if (!m_scrollableAreaSet)
+        return;
+    m_scrollableAreaSet->remove(scrollableArea);
+}
+
+bool Page::containsScrollableArea(ScrollableArea* scrollableArea) const
+{
+    if (!m_scrollableAreaSet)
+        return false;
+    return m_scrollableAreaSet->contains(scrollableArea);
+}
+
 #if !ASSERT_DISABLED
 void Page::checkFrameCountConsistency() const
 {
diff --git a/Source/WebCore/page/Page.h b/Source/WebCore/page/Page.h
index 4498d36..8307123 100644
--- a/Source/WebCore/page/Page.h
+++ b/Source/WebCore/page/Page.h
@@ -70,6 +70,7 @@ namespace WebCore {
     class ProgressTracker;
     class RenderTheme;
     class VisibleSelection;
+    class ScrollableArea;
     class SelectionController;
     class Settings;
     class SharedGraphicsContext3D;
@@ -118,6 +119,8 @@ namespace WebCore {
         Page(const PageClients&);
         ~Page();
 
+        void setNeedsRecalcStyleInAllFrames();
+
         RenderTheme* theme() const { return m_theme.get(); };
 
         ViewportArguments viewportArguments() const { return m_viewportArguments; }
@@ -279,11 +282,21 @@ namespace WebCore {
         void setJavaScriptURLsAreAllowed(bool);
         bool javaScriptURLsAreAllowed() const;
 
+        typedef HashSet<ScrollableArea*> ScrollableAreaSet;
+        void addScrollableArea(ScrollableArea*);
+        void removeScrollableArea(ScrollableArea*);
+        bool containsScrollableArea(ScrollableArea*) const;
+        const ScrollableAreaSet* scrollableAreaSet() const { return m_scrollableAreaSet.get(); }
+
         // Don't allow more than a certain number of frames in a page.
         // This seems like a reasonable upper bound, and otherwise mutually
         // recursive frameset pages can quickly bring the program to its knees
         // with exponential growth in the number of frames.
         static const int maxNumberOfFrames = 1000;
+
+        void setEditable(bool isEditable) { m_isEditable = isEditable; }
+        bool isEditable() { return m_isEditable; }
+
     private:
         void initGroup();
 
@@ -386,6 +399,10 @@ namespace WebCore {
         ViewportArguments m_viewportArguments;
 
         double m_minimumTimerInterval;
+
+        OwnPtr<ScrollableAreaSet> m_scrollableAreaSet;
+
+        bool m_isEditable;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/PageGroup.cpp b/Source/WebCore/page/PageGroup.cpp
index 96e7301..d53de08 100644
--- a/Source/WebCore/page/PageGroup.cpp
+++ b/Source/WebCore/page/PageGroup.cpp
@@ -33,6 +33,7 @@
 #include "GroupSettings.h"
 #include "IDBFactoryBackendInterface.h"
 #include "Page.h"
+#include "SecurityOrigin.h"
 #include "Settings.h"
 #include "StorageNamespace.h"
 
@@ -115,12 +116,19 @@ void PageGroup::closeLocalStorage()
 #endif
 }
 
+<<<<<<< HEAD
 #if ENABLE(DOM_STORAGE) && defined(ANDROID)
 void PageGroup::clearDomStorage()
+=======
+#if ENABLE(DOM_STORAGE)
+
+void PageGroup::clearLocalStorageForAllOrigins()
+>>>>>>> webkit.org at r82507
 {
     if (!pageGroups)
         return;
 
+<<<<<<< HEAD
 
     PageGroupMap::iterator end = pageGroups->end();
 
@@ -198,6 +206,47 @@ void PageGroup::removeLocalStorage()
 
     m_localStorage = 0;
 }
+=======
+    PageGroupMap::iterator end = pageGroups->end();
+    for (PageGroupMap::iterator it = pageGroups->begin(); it != end; ++it) {
+        if (it->second->hasLocalStorage())
+            it->second->localStorage()->clearAllOriginsForDeletion();
+    }
+}
+
+void PageGroup::clearLocalStorageForOrigin(SecurityOrigin* origin)
+{
+    if (!pageGroups)
+        return;
+
+    PageGroupMap::iterator end = pageGroups->end();
+    for (PageGroupMap::iterator it = pageGroups->begin(); it != end; ++it) {
+        if (it->second->hasLocalStorage())
+            it->second->localStorage()->clearOriginForDeletion(origin);
+    }    
+}
+    
+void PageGroup::syncLocalStorage()
+{
+    if (!pageGroups)
+        return;
+
+    PageGroupMap::iterator end = pageGroups->end();
+    for (PageGroupMap::iterator it = pageGroups->begin(); it != end; ++it) {
+        if (it->second->hasLocalStorage())
+            it->second->localStorage()->sync();
+    }
+}
+
+unsigned PageGroup::numberOfPageGroups()
+{
+    if (!pageGroups)
+        return 0;
+
+    return pageGroups->size();
+}
+
+>>>>>>> webkit.org at r82507
 #endif
 
 void PageGroup::addPage(Page* page)
@@ -299,6 +348,7 @@ StorageNamespace* PageGroup::localStorage()
 
     return m_localStorage.get();
 }
+
 #endif
 
 #if ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/page/PageGroup.h b/Source/WebCore/page/PageGroup.h
index aa600a5..71e22a1 100644
--- a/Source/WebCore/page/PageGroup.h
+++ b/Source/WebCore/page/PageGroup.h
@@ -39,6 +39,7 @@ namespace WebCore {
     class GroupSettings;
     class IDBFactoryBackendInterface;
     class Page;
+    class SecurityOrigin;
     class StorageNamespace;
 
     class PageGroup {
@@ -49,7 +50,16 @@ namespace WebCore {
         ~PageGroup();
 
         static PageGroup* pageGroup(const String& groupName);
+
         static void closeLocalStorage();
+
+#if ENABLE(DOM_STORAGE)
+        static void clearLocalStorageForAllOrigins();
+        static void clearLocalStorageForOrigin(SecurityOrigin*);
+        // DumpRenderTree helper that triggers a StorageArea sync.
+        static void syncLocalStorage();
+#endif
+        static unsigned numberOfPageGroups();
         
 #if ENABLE(DOM_STORAGE) && defined(ANDROID)
         static void clearDomStorage();
diff --git a/Source/WebCore/page/PageGroupLoadDeferrer.cpp b/Source/WebCore/page/PageGroupLoadDeferrer.cpp
index 292b4cd..dfbb244 100644
--- a/Source/WebCore/page/PageGroupLoadDeferrer.cpp
+++ b/Source/WebCore/page/PageGroupLoadDeferrer.cpp
@@ -21,11 +21,11 @@
 #include "config.h"
 #include "PageGroupLoadDeferrer.h"
 
-#include "AsyncScriptRunner.h"
 #include "DocumentParser.h"
 #include "Frame.h"
 #include "Page.h"
 #include "PageGroup.h"
+#include "ScriptRunner.h"
 #include <wtf/HashSet.h>
 
 namespace WebCore {
@@ -39,8 +39,23 @@ PageGroupLoadDeferrer::PageGroupLoadDeferrer(Page* page, bool deferSelf)
     HashSet<Page*>::const_iterator end = pages.end();
     for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
         Page* otherPage = *it;
-        if ((deferSelf || otherPage != page) && !otherPage->defersLoading())
-            m_deferredFrames.append(otherPage->mainFrame());
+        if ((deferSelf || otherPage != page)) {
+            if (!otherPage->defersLoading()) {
+                m_deferredFrames.append(otherPage->mainFrame());
+
+                // This code is not logically part of load deferring, but we do not want JS code executed beneath modal
+                // windows or sheets, which is exactly when PageGroupLoadDeferrer is used.
+                // NOTE: if PageGroupLoadDeferrer is ever used for tasks other than showing a modal window or sheet,
+                // the constructor will need to take a ActiveDOMObject::ReasonForSuspension.
+                for (Frame* frame = otherPage->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+                    frame->document()->suspendScriptedAnimationControllerCallbacks();
+                    frame->document()->suspendActiveDOMObjects(ActiveDOMObject::WillShowDialog);
+                    frame->document()->scriptRunner()->suspend();
+                    if (DocumentParser* parser = frame->document()->parser())
+                        parser->suspendScheduledTasks();
+                }
+            }
+        }
     }
 
     size_t count = m_deferredFrames.size();
@@ -52,8 +67,17 @@ PageGroupLoadDeferrer::PageGroupLoadDeferrer(Page* page, bool deferSelf)
 PageGroupLoadDeferrer::~PageGroupLoadDeferrer()
 {
     for (size_t i = 0; i < m_deferredFrames.size(); ++i) {
-        if (Page* page = m_deferredFrames[i]->page())
+        if (Page* page = m_deferredFrames[i]->page()) {
             page->setDefersLoading(false);
+
+            for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+                frame->document()->resumeActiveDOMObjects();
+                frame->document()->resumeScriptedAnimationControllerCallbacks();
+                frame->document()->scriptRunner()->resume();
+                if (DocumentParser* parser = frame->document()->parser())
+                    parser->resumeScheduledTasks();
+            }
+        }
     }
 }
 
diff --git a/Source/WebCore/page/PrintContext.cpp b/Source/WebCore/page/PrintContext.cpp
index da29f0e..6c8b312 100644
--- a/Source/WebCore/page/PrintContext.cpp
+++ b/Source/WebCore/page/PrintContext.cpp
@@ -282,16 +282,16 @@ String PrintContext::pageProperty(Frame* frame, const char* propertyName, int pa
     if (!strcmp(propertyName, "margin-left")) {
         if (style->marginLeft().isAuto())
             return String("auto");
-        return String::number(style->marginLeft().rawValue());
+        return String::number(style->marginLeft().value());
     }
     if (!strcmp(propertyName, "line-height"))
-        return String::number(style->lineHeight().rawValue());
+        return String::number(style->lineHeight().value());
     if (!strcmp(propertyName, "font-size"))
         return String::number(style->fontDescription().computedPixelSize());
     if (!strcmp(propertyName, "font-family"))
         return style->fontDescription().family().family().string();
     if (!strcmp(propertyName, "size"))
-        return makeString(String::number(style->pageSize().width().rawValue()), ' ', String::number(style->pageSize().height().rawValue()));
+        return makeString(String::number(style->pageSize().width().value()), ' ', String::number(style->pageSize().height().value()));
 
     return makeString("pageProperty() unimplemented for: ", propertyName);
 }
diff --git a/Source/WebCore/page/SecurityOrigin.cpp b/Source/WebCore/page/SecurityOrigin.cpp
index 977e860..ddd42ea 100644
--- a/Source/WebCore/page/SecurityOrigin.cpp
+++ b/Source/WebCore/page/SecurityOrigin.cpp
@@ -79,8 +79,17 @@ SecurityOrigin::SecurityOrigin(const KURL& url, SandboxFlags sandboxFlags)
     if (m_protocol == "about" || m_protocol == "javascript")
         m_protocol = "";
 
+#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+    bool isBlobOrFileSystemProtocol = false;
+#if ENABLE(BLOB)
+    if (m_protocol == BlobURL::blobProtocol())
+        isBlobOrFileSystemProtocol = true;
+#endif
 #if ENABLE(FILE_SYSTEM)
-    if (m_protocol == "filesystem") {
+    if (m_protocol == "filesystem")
+        isBlobOrFileSystemProtocol = true;
+#endif
+    if (isBlobOrFileSystemProtocol) {
         KURL originURL(ParsedURLString, url.path());
         if (originURL.isValid()) {
             m_protocol = originURL.protocol().lower();
@@ -102,7 +111,13 @@ SecurityOrigin::SecurityOrigin(const KURL& url, SandboxFlags sandboxFlags)
     m_canLoadLocalResources = isLocal();
     if (m_canLoadLocalResources) {
         // Directories should never be readable.
-        if (!url.hasPath() || url.path().endsWith("/"))
+        // Note that we do not do this check for blob or filesystem url because its origin is file:/// when it is created from local file urls.
+#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+        bool doDirectoryCheck = !isBlobOrFileSystemProtocol;
+#else
+        bool doDirectoryCheck = true;
+#endif
+        if (doDirectoryCheck && (!url.hasPath() || url.path().endsWith("/")))
             m_isUnique = true;
         // Store the path in case we are doing per-file origin checking.
         m_filePath = url.path();
@@ -137,10 +152,6 @@ PassRefPtr<SecurityOrigin> SecurityOrigin::create(const KURL& url, SandboxFlags
 {
     if (!url.isValid())
         return adoptRef(new SecurityOrigin(KURL(), sandboxFlags));
-#if ENABLE(BLOB)
-    if (url.protocolIs(BlobURL::blobProtocol()))
-        return adoptRef(new SecurityOrigin(BlobURL::getOrigin(url), sandboxFlags));
-#endif
     return adoptRef(new SecurityOrigin(url, sandboxFlags));
 }
 
@@ -253,12 +264,7 @@ bool SecurityOrigin::canRequest(const KURL& url) const
 
     RefPtr<SecurityOrigin> targetOrigin = SecurityOrigin::create(url);
 
-    bool doUniqueOriginCheck = true;
-#if ENABLE(BLOB)
-    // For blob scheme, we want to ignore this check.
-    doUniqueOriginCheck = !url.protocolIs(BlobURL::blobProtocol());
-#endif
-    if (doUniqueOriginCheck && targetOrigin->isUnique())
+    if (targetOrigin->isUnique())
         return false;
 
     // We call isSameSchemeHostPort here instead of canAccess because we want
diff --git a/Source/WebCore/page/SecurityOrigin.h b/Source/WebCore/page/SecurityOrigin.h
index f27c593..262dd8d 100644
--- a/Source/WebCore/page/SecurityOrigin.h
+++ b/Source/WebCore/page/SecurityOrigin.h
@@ -31,14 +31,14 @@
 
 #include "FrameLoaderTypes.h"
 #include "PlatformString.h"
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
 class Document;
 class KURL;
 
-class SecurityOrigin : public ThreadSafeShared<SecurityOrigin> {
+class SecurityOrigin : public ThreadSafeRefCounted<SecurityOrigin> {
 public:
     static PassRefPtr<SecurityOrigin> createFromDatabaseIdentifier(const String&);
     static PassRefPtr<SecurityOrigin> createFromString(const String&);
diff --git a/Source/WebCore/page/SecurityOriginHash.h b/Source/WebCore/page/SecurityOriginHash.h
index c2ebdd1..db3845c 100644
--- a/Source/WebCore/page/SecurityOriginHash.h
+++ b/Source/WebCore/page/SecurityOriginHash.h
@@ -43,7 +43,7 @@ struct SecurityOriginHash {
             origin->host().impl() ? origin->host().impl()->hash() : 0,
             origin->port()
         };
-        return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+        return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
     }
     static unsigned hash(const RefPtr<SecurityOrigin>& origin)
     {
diff --git a/Source/WebCore/page/Settings.cpp b/Source/WebCore/page/Settings.cpp
index f0b489a..eb8c903 100644
--- a/Source/WebCore/page/Settings.cpp
+++ b/Source/WebCore/page/Settings.cpp
@@ -45,12 +45,6 @@ using namespace std;
 
 namespace WebCore {
 
-static void setNeedsRecalcStyleInAllFrames(Page* page)
-{
-    for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
-        frame->document()->styleSelectorChanged(DeferRecalcStyle);
-}
-
 static void setLoadsImagesAutomaticallyInAllFrames(Page* page)
 {
     for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
@@ -94,6 +88,7 @@ Settings::Settings(Page* page)
     , m_minimumLogicalFontSize(0)
     , m_defaultFontSize(0)
     , m_defaultFixedFontSize(0)
+    , m_validationMessageTimerMagnification(50)
     , m_maximumDecodedImageSize(numeric_limits<size_t>::max())
 #if ENABLE(DOM_STORAGE)
     , m_sessionStorageQuota(StorageMap::noQuota)
@@ -146,6 +141,7 @@ Settings::Settings(Page* page)
     , m_enforceCSSMIMETypeInNoQuirksMode(true)
     , m_usesEncodingDetector(false)
     , m_allowScriptsToCloseWindows(false)
+    , m_canvasUsesAcceleratedDrawing(false)
     , m_acceleratedDrawingEnabled(false)
     // FIXME: This should really be disabled by default as it makes platforms that don't support the feature download files
     // they can't use by. Leaving enabled for now to not change existing behavior.
@@ -177,6 +173,7 @@ Settings::Settings(Page* page)
     , m_usePreHTML5ParserQuirks(false)
     , m_hyperlinkAuditingEnabled(false)
     , m_crossOriginCheckInGetMatchedCSSRulesDisabled(false)
+<<<<<<< HEAD
 #ifdef ANDROID_LAYOUT
     , m_useWideViewport(false)
 #endif
@@ -192,6 +189,10 @@ Settings::Settings(Page* page)
 #ifdef ANDROID_PLUGINS
     , m_pluginsOnDemand(false)
 #endif
+=======
+    , m_useQuickLookResourceCachingQuirks(false)
+    , m_forceCompositingMode(false)
+>>>>>>> webkit.org at r82507
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -208,7 +209,7 @@ void Settings::setStandardFontFamily(const AtomicString& standardFontFamily)
         return;
 
     m_standardFontFamily = standardFontFamily;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setFixedFontFamily(const AtomicString& fixedFontFamily)
@@ -217,7 +218,7 @@ void Settings::setFixedFontFamily(const AtomicString& fixedFontFamily)
         return;
         
     m_fixedFontFamily = fixedFontFamily;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setSerifFontFamily(const AtomicString& serifFontFamily)
@@ -226,7 +227,7 @@ void Settings::setSerifFontFamily(const AtomicString& serifFontFamily)
         return;
         
     m_serifFontFamily = serifFontFamily;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setSansSerifFontFamily(const AtomicString& sansSerifFontFamily)
@@ -235,7 +236,7 @@ void Settings::setSansSerifFontFamily(const AtomicString& sansSerifFontFamily)
         return;
         
     m_sansSerifFontFamily = sansSerifFontFamily; 
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setCursiveFontFamily(const AtomicString& cursiveFontFamily)
@@ -244,7 +245,7 @@ void Settings::setCursiveFontFamily(const AtomicString& cursiveFontFamily)
         return;
         
     m_cursiveFontFamily = cursiveFontFamily;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setFantasyFontFamily(const AtomicString& fantasyFontFamily)
@@ -253,7 +254,7 @@ void Settings::setFantasyFontFamily(const AtomicString& fantasyFontFamily)
         return;
         
     m_fantasyFontFamily = fantasyFontFamily;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setMinimumFontSize(int minimumFontSize)
@@ -262,7 +263,7 @@ void Settings::setMinimumFontSize(int minimumFontSize)
         return;
 
     m_minimumFontSize = minimumFontSize;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setMinimumLogicalFontSize(int minimumLogicalFontSize)
@@ -271,7 +272,7 @@ void Settings::setMinimumLogicalFontSize(int minimumLogicalFontSize)
         return;
 
     m_minimumLogicalFontSize = minimumLogicalFontSize;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setDefaultFontSize(int defaultFontSize)
@@ -280,7 +281,7 @@ void Settings::setDefaultFontSize(int defaultFontSize)
         return;
 
     m_defaultFontSize = defaultFontSize;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setDefaultFixedFontSize(int defaultFontSize)
@@ -289,7 +290,7 @@ void Settings::setDefaultFixedFontSize(int defaultFontSize)
         return;
 
     m_defaultFixedFontSize = defaultFontSize;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 #ifdef ANDROID_BLOCK_NETWORK_IMAGE
@@ -414,7 +415,7 @@ void Settings::setTextAreasAreResizable(bool textAreasAreResizable)
         return;
 
     m_textAreasAreResizable = textAreasAreResizable;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setEditableLinkBehavior(EditableLinkBehavior editableLinkBehavior)
@@ -708,7 +709,7 @@ void Settings::setAuthorAndUserStylesEnabled(bool authorAndUserStylesEnabled)
         return;
 
     m_authorAndUserStylesEnabled = authorAndUserStylesEnabled;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setFontRenderingMode(FontRenderingMode mode)
@@ -716,7 +717,7 @@ void Settings::setFontRenderingMode(FontRenderingMode mode)
     if (fontRenderingMode() == mode)
         return;
     m_fontRenderingMode = mode;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 FontRenderingMode Settings::fontRenderingMode() const
@@ -818,7 +819,12 @@ void Settings::setAcceleratedCompositingEnabled(bool enabled)
         return;
         
     m_acceleratedCompositingEnabled = enabled;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
+}
+
+void Settings::setCanvasUsesAcceleratedDrawing(bool enabled)
+{
+    m_canvasUsesAcceleratedDrawing = enabled;
 }
 
 void Settings::setAcceleratedDrawingEnabled(bool enabled)
@@ -857,7 +863,7 @@ void Settings::setShowDebugBorders(bool enabled)
         return;
         
     m_showDebugBorders = enabled;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setShowRepaintCounter(bool enabled)
@@ -866,7 +872,7 @@ void Settings::setShowRepaintCounter(bool enabled)
         return;
         
     m_showRepaintCounter = enabled;
-    setNeedsRecalcStyleInAllFrames(m_page);
+    m_page->setNeedsRecalcStyleInAllFrames();
 }
 
 void Settings::setExperimentalNotificationsEnabled(bool enabled)
diff --git a/Source/WebCore/page/Settings.h b/Source/WebCore/page/Settings.h
index 0e93249..e8e791a 100644
--- a/Source/WebCore/page/Settings.h
+++ b/Source/WebCore/page/Settings.h
@@ -351,6 +351,9 @@ namespace WebCore {
         void setXSSAuditorEnabled(bool);
         bool xssAuditorEnabled() const { return m_xssAuditorEnabled; }
 
+        void setCanvasUsesAcceleratedDrawing(bool);
+        bool canvasUsesAcceleratedDrawing() const { return m_canvasUsesAcceleratedDrawing; }
+
         void setAcceleratedDrawingEnabled(bool);
         bool acceleratedDrawingEnabled() const { return m_acceleratedDrawingEnabled; }
         
@@ -427,6 +430,14 @@ namespace WebCore {
         // and http://webkit.org/b/40908
         void setInteractiveFormValidationEnabled(bool flag) { m_interactiveFormValidation = flag; }
         bool interactiveFormValidationEnabled() const { return m_interactiveFormValidation; }
+
+        // Sets the maginication value for validation message timer.
+        // If the maginication value is N, a validation message disappears
+        // automatically after <message length> * N / 1000 seconds. If N is
+        // equal to or less than 0, a validation message doesn't disappears
+        // automaticaly. The default value is 50.
+        void setValidationMessageTimerMagnification(int newValue) { m_validationMessageTimerMagnification = newValue; }
+        int validationMessageTimerMaginification() const { return m_validationMessageTimerMagnification; }
         
         void setUsePreHTML5ParserQuirks(bool flag) { m_usePreHTML5ParserQuirks = flag; }
         bool usePreHTML5ParserQuirks() const { return m_usePreHTML5ParserQuirks; }
@@ -436,6 +447,12 @@ namespace WebCore {
 
         void setCrossOriginCheckInGetMatchedCSSRulesDisabled(bool flag) { m_crossOriginCheckInGetMatchedCSSRulesDisabled = flag; }
         bool crossOriginCheckInGetMatchedCSSRulesDisabled() const { return m_crossOriginCheckInGetMatchedCSSRulesDisabled; }
+        
+        void setUseQuickLookResourceCachingQuirks(bool flag) { m_useQuickLookResourceCachingQuirks = flag; }
+        bool useQuickLookResourceCachingQuirks() const { return m_useQuickLookResourceCachingQuirks; }
+
+        void setForceCompositingMode(bool flag) { m_forceCompositingMode = flag; }
+        bool forceCompositingMode() { return m_forceCompositingMode; }
 
 #if ENABLE(WEB_AUTOFILL)
         void setAutoFillEnabled(bool flag) { m_autoFillEnabled = flag; }
@@ -461,6 +478,7 @@ namespace WebCore {
         int m_minimumLogicalFontSize;
         int m_defaultFontSize;
         int m_defaultFixedFontSize;
+        int m_validationMessageTimerMagnification;
         size_t m_maximumDecodedImageSize;
 #if ENABLE(DOM_STORAGE)
         unsigned m_sessionStorageQuota;
@@ -527,6 +545,7 @@ namespace WebCore {
         bool m_enforceCSSMIMETypeInNoQuirksMode : 1;
         bool m_usesEncodingDetector : 1;
         bool m_allowScriptsToCloseWindows : 1;
+        bool m_canvasUsesAcceleratedDrawing : 1;
         bool m_acceleratedDrawingEnabled : 1;
         bool m_downloadableBinaryFontsEnabled : 1;
         bool m_xssAuditorEnabled : 1;
@@ -556,6 +575,7 @@ namespace WebCore {
         bool m_usePreHTML5ParserQuirks: 1;
         bool m_hyperlinkAuditingEnabled : 1;
         bool m_crossOriginCheckInGetMatchedCSSRulesDisabled : 1;
+<<<<<<< HEAD
 #ifdef ANDROID_META_SUPPORT
         // default is yes
         bool m_viewport_user_scalable : 1;
@@ -585,6 +605,10 @@ namespace WebCore {
 #ifdef ANDROID_PLUGINS
         bool m_pluginsOnDemand : 1;
 #endif
+=======
+        bool m_useQuickLookResourceCachingQuirks : 1;
+        bool m_forceCompositingMode : 1;
+>>>>>>> webkit.org at r82507
 
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
diff --git a/Source/WebCore/page/WebKitAnimation.cpp b/Source/WebCore/page/WebKitAnimation.cpp
new file mode 100644
index 0000000..ff7102f
--- /dev/null
+++ b/Source/WebCore/page/WebKitAnimation.cpp
@@ -0,0 +1,120 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "WebKitAnimation.h"
+
+#include "Animation.h"
+#include "AnimationBase.h"
+#include "RenderStyle.h"
+
+using namespace std;
+
+namespace WebCore {
+
+WebKitAnimation::WebKitAnimation(PassRefPtr<KeyframeAnimation> keyframeAnimation)
+    : m_keyframeAnimation(keyframeAnimation)
+{
+}
+
+String WebKitAnimation::name() const
+{
+    return m_keyframeAnimation->animation()->name();
+}
+
+double WebKitAnimation::duration() const
+{
+    return m_keyframeAnimation->duration();
+}
+
+double WebKitAnimation::elapsedTime() const
+{
+    return m_keyframeAnimation->getElapsedTime();
+}
+
+void WebKitAnimation::setElapsedTime(double time)
+{
+    m_keyframeAnimation->setElapsedTime(time);
+}
+
+double WebKitAnimation::delay() const
+{
+    return m_keyframeAnimation->animation()->delay();
+}
+
+int WebKitAnimation::iterationCount() const
+{
+    return m_keyframeAnimation->animation()->iterationCount();
+}
+
+bool WebKitAnimation::paused() const
+{
+    return m_keyframeAnimation->paused();
+}
+
+bool WebKitAnimation::ended() const
+{
+    int iterations = iterationCount();
+    if (iterations == Animation::IterationCountInfinite)
+        return false;
+    return m_keyframeAnimation->getElapsedTime() > (m_keyframeAnimation->duration() * iterations);
+}
+
+WebKitAnimation::Direction WebKitAnimation::direction() const
+{
+    if (m_keyframeAnimation->animation()->direction() == Animation::AnimationDirectionNormal)
+        return DIRECTION_NORMAL;
+    return DIRECTION_ALTERNATE;
+}
+
+WebKitAnimation::FillMode WebKitAnimation::fillMode() const
+{
+    switch (m_keyframeAnimation->animation()->fillMode()) {
+    case AnimationFillModeNone:
+        return FILL_NONE;
+        break;
+    case AnimationFillModeForwards:
+        return FILL_FORWARDS;
+        break;
+    case AnimationFillModeBackwards:
+        return FILL_BACKWARDS;
+        break;
+    default:
+        return FILL_BOTH;
+        break;
+    }
+}
+
+void WebKitAnimation::pause()
+{
+    m_keyframeAnimation->pause();
+}
+
+void WebKitAnimation::play()
+{
+    m_keyframeAnimation->play();
+}
+
+}
diff --git a/Source/WebCore/page/WebKitAnimation.h b/Source/WebCore/page/WebKitAnimation.h
new file mode 100644
index 0000000..6bea1e5
--- /dev/null
+++ b/Source/WebCore/page/WebKitAnimation.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebKitAnimation_h
+#define WebKitAnimation_h
+
+#include "Animation.h"
+#include "AnimationBase.h"
+#include "KeyframeAnimation.h"
+#include "RenderStyle.h"
+
+namespace WebCore {
+
+class WebKitAnimation : public RefCounted<WebKitAnimation> {
+public:
+
+    static PassRefPtr<WebKitAnimation> create(PassRefPtr<KeyframeAnimation> keyframeAnimation)
+    {
+        return adoptRef(new WebKitAnimation(keyframeAnimation));
+    }
+
+    virtual ~WebKitAnimation() { }
+
+    // DOM API
+
+    String name() const;
+
+    double duration() const;
+
+    double elapsedTime() const;
+    void setElapsedTime(double);
+
+    double delay() const;
+    int iterationCount() const;
+
+    bool paused() const;
+    bool ended() const;
+
+    // direction
+    enum Direction { DIRECTION_NORMAL, DIRECTION_ALTERNATE };
+    Direction direction() const;
+
+    // fill mode
+    enum FillMode { FILL_NONE, FILL_BACKWARDS, FILL_FORWARDS, FILL_BOTH };
+    FillMode fillMode() const;
+
+    void play();
+    void pause();
+
+protected:
+    WebKitAnimation(PassRefPtr<KeyframeAnimation>);
+
+private:
+    RefPtr<KeyframeAnimation> m_keyframeAnimation;
+};
+
+} // namespace
+
+#endif
diff --git a/Source/WebCore/page/WebKitAnimation.idl b/Source/WebCore/page/WebKitAnimation.idl
new file mode 100644
index 0000000..4fba2e8
--- /dev/null
+++ b/Source/WebCore/page/WebKitAnimation.idl
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+
+    interface WebKitAnimation {
+
+        readonly attribute DOMString name;
+
+        readonly attribute double duration;
+        attribute double elapsedTime;
+
+        readonly attribute double delay;
+        readonly attribute [Custom] int iterationCount;
+
+        readonly attribute boolean paused;
+        readonly attribute boolean ended;
+
+        const unsigned short DIRECTION_NORMAL = 0;
+        const unsigned short DIRECTION_ALTERNATE = 1;
+        readonly attribute unsigned short direction;
+
+        const unsigned short FILL_NONE = 0;
+        const unsigned short FILL_BACKWARDS = 1;
+        const unsigned short FILL_FORWARDS = 2;
+        const unsigned short FILL_BOTH = 3;
+        readonly attribute unsigned short fillMode;
+
+        void play();
+        void pause();
+    };
+
+}
diff --git a/Source/WebCore/page/WebKitAnimationList.cpp b/Source/WebCore/page/WebKitAnimationList.cpp
new file mode 100644
index 0000000..31e46d7
--- /dev/null
+++ b/Source/WebCore/page/WebKitAnimationList.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "WebKitAnimationList.h"
+
+#include "Animation.h"
+#include "AnimationBase.h"
+#include "RenderStyle.h"
+#include "WebKitAnimation.h"
+
+namespace WebCore {
+    
+WebKitAnimationList::WebKitAnimationList()
+{
+}
+
+WebKitAnimationList::~WebKitAnimationList()
+{
+}
+
+unsigned WebKitAnimationList::length() const
+{
+    return m_animations.size();
+}
+
+WebKitAnimation* WebKitAnimationList::item(unsigned index)
+{
+    if (index < m_animations.size())
+        return m_animations[index].get();
+    return 0;
+}
+
+void WebKitAnimationList::deleteAnimation(unsigned index)
+{
+    if (index >= m_animations.size())
+        return;
+
+    m_animations.remove(index);
+}
+
+void WebKitAnimationList::append(RefPtr<WebKitAnimation> animation)
+{
+    m_animations.append(animation);
+}
+
+unsigned WebKitAnimationList::insertAnimation(RefPtr<WebKitAnimation> animation, unsigned index)
+{
+    if (!animation)
+        return 0;
+
+    if (index > m_animations.size())
+        return 0;
+
+    m_animations.insert(index, animation);
+    return index;
+}
+
+} // namespace WebCore
+
diff --git a/Source/WebCore/page/WebKitAnimationList.h b/Source/WebCore/page/WebKitAnimationList.h
new file mode 100644
index 0000000..b82e38a
--- /dev/null
+++ b/Source/WebCore/page/WebKitAnimationList.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebKitAnimationList_h
+#define WebKitAnimationList_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+  
+class WebKitAnimation;
+
+class WebKitAnimationList : public RefCounted<WebKitAnimationList> {
+public:
+    static PassRefPtr<WebKitAnimationList> create()
+    {
+        return adoptRef(new WebKitAnimationList());
+    }
+    ~WebKitAnimationList();
+
+    unsigned length() const;
+    WebKitAnimation* item(unsigned index);
+
+    unsigned insertAnimation(RefPtr<WebKitAnimation>, unsigned index);
+    void deleteAnimation(unsigned index);
+    void append(RefPtr<WebKitAnimation>);
+
+private:
+    WebKitAnimationList();
+
+    Vector<RefPtr<WebKitAnimation> > m_animations;
+};
+
+} // namespace WebCore
+
+#endif // WebKitAnimationList_h
diff --git a/Source/WebCore/page/WebKitAnimationList.idl b/Source/WebCore/page/WebKitAnimationList.idl
new file mode 100644
index 0000000..4c376e6
--- /dev/null
+++ b/Source/WebCore/page/WebKitAnimationList.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        CustomMarkFunction,
+        HasIndexGetter
+    ] WebKitAnimationList {
+        readonly attribute unsigned long length;
+        WebKitAnimation item(in unsigned long index);
+    };
+
+}
diff --git a/Source/WebCore/page/animation/AnimationBase.cpp b/Source/WebCore/page/animation/AnimationBase.cpp
index 9a906e2..0fe98be 100644
--- a/Source/WebCore/page/animation/AnimationBase.cpp
+++ b/Source/WebCore/page/animation/AnimationBase.cpp
@@ -113,7 +113,7 @@ static inline Color blendFunc(const AnimationBase* anim, const Color& from, cons
 
 static inline Length blendFunc(const AnimationBase*, const Length& from, const Length& to, double progress)
 {  
-    return to.blend(from, progress);
+    return to.blend(from, narrowPrecisionToFloat(progress));
 }
 
 static inline LengthSize blendFunc(const AnimationBase* anim, const LengthSize& from, const LengthSize& to, double progress)
@@ -798,7 +798,6 @@ AnimationBase::AnimationBase(const Animation* transition, RenderObject* renderer
     , m_isAccelerated(false)
     , m_transformFunctionListValid(false)
     , m_nextIterationDuration(-1)
-    , m_next(0)
 {
     // Compute the total duration
     m_totalDuration = -1;
@@ -806,12 +805,6 @@ AnimationBase::AnimationBase(const Animation* transition, RenderObject* renderer
         m_totalDuration = m_animation->duration() * m_animation->iterationCount();
 }
 
-AnimationBase::~AnimationBase()
-{
-    m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
-    m_compAnim->animationController()->removeFromStartTimeResponseWaitList(this);
-}
-
 bool AnimationBase::propertiesEqual(int prop, const RenderStyle* a, const RenderStyle* b)
 {
     ensurePropertyMap();
@@ -936,7 +929,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
     // If we get AnimationStateInputRestartAnimation then we force a new animation, regardless of state.
     if (input == AnimationStateInputMakeNew) {
         if (m_animState == AnimationStateStartWaitStyleAvailable)
-            m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
+            m_compAnim->animationController()->removeFromAnimationsWaitingForStyle(this);
         m_animState = AnimationStateNew;
         m_startTime = 0;
         m_pauseTime = -1;
@@ -948,7 +941,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
 
     if (input == AnimationStateInputRestartAnimation) {
         if (m_animState == AnimationStateStartWaitStyleAvailable)
-            m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
+            m_compAnim->animationController()->removeFromAnimationsWaitingForStyle(this);
         m_animState = AnimationStateNew;
         m_startTime = 0;
         m_pauseTime = -1;
@@ -963,7 +956,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
 
     if (input == AnimationStateInputEndAnimation) {
         if (m_animState == AnimationStateStartWaitStyleAvailable)
-            m_compAnim->animationController()->removeFromStyleAvailableWaitList(this);
+            m_compAnim->animationController()->removeFromAnimationsWaitingForStyle(this);
         m_animState = AnimationStateDone;
         endAnimation();
         return;
@@ -1003,7 +996,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
                 ASSERT(param >= 0);
                 // Start timer has fired, tell the animation to start and wait for it to respond with start time
                 m_animState = AnimationStateStartWaitStyleAvailable;
-                m_compAnim->animationController()->addToStyleAvailableWaitList(this);
+                m_compAnim->animationController()->addToAnimationsWaitingForStyle(this);
 
                 // Trigger a render so we can start the animation
                 if (m_object)
@@ -1038,7 +1031,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
                         timeOffset = -m_animation->delay();
                     bool started = startAnimation(timeOffset);
 
-                    m_compAnim->animationController()->addToStartTimeResponseWaitList(this, started);
+                    m_compAnim->animationController()->addToAnimationsWaitingForStartTimeResponse(this, started);
                     m_isAccelerated = started;
                 }
             } else {
@@ -1072,7 +1065,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
             } else {
                 // We are pausing while waiting for a start response. Cancel the animation and wait. When 
                 // we unpause, we will act as though the start timer just fired
-                m_pauseTime = -1;
+                m_pauseTime = beginAnimationUpdateTime();
                 pauseAnimation(beginAnimationUpdateTime() - m_startTime);
                 m_animState = AnimationStatePausedWaitResponse;
             }
@@ -1167,7 +1160,7 @@ void AnimationBase::updateStateMachine(AnimStateInput input, double param)
                         m_isAccelerated = true;
                     } else {
                         bool started = startAnimation(beginAnimationUpdateTime() - m_startTime);
-                        m_compAnim->animationController()->addToStartTimeResponseWaitList(this, started);
+                        m_compAnim->animationController()->addToAnimationsWaitingForStartTimeResponse(this, started);
                         m_isAccelerated = started;
                     }
                 }
@@ -1397,5 +1390,21 @@ double AnimationBase::getElapsedTime() const
 
     return beginAnimationUpdateTime() - m_startTime;
 }
-    
+
+void AnimationBase::setElapsedTime(double time)
+{
+    // FIXME: implement this method
+    UNUSED_PARAM(time);
+}
+
+void AnimationBase::play()
+{
+    // FIXME: implement this method
+}
+
+void AnimationBase::pause()
+{
+    // FIXME: implement this method
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/page/animation/AnimationBase.h b/Source/WebCore/page/animation/AnimationBase.h
index 877d649..1ab14e3 100644
--- a/Source/WebCore/page/animation/AnimationBase.h
+++ b/Source/WebCore/page/animation/AnimationBase.h
@@ -51,7 +51,7 @@ class AnimationBase : public RefCounted<AnimationBase> {
 
 public:
     AnimationBase(const Animation* transition, RenderObject* renderer, CompositeAnimation* compAnim);
-    virtual ~AnimationBase();
+    virtual ~AnimationBase() { }
 
     RenderObject* renderer() const { return m_object; }
     void clearRenderer() { m_object = 0; }
@@ -163,13 +163,16 @@ public:
     
     // Freeze the animation; used by DumpRenderTree.
     void freezeAtTime(double t);
+
+    // Play and pause API
+    void play();
+    void pause();
     
     double beginAnimationUpdateTime() const;
     
     double getElapsedTime() const;
-    
-    AnimationBase* next() const { return m_next; }
-    void setNext(AnimationBase* animation) { m_next = animation; }
+    // Setting the elapsed time will adjust the start time and possibly pause time.
+    void setElapsedTime(double);
     
     void styleAvailable() 
     {
@@ -182,7 +185,9 @@ public:
 #endif
 
     static HashSet<int> animatableShorthandsAffectingProperty(int property);
-    
+
+    const Animation* animation() const { return m_animation.get(); }
+
 protected:
     virtual void overrideAnimations() { }
     virtual void resumeOverriddenAnimations() { }
@@ -230,8 +235,6 @@ protected:
     bool m_transformFunctionListValid;
     double m_totalDuration, m_nextIterationDuration;
     
-    AnimationBase* m_next;
-    
 private:
     static void ensurePropertyMap();
 };
diff --git a/Source/WebCore/page/animation/AnimationController.cpp b/Source/WebCore/page/animation/AnimationController.cpp
index dcdea03..5b166d4 100644
--- a/Source/WebCore/page/animation/AnimationController.cpp
+++ b/Source/WebCore/page/animation/AnimationController.cpp
@@ -37,12 +37,14 @@
 #include "Frame.h"
 #include "RenderView.h"
 #include "WebKitAnimationEvent.h"
+#include "WebKitAnimationList.h"
 #include "WebKitTransitionEvent.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
+// FIXME: Why isn't this set to 60fps or something?
 static const double cAnimationTimerDelay = 0.025;
 static const double cBeginAnimationUpdateTimeNotSet = -1;
 
@@ -51,11 +53,9 @@ AnimationControllerPrivate::AnimationControllerPrivate(Frame* frame)
     , m_updateStyleIfNeededDispatcher(this, &AnimationControllerPrivate::updateStyleIfNeededDispatcherFired)
     , m_frame(frame)
     , m_beginAnimationUpdateTime(cBeginAnimationUpdateTimeNotSet)
-    , m_styleAvailableWaiters(0)
-    , m_lastStyleAvailableWaiter(0)
-    , m_startTimeResponseWaiters(0)
-    , m_lastStartTimeResponseWaiter(0)
-    , m_waitingForStartTimeResponse(false)
+    , m_animationsWaitingForStyle()
+    , m_animationsWaitingForStartTimeResponse()
+    , m_waitingForAsyncStartNotification(false)
 {
 }
 
@@ -323,13 +323,13 @@ double AnimationControllerPrivate::beginAnimationUpdateTime()
 void AnimationControllerPrivate::endAnimationUpdate()
 {
     styleAvailable();
-    if (!m_waitingForStartTimeResponse)
+    if (!m_waitingForAsyncStartNotification)
         startTimeResponse(beginAnimationUpdateTime());
 }
 
 void AnimationControllerPrivate::receivedStartTimeResponse(double time)
 {
-    m_waitingForStartTimeResponse = false;
+    m_waitingForAsyncStartNotification = false;
     startTimeResponse(time);
 }
 
@@ -365,52 +365,31 @@ unsigned AnimationControllerPrivate::numberOfActiveAnimations() const
     return count;
 }
 
-void AnimationControllerPrivate::addToStyleAvailableWaitList(AnimationBase* animation)
+void AnimationControllerPrivate::addToAnimationsWaitingForStyle(AnimationBase* animation)
 {
-    ASSERT(!animation->next());
-    
-    if (m_styleAvailableWaiters)
-        m_lastStyleAvailableWaiter->setNext(animation);
-    else
-        m_styleAvailableWaiters = animation;
-        
-    m_lastStyleAvailableWaiter = animation;
-    animation->setNext(0);
-}
-
-void AnimationControllerPrivate::removeFromStyleAvailableWaitList(AnimationBase* animationToRemove)
-{
-    AnimationBase* prevAnimation = 0;
-    for (AnimationBase* animation = m_styleAvailableWaiters; animation; animation = animation->next()) {
-        if (animation == animationToRemove) {
-            if (prevAnimation)
-                prevAnimation->setNext(animation->next());
-            else
-                m_styleAvailableWaiters = animation->next();
-            
-            if (m_lastStyleAvailableWaiter == animation)
-                m_lastStyleAvailableWaiter = prevAnimation;
-                
-            animationToRemove->setNext(0);
-        }
-    }
+    // Make sure this animation is not in the start time waiters
+    m_animationsWaitingForStartTimeResponse.remove(animation);
+
+    m_animationsWaitingForStyle.add(animation);
+}
+
+void AnimationControllerPrivate::removeFromAnimationsWaitingForStyle(AnimationBase* animationToRemove)
+{
+    m_animationsWaitingForStyle.remove(animationToRemove);
 }
 
 void AnimationControllerPrivate::styleAvailable()
 {
     // Go through list of waiters and send them on their way
-    for (AnimationBase* animation = m_styleAvailableWaiters; animation; ) {
-        AnimationBase* nextAnimation = animation->next();
-        animation->setNext(0);
-        animation->styleAvailable();
-        animation = nextAnimation;
-    }
-    
-    m_styleAvailableWaiters = 0;
-    m_lastStyleAvailableWaiter = 0;
+    WaitingAnimationsSet::const_iterator it = m_animationsWaitingForStyle.begin();
+    WaitingAnimationsSet::const_iterator end = m_animationsWaitingForStyle.end();
+    for (; it != end; ++it)
+        (*it)->styleAvailable();
+
+    m_animationsWaitingForStyle.clear();
 }
 
-void AnimationControllerPrivate::addToStartTimeResponseWaitList(AnimationBase* animation, bool willGetResponse)
+void AnimationControllerPrivate::addToAnimationsWaitingForStartTimeResponse(AnimationBase* animation, bool willGetResponse)
 {
     // If willGetResponse is true, it means this animation is actually waiting for a response
     // (which will come in as a call to notifyAnimationStarted()).
@@ -429,54 +408,48 @@ void AnimationControllerPrivate::addToStartTimeResponseWaitList(AnimationBase* a
     // This will synchronize all software and accelerated animations started in the same 
     // updateStyleIfNeeded cycle.
     //
-    ASSERT(!animation->next());
     
     if (willGetResponse)
-        m_waitingForStartTimeResponse = true;
+        m_waitingForAsyncStartNotification = true;
     
-    if (m_startTimeResponseWaiters)
-        m_lastStartTimeResponseWaiter->setNext(animation);
-    else
-        m_startTimeResponseWaiters = animation;
-        
-    m_lastStartTimeResponseWaiter = animation;
-    animation->setNext(0);
-}
-
-void AnimationControllerPrivate::removeFromStartTimeResponseWaitList(AnimationBase* animationToRemove)
-{
-    AnimationBase* prevAnimation = 0;
-    for (AnimationBase* animation = m_startTimeResponseWaiters; animation; animation = animation->next()) {
-        if (animation == animationToRemove) {
-            if (prevAnimation)
-                prevAnimation->setNext(animation->next());
-            else
-                m_startTimeResponseWaiters = animation->next();
-            
-            if (m_lastStartTimeResponseWaiter == animation)
-                m_lastStartTimeResponseWaiter = prevAnimation;
-                
-            animationToRemove->setNext(0);
-        }
-        prevAnimation = animation;
-    }
+    m_animationsWaitingForStartTimeResponse.add(animation);
+}
+
+void AnimationControllerPrivate::removeFromAnimationsWaitingForStartTimeResponse(AnimationBase* animationToRemove)
+{
+    m_animationsWaitingForStartTimeResponse.remove(animationToRemove);
     
-    if (!m_startTimeResponseWaiters)
-        m_waitingForStartTimeResponse = false;
+    if (m_animationsWaitingForStartTimeResponse.isEmpty())
+        m_waitingForAsyncStartNotification = false;
 }
 
 void AnimationControllerPrivate::startTimeResponse(double time)
 {
     // Go through list of waiters and send them on their way
-    for (AnimationBase* animation = m_startTimeResponseWaiters; animation; ) {
-        AnimationBase* nextAnimation = animation->next();
-        animation->setNext(0);
-        animation->onAnimationStartResponse(time);
-        animation = nextAnimation;
-    }
+
+    WaitingAnimationsSet::const_iterator it = m_animationsWaitingForStartTimeResponse.begin();
+    WaitingAnimationsSet::const_iterator end = m_animationsWaitingForStartTimeResponse.end();
+    for (; it != end; ++it)
+        (*it)->onAnimationStartResponse(time);
     
-    m_startTimeResponseWaiters = 0;
-    m_lastStartTimeResponseWaiter = 0;
+    m_animationsWaitingForStartTimeResponse.clear();
+    m_waitingForAsyncStartNotification = false;
+}
+
+void AnimationControllerPrivate::animationWillBeRemoved(AnimationBase* animation)
+{
+    removeFromAnimationsWaitingForStyle(animation);
+    removeFromAnimationsWaitingForStartTimeResponse(animation);
+}
+
+PassRefPtr<WebKitAnimationList> AnimationControllerPrivate::animationsForRenderer(RenderObject* renderer) const
+{
+    RefPtr<CompositeAnimation> animation = m_compositeAnimations.get(renderer);
+
+    if (!animation)
+        return 0;
+
+    return animation->animations();
 }
 
 AnimationController::AnimationController(Frame* frame)
@@ -612,4 +585,9 @@ bool AnimationController::supportsAcceleratedAnimationOfProperty(CSSPropertyID p
 #endif
 }
 
+PassRefPtr<WebKitAnimationList> AnimationController::animationsForRenderer(RenderObject* renderer) const
+{
+    return m_data->animationsForRenderer(renderer);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/page/animation/AnimationController.h b/Source/WebCore/page/animation/AnimationController.h
index 5279467..a355f87 100644
--- a/Source/WebCore/page/animation/AnimationController.h
+++ b/Source/WebCore/page/animation/AnimationController.h
@@ -42,6 +42,7 @@ class Frame;
 class Node;
 class RenderObject;
 class RenderStyle;
+class WebKitAnimationList;
 
 class AnimationController {
 public:
@@ -73,6 +74,8 @@ public:
     
     static bool supportsAcceleratedAnimationOfProperty(CSSPropertyID);
 
+    PassRefPtr<WebKitAnimationList> animationsForRenderer(RenderObject*) const;
+
 private:
     AnimationControllerPrivate* m_data;
 };
diff --git a/Source/WebCore/page/animation/AnimationControllerPrivate.h b/Source/WebCore/page/animation/AnimationControllerPrivate.h
index 186dd7d..1146eba 100644
--- a/Source/WebCore/page/animation/AnimationControllerPrivate.h
+++ b/Source/WebCore/page/animation/AnimationControllerPrivate.h
@@ -33,6 +33,7 @@
 #include "PlatformString.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
@@ -48,6 +49,7 @@ class Frame;
 class Node;
 class RenderObject;
 class RenderStyle;
+class WebKitAnimationList;
 
 class AnimationControllerPrivate {
     WTF_MAKE_NONCOPYABLE(AnimationControllerPrivate); WTF_MAKE_FAST_ALLOCATED;
@@ -87,11 +89,15 @@ public:
     void endAnimationUpdate();
     void receivedStartTimeResponse(double);
     
-    void addToStyleAvailableWaitList(AnimationBase*);
-    void removeFromStyleAvailableWaitList(AnimationBase*);    
-    
-    void addToStartTimeResponseWaitList(AnimationBase*, bool willGetResponse);
-    void removeFromStartTimeResponseWaitList(AnimationBase*);    
+    void addToAnimationsWaitingForStyle(AnimationBase*);
+    void removeFromAnimationsWaitingForStyle(AnimationBase*);
+
+    void addToAnimationsWaitingForStartTimeResponse(AnimationBase*, bool willGetResponse);
+    void removeFromAnimationsWaitingForStartTimeResponse(AnimationBase*);
+
+    void animationWillBeRemoved(AnimationBase*);
+
+    PassRefPtr<WebKitAnimationList> animationsForRenderer(RenderObject*) const;
     
 private:
     void animationTimerFired(Timer<AnimationControllerPrivate>*);
@@ -119,12 +125,11 @@ private:
     Vector<RefPtr<Node> > m_nodeChangesToDispatch;
     
     double m_beginAnimationUpdateTime;
-    AnimationBase* m_styleAvailableWaiters;
-    AnimationBase* m_lastStyleAvailableWaiter;
-    
-    AnimationBase* m_startTimeResponseWaiters;
-    AnimationBase* m_lastStartTimeResponseWaiter;
-    bool m_waitingForStartTimeResponse;
+
+    typedef HashSet<RefPtr<AnimationBase> > WaitingAnimationsSet;
+    WaitingAnimationsSet m_animationsWaitingForStyle;
+    WaitingAnimationsSet m_animationsWaitingForStartTimeResponse;
+    bool m_waitingForAsyncStartNotification;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/animation/CompositeAnimation.cpp b/Source/WebCore/page/animation/CompositeAnimation.cpp
index 602491e..27409d9 100644
--- a/Source/WebCore/page/animation/CompositeAnimation.cpp
+++ b/Source/WebCore/page/animation/CompositeAnimation.cpp
@@ -36,6 +36,8 @@
 #include "KeyframeAnimation.h"
 #include "RenderObject.h"
 #include "RenderStyle.h"
+#include "WebKitAnimation.h"
+#include "WebKitAnimationList.h"
 
 namespace WebCore {
 
@@ -54,6 +56,7 @@ void CompositeAnimation::clearRenderer()
         CSSPropertyTransitionsMap::const_iterator transitionsEnd = m_transitions.end();
         for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != transitionsEnd; ++it) {
             ImplicitAnimation* transition = it->second.get();
+            animationController()->animationWillBeRemoved(transition);
             transition->clearRenderer();
         }
     }
@@ -62,6 +65,7 @@ void CompositeAnimation::clearRenderer()
         AnimationNameMap::const_iterator animationsEnd = m_keyframeAnimations.end();
         for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != animationsEnd; ++it) {
             KeyframeAnimation* anim = it->second.get();
+            animationController()->animationWillBeRemoved(anim);
             anim->clearRenderer();
         }
     }
@@ -173,8 +177,10 @@ void CompositeAnimation::updateTransitions(RenderObject* renderer, RenderStyle*
     end = m_transitions.end();
     for (CSSPropertyTransitionsMap::const_iterator it = m_transitions.begin(); it != end; ++it) {
         ImplicitAnimation* anim = it->second.get();
-        if (!anim->active())
+        if (!anim->active()) {
+            animationController()->animationWillBeRemoved(anim);
             toBeRemoved.append(anim->animatingProperty());
+        }
     }
 
     // Now remove the transitions from the list
@@ -252,8 +258,11 @@ void CompositeAnimation::updateKeyframeAnimations(RenderObject* renderer, Render
     kfend = m_keyframeAnimations.end();
     for (AnimationNameMap::const_iterator it = m_keyframeAnimations.begin(); it != kfend; ++it) {
         KeyframeAnimation* keyframeAnim = it->second.get();
-        if (keyframeAnim->index() < 0)
+        if (keyframeAnim->index() < 0) {
             animsToBeRemoved.append(keyframeAnim->name().impl());
+            animationController()->animationWillBeRemoved(keyframeAnim);
+            keyframeAnim->clearRenderer();
+        }
     }
     
     // Now remove the animations from the list.
@@ -560,4 +569,20 @@ unsigned CompositeAnimation::numberOfActiveAnimations() const
     return count;
 }
 
+PassRefPtr<WebKitAnimationList> CompositeAnimation::animations() const
+{
+    RefPtr<WebKitAnimationList> animations = WebKitAnimationList::create();
+    if (!m_keyframeAnimations.isEmpty()) {
+        m_keyframeAnimations.checkConsistency();
+        for (Vector<AtomicStringImpl*>::const_iterator it = m_keyframeAnimationOrderMap.begin(); it != m_keyframeAnimationOrderMap.end(); ++it) {
+            RefPtr<KeyframeAnimation> keyframeAnimation = m_keyframeAnimations.get(*it);
+            if (keyframeAnimation) {
+                RefPtr<WebKitAnimation> anim = WebKitAnimation::create(keyframeAnimation);
+                animations->append(anim);
+            }
+        }
+    }
+    return animations;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/page/animation/CompositeAnimation.h b/Source/WebCore/page/animation/CompositeAnimation.h
index 249f4c3..1bfe585 100644
--- a/Source/WebCore/page/animation/CompositeAnimation.h
+++ b/Source/WebCore/page/animation/CompositeAnimation.h
@@ -41,6 +41,7 @@ class AnimationControllerPrivate;
 class AnimationController;
 class RenderObject;
 class RenderStyle;
+class WebKitAnimationList;
 
 // A CompositeAnimation represents a collection of animations that are running
 // on a single RenderObject, such as a number of properties transitioning at once.
@@ -80,6 +81,8 @@ public:
     bool pauseTransitionAtTime(int property, double t);
     unsigned numberOfActiveAnimations() const;
 
+    PassRefPtr<WebKitAnimationList> animations() const;
+
 private:
     CompositeAnimation(AnimationControllerPrivate* animationController)
         : m_animationController(animationController)
diff --git a/Source/WebCore/page/mac/WebCoreViewFactory.m b/Source/WebCore/page/mac/WebCoreViewFactory.m
index 5398989..17a7a29 100644
--- a/Source/WebCore/page/mac/WebCoreViewFactory.m
+++ b/Source/WebCore/page/mac/WebCoreViewFactory.m
@@ -37,7 +37,7 @@ static WebCoreViewFactory *sharedFactory;
 
 - init
 {
-    [super init];
+    self = [super init];
     
     ASSERT(!sharedFactory);
     sharedFactory = [self retain];
diff --git a/Source/WebCore/platform/ColorData.gperf b/Source/WebCore/platform/ColorData.gperf
index 2a72237..277d83e 100644
--- a/Source/WebCore/platform/ColorData.gperf
+++ b/Source/WebCore/platform/ColorData.gperf
@@ -107,7 +107,7 @@ maroon, 0xff800000
 mediumaquamarine, 0xff66cdaa
 mediumblue, 0xff0000cd
 mediumorchid, 0xffba55d3
-mediumpurple, 0xff9370d8
+mediumpurple, 0xff9370db
 mediumseagreen, 0xff3cb371
 mediumslateblue, 0xff7b68ee
 mediumspringgreen, 0xff00fa9a
@@ -128,7 +128,7 @@ orchid, 0xffda70d6
 palegoldenrod, 0xffeee8aa
 palegreen, 0xff98fb98
 paleturquoise, 0xffafeeee
-palevioletred, 0xffd87093
+palevioletred, 0xffdb7093
 papayawhip, 0xffffefd5
 peachpuff, 0xffffdab9
 peru, 0xffcd853f
diff --git a/Source/WebCore/platform/CrossThreadCopier.h b/Source/WebCore/platform/CrossThreadCopier.h
index 5eb40ee..a25d6fa 100644
--- a/Source/WebCore/platform/CrossThreadCopier.h
+++ b/Source/WebCore/platform/CrossThreadCopier.h
@@ -56,7 +56,7 @@ namespace WebCore {
         }
     };
 
-    template<bool isConvertibleToInteger, bool isThreadsafeShared, typename T> struct CrossThreadCopierBase;
+    template<bool isConvertibleToInteger, bool isThreadSafeRefCounted, typename T> struct CrossThreadCopierBase;
 
     // Integers get passed through without any changes.
     template<typename T> struct CrossThreadCopierBase<true, false, T> : public CrossThreadCopierPassThrough<T> {
@@ -114,8 +114,8 @@ namespace WebCore {
     };
 
     template<typename T> struct CrossThreadCopier : public CrossThreadCopierBase<WTF::IsConvertibleToInteger<T>::value,
-                                                                                 WTF::IsSubclassOfTemplate<typename WTF::RemoveTemplate<T, RefPtr>::Type, ThreadSafeShared>::value
-                                                                                     || WTF::IsSubclassOfTemplate<typename WTF::RemoveTemplate<T, PassRefPtr>::Type, ThreadSafeShared>::value,
+                                                                                 WTF::IsSubclassOfTemplate<typename WTF::RemoveTemplate<T, RefPtr>::Type, ThreadSafeRefCounted>::value
+                                                                                     || WTF::IsSubclassOfTemplate<typename WTF::RemoveTemplate<T, PassRefPtr>::Type, ThreadSafeRefCounted>::value,
                                                                                  T> {
     };
 
diff --git a/Source/WebCore/platform/DefaultLocalizationStrategy.cpp b/Source/WebCore/platform/DefaultLocalizationStrategy.cpp
new file mode 100644
index 0000000..1a50c3c
--- /dev/null
+++ b/Source/WebCore/platform/DefaultLocalizationStrategy.cpp
@@ -0,0 +1,874 @@
+/*
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DefaultLocalizationStrategy.h"
+
+#if USE(PLATFORM_STRATEGIES)
+
+#include "IntSize.h"
+#include "LocalizedStrings.h"
+#include "NotImplemented.h"
+#include <wtf/MathExtras.h>
+#include <wtf/text/CString.h>
+#include <wtf/UnusedParam.h>
+
+#if USE(CF)
+#include <wtf/RetainPtr.h>
+#endif
+
+namespace WebCore {
+
+// We can't use String::format for two reasons:
+//  1) It doesn't handle non-ASCII characters in the format string.
+//  2) It doesn't handle the %2$d syntax.
+// Note that because |format| is used as the second parameter to va_start, it cannot be a reference
+// type according to section 18.7/3 of the C++ N1905 standard.
+static String formatLocalizedString(String format, ...)
+{
+#if USE(CF)
+    va_list arguments;
+    va_start(arguments, format);
+    RetainPtr<CFStringRef> formatCFString(AdoptCF, format.createCFString());
+    RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormatAndArguments(0, 0, formatCFString.get(), arguments));
+    va_end(arguments);
+    return result.get();
+#elif PLATFORM(QT)
+    va_list arguments;
+    va_start(arguments, format);
+    QString result;
+    result.vsprintf(format.latin1().data(), arguments);
+    va_end(arguments);
+    return result;
+#else
+    notImplemented();
+    return format;
+#endif
+}
+
+DefaultLocalizationStrategy::DefaultLocalizationStrategy()
+{
+}
+
+String DefaultLocalizationStrategy::inputElementAltText()
+{
+    return UI_STRING_KEY("Submit", "Submit (input element)", "alt text for <input> elements with no alt, title, or value");
+}
+
+String DefaultLocalizationStrategy::resetButtonDefaultLabel()
+{
+    return UI_STRING("Reset", "default label for Reset buttons in forms on web pages");
+}
+
+String DefaultLocalizationStrategy::searchableIndexIntroduction()
+{
+    return UI_STRING("This is a searchable index. Enter search keywords: ",
+        "text that appears at the start of nearly-obsolete web pages in the form of a 'searchable index'");
+}
+
+String DefaultLocalizationStrategy::submitButtonDefaultLabel()
+{
+    return UI_STRING("Submit", "default label for Submit buttons in forms on web pages");
+}
+
+String DefaultLocalizationStrategy::fileButtonChooseFileLabel()
+{
+    return UI_STRING("Choose File", "title for file button used in HTML forms");
+}
+
+String DefaultLocalizationStrategy::fileButtonNoFileSelectedLabel()
+{
+    return UI_STRING("no file selected", "text to display in file button used in HTML forms when no file is selected");
+}
+
+String DefaultLocalizationStrategy::defaultDetailsSummaryText()
+{
+    return UI_STRING("Details", "text to display in <details> tag when it has no <summary> child");
+}
+
+#if PLATFORM(MAC)
+String DefaultLocalizationStrategy::copyImageUnknownFileLabel()
+{
+    return UI_STRING("unknown", "Unknown filename");
+}
+#endif
+
+#if ENABLE(CONTEXT_MENUS)
+
+String DefaultLocalizationStrategy::contextMenuItemTagOpenLinkInNewWindow()
+{
+    return UI_STRING("Open Link in New Window", "Open in New Window context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagDownloadLinkToDisk()
+{
+    return UI_STRING("Download Linked File", "Download Linked File context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCopyLinkToClipboard()
+{
+    return UI_STRING("Copy Link", "Copy Link context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagOpenImageInNewWindow()
+{
+    return UI_STRING("Open Image in New Window", "Open Image in New Window context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagDownloadImageToDisk()
+{
+    return UI_STRING("Download Image", "Download Image context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCopyImageToClipboard()
+{
+    return UI_STRING("Copy Image", "Copy Image context menu item");
+}
+
+#if PLATFORM(QT)
+String DefaultLocalizationStrategy::contextMenuItemTagCopyImageUrlToClipboard()
+{
+    return UI_STRING("Copy Image Address", "Copy Image Address menu item");
+}
+#endif
+
+String DefaultLocalizationStrategy::contextMenuItemTagOpenVideoInNewWindow()
+{
+    return UI_STRING("Open Video in New Window", "Open Video in New Window context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagOpenAudioInNewWindow()
+{
+    return UI_STRING("Open Audio in New Window", "Open Audio in New Window context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCopyVideoLinkToClipboard()
+{
+    return UI_STRING("Copy Video Address", "Copy Video Address Location context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCopyAudioLinkToClipboard()
+{
+    return UI_STRING("Copy Audio Address", "Copy Audio Address Location context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagToggleMediaControls()
+{
+    return UI_STRING("Controls", "Media Controls context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagToggleMediaLoop()
+{
+    return UI_STRING("Loop", "Media Loop context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagEnterVideoFullscreen()
+{
+    return UI_STRING("Enter Fullscreen", "Video Enter Fullscreen context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagMediaPlay()
+{
+    return UI_STRING("Play", "Media Play context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagMediaPause()
+{
+    return UI_STRING("Pause", "Media Pause context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagMediaMute()
+{
+    return UI_STRING("Mute", "Media Mute context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagOpenFrameInNewWindow()
+{
+    return UI_STRING("Open Frame in New Window", "Open Frame in New Window context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCopy()
+{
+    return UI_STRING("Copy", "Copy context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagGoBack()
+{
+    return UI_STRING("Back", "Back context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagGoForward()
+{
+    return UI_STRING("Forward", "Forward context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagStop()
+{
+    return UI_STRING("Stop", "Stop context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagReload()
+{
+    return UI_STRING("Reload", "Reload context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCut()
+{
+    return UI_STRING("Cut", "Cut context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagPaste()
+{
+    return UI_STRING("Paste", "Paste context menu item");
+}
+
+#if PLATFORM(GTK)
+
+String DefaultLocalizationStrategy::contextMenuItemTagDelete()
+{
+    notImplemented();
+    return "Delete";
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagInputMethods()
+{
+    notImplemented();
+    return "Input Methods";
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagUnicode()
+{
+    notImplemented();
+    return "Unicode";
+}
+
+#endif
+
+#if PLATFORM(GTK) || PLATFORM(QT)
+
+String DefaultLocalizationStrategy::contextMenuItemTagSelectAll()
+{
+    notImplemented();
+    return "Select All";
+}
+
+#endif
+
+String DefaultLocalizationStrategy::contextMenuItemTagNoGuessesFound()
+{
+    return UI_STRING("No Guesses Found", "No Guesses Found context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagIgnoreSpelling()
+{
+    return UI_STRING("Ignore Spelling", "Ignore Spelling context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagLearnSpelling()
+{
+    return UI_STRING("Learn Spelling", "Learn Spelling context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagSearchWeb()
+{
+    return UI_STRING("Search in Google", "Search in Google context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagLookUpInDictionary(const String& selectedString)
+{
+#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
+    UNUSED_PARAM(selectedString);
+    return UI_STRING("Look Up in Dictionary", "Look Up in Dictionary context menu item");
+#else
+    return UI_STRING("Look Up “<selection>”", "Look Up context menu item with selected word").replace("<selection>", selectedString);
+#endif
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagOpenLink()
+{
+    return UI_STRING("Open Link", "Open Link context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagIgnoreGrammar()
+{
+    return UI_STRING("Ignore Grammar", "Ignore Grammar context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagSpellingMenu()
+{
+    return UI_STRING("Spelling and Grammar", "Spelling and Grammar context sub-menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagShowSpellingPanel(bool show)
+{
+    if (show)
+        return UI_STRING("Show Spelling and Grammar", "menu item title");
+    return UI_STRING("Hide Spelling and Grammar", "menu item title");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCheckSpelling()
+{
+    return UI_STRING("Check Document Now", "Check spelling context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCheckSpellingWhileTyping()
+{
+    return UI_STRING("Check Spelling While Typing", "Check spelling while typing context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCheckGrammarWithSpelling()
+{
+    return UI_STRING("Check Grammar With Spelling", "Check grammar with spelling context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagFontMenu()
+{
+    return UI_STRING("Font", "Font context sub-menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagBold()
+{
+    return UI_STRING("Bold", "Bold context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagItalic()
+{
+    return UI_STRING("Italic", "Italic context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagUnderline()
+{
+    return UI_STRING("Underline", "Underline context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagOutline()
+{
+    return UI_STRING("Outline", "Outline context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagWritingDirectionMenu()
+{
+    return UI_STRING("Paragraph Direction", "Paragraph direction context sub-menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagTextDirectionMenu()
+{
+    return UI_STRING("Selection Direction", "Selection direction context sub-menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagDefaultDirection()
+{
+    return UI_STRING("Default", "Default writing direction context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagLeftToRight()
+{
+    return UI_STRING("Left to Right", "Left to Right context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagRightToLeft()
+{
+    return UI_STRING("Right to Left", "Right to Left context menu item");
+}
+
+#if PLATFORM(MAC)
+
+String DefaultLocalizationStrategy::contextMenuItemTagSearchInSpotlight()
+{
+    return UI_STRING("Search in Spotlight", "Search in Spotlight context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagShowFonts()
+{
+    return UI_STRING("Show Fonts", "Show fonts context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagStyles()
+{
+    return UI_STRING("Styles...", "Styles context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagShowColors()
+{
+    return UI_STRING("Show Colors", "Show colors context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagSpeechMenu()
+{
+    return UI_STRING("Speech", "Speech context sub-menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagStartSpeaking()
+{
+    return UI_STRING("Start Speaking", "Start speaking context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagStopSpeaking()
+{
+    return UI_STRING("Stop Speaking", "Stop speaking context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCorrectSpellingAutomatically()
+{
+    return UI_STRING("Correct Spelling Automatically", "Correct Spelling Automatically context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagSubstitutionsMenu()
+{
+    return UI_STRING("Substitutions", "Substitutions context sub-menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagShowSubstitutions(bool show)
+{
+    if (show) 
+        return UI_STRING("Show Substitutions", "menu item title");
+    return UI_STRING("Hide Substitutions", "menu item title");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagSmartCopyPaste()
+{
+    return UI_STRING("Smart Copy/Paste", "Smart Copy/Paste context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagSmartQuotes()
+{
+    return UI_STRING("Smart Quotes", "Smart Quotes context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagSmartDashes()
+{
+    return UI_STRING("Smart Dashes", "Smart Dashes context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagSmartLinks()
+{
+    return UI_STRING("Smart Links", "Smart Links context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagTextReplacement()
+{
+    return UI_STRING("Text Replacement", "Text Replacement context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagTransformationsMenu()
+{
+    return UI_STRING("Transformations", "Transformations context sub-menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagMakeUpperCase()
+{
+    return UI_STRING("Make Upper Case", "Make Upper Case context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagMakeLowerCase()
+{
+    return UI_STRING("Make Lower Case", "Make Lower Case context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagCapitalize()
+{
+    return UI_STRING("Capitalize", "Capitalize context menu item");
+}
+
+String DefaultLocalizationStrategy::contextMenuItemTagChangeBack(const String& replacedString)
+{
+    notImplemented();
+    return replacedString;
+}
+
+#endif
+
+String DefaultLocalizationStrategy::contextMenuItemTagInspectElement()
+{
+    return UI_STRING("Inspect Element", "Inspect Element context menu item");
+}
+
+#endif // ENABLE(CONTEXT_MENUS)
+
+String DefaultLocalizationStrategy::searchMenuNoRecentSearchesText()
+{
+    return UI_STRING("No recent searches", "Label for only item in menu that appears when clicking on the search field image, when no searches have been performed");
+}
+
+String DefaultLocalizationStrategy::searchMenuRecentSearchesText()
+{
+    return UI_STRING("Recent Searches", "label for first item in the menu that appears when clicking on the search field image, used as embedded menu title");
+}
+
+String DefaultLocalizationStrategy::searchMenuClearRecentSearchesText()
+{
+    return UI_STRING("Clear Recent Searches", "menu item in Recent Searches menu that empties menu's contents");
+}
+
+String DefaultLocalizationStrategy::AXWebAreaText()
+{
+    return UI_STRING("HTML content", "accessibility role description for web area");
+}
+
+String DefaultLocalizationStrategy::AXLinkText()
+{
+    return UI_STRING("link", "accessibility role description for link");
+}
+
+String DefaultLocalizationStrategy::AXListMarkerText()
+{
+    return UI_STRING("list marker", "accessibility role description for list marker");
+}
+
+String DefaultLocalizationStrategy::AXImageMapText()
+{
+    return UI_STRING("image map", "accessibility role description for image map");
+}
+
+String DefaultLocalizationStrategy::AXHeadingText()
+{
+    return UI_STRING("heading", "accessibility role description for headings");
+}
+
+String DefaultLocalizationStrategy::AXDefinitionListTermText()
+{
+    return UI_STRING("term", "term word of a definition");
+}
+
+String DefaultLocalizationStrategy::AXDefinitionListDefinitionText()
+{
+    return UI_STRING("definition", "definition phrase");
+}
+
+#if PLATFORM(MAC)
+String DefaultLocalizationStrategy::AXARIAContentGroupText(const String& ariaType)
+{
+    if (ariaType == "ARIAApplicationAlert")
+        return UI_STRING("alert", "An ARIA accessibility group that acts as an alert.");
+    if (ariaType == "ARIAApplicationAlertDialog")
+        return UI_STRING("alert dialog", "An ARIA accessibility group that acts as an alert dialog.");
+    if (ariaType == "ARIAApplicationDialog")
+        return UI_STRING("dialog", "An ARIA accessibility group that acts as an dialog.");
+    if (ariaType == "ARIAApplicationLog")
+        return UI_STRING("log", "An ARIA accessibility group that acts as a console log.");
+    if (ariaType == "ARIAApplicationMarquee")
+        return UI_STRING("marquee", "An ARIA accessibility group that acts as a marquee.");    
+    if (ariaType == "ARIAApplicationStatus")
+        return UI_STRING("application status", "An ARIA accessibility group that acts as a status update.");    
+    if (ariaType == "ARIAApplicationTimer")
+        return UI_STRING("timer", "An ARIA accessibility group that acts as an updating timer.");    
+    if (ariaType == "ARIADocument")
+        return UI_STRING("document", "An ARIA accessibility group that acts as a document.");    
+    if (ariaType == "ARIADocumentArticle")
+        return UI_STRING("article", "An ARIA accessibility group that acts as an article.");    
+    if (ariaType == "ARIADocumentNote")
+        return UI_STRING("note", "An ARIA accessibility group that acts as a note in a document.");    
+    if (ariaType == "ARIADocumentRegion")
+        return UI_STRING("region", "An ARIA accessibility group that acts as a distinct region in a document.");    
+    if (ariaType == "ARIALandmarkApplication")
+        return UI_STRING("application", "An ARIA accessibility group that acts as an application.");    
+    if (ariaType == "ARIALandmarkBanner")
+        return UI_STRING("banner", "An ARIA accessibility group that acts as a banner.");    
+    if (ariaType == "ARIALandmarkComplementary")
+        return UI_STRING("complementary", "An ARIA accessibility group that acts as a region of complementary information.");    
+    if (ariaType == "ARIALandmarkContentInfo")
+        return UI_STRING("content", "An ARIA accessibility group that contains content.");    
+    if (ariaType == "ARIALandmarkMain")
+        return UI_STRING("main", "An ARIA accessibility group that is the main portion of the website.");    
+    if (ariaType == "ARIALandmarkNavigation")
+        return UI_STRING("navigation", "An ARIA accessibility group that contains the main navigation elements of a website.");    
+    if (ariaType == "ARIALandmarkSearch")
+        return UI_STRING("search", "An ARIA accessibility group that contains a search feature of a website.");    
+    if (ariaType == "ARIAUserInterfaceTooltip")
+        return UI_STRING("tooltip", "An ARIA accessibility group that acts as a tooltip.");    
+    if (ariaType == "ARIATabPanel")
+        return UI_STRING("tab panel", "An ARIA accessibility group that contains the content of a tab.");
+    if (ariaType == "ARIADocumentMath")
+        return UI_STRING("math", "An ARIA accessibility group that contains mathematical symbols.");
+    return String();
+}
+#endif
+
+String DefaultLocalizationStrategy::AXButtonActionVerb()
+{
+    return UI_STRING("press", "Verb stating the action that will occur when a button is pressed, as used by accessibility");
+}
+
+String DefaultLocalizationStrategy::AXRadioButtonActionVerb() 
+{
+    return UI_STRING("select", "Verb stating the action that will occur when a radio button is clicked, as used by accessibility");
+}
+
+String DefaultLocalizationStrategy::AXTextFieldActionVerb()
+{
+    return UI_STRING("activate", "Verb stating the action that will occur when a text field is selected, as used by accessibility");
+}
+
+String DefaultLocalizationStrategy::AXCheckedCheckBoxActionVerb()
+{
+    return UI_STRING("uncheck", "Verb stating the action that will occur when a checked checkbox is clicked, as used by accessibility");
+}
+
+String DefaultLocalizationStrategy::AXUncheckedCheckBoxActionVerb()
+{
+    return UI_STRING("check", "Verb stating the action that will occur when an unchecked checkbox is clicked, as used by accessibility");
+}
+
+String DefaultLocalizationStrategy::AXMenuListActionVerb()
+{
+    notImplemented();
+    return "select";
+}
+
+String DefaultLocalizationStrategy::AXMenuListPopupActionVerb()
+{
+    notImplemented();
+    return "select";
+}
+
+String DefaultLocalizationStrategy::AXLinkActionVerb()
+{
+    return UI_STRING("jump", "Verb stating the action that will occur when a link is clicked, as used by accessibility");
+}
+
+String DefaultLocalizationStrategy::missingPluginText()
+{
+    return UI_STRING("Missing Plug-in", "Label text to be used when a plugin is missing");
+}
+
+String DefaultLocalizationStrategy::crashedPluginText()
+{
+    return UI_STRING("Plug-in Failure", "Label text to be used if plugin host process has crashed");
+}
+
+String DefaultLocalizationStrategy::multipleFileUploadText(unsigned numberOfFiles)
+{
+    return formatLocalizedString(UI_STRING("%d files", "Label to describe the number of files selected in a file upload control that allows multiple files"), numberOfFiles);
+}
+
+String DefaultLocalizationStrategy::unknownFileSizeText()
+{
+    return UI_STRING("Unknown", "Unknown filesize FTP directory listing item");
+}
+
+#if PLATFORM(WIN)
+
+String DefaultLocalizationStrategy::uploadFileText()
+{
+    notImplemented();
+    return "upload";
+}
+
+String DefaultLocalizationStrategy::allFilesText()
+{
+    notImplemented();
+    return "all files";
+}
+
+#endif
+
+#if PLATFORM(MAC)
+
+String DefaultLocalizationStrategy::keygenMenuItem512()
+{
+    return UI_STRING("512 (Low Grade)", "Menu item title for KEYGEN pop-up menu");
+}
+
+String DefaultLocalizationStrategy::keygenMenuItem1024()
+{
+    return UI_STRING("1024 (Medium Grade)", "Menu item title for KEYGEN pop-up menu");
+}
+
+String DefaultLocalizationStrategy::keygenMenuItem2048()
+{
+    return UI_STRING("2048 (High Grade)", "Menu item title for KEYGEN pop-up menu");
+}
+
+String DefaultLocalizationStrategy::keygenKeychainItemName(const String& host)
+{
+    return UI_STRING("Key from <hostname>", "Name of keychain key generated by the KEYGEN tag").replace("<hostname>", host);
+}
+
+#endif
+
+String DefaultLocalizationStrategy::imageTitle(const String& filename, const IntSize& size)
+{
+    // FIXME: This should format the numbers correctly. In Mac WebKit, we used +[NSNumberFormatter localizedStringFromNumber:numberStyle:].
+    return formatLocalizedString(UI_STRING("<filename> %d×%d pixels", "window title suffix for a standalone image (uses multiplication symbol, not x)"), size.width(), size.height()).replace("<filename>", filename);
+}
+
+String DefaultLocalizationStrategy::mediaElementLoadingStateText()
+{
+    return UI_STRING("Loading...", "Media controller status message when the media is loading");
+}
+
+String DefaultLocalizationStrategy::mediaElementLiveBroadcastStateText()
+{
+    return UI_STRING("Live Broadcast", "Media controller status message when watching a live broadcast");
+}
+
+String DefaultLocalizationStrategy::localizedMediaControlElementString(const String& name)
+{
+    if (name == "AudioElement")
+        return UI_STRING("audio element controller", "accessibility role description for audio element controller");
+    if (name == "VideoElement")
+        return UI_STRING("video element controller", "accessibility role description for video element controller");
+    if (name == "MuteButton")
+        return UI_STRING("mute", "accessibility role description for mute button");
+    if (name == "UnMuteButton")
+        return UI_STRING("unmute", "accessibility role description for turn mute off button");
+    if (name == "PlayButton")
+        return UI_STRING("play", "accessibility role description for play button");
+    if (name == "PauseButton")
+        return UI_STRING("pause", "accessibility role description for pause button");
+    if (name == "Slider")
+        return UI_STRING("movie time", "accessibility role description for timeline slider");
+    if (name == "SliderThumb")
+        return UI_STRING("timeline slider thumb", "accessibility role description for timeline thumb");
+    if (name == "RewindButton")
+        return UI_STRING("back 30 seconds", "accessibility role description for seek back 30 seconds button");
+    if (name == "ReturnToRealtimeButton")
+        return UI_STRING("return to realtime", "accessibility role description for return to real time button");
+    if (name == "CurrentTimeDisplay")
+        return UI_STRING("elapsed time", "accessibility role description for elapsed time display");
+    if (name == "TimeRemainingDisplay")
+        return UI_STRING("remaining time", "accessibility role description for time remaining display");
+    if (name == "StatusDisplay")
+        return UI_STRING("status", "accessibility role description for movie status");
+    if (name == "FullscreenButton")
+        return UI_STRING("fullscreen", "accessibility role description for enter fullscreen button");
+    if (name == "SeekForwardButton")
+        return UI_STRING("fast forward", "accessibility role description for fast forward button");
+    if (name == "SeekBackButton")
+        return UI_STRING("fast reverse", "accessibility role description for fast reverse button");
+    if (name == "ShowClosedCaptionsButton")
+        return UI_STRING("show closed captions", "accessibility role description for show closed captions button");
+    if (name == "HideClosedCaptionsButton")
+        return UI_STRING("hide closed captions", "accessibility role description for hide closed captions button");
+
+    // FIXME: the ControlsPanel container should never be visible in the accessibility hierarchy.
+    if (name == "ControlsPanel")
+        return String();
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String DefaultLocalizationStrategy::localizedMediaControlElementHelpText(const String& name)
+{
+    if (name == "AudioElement")
+        return UI_STRING("audio element playback controls and status display", "accessibility role description for audio element controller");
+    if (name == "VideoElement")
+        return UI_STRING("video element playback controls and status display", "accessibility role description for video element controller");
+    if (name == "MuteButton")
+        return UI_STRING("mute audio tracks", "accessibility help text for mute button");
+    if (name == "UnMuteButton")
+        return UI_STRING("unmute audio tracks", "accessibility help text for un mute button");
+    if (name == "PlayButton")
+        return UI_STRING("begin playback", "accessibility help text for play button");
+    if (name == "PauseButton")
+        return UI_STRING("pause playback", "accessibility help text for pause button");
+    if (name == "Slider")
+        return UI_STRING("movie time scrubber", "accessibility help text for timeline slider");
+    if (name == "SliderThumb")
+        return UI_STRING("movie time scrubber thumb", "accessibility help text for timeline slider thumb");
+    if (name == "RewindButton")
+        return UI_STRING("seek movie back 30 seconds", "accessibility help text for jump back 30 seconds button");
+    if (name == "ReturnToRealtimeButton")
+        return UI_STRING("return streaming movie to real time", "accessibility help text for return streaming movie to real time button");
+    if (name == "CurrentTimeDisplay")
+        return UI_STRING("current movie time in seconds", "accessibility help text for elapsed time display");
+    if (name == "TimeRemainingDisplay")
+        return UI_STRING("number of seconds of movie remaining", "accessibility help text for remaining time display");
+    if (name == "StatusDisplay")
+        return UI_STRING("current movie status", "accessibility help text for movie status display");
+    if (name == "SeekBackButton")
+        return UI_STRING("seek quickly back", "accessibility help text for fast rewind button");
+    if (name == "SeekForwardButton")
+        return UI_STRING("seek quickly forward", "accessibility help text for fast forward button");
+    if (name == "FullscreenButton")
+        return UI_STRING("Play movie in fullscreen mode", "accessibility help text for enter fullscreen button");
+    if (name == "ShowClosedCaptionsButton")
+        return UI_STRING("start displaying closed captions", "accessibility help text for show closed captions button");
+    if (name == "HideClosedCaptionsButton")
+        return UI_STRING("stop displaying closed captions", "accessibility help text for hide closed captions button");
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String DefaultLocalizationStrategy::localizedMediaTimeDescription(float time)
+{
+    if (!isfinite(time))
+        return UI_STRING("indefinite time", "accessibility help text for an indefinite media controller time value");
+
+    int seconds = static_cast<int>(fabsf(time)); 
+    int days = seconds / (60 * 60 * 24);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+
+    if (days)
+        return formatLocalizedString(UI_STRING("%1$d days %2$d hours %3$d minutes %4$d seconds", "accessibility help text for media controller time value >= 1 day"), days, hours, minutes, seconds);
+    if (hours)
+        return formatLocalizedString(UI_STRING("%1$d hours %2$d minutes %3$d seconds", "accessibility help text for media controller time value >= 60 minutes"), hours, minutes, seconds);
+    if (minutes)
+        return formatLocalizedString(UI_STRING("%1$d minutes %2$d seconds", "accessibility help text for media controller time value >= 60 seconds"), minutes, seconds);
+    return formatLocalizedString(UI_STRING("%1$d seconds", "accessibility help text for media controller time value < 60 seconds"), seconds);
+}
+
+String DefaultLocalizationStrategy::validationMessageValueMissingText()
+{
+    return UI_STRING("value missing", "Validation message for required form control elements that have no value");
+}
+
+String DefaultLocalizationStrategy::validationMessageTypeMismatchText()
+{
+    return UI_STRING("type mismatch", "Validation message for input form controls with a value not matching type");
+}
+
+String DefaultLocalizationStrategy::validationMessagePatternMismatchText()
+{
+    return UI_STRING("pattern mismatch", "Validation message for input form controls requiring a constrained value according to pattern");
+}
+
+String DefaultLocalizationStrategy::validationMessageTooLongText()
+{
+    return UI_STRING("too long", "Validation message for form control elements with a value longer than maximum allowed length");
+}
+
+String DefaultLocalizationStrategy::validationMessageRangeUnderflowText()
+{
+    return UI_STRING("range underflow", "Validation message for input form controls with value lower than allowed minimum");
+}
+
+String DefaultLocalizationStrategy::validationMessageRangeOverflowText()
+{
+    return UI_STRING("range overflow", "Validation message for input form controls with value higher than allowed maximum");
+}
+
+String DefaultLocalizationStrategy::validationMessageStepMismatchText()
+{
+    return UI_STRING("step mismatch", "Validation message for input form controls with value not respecting the step attribute");
+}
+
+} // namespace WebCore
+
+#endif // USE(PLATFORM_STRATEGIES)
diff --git a/Source/WebCore/platform/DefaultLocalizationStrategy.h b/Source/WebCore/platform/DefaultLocalizationStrategy.h
new file mode 100644
index 0000000..56120e0
--- /dev/null
+++ b/Source/WebCore/platform/DefaultLocalizationStrategy.h
@@ -0,0 +1,187 @@
+/*
+ * Copyright (C) 2010, 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DefaultLocalizationStrategy_h
+#define DefaultLocalizationStrategy_h
+
+#if USE(PLATFORM_STRATEGIES)
+
+#include "LocalizationStrategy.h"
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class DefaultLocalizationStrategy : public LocalizationStrategy {
+public:
+    DefaultLocalizationStrategy();
+
+private:
+    virtual String inputElementAltText();
+    virtual String resetButtonDefaultLabel();
+    virtual String searchableIndexIntroduction();
+    virtual String submitButtonDefaultLabel();
+    virtual String fileButtonChooseFileLabel();
+    virtual String fileButtonNoFileSelectedLabel();
+    virtual String defaultDetailsSummaryText();
+#if PLATFORM(MAC)
+    virtual String copyImageUnknownFileLabel();
+#endif
+#if ENABLE(CONTEXT_MENUS)
+    virtual String contextMenuItemTagOpenLinkInNewWindow();
+    virtual String contextMenuItemTagDownloadLinkToDisk();
+    virtual String contextMenuItemTagCopyLinkToClipboard();
+    virtual String contextMenuItemTagOpenImageInNewWindow();
+    virtual String contextMenuItemTagDownloadImageToDisk();
+    virtual String contextMenuItemTagCopyImageToClipboard();
+#if PLATFORM(QT)
+    virtual String contextMenuItemTagCopyImageUrlToClipboard();
+#endif
+    virtual String contextMenuItemTagOpenFrameInNewWindow();
+    virtual String contextMenuItemTagCopy();
+    virtual String contextMenuItemTagGoBack();
+    virtual String contextMenuItemTagGoForward();
+    virtual String contextMenuItemTagStop();
+    virtual String contextMenuItemTagReload();
+    virtual String contextMenuItemTagCut();
+    virtual String contextMenuItemTagPaste();
+#if PLATFORM(GTK)
+    virtual String contextMenuItemTagDelete();
+    virtual String contextMenuItemTagInputMethods();
+    virtual String contextMenuItemTagUnicode();
+#endif
+#if PLATFORM(GTK) || PLATFORM(QT)
+    virtual String contextMenuItemTagSelectAll();
+#endif
+    virtual String contextMenuItemTagNoGuessesFound();
+    virtual String contextMenuItemTagIgnoreSpelling();
+    virtual String contextMenuItemTagLearnSpelling();
+    virtual String contextMenuItemTagSearchWeb();
+    virtual String contextMenuItemTagLookUpInDictionary(const String& selectedString);
+    virtual String contextMenuItemTagOpenLink();
+    virtual String contextMenuItemTagIgnoreGrammar();
+    virtual String contextMenuItemTagSpellingMenu();
+    virtual String contextMenuItemTagShowSpellingPanel(bool show);
+    virtual String contextMenuItemTagCheckSpelling();
+    virtual String contextMenuItemTagCheckSpellingWhileTyping();
+    virtual String contextMenuItemTagCheckGrammarWithSpelling();
+    virtual String contextMenuItemTagFontMenu();
+    virtual String contextMenuItemTagBold();
+    virtual String contextMenuItemTagItalic();
+    virtual String contextMenuItemTagUnderline();
+    virtual String contextMenuItemTagOutline();
+    virtual String contextMenuItemTagWritingDirectionMenu();
+    virtual String contextMenuItemTagTextDirectionMenu();
+    virtual String contextMenuItemTagDefaultDirection();
+    virtual String contextMenuItemTagLeftToRight();
+    virtual String contextMenuItemTagRightToLeft();
+#if PLATFORM(MAC)
+    virtual String contextMenuItemTagSearchInSpotlight();
+    virtual String contextMenuItemTagShowFonts();
+    virtual String contextMenuItemTagStyles();
+    virtual String contextMenuItemTagShowColors();
+    virtual String contextMenuItemTagSpeechMenu();
+    virtual String contextMenuItemTagStartSpeaking();
+    virtual String contextMenuItemTagStopSpeaking();
+    virtual String contextMenuItemTagCorrectSpellingAutomatically();
+    virtual String contextMenuItemTagSubstitutionsMenu();
+    virtual String contextMenuItemTagShowSubstitutions(bool show);
+    virtual String contextMenuItemTagSmartCopyPaste();
+    virtual String contextMenuItemTagSmartQuotes();
+    virtual String contextMenuItemTagSmartDashes();
+    virtual String contextMenuItemTagSmartLinks();
+    virtual String contextMenuItemTagTextReplacement();
+    virtual String contextMenuItemTagTransformationsMenu();
+    virtual String contextMenuItemTagMakeUpperCase();
+    virtual String contextMenuItemTagMakeLowerCase();
+    virtual String contextMenuItemTagCapitalize();
+    virtual String contextMenuItemTagChangeBack(const String& replacedString);
+#endif
+    virtual String contextMenuItemTagInspectElement();
+    virtual String contextMenuItemTagOpenVideoInNewWindow();
+    virtual String contextMenuItemTagOpenAudioInNewWindow();
+    virtual String contextMenuItemTagCopyVideoLinkToClipboard();
+    virtual String contextMenuItemTagCopyAudioLinkToClipboard();
+    virtual String contextMenuItemTagToggleMediaControls();
+    virtual String contextMenuItemTagToggleMediaLoop();
+    virtual String contextMenuItemTagEnterVideoFullscreen();
+    virtual String contextMenuItemTagMediaPlay();
+    virtual String contextMenuItemTagMediaPause();
+    virtual String contextMenuItemTagMediaMute();
+#endif // ENABLE(CONTEXT_MENUS)
+    virtual String searchMenuNoRecentSearchesText();
+    virtual String searchMenuRecentSearchesText();
+    virtual String searchMenuClearRecentSearchesText();
+    virtual String AXWebAreaText();
+    virtual String AXLinkText();
+    virtual String AXListMarkerText();
+    virtual String AXImageMapText();
+    virtual String AXHeadingText();
+    virtual String AXDefinitionListTermText();
+    virtual String AXDefinitionListDefinitionText();
+#if PLATFORM(MAC)
+    virtual String AXARIAContentGroupText(const String& ariaType);
+#endif
+    virtual String AXButtonActionVerb();
+    virtual String AXRadioButtonActionVerb();
+    virtual String AXTextFieldActionVerb();
+    virtual String AXCheckedCheckBoxActionVerb();
+    virtual String AXUncheckedCheckBoxActionVerb();
+    virtual String AXMenuListActionVerb();
+    virtual String AXMenuListPopupActionVerb();
+    virtual String AXLinkActionVerb();
+    virtual String missingPluginText();
+    virtual String crashedPluginText();
+    virtual String multipleFileUploadText(unsigned numberOfFiles);
+    virtual String unknownFileSizeText();
+#if PLATFORM(WIN)
+    virtual String uploadFileText();
+    virtual String allFilesText();
+#endif
+#if PLATFORM(MAC)
+    virtual String keygenMenuItem512();
+    virtual String keygenMenuItem1024();
+    virtual String keygenMenuItem2048();
+    virtual String keygenKeychainItemName(const String& host);
+#endif
+    virtual String imageTitle(const String& filename, const IntSize&);
+    virtual String mediaElementLoadingStateText();
+    virtual String mediaElementLiveBroadcastStateText();
+    virtual String localizedMediaControlElementString(const String&);
+    virtual String localizedMediaControlElementHelpText(const String&);
+    virtual String localizedMediaTimeDescription(float);
+    virtual String validationMessageValueMissingText();
+    virtual String validationMessageTypeMismatchText();
+    virtual String validationMessagePatternMismatchText();
+    virtual String validationMessageTooLongText();
+    virtual String validationMessageRangeUnderflowText();
+    virtual String validationMessageRangeOverflowText();
+    virtual String validationMessageStepMismatchText();
+};
+
+} // namespace WebCore
+
+#endif // USE(PLATFORM_STRATEGIES)
+
+#endif // DefaultLocalizationStrategy_h
diff --git a/Source/WebCore/platform/FileMetadata.h b/Source/WebCore/platform/FileMetadata.h
index 9b7d09b..99fe2f3 100644
--- a/Source/WebCore/platform/FileMetadata.h
+++ b/Source/WebCore/platform/FileMetadata.h
@@ -31,6 +31,8 @@
 #ifndef FileMetadata_h
 #define FileMetadata_h
 
+#include <wtf/text/WTFString.h>
+
 #if ENABLE(FILE_SYSTEM)
 
 namespace WebCore {
@@ -52,6 +54,8 @@ struct FileMetadata {
 
     Type type;
 
+    String platformPath;
+
     FileMetadata() : modificationTime(0.0), length(-1), type(TypeUnknown) { }
 };
 
diff --git a/Source/WebCore/platform/FileSystem.cpp b/Source/WebCore/platform/FileSystem.cpp
index 0f69b7f..cc2e904 100644
--- a/Source/WebCore/platform/FileSystem.cpp
+++ b/Source/WebCore/platform/FileSystem.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "FileSystem.h"
 
+#include <wtf/HexNumber.h>
+
 namespace WebCore {
 
 // The following lower-ASCII characters need escaping to be used in a filename
@@ -75,8 +77,6 @@ static inline bool shouldEscapeUChar(UChar c)
     return c > 127 ? false : needsEscaping[c];
 }
 
-static const char hexDigits[17] = "0123456789ABCDEF";
-
 String encodeForFileName(const String& inputStr)
 {
     unsigned length = inputStr.length();
@@ -90,8 +90,7 @@ String encodeForFileName(const String& inputStr)
         UChar c = *str++;
         if (shouldEscapeUChar(c)) {
             *p++ = '%';
-            *p++ = hexDigits[(c >> 4) & 0xF];
-            *p++ = hexDigits[c & 0xF];
+            placeByteAsHex(c, p);
         } else
             *p++ = c;
     }
diff --git a/Source/WebCore/platform/FileSystem.h b/Source/WebCore/platform/FileSystem.h
index 8b7d0f0..49a78e8 100644
--- a/Source/WebCore/platform/FileSystem.h
+++ b/Source/WebCore/platform/FileSystem.h
@@ -172,7 +172,7 @@ CString fileSystemRepresentation(const String&);
 inline bool isHandleValid(const PlatformFileHandle& handle) { return handle != invalidPlatformFileHandle; }
 
 // Prefix is what the filename should be prefixed with, not the full path.
-CString openTemporaryFile(const char* prefix, PlatformFileHandle&);
+String openTemporaryFile(const String& prefix, PlatformFileHandle&);
 PlatformFileHandle openFile(const String& path, FileOpenMode);
 void closeFile(PlatformFileHandle&);
 // Returns the resulting offset from the beginning of the file if successful, -1 otherwise.
diff --git a/Source/WebCore/platform/HostWindow.h b/Source/WebCore/platform/HostWindow.h
index 0d19356..316f043 100644
--- a/Source/WebCore/platform/HostWindow.h
+++ b/Source/WebCore/platform/HostWindow.h
@@ -52,7 +52,7 @@ public:
 
 #if ENABLE(TILED_BACKING_STORE)
     // Requests the host to do the actual scrolling. This is only used in combination with a tiled backing store.
-    virtual void delegatedScrollRequested(const IntSize& scrollDelta) = 0;
+    virtual void delegatedScrollRequested(const IntPoint& scrollPoint) = 0;
 #endif
 
     // Methods for doing coordinate conversions to and from screen coordinates.
diff --git a/Source/WebCore/platform/KURL.cpp b/Source/WebCore/platform/KURL.cpp
index 0032f09..88ad3d9 100644
--- a/Source/WebCore/platform/KURL.cpp
+++ b/Source/WebCore/platform/KURL.cpp
@@ -30,6 +30,7 @@
 #include "TextEncoding.h"
 #include <wtf/text/CString.h>
 #include <wtf/HashMap.h>
+#include <wtf/HexNumber.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/StringHash.h>
 
@@ -89,8 +90,6 @@ enum URLCharacterClasses {
     BadChar = 1 << 6
 };
 
-static const char hexDigits[17] = "0123456789ABCDEF";
-
 static const unsigned char characterClassTable[256] = {
     /* 0 nul */ PathSegmentEndChar,    /* 1 soh */ BadChar,
     /* 2 stx */ BadChar,    /* 3 etx */ BadChar,
@@ -221,7 +220,6 @@ static const unsigned char characterClassTable[256] = {
 static int copyPathRemovingDots(char* dst, const char* src, int srcStart, int srcEnd);
 static void encodeRelativeString(const String& rel, const TextEncoding&, CharBuffer& ouput);
 static String substituteBackslashes(const String&);
-static bool isValidProtocol(const String&);
 
 static inline bool isSchemeFirstChar(char c) { return characterClassTable[static_cast<unsigned char>(c)] & SchemeFirstChar; }
 static inline bool isSchemeFirstChar(UChar c) { return c <= 0xff && (characterClassTable[c] & SchemeFirstChar); }
@@ -861,7 +859,11 @@ void KURL::setPath(const String& s)
 
     // FIXME: encodeWithURLEscapeSequences does not correctly escape '#' and '?', so fragment and query parts
     // may be inadvertently affected.
-    parse(m_string.left(m_portEnd) + encodeWithURLEscapeSequences(s) + m_string.substring(m_pathEnd));
+    String path = s;
+    if (path.isEmpty() || path[0] != '/')
+        path = "/" + path;
+
+    parse(m_string.left(m_portEnd) + encodeWithURLEscapeSequences(path) + m_string.substring(m_pathEnd));
 }
 
 String KURL::prettyURL() const
@@ -971,8 +973,7 @@ String decodeURLEscapeSequences(const String& str, const TextEncoding& encoding)
 static void appendEscapedChar(char*& buffer, unsigned char c)
 {
     *buffer++ = '%';
-    *buffer++ = hexDigits[c >> 4];
-    *buffer++ = hexDigits[c & 0xF];
+    placeByteAsHex(c, buffer);
 }
 
 static void appendEscapingBadChars(char*& buffer, const char* strStart, size_t length)
@@ -1131,6 +1132,11 @@ static inline bool isDefaultPortForScheme(const char* port, size_t portLength, c
     return false;
 }
 
+static inline bool hostPortIsEmptyButCredentialsArePresent(int hostStart, int portEnd, char userEndChar)
+{
+    return userEndChar == '@' && hostStart == portEnd;
+}
+
 void KURL::parse(const char* url, const String* originalString)
 {
     if (!url || url[0] == '\0') {
@@ -1256,6 +1262,12 @@ void KURL::parse(const char* url, const String* originalString)
             return;
         }
 
+        if (hostPortIsEmptyButCredentialsArePresent(hostStart, portEnd, url[userEnd])) {
+            // in this circumstance, act as if there is an erroneous hostname containing an '@'
+            userEnd = userStart;
+            hostStart = userEnd;
+        }
+
         if (userStart == portEnd && !m_protocolInHTTPFamily && !isFile) {
             // No authority found, which means that this is not a net_path, but rather an abs_path whose first two
             // path segments are empty. For file, http and https only, an empty authority is allowed.
diff --git a/Source/WebCore/platform/KURL.h b/Source/WebCore/platform/KURL.h
index be72824..5764494 100644
--- a/Source/WebCore/platform/KURL.h
+++ b/Source/WebCore/platform/KURL.h
@@ -279,6 +279,8 @@ bool protocolIsJavaScript(const String& url);
 bool isDefaultPortForProtocol(unsigned short port, const String& protocol);
 bool portAllowed(const KURL&); // Blacklist ports that should never be used for Web resources.
 
+bool isValidProtocol(const String&);
+
 String mimeTypeFromDataURL(const String& url);
 
 // Unescapes the given string using URL escaping rules, given an optional
diff --git a/Source/WebCore/platform/KURLGoogle.cpp b/Source/WebCore/platform/KURLGoogle.cpp
index 231c43d..88120a8 100644
--- a/Source/WebCore/platform/KURLGoogle.cpp
+++ b/Source/WebCore/platform/KURLGoogle.cpp
@@ -133,6 +133,22 @@ static inline bool isSchemeChar(char c)
     return isSchemeFirstChar(c) || (c >= '0' && c <= '9') || c == '.' || c == '-' || c == '*';
 }
 
+bool isValidProtocol(const String& protocol)
+{
+    // NOTE This is a copy of the function in KURL.cpp.
+    // RFC3986: ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )
+    if (protocol.isEmpty())
+        return false;
+    if (!isSchemeFirstChar(protocol[0]))
+        return false;
+    unsigned protocolLength = protocol.length();
+    for (unsigned i = 1; i < protocolLength; i++) {
+        if (!isSchemeChar(protocol[i]))
+            return false;
+    }
+    return true;
+}
+
 
 // KURLGooglePrivate -----------------------------------------------------------
 
diff --git a/Source/WebCore/platform/KillRingNone.cpp b/Source/WebCore/platform/KillRingNone.cpp
index 35098aa..310aa08 100644
--- a/Source/WebCore/platform/KillRingNone.cpp
+++ b/Source/WebCore/platform/KillRingNone.cpp
@@ -28,11 +28,11 @@
 
 namespace WebCore {
 
-void KillRing::append(const String& string)
+void KillRing::append(const String&)
 {
 }
 
-void KillRing::prepend(const String& string)
+void KillRing::prepend(const String&)
 {
 }
 
diff --git a/Source/WebCore/platform/Length.h b/Source/WebCore/platform/Length.h
index 886dfec..2b11a5f 100644
--- a/Source/WebCore/platform/Length.h
+++ b/Source/WebCore/platform/Length.h
@@ -1,6 +1,7 @@
 /*
     Copyright (C) 1999 Lars Knoll (knoll@kde.org)
     Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+    Copyright (C) 2011 Rik Cabanier (cabanier@adobe.com)
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -30,7 +31,6 @@
 namespace WebCore {
 
 const int undefinedLength = -1;
-const int percentScaleFactor = 128;
 const int intMaxForLength = 0x7ffffff; // max value for a 28-bit int
 const int intMinForLength = (-0x7ffffff - 1); // min value for a 28-bit int
 
@@ -40,72 +40,79 @@ struct Length {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     Length()
-        : m_value(0)
+        :  m_intValue(0), m_quirk(false), m_type(Auto), m_isFloat(false)
     {
     }
 
     Length(LengthType t)
-        : m_value(t)
+        : m_intValue(0), m_quirk(false), m_type(t), m_isFloat(false)
     {
     }
 
     Length(int v, LengthType t, bool q = false)
-        : m_value((v * 16) | (q << 3) | t) // FIXME: Doesn't work if the passed-in value is very large!
+        : m_intValue(v), m_quirk(q), m_type(t), m_isFloat(false)
     {
-        ASSERT(t != Percent);
+    }
+    
+    Length(float v, LengthType t, bool q = false)
+    : m_floatValue(v), m_quirk(q), m_type(t), m_isFloat(true)
+    {            
     }
 
     Length(double v, LengthType t, bool q = false)
-        : m_value(static_cast<int>(v * percentScaleFactor) * 16 | (q << 3) | t)
-    {
-        ASSERT(t == Percent);
+        : m_quirk(q), m_type(t), m_isFloat(true)
+    {           
+        m_floatValue = static_cast<float>(v);    
     }
 
-    bool operator==(const Length& o) const { return m_value == o.m_value; }
-    bool operator!=(const Length& o) const { return m_value != o.m_value; }
+    bool operator==(const Length& o) const { return (getFloatValue() == o.getFloatValue()) && (m_type == o.m_type) && (m_quirk == o.m_quirk); }
+    bool operator!=(const Length& o) const { return (getFloatValue() != o.getFloatValue()) || (m_type != o.m_type) || (m_quirk != o.m_quirk); }
 
+    const Length& operator*=(float v)
+    {        
+        if (m_isFloat)
+            m_floatValue = static_cast<float>(m_floatValue * v);
+        else        
+            m_intValue = static_cast<int>(m_intValue * v);
+        
+        return *this;
+    }
+    
     int value() const {
-        ASSERT(type() != Percent);
-        return rawValue();
+        return getIntValue();
     }
 
-    int rawValue() const { return (m_value & ~0xF) / 16; }
-
-    double percent() const
+    float percent() const
     {
         ASSERT(type() == Percent);
-        return static_cast<double>(rawValue()) / percentScaleFactor;
+        return getFloatValue();
     }
 
-    LengthType type() const { return static_cast<LengthType>(m_value & 7); }
-    bool quirk() const { return (m_value >> 3) & 1; }
+    LengthType type() const { return static_cast<LengthType>(m_type); }
+    bool quirk() const { return m_quirk; }
 
     void setValue(LengthType t, int value)
     {
-        ASSERT(t != Percent);
-        setRawValue(t, value);
+        m_type = t;
+        m_intValue = value;
+        m_isFloat = false;
     }
 
-    void setRawValue(LengthType t, int value) { m_value = value * 16 | (m_value & 0x8) | t; }
-
     void setValue(int value)
     {
-        ASSERT(!value || type() != Percent);
-        setRawValue(value);
+        setValue(Fixed, value);
     }
 
-    void setRawValue(int value) { m_value = value * 16 | (m_value & 0xF); }
-
-    void setValue(LengthType t, double value)
+    void setValue(LengthType t, float value)
     {
-        ASSERT(t == Percent);
-        m_value = static_cast<int>(value * percentScaleFactor) * 16 | (m_value & 0x8) | t;
+        m_type = t;
+        m_floatValue = value;
+        m_isFloat = true;    
     }
 
-    void setValue(double value)
+    void setValue(float value)
     {
-        ASSERT(type() == Percent);
-        m_value = static_cast<int>(value * percentScaleFactor) * 16 | (m_value & 0xF);
+        *this = Length(value, Fixed);
     }
 
     // note: works only for certain types, returns undefinedLength otherwise
@@ -113,11 +120,8 @@ public:
     {
         switch (type()) {
             case Fixed:
-                return value();
             case Percent:
-                if (roundPercentages)
-                    return static_cast<int>(round(maxValue * percent() / 100.0));
-                return maxValue * rawValue() / (100 * percentScaleFactor);
+                return calcMinValue(maxValue, roundPercentages);
             case Auto:
                 return maxValue;
             default:
@@ -132,8 +136,9 @@ public:
                 return value();
             case Percent:
                 if (roundPercentages)
-                    return static_cast<int>(round(maxValue * percent() / 100.0));
-                return maxValue * rawValue() / (100 * percentScaleFactor);
+                    return static_cast<int>(round(maxValue * percent() / 100.0f));
+                // Don't remove the extra cast to float. It is needed for rounding on 32-bit Intel machines that use the FPU stack.
+                return static_cast<int>(static_cast<float>(maxValue * percent() / 100.0f));
             case Auto:
             default:
                 return 0;
@@ -144,9 +149,9 @@ public:
     {
         switch (type()) {
             case Fixed:
-                return static_cast<float>(value());
+                return getFloatValue();
             case Percent:
-                return static_cast<float>(maxValue * percent() / 100.0);
+                return static_cast<float>(maxValue * percent() / 100.0f);
             case Auto:
                 return static_cast<float>(maxValue);
             default:
@@ -154,10 +159,14 @@ public:
         }
     }
 
-    bool isUndefined() const { return rawValue() == undefinedLength; }
-    bool isZero() const { return !(m_value & ~0xF); }
-    bool isPositive() const { return rawValue() > 0; }
-    bool isNegative() const { return rawValue() < 0; }
+    bool isUndefined() const { return value() == undefinedLength; }
+    bool isZero() const 
+    { 
+        return m_isFloat ? !m_floatValue : !m_intValue;
+    }
+    
+    bool isPositive() const { return getFloatValue() > 0; }
+    bool isNegative() const { return getFloatValue() < 0; }
 
     bool isAuto() const { return type() == Auto; }
     bool isRelative() const { return type() == Relative; }
@@ -165,7 +174,7 @@ public:
     bool isFixed() const { return type() == Fixed; }
     bool isIntrinsicOrAuto() const { return type() == Auto || type() == MinIntrinsic || type() == Intrinsic; }
 
-    Length blend(const Length& from, double progress) const
+    Length blend(const Length& from, float progress) const
     {
         // Blend two lengths to produce a new length that is in between them.  Used for animation.
         if (!from.isZero() && !isZero() && from.type() != type())
@@ -179,18 +188,34 @@ public:
             resultType = from.type();
         
         if (resultType == Percent) {
-            double fromPercent = from.isZero() ? 0. : from.percent();
-            double toPercent = isZero() ? 0. : percent();
+            float fromPercent = from.isZero() ? 0 : from.percent();
+            float toPercent = isZero() ? 0 : percent();
             return Length(fromPercent + (toPercent - fromPercent) * progress, Percent);
         } 
             
-        int fromValue = from.isZero() ? 0 : from.value();
-        int toValue = isZero() ? 0 : value();
-        return Length(int(fromValue + (toValue - fromValue) * progress), resultType);
+        float fromValue = from.isZero() ? 0 : from.value();
+        float toValue = isZero() ? 0 : value();
+        return Length(fromValue + (toValue - fromValue) * progress, resultType);
     }
 
 private:
-    int m_value;
+    int getIntValue() const
+    {
+        return m_isFloat ? static_cast<int>(m_floatValue) : m_intValue;
+    }
+
+    float getFloatValue() const
+    {
+        return m_isFloat ? m_floatValue : m_intValue;
+    }
+
+    union {
+        int m_intValue;
+        float m_floatValue;
+    };
+    bool m_quirk;
+    unsigned char m_type;
+    bool m_isFloat;
 };
 
 PassOwnArrayPtr<Length> newCoordsArray(const String&, int& len);
diff --git a/Source/WebCore/platform/LinkHash.cpp b/Source/WebCore/platform/LinkHash.cpp
index a2acad1..29671a0 100644
--- a/Source/WebCore/platform/LinkHash.cpp
+++ b/Source/WebCore/platform/LinkHash.cpp
@@ -197,7 +197,7 @@ static inline bool needsTrailingSlash(const UChar* characters, unsigned length)
 
 static ALWAYS_INLINE LinkHash visitedLinkHashInline(const UChar* url, unsigned length)
 {
-    return AlreadyHashed::avoidDeletedValue(WTF::StringHasher::createHash(url, length));
+    return AlreadyHashed::avoidDeletedValue(StringHasher::computeHash(url, length));
 }
 
 LinkHash visitedLinkHash(const UChar* url, unsigned length)
diff --git a/Source/WebCore/platform/LocalizationStrategy.h b/Source/WebCore/platform/LocalizationStrategy.h
index eba0e7c..f883893 100644
--- a/Source/WebCore/platform/LocalizationStrategy.h
+++ b/Source/WebCore/platform/LocalizationStrategy.h
@@ -79,7 +79,7 @@ public:
     virtual String contextMenuItemTagIgnoreSpelling() = 0;
     virtual String contextMenuItemTagLearnSpelling() = 0;
     virtual String contextMenuItemTagSearchWeb() = 0;
-    virtual String contextMenuItemTagLookUpInDictionary() = 0;
+    virtual String contextMenuItemTagLookUpInDictionary(const String& selectedString) = 0;
     virtual String contextMenuItemTagOpenLink() = 0;
     virtual String contextMenuItemTagIgnoreGrammar() = 0;
     virtual String contextMenuItemTagSpellingMenu() = 0;
@@ -167,6 +167,13 @@ public:
     virtual String allFilesText() = 0;
 #endif
 
+#if PLATFORM(MAC)
+    virtual String keygenMenuItem512() = 0;
+    virtual String keygenMenuItem1024() = 0;
+    virtual String keygenMenuItem2048() = 0;
+    virtual String keygenKeychainItemName(const String& host) = 0;
+#endif
+
     virtual String imageTitle(const String& filename, const IntSize& size) = 0;
 
     virtual String mediaElementLoadingStateText() = 0;
diff --git a/Source/WebCore/platform/LocalizedStrings.cpp b/Source/WebCore/platform/LocalizedStrings.cpp
index 9656dbe..f5ad0b7 100644
--- a/Source/WebCore/platform/LocalizedStrings.cpp
+++ b/Source/WebCore/platform/LocalizedStrings.cpp
@@ -190,9 +190,9 @@ String contextMenuItemTagSearchWeb()
     return platformStrategies()->localizationStrategy()->contextMenuItemTagSearchWeb();
 }
 
-String contextMenuItemTagLookUpInDictionary()
+String contextMenuItemTagLookUpInDictionary(const String& selectedString)
 {
-    return platformStrategies()->localizationStrategy()->contextMenuItemTagLookUpInDictionary();
+    return platformStrategies()->localizationStrategy()->contextMenuItemTagLookUpInDictionary(selectedString);
 }
 
 String contextMenuItemTagOpenLink()
@@ -569,6 +569,29 @@ String allFilesText()
 }
 #endif
 
+#if PLATFORM(MAC)
+String keygenMenuItem512()
+{
+    return platformStrategies()->localizationStrategy()->keygenMenuItem512();
+}
+
+String keygenMenuItem1024()
+{
+    return platformStrategies()->localizationStrategy()->keygenMenuItem1024();
+}
+
+String keygenMenuItem2048()
+{
+    return platformStrategies()->localizationStrategy()->keygenMenuItem2048();
+}
+
+String keygenKeychainItemName(const String& host)
+{
+    return platformStrategies()->localizationStrategy()->keygenKeychainItemName(host);
+}
+
+#endif
+
 String imageTitle(const String& filename, const IntSize& size)
 {
     return platformStrategies()->localizationStrategy()->imageTitle(filename, size);
@@ -676,4 +699,11 @@ String validationMessageStepMismatchText(const String&, const String&)
 
 #endif // USE(PLATFORM_STRATEGIES)
 
+#if !PLATFORM(MAC) && !PLATFORM(WIN)
+String localizedString(const char* key)
+{
+    return String::fromUTF8(key, strlen(key));
+}
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/LocalizedStrings.h b/Source/WebCore/platform/LocalizedStrings.h
index f22c975..3885439 100644
--- a/Source/WebCore/platform/LocalizedStrings.h
+++ b/Source/WebCore/platform/LocalizedStrings.h
@@ -75,7 +75,7 @@ namespace WebCore {
     String contextMenuItemTagIgnoreSpelling();
     String contextMenuItemTagLearnSpelling();
     String contextMenuItemTagSearchWeb();
-    String contextMenuItemTagLookUpInDictionary();
+    String contextMenuItemTagLookUpInDictionary(const String& selectedString);
     String contextMenuItemTagOpenLink();
     String contextMenuItemTagIgnoreGrammar();
     String contextMenuItemTagSpellingMenu();
@@ -163,6 +163,13 @@ namespace WebCore {
     String allFilesText();
 #endif
 
+#if PLATFORM(MAC)
+    String keygenMenuItem512();
+    String keygenMenuItem1024();
+    String keygenMenuItem2048();
+    String keygenKeychainItemName(const String& host);
+#endif
+
     String imageTitle(const String& filename, const IntSize& size);
 
     String mediaElementLoadingStateText();
@@ -187,9 +194,11 @@ namespace WebCore {
     String validationMessageRangeOverflowText(const String& maximum);
     String validationMessageStepMismatchText(const String& base, const String& step);
 
-#if PLATFORM(MAC)
+
+#define UI_STRING(string, description) WebCore::localizedString(string)
+#define UI_STRING_KEY(string, key, description) WebCore::localizedString(key)
+
     String localizedString(const char* key);
-#endif
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/MIMETypeRegistry.cpp b/Source/WebCore/platform/MIMETypeRegistry.cpp
index e76906e..d0ad985 100644
--- a/Source/WebCore/platform/MIMETypeRegistry.cpp
+++ b/Source/WebCore/platform/MIMETypeRegistry.cpp
@@ -55,6 +55,7 @@ static HashSet<String>* supportedImageMIMETypesForEncoding;
 static HashSet<String>* supportedJavaScriptMIMETypes;
 static HashSet<String>* supportedNonImageMIMETypes;
 static HashSet<String>* supportedMediaMIMETypes;
+static HashSet<String>* unsupportedTextMIMETypes;
 
 typedef HashMap<String, Vector<String>*, CaseFoldingHash> MediaMIMETypeMap;
     
@@ -419,6 +420,27 @@ static void initializeSupportedMediaMIMETypes()
 #endif
 }
 
+static void initializeUnsupportedTextMIMETypes()
+{
+    static const char* types[] = {
+        "text/calendar",
+        "text/x-calendar",
+        "text/x-vcalendar",
+        "text/vcalendar",
+        "text/vcard",
+        "text/x-vcard",
+        "text/directory",
+        "text/ldif",
+        "text/qif",
+        "text/x-qif",
+        "text/x-csv",
+        "text/x-vcf",
+        "text/rtf",
+    };
+    for (size_t i = 0; i < WTF_ARRAY_LENGTH(types); ++i)
+      unsupportedTextMIMETypes->add(types[i]);
+}
+
 static void initializeMIMETypeRegistry()
 {
     supportedJavaScriptMIMETypes = new HashSet<String>;
@@ -430,6 +452,9 @@ static void initializeMIMETypeRegistry()
     supportedImageResourceMIMETypes = new HashSet<String>;
     supportedImageMIMETypes = new HashSet<String>;
     initializeSupportedImageMIMETypes();
+
+    unsupportedTextMIMETypes = new HashSet<String>;
+    initializeUnsupportedTextMIMETypes();
 }
 
 String MIMETypeRegistry::getMIMETypeForPath(const String& path)
@@ -500,6 +525,15 @@ bool MIMETypeRegistry::isSupportedMediaMIMEType(const String& mimeType)
     return supportedMediaMIMETypes->contains(mimeType);
 }
 
+bool MIMETypeRegistry::isUnsupportedTextMIMEType(const String& mimeType)
+{
+    if (mimeType.isEmpty())
+        return false;
+    if (!unsupportedTextMIMETypes)
+        initializeMIMETypeRegistry();
+    return unsupportedTextMIMETypes->contains(mimeType);
+}
+
 bool MIMETypeRegistry::isJavaAppletMIMEType(const String& mimeType)
 {
     // Since this set is very limited and is likely to remain so we won't bother with the overhead
@@ -546,6 +580,13 @@ HashSet<String>& MIMETypeRegistry::getSupportedMediaMIMETypes()
     return *supportedMediaMIMETypes;
 }
 
+HashSet<String>& MIMETypeRegistry::getUnsupportedTextMIMETypes()
+{
+    if (!unsupportedTextMIMETypes)
+        initializeMIMETypeRegistry();
+    return *unsupportedTextMIMETypes;
+}
+
 const String& defaultMIMEType()
 {
     DEFINE_STATIC_LOCAL(const String, defaultMIMEType, ("application/octet-stream"));
diff --git a/Source/WebCore/platform/MIMETypeRegistry.h b/Source/WebCore/platform/MIMETypeRegistry.h
index d069035..19d1b4b 100644
--- a/Source/WebCore/platform/MIMETypeRegistry.h
+++ b/Source/WebCore/platform/MIMETypeRegistry.h
@@ -68,6 +68,10 @@ public:
     // Check to see if a mime type is suitable for being loaded using <video> and <audio>
     static bool isSupportedMediaMIMEType(const String& mimeType); 
 
+    // Check to see if the mime type is not suitable for being loaded as a text
+    // document in a frame. Only valid for mime types begining with "text/".
+    static bool isUnsupportedTextMIMEType(const String& mimeType);
+
     // Check to see if a mime type is a valid Java applet mime type
     static bool isJavaAppletMIMEType(const String& mimeType);
 
@@ -80,6 +84,7 @@ public:
     static HashSet<String>& getSupportedImageMIMETypesForEncoding();
     static HashSet<String>& getSupportedNonImageMIMETypes();
     static HashSet<String>& getSupportedMediaMIMETypes();
+    static HashSet<String>& getUnsupportedTextMIMETypes();
 };
 
 const String& defaultMIMEType();
diff --git a/Source/WebCore/platform/PlatformGestureRecognizer.cpp b/Source/WebCore/platform/PlatformGestureRecognizer.cpp
new file mode 100644
index 0000000..38fc3fe
--- /dev/null
+++ b/Source/WebCore/platform/PlatformGestureRecognizer.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PlatformGestureRecognizer.h"
+
+namespace WebCore {
+
+PlatformGestureRecognizer::PlatformGestureRecognizer() { }
+PlatformGestureRecognizer::~PlatformGestureRecognizer() { }
+
+// To get a useful GestureRecognizer, a specific platform should return something
+// here that meets its needs. EventHandler will ignore null GestureRecognizers.
+PlatformGestureRecognizer* PlatformGestureRecognizer::create()
+{
+    return 0;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/PlatformGestureRecognizer.h b/Source/WebCore/platform/PlatformGestureRecognizer.h
new file mode 100644
index 0000000..f6e85a5
--- /dev/null
+++ b/Source/WebCore/platform/PlatformGestureRecognizer.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) 2011, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PlatformGestureRecognizer_h
+#define PlatformGestureRecognizer_h
+
+namespace WebCore {
+
+class EventHandler;
+class PlatformGestureRecognizer;
+class PlatformTouchEvent;
+
+// A GestureRecognizer detects gestures occurring in the touch event.
+// In response to a given touch event, the GestureRecognizer, updates
+// its internal state and optionally dispatches synthetic events to the
+// invoking EventHandler instance.
+class PlatformGestureRecognizer {
+protected:
+    PlatformGestureRecognizer();
+
+public:
+    virtual ~PlatformGestureRecognizer();
+
+    // Invoked for each touch event that could contribute to the current gesture.
+    // Takes a PlatformTouchEvent and the EventHandler that originated it and which will also
+    // be the target of any generated synthetic event. Finally, |handled|
+    // specifies if the |event| was actually handled by |source| (by the JavaScript)
+    // Returns true if the event resulted in firing a synthetic event.
+    virtual bool processTouchEventForGesture(const PlatformTouchEvent&, EventHandler*, bool handled) = 0;
+
+    // Factory method for GestureManagers.
+    static PlatformGestureRecognizer* create();
+};
+
+} // namespace WebCore
+
+#endif // PlatformGestureRecognizer_h
diff --git a/Source/WebCore/platform/PlatformKeyboardEvent.h b/Source/WebCore/platform/PlatformKeyboardEvent.h
index fcca8bd..a3127c7 100644
--- a/Source/WebCore/platform/PlatformKeyboardEvent.h
+++ b/Source/WebCore/platform/PlatformKeyboardEvent.h
@@ -96,7 +96,7 @@ namespace WebCore {
             AltKey = 1 << 0,
             CtrlKey = 1 << 1,
             MetaKey = 1 << 2,
-            ShiftKey = 1 << 3,
+            ShiftKey = 1 << 3
         };
 
         PlatformKeyboardEvent()
diff --git a/Source/WebCore/platform/PlatformStrategies.cpp b/Source/WebCore/platform/PlatformStrategies.cpp
index e0baa70..9623108 100644
--- a/Source/WebCore/platform/PlatformStrategies.cpp
+++ b/Source/WebCore/platform/PlatformStrategies.cpp
@@ -29,6 +29,8 @@
 
 #include "PlatformStrategies.h"
 
+#include "DefaultLocalizationStrategy.h"
+
 namespace WebCore {
 
 static PlatformStrategies* s_platformStrategies;
@@ -51,7 +53,12 @@ void setPlatformStrategies(PlatformStrategies* platformStrategies)
     // throw an exception here in release builds.
     ASSERT(platformStrategies != s_platformStrategies);
 }
-    
+
+LocalizationStrategy* PlatformStrategies::createLocalizationStrategy()
+{
+    return new DefaultLocalizationStrategy;
+}
+
 } // namespace WebCore
 
 #endif // USE(PLATFORM_STRATEGIES)
diff --git a/Source/WebCore/platform/PlatformStrategies.h b/Source/WebCore/platform/PlatformStrategies.h
index bda7c90..6768658 100644
--- a/Source/WebCore/platform/PlatformStrategies.h
+++ b/Source/WebCore/platform/PlatformStrategies.h
@@ -81,7 +81,7 @@ protected:
 private:
     virtual CookiesStrategy* createCookiesStrategy() = 0;
     virtual PluginStrategy* createPluginStrategy() = 0;
-    virtual LocalizationStrategy* createLocalizationStrategy() = 0;
+    virtual LocalizationStrategy* createLocalizationStrategy();
     virtual VisitedLinkStrategy* createVisitedLinkStrategy() = 0;
 
     CookiesStrategy* m_cookiesStrategy;
diff --git a/Source/WebCore/platform/ScrollAnimator.h b/Source/WebCore/platform/ScrollAnimator.h
index 060511c..6698b63 100644
--- a/Source/WebCore/platform/ScrollAnimator.h
+++ b/Source/WebCore/platform/ScrollAnimator.h
@@ -68,6 +68,8 @@ public:
 
     FloatPoint currentPosition() const;
 
+    virtual void cancelAnimations() { }
+
     virtual void contentAreaWillPaint() const { }
     virtual void mouseEnteredContentArea() const { }
     virtual void mouseExitedContentArea() const { }
diff --git a/Source/WebCore/platform/ScrollTypes.h b/Source/WebCore/platform/ScrollTypes.h
index f07fb1a..1f8e095 100644
--- a/Source/WebCore/platform/ScrollTypes.h
+++ b/Source/WebCore/platform/ScrollTypes.h
@@ -119,7 +119,7 @@ namespace WebCore {
     enum ScrollbarControlStateMask {
         ActiveScrollbarState = 1,
         EnabledScrollbarState = 1 << 1,
-        PressedScrollbarState = 1 << 2,
+        PressedScrollbarState = 1 << 2
     };
 
     enum ScrollbarPart {
@@ -133,7 +133,7 @@ namespace WebCore {
         ForwardButtonEndPart = 1 << 6,
         ScrollbarBGPart = 1 << 7,
         TrackBGPart = 1 << 8,
-        AllParts = 0xffffffff,
+        AllParts = 0xffffffff
     };
 
     enum ScrollbarButtonsPlacement {
diff --git a/Source/WebCore/platform/ScrollView.cpp b/Source/WebCore/platform/ScrollView.cpp
index baf2e32..58615fb 100644
--- a/Source/WebCore/platform/ScrollView.cpp
+++ b/Source/WebCore/platform/ScrollView.cpp
@@ -124,7 +124,7 @@ void ScrollView::setHasVerticalScrollbar(bool hasBar)
         axObjectCache()->handleScrollbarUpdate(this);
 }
 
-#if !PLATFORM(GTK)
+#if !USE(NATIVE_GTK_MAIN_FRAME_SCROLLBAR)
 PassRefPtr<Scrollbar> ScrollView::createScrollbar(ScrollbarOrientation orientation)
 {
     return Scrollbar::createNativeScrollbar(this, orientation, RegularScrollbar);
@@ -224,7 +224,7 @@ void ScrollView::setDelegatesScrolling(bool delegatesScrolling)
     m_delegatesScrolling = delegatesScrolling;
 }
 
-#if !PLATFORM(GTK)
+#if !USE(NATIVE_GTK_MAIN_FRAME_SCROLLBAR)
 IntRect ScrollView::visibleContentRect(bool includeScrollbars) const
 {
     if (platformWidget())
@@ -357,6 +357,10 @@ void ScrollView::didCompleteRubberBand(const IntSize&) const
 {
 }
 
+void ScrollView::notifyPageThatContentAreaWillPaint() const
+{
+}
+
 void ScrollView::setScrollOffset(const IntPoint& offset)
 {
     int horizontalOffset = offset.x();
@@ -408,7 +412,7 @@ void ScrollView::setScrollPosition(const IntPoint& scrollPoint)
 
 #if ENABLE(TILED_BACKING_STORE)
     if (delegatesScrolling()) {
-        hostWindow()->delegatedScrollRequested(IntSize(scrollPoint.x(), scrollPoint.y()));
+        hostWindow()->delegatedScrollRequested(scrollPoint);
         if (!m_actualVisibleContentRect.isEmpty())
             m_actualVisibleContentRect.setLocation(scrollPoint);
         return;
@@ -439,15 +443,18 @@ bool ScrollView::logicalScroll(ScrollLogicalDirection direction, ScrollGranulari
 IntSize ScrollView::overhangAmount() const
 {
     IntSize stretch;
-    if (scrollY() < 0)
-        stretch.setHeight(scrollY());
-    else if (scrollY() > contentsHeight() - visibleContentRect().height())
-        stretch.setHeight(scrollY() - (contentsHeight() - visibleContentRect().height()));
 
-    if (scrollX() < 0)
-        stretch.setWidth(scrollX());
-    else if (scrollX() > contentsWidth() - visibleContentRect().width())
-        stretch.setWidth(scrollX() - (contentsWidth() - visibleContentRect().width()));
+    int physicalScrollY = scrollPosition().y() + m_scrollOrigin.y();
+    if (physicalScrollY < 0)
+        stretch.setHeight(physicalScrollY);
+    else if (physicalScrollY > contentsHeight() - visibleContentRect().height())
+        stretch.setHeight(physicalScrollY - (contentsHeight() - visibleContentRect().height()));
+
+    int physicalScrollX = scrollPosition().x() + m_scrollOrigin.x();
+    if (physicalScrollX < 0)
+        stretch.setWidth(physicalScrollX);
+    else if (physicalScrollX > contentsWidth() - visibleContentRect().width())
+        stretch.setWidth(physicalScrollX - (contentsWidth() - visibleContentRect().width()));
 
     return stretch;
 }
@@ -947,7 +954,7 @@ void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
     if (context->paintingDisabled() && !context->updatingControlTints())
         return;
 
-    scrollAnimator()->contentAreaWillPaint();
+    notifyPageThatContentAreaWillPaint();
     
     IntRect documentDirtyRect = rect;
     documentDirtyRect.intersect(frameRect());
@@ -1000,26 +1007,28 @@ void ScrollView::calculateOverhangAreasForPainting(IntRect& horizontalOverhangRe
     int horizontalScrollbarHeight = (horizontalScrollbar() && !horizontalScrollbar()->isOverlayScrollbar())
         ? horizontalScrollbar()->height() : 0;
 
-    if (scrollY() < 0) {
+    int physicalScrollY = scrollPosition().y() + m_scrollOrigin.y();
+    if (physicalScrollY < 0) {
         horizontalOverhangRect = frameRect();
-        horizontalOverhangRect.setHeight(-scrollY());
-    } else if (scrollY() > contentsHeight() - visibleContentRect().height()) {
-        int height = scrollY() - (contentsHeight() - visibleContentRect().height());
+        horizontalOverhangRect.setHeight(-physicalScrollY);
+    } else if (physicalScrollY > contentsHeight() - visibleContentRect().height()) {
+        int height = physicalScrollY - (contentsHeight() - visibleContentRect().height());
         horizontalOverhangRect = frameRect();
         horizontalOverhangRect.setY(frameRect().maxY() - height - horizontalScrollbarHeight);
         horizontalOverhangRect.setHeight(height);
     }
 
-    if (scrollX() < 0) {
-        verticalOverhangRect.setWidth(-scrollX());
+    int physicalScrollX = scrollPosition().x() + m_scrollOrigin.x();
+    if (physicalScrollX < 0) {
+        verticalOverhangRect.setWidth(-physicalScrollX);
         verticalOverhangRect.setHeight(frameRect().height() - horizontalOverhangRect.height());
         verticalOverhangRect.setX(frameRect().x());
         if (horizontalOverhangRect.y() == frameRect().y())
             verticalOverhangRect.setY(frameRect().y() + horizontalOverhangRect.height());
         else
             verticalOverhangRect.setY(frameRect().y());
-    } else if (scrollX() > contentsWidth() - visibleContentRect().width()) {
-        int width = scrollX() - (contentsWidth() - visibleContentRect().width());
+    } else if (physicalScrollX > contentsWidth() - visibleContentRect().width()) {
+        int width = physicalScrollX - (contentsWidth() - visibleContentRect().width());
         verticalOverhangRect.setWidth(width);
         verticalOverhangRect.setHeight(frameRect().height() - horizontalOverhangRect.height());
         verticalOverhangRect.setX(frameRect().maxX() - width - verticalScrollbarWidth);
@@ -1195,7 +1204,7 @@ void ScrollView::setScrollOrigin(const IntPoint& origin, bool updatePositionAtAl
         updateScrollbars(scrollOffset());
 }
 
-#if !PLATFORM(WX) && !PLATFORM(GTK) && !PLATFORM(EFL)
+#if !PLATFORM(WX) && !USE(NATIVE_GTK_MAIN_FRAME_SCROLLBAR) && !PLATFORM(EFL)
 
 void ScrollView::platformInit()
 {
diff --git a/Source/WebCore/platform/ScrollView.h b/Source/WebCore/platform/ScrollView.h
index 1d6fba5..bff77d5 100644
--- a/Source/WebCore/platform/ScrollView.h
+++ b/Source/WebCore/platform/ScrollView.h
@@ -62,6 +62,7 @@ public:
     virtual int scrollPosition(Scrollbar*) const;
     virtual void setScrollOffset(const IntPoint&);
     virtual void didCompleteRubberBand(const IntSize&) const;
+    virtual void notifyPageThatContentAreaWillPaint() const;
 
     // NOTE: This should only be called by the overriden setScrollOffset from ScrollableArea.
     virtual void scrollTo(const IntSize& newOffset);
@@ -354,19 +355,6 @@ private:
     bool m_clipsRepaints;
     bool m_delegatesScrolling;
 
-    // There are 8 possible combinations of writing mode and direction.  Scroll origin will be non-zero in the x or y axis
-    // if there is any reversed direction or writing-mode.  The combinations are:
-    // writing-mode / direction     scrollOrigin.x() set    scrollOrigin.y() set
-    // horizontal-tb / ltr          NO                      NO
-    // horizontal-tb / rtl          YES                     NO
-    // horizontal-bt / ltr          NO                      YES
-    // horizontal-bt / rtl          YES                     YES
-    // vertical-lr / ltr            NO                      NO
-    // vertical-lr / rtl            NO                      YES
-    // vertical-rl / ltr            YES                     NO
-    // vertical-rl / rtl            YES                     YES
-    IntPoint m_scrollOrigin;
-
     IntSize m_boundsSize;
 
     void init();
diff --git a/Source/WebCore/platform/ScrollableArea.h b/Source/WebCore/platform/ScrollableArea.h
index f1c1308..d08de00 100644
--- a/Source/WebCore/platform/ScrollableArea.h
+++ b/Source/WebCore/platform/ScrollableArea.h
@@ -69,6 +69,7 @@ public:
     bool hasOverlayScrollbars() const;
 
     ScrollAnimator* scrollAnimator() const { return m_scrollAnimator.get(); }
+    const IntPoint& scrollOrigin() const { return m_scrollOrigin; }
 
     virtual int scrollSize(ScrollbarOrientation) const = 0;
     virtual int scrollPosition(Scrollbar*) const = 0;
@@ -114,6 +115,10 @@ public:
     virtual IntSize overhangAmount() const { ASSERT_NOT_REACHED(); return IntSize(); }
     virtual IntPoint currentMousePosition() const { return IntPoint(); }
     virtual void didCompleteRubberBand(const IntSize&) const { ASSERT_NOT_REACHED(); }
+    virtual bool shouldSuspendScrollAnimations() const { return true; }
+    virtual void scrollbarStyleChanged() { }
+
+    virtual void disconnectFromPage() { }
 
 private:
     // NOTE: Only called from the ScrollAnimator.
@@ -124,6 +129,20 @@ private:
     bool m_constrainsScrollingToContentEdge;
 
     bool m_inLiveResize;
+
+protected:
+    // There are 8 possible combinations of writing mode and direction. Scroll origin will be non-zero in the x or y axis
+    // if there is any reversed direction or writing-mode. The combinations are:
+    // writing-mode / direction     scrollOrigin.x() set    scrollOrigin.y() set
+    // horizontal-tb / ltr          NO                      NO
+    // horizontal-tb / rtl          YES                     NO
+    // horizontal-bt / ltr          NO                      YES
+    // horizontal-bt / rtl          YES                     YES
+    // vertical-lr / ltr            NO                      NO
+    // vertical-lr / rtl            NO                      YES
+    // vertical-rl / ltr            YES                     NO
+    // vertical-rl / rtl            YES                     YES
+    IntPoint m_scrollOrigin;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/SharedBuffer.cpp b/Source/WebCore/platform/SharedBuffer.cpp
index 34553ec..0900ae4 100644
--- a/Source/WebCore/platform/SharedBuffer.cpp
+++ b/Source/WebCore/platform/SharedBuffer.cpp
@@ -167,6 +167,9 @@ void SharedBuffer::clear()
 
     m_buffer.clear();
     m_purgeableBuffer.clear();
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+    m_dataArray.clear();
+#endif
 }
 
 PassRefPtr<SharedBuffer> SharedBuffer::copy() const
@@ -206,6 +209,9 @@ const Vector<char>& SharedBuffer::buffer() const
             freeSegment(m_segments[i]);
         }
         m_segments.clear();
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+        copyDataArrayAndClear(destination, bytesLeft);
+#endif
     }
     return m_buffer;
 }
diff --git a/Source/WebCore/platform/SharedBuffer.h b/Source/WebCore/platform/SharedBuffer.h
index dfde5a1..f7318e3 100644
--- a/Source/WebCore/platform/SharedBuffer.h
+++ b/Source/WebCore/platform/SharedBuffer.h
@@ -97,6 +97,10 @@ public:
     const char* platformData() const;
     unsigned platformDataSize() const;
 
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+    void append(CFDataRef);
+#endif
+
     PassRefPtr<SharedBuffer> copy() const;
     
     bool hasPurgeableBuffer() const { return m_purgeableBuffer.get(); }
@@ -138,6 +142,10 @@ private:
     mutable Vector<char> m_buffer;
     mutable Vector<char*> m_segments;
     OwnPtr<PurgeableBuffer> m_purgeableBuffer;
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+    mutable Vector<RetainPtr<CFDataRef> > m_dataArray;
+    void copyDataArrayAndClear(char *destination, unsigned bytesToCopy) const;
+#endif
 #if USE(CF)
     SharedBuffer(CFDataRef);
     RetainPtr<CFDataRef> m_cfData;
diff --git a/Source/WebCore/platform/UUID.cpp b/Source/WebCore/platform/UUID.cpp
index 7f59081..fce0645 100644
--- a/Source/WebCore/platform/UUID.cpp
+++ b/Source/WebCore/platform/UUID.cpp
@@ -44,6 +44,7 @@
 #elif OS(LINUX) && !PLATFORM(CHROMIUM)
 #include <stdio.h>
 #elif (OS(LINUX) && PLATFORM(CHROMIUM)) || (OS(DARWIN) && !USE(CF))
+#include <wtf/HexNumber.h>
 #include <wtf/RandomNumber.h>
 #include <wtf/text/StringBuilder.h>
 #endif
@@ -100,17 +101,18 @@ String createCanonicalUUIDString()
 
     // Format as Version 4 UUID.
     StringBuilder builder;
-    builder.append(String::format("%08x", randomData[0]));
+    appendUnsignedAsHexFixedSize(randomData[0], builder, 8, Lowercase);
     builder.append("-");
-    builder.append(String::format("%04x", randomData[1] >> 16));
+    appendUnsignedAsHexFixedSize(randomData[1] >> 16, builder, 4, Lowercase);
     builder.append("-4");
-    builder.append(String::format("%03x", randomData[1] & 0x00000fff));
+    appendUnsignedAsHexFixedSize(randomData[1] & 0x00000fff, builder, 3, Lowercase);
     builder.append("-");
-    builder.append(String::format("%x", (randomData[2] >> 30) | 0x8)); // Condense this byte to 8, 9, a, and b.
-    builder.append(String::format("%03x", (randomData[2] >> 16) & 0x00000fff));
+    appendUnsignedAsHexFixedSize((randomData[2] >> 30) | 0x8, builder, 1, Lowercase);
+    appendUnsignedAsHexFixedSize((randomData[2] >> 16) & 0x00000fff, builder, 3, Lowercase);
     builder.append("-");
-    builder.append(String::format("%04x", randomData[2] & 0x0000ffff));
-    builder.append(String::format("%08x", randomData[3]));
+    appendUnsignedAsHexFixedSize(randomData[2] & 0x0000ffff, builder, 4, Lowercase);
+    appendUnsignedAsHexFixedSize(randomData[3], builder, 8, Lowercase);
+    builder.append("\n");
     return builder.toString();
 #else
     notImplemented();
diff --git a/Source/WebCore/platform/android/FileSystemAndroid.cpp b/Source/WebCore/platform/android/FileSystemAndroid.cpp
index 9ed43f0..30dc1d3 100644
--- a/Source/WebCore/platform/android/FileSystemAndroid.cpp
+++ b/Source/WebCore/platform/android/FileSystemAndroid.cpp
@@ -55,26 +55,25 @@ CString fileSystemRepresentation(const String& path)
     return path.utf8();
 }
 
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
+String openTemporaryFile(const String& prefix, PlatformFileHandle& handle)
 {
     int number = rand() % 10000 + 1;
-    CString filename;
+    String filename;
     do {
         StringBuilder builder;
         builder.append(sPluginPath);
         builder.append('/');
         builder.append(prefix);
         builder.append(String::number(number));
-        filename = builder.toString().utf8();
-        const char* fstr = filename.data();
-        handle = open(filename.data(), O_WRONLY | O_CREAT | O_EXCL, S_IRUSR | S_IWUSR);
+        filename = builder.toString();
+        handle = open(filename.utf8().data(), O_WRONLY | O_CREAT | O_EXCL, S_IRUSR | S_IWUSR);
         number++;
         
         if (handle != -1)
             return filename;
     } while (errno == EEXIST);
     
-    return CString();
+    return String();
 }
 
 bool unloadModule(PlatformModule module)
diff --git a/Source/WebCore/platform/android/LocalizedStringsAndroid.cpp b/Source/WebCore/platform/android/LocalizedStringsAndroid.cpp
index 5a96cf6..e5a733a 100644
--- a/Source/WebCore/platform/android/LocalizedStringsAndroid.cpp
+++ b/Source/WebCore/platform/android/LocalizedStringsAndroid.cpp
@@ -230,7 +230,7 @@ String contextMenuItemTagSearchWeb()
     return String();
 }
 
-String contextMenuItemTagLookUpInDictionary()
+String contextMenuItemTagLookUpInDictionary(const String&)
 {
     notImplemented();
     return String();
diff --git a/Source/WebCore/platform/audio/AudioBus.cpp b/Source/WebCore/platform/audio/AudioBus.cpp
index dd4746d..6f74471 100644
--- a/Source/WebCore/platform/audio/AudioBus.cpp
+++ b/Source/WebCore/platform/audio/AudioBus.cpp
@@ -32,6 +32,9 @@
 
 #include "AudioBus.h"
 
+#if !PLATFORM(MAC)
+#include "SincResampler.h"
+#endif
 #include "VectorMath.h"
 #include <algorithm>
 #include <assert.h>
@@ -360,6 +363,90 @@ void AudioBus::sumWithGainFrom(const AudioBus &sourceBus, double* lastMixGain, d
     processWithGainFrom(sourceBus, lastMixGain, targetGain, true);
 }
 
+#if !PLATFORM(MAC)
+PassOwnPtr<AudioBus> AudioBus::createBySampleRateConverting(AudioBus* sourceBus, bool mixToMono, double newSampleRate)
+{
+    // sourceBus's sample-rate must be known.
+    ASSERT(sourceBus && sourceBus->sampleRate());
+    if (!sourceBus || !sourceBus->sampleRate())
+        return 0;
+
+    double sourceSampleRate = sourceBus->sampleRate();
+    double destinationSampleRate = newSampleRate;
+    unsigned numberOfSourceChannels = sourceBus->numberOfChannels();
+
+    if (numberOfSourceChannels == 1)
+        mixToMono = false; // already mono
+        
+    if (sourceSampleRate == destinationSampleRate) {
+        // No sample-rate conversion is necessary.
+        if (mixToMono)
+            return AudioBus::createByMixingToMono(sourceBus);
+
+        // Return exact copy.
+        return AudioBus::createBufferFromRange(sourceBus, 0, sourceBus->length());
+    }
+    
+    // First, mix to mono (if necessary) then sample-rate convert.
+    AudioBus* resamplerSourceBus;
+    OwnPtr<AudioBus> mixedMonoBus;
+    if (mixToMono) {
+        mixedMonoBus = AudioBus::createByMixingToMono(sourceBus);
+        resamplerSourceBus = mixedMonoBus.get();
+    } else {
+        // Directly resample without down-mixing.
+        resamplerSourceBus = sourceBus;
+    }
+
+    // Calculate destination length based on the sample-rates.
+    double sampleRateRatio = sourceSampleRate / destinationSampleRate;
+    int sourceLength = resamplerSourceBus->length();
+    int destinationLength = sourceLength / sampleRateRatio;
+
+    // Create destination bus with same number of channels.
+    unsigned numberOfDestinationChannels = resamplerSourceBus->numberOfChannels();
+    OwnPtr<AudioBus> destinationBus(adoptPtr(new AudioBus(numberOfDestinationChannels, destinationLength)));
+
+    // Sample-rate convert each channel.
+    for (unsigned i = 0; i < numberOfDestinationChannels; ++i) {
+        float* source = resamplerSourceBus->channel(i)->data();
+        float* destination = destinationBus->channel(i)->data();
+
+        SincResampler resampler(sampleRateRatio);
+        resampler.process(source, destination, sourceLength);
+    }
+
+    return destinationBus.release();
+}
+#endif // !PLATFORM(MAC)
+
+PassOwnPtr<AudioBus> AudioBus::createByMixingToMono(AudioBus* sourceBus)
+{
+    switch (sourceBus->numberOfChannels()) {
+    case 1:
+        // Simply create an exact copy.
+        return AudioBus::createBufferFromRange(sourceBus, 0, sourceBus->length());
+    case 2:
+        {
+            unsigned n = sourceBus->length();
+            OwnPtr<AudioBus> destinationBus(adoptPtr(new AudioBus(1, n)));
+
+            float* sourceL = sourceBus->channel(0)->data();
+            float* sourceR = sourceBus->channel(1)->data();
+            float* destination = destinationBus->channel(0)->data();
+        
+            // Do the mono mixdown.
+            for (unsigned i = 0; i < n; ++i)
+                destination[i] = 0.5 * (sourceL[i] + sourceR[i]);
+
+            return destinationBus.release();
+        }
+    }
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
 } // WebCore
 
 #endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/platform/audio/AudioBus.h b/Source/WebCore/platform/audio/AudioBus.h
index 888f6bf..1943c0d 100644
--- a/Source/WebCore/platform/audio/AudioBus.h
+++ b/Source/WebCore/platform/audio/AudioBus.h
@@ -89,6 +89,18 @@ public:
     // 0 may be returned if the range does not fit in the sourceBuffer
     static PassOwnPtr<AudioBus> createBufferFromRange(AudioBus* sourceBuffer, unsigned startFrame, unsigned endFrame);
 
+
+#if !PLATFORM(MAC)
+    // Creates a new AudioBus by sample-rate converting sourceBus to the newSampleRate.
+    // setSampleRate() must have been previously called on sourceBus.
+    // Note: sample-rate conversion is already handled in the file-reading code for the mac port, so we don't need this.
+    static PassOwnPtr<AudioBus> createBySampleRateConverting(AudioBus* sourceBus, bool mixToMono, double newSampleRate);
+#endif
+
+    // Creates a new AudioBus by mixing all the channels down to mono.
+    // If sourceBus is already mono, then the returned AudioBus will simply be a copy.
+    static PassOwnPtr<AudioBus> createByMixingToMono(AudioBus* sourceBus);
+
     // Scales all samples by the same amount.
     void scale(double scale);
 
diff --git a/Source/WebCore/platform/audio/HRTFKernel.cpp b/Source/WebCore/platform/audio/HRTFKernel.cpp
index 22d4b12..9db35ba 100644
--- a/Source/WebCore/platform/audio/HRTFKernel.cpp
+++ b/Source/WebCore/platform/audio/HRTFKernel.cpp
@@ -45,17 +45,18 @@ namespace WebCore {
 // This represents the initial delay before the most energetic part of the impulse response.
 // The sample-frame delay is removed from the impulseP impulse response, and this value  is returned.
 // the length of the passed in AudioChannel must be a power of 2.
-static double extractAverageGroupDelay(AudioChannel* channel)
+static double extractAverageGroupDelay(AudioChannel* channel, size_t analysisFFTSize)
 {
     ASSERT(channel);
         
     float* impulseP = channel->data();
-    size_t length = channel->length();
     
-    // Check that length is power-of-2;
-    ASSERT(1UL << static_cast<unsigned>(log2(length)) == length);
+    ASSERT(channel->length() >= analysisFFTSize);
+    
+    // Check for power-of-2.
+    ASSERT(1UL << static_cast<unsigned>(log2(analysisFFTSize)) == analysisFFTSize);
 
-    FFTFrame estimationFrame(length);
+    FFTFrame estimationFrame(analysisFFTSize);
     estimationFrame.doFFT(impulseP);
 
     double frameDelay = estimationFrame.extractAverageGroupDelay();
@@ -71,7 +72,7 @@ HRTFKernel::HRTFKernel(AudioChannel* channel, size_t fftSize, double sampleRate,
     ASSERT(channel);
 
     // Determine the leading delay (average group delay) for the response.
-    m_frameDelay = extractAverageGroupDelay(channel);
+    m_frameDelay = extractAverageGroupDelay(channel, fftSize / 2);
 
     float* impulseResponse = channel->data();
     size_t responseLength = channel->length();
diff --git a/Source/WebCore/platform/audio/SincResampler.cpp b/Source/WebCore/platform/audio/SincResampler.cpp
new file mode 100644
index 0000000..e6f34b4
--- /dev/null
+++ b/Source/WebCore/platform/audio/SincResampler.cpp
@@ -0,0 +1,342 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "SincResampler.h"
+
+#include <wtf/MathExtras.h>
+
+using namespace std;
+
+// Input buffer layout, dividing the total buffer into regions (r0 - r5):
+//
+// |----------------|----------------------------------------------------------------|----------------|
+//
+//                                              blockSize + kernelSize / 2                           
+//                   <-------------------------------------------------------------------------------->
+//                                                  r0
+//
+//   kernelSize / 2   kernelSize / 2                                 kernelSize / 2     kernelSize / 2 
+// <---------------> <--------------->                              <---------------> <--------------->
+//         r1                r2                                             r3                r4
+// 
+//                                              blockSize                           
+//                                     <-------------------------------------------------------------->
+//                                                  r5
+
+// The Algorithm:
+//
+// 1) Consume input frames into r0 (r1 is zero-initialized).
+// 2) Position kernel centered at start of r0 (r2) and generate output frames until kernel is centered at start of r4.
+//    or we've finished generating all the output frames.
+// 3) Copy r3 to r1 and r4 to r2.
+// 4) Consume input frames into r5 (zero-pad if we run out of input).
+// 5) Goto (2) until all of input is consumed.
+//
+// note: we're glossing over how the sub-sample handling works with m_virtualSourceIndex, etc.
+
+namespace WebCore {
+
+SincResampler::SincResampler(double scaleFactor, unsigned kernelSize, unsigned numberOfKernelOffsets)
+    : m_scaleFactor(scaleFactor)
+    , m_kernelSize(kernelSize)
+    , m_numberOfKernelOffsets(numberOfKernelOffsets)
+    , m_kernelStorage(m_kernelSize * (m_numberOfKernelOffsets + 1))
+    , m_virtualSourceIndex(0.0)
+    , m_blockSize(512)
+    , m_inputBuffer(m_blockSize + m_kernelSize) // See input buffer layout above.
+    , m_source(0)
+    , m_sourceFramesAvailable(0)
+{
+    initializeKernel();
+}
+
+void SincResampler::initializeKernel()
+{
+    // Blackman window parameters.
+    double alpha = 0.16;
+    double a0 = 0.5 * (1.0 - alpha);
+    double a1 = 0.5;
+    double a2 = 0.5 * alpha;
+
+    // sincScaleFactor is basically the normalized cutoff frequency of the low-pass filter.
+    double sincScaleFactor = m_scaleFactor > 1.0 ? 1.0 / m_scaleFactor : 1.0;
+
+    // The sinc function is an idealized brick-wall filter, but since we're windowing it the
+    // transition from pass to stop does not happen right away. So we should adjust the
+    // lowpass filter cutoff slightly downward to avoid some aliasing at the very high-end.
+    // FIXME: this value is empirical and to be more exact should vary depending on m_kernelSize.
+    sincScaleFactor *= 0.9;
+
+    int n = m_kernelSize;
+    int halfSize = n / 2;
+
+    // Generates a set of windowed sinc() kernels.
+    // We generate a range of sub-sample offsets from 0.0 to 1.0.
+    for (unsigned offsetIndex = 0; offsetIndex <= m_numberOfKernelOffsets; ++offsetIndex) {
+        double subsampleOffset = static_cast<double>(offsetIndex) / m_numberOfKernelOffsets;
+
+        for (int i = 0; i < n; ++i) {
+            // Compute the sinc() with offset.
+            double s = sincScaleFactor * piDouble * (i - halfSize - subsampleOffset);
+            double sinc = !s ? 1.0 : sin(s) / s;
+            sinc *= sincScaleFactor;
+
+            // Compute Blackman window, matching the offset of the sinc().
+            double x = (i - subsampleOffset) / n;
+            double window = a0 - a1 * cos(2.0 * piDouble * x) + a2 * cos(4.0 * piDouble * x);
+
+            // Window the sinc() function and store at the correct offset.
+            m_kernelStorage[i + offsetIndex * m_kernelSize] = sinc * window;
+        }
+    }
+}
+
+void SincResampler::consumeSource(float* buffer, unsigned numberOfSourceFrames)
+{
+    ASSERT(m_source);
+    if (!m_source)
+        return;
+    
+    // Clamp to number of frames available and zero-pad.
+    unsigned framesToCopy = min(m_sourceFramesAvailable, numberOfSourceFrames);
+    memcpy(buffer, m_source, sizeof(float) * framesToCopy);
+    
+    // Zero-pad if necessary.
+    if (framesToCopy < numberOfSourceFrames)
+        memset(buffer + framesToCopy, 0, sizeof(float) * (numberOfSourceFrames - framesToCopy));
+    
+    m_sourceFramesAvailable -= framesToCopy;
+    m_source += numberOfSourceFrames;
+}
+
+void SincResampler::process(float* source, float* destination, unsigned numberOfSourceFrames)
+{
+    ASSERT(m_blockSize > m_kernelSize);
+    ASSERT(m_inputBuffer.size() >= m_blockSize + m_kernelSize);
+    ASSERT(!(m_kernelSize % 2));
+    
+    // Setup various region pointers in the buffer (see diagram above).
+    float* r0 = m_inputBuffer.data() + m_kernelSize / 2;
+    float* r1 = m_inputBuffer.data();
+    float* r2 = r0;
+    float* r3 = r0 + m_blockSize - m_kernelSize / 2;
+    float* r4 = r0 + m_blockSize;
+    float* r5 = r0 + m_kernelSize / 2;
+
+    m_source = source;
+    m_sourceFramesAvailable = numberOfSourceFrames;
+
+    unsigned numberOfDestinationFrames = static_cast<unsigned>(numberOfSourceFrames / m_scaleFactor);
+
+    // Step (1)
+    // Prime the input buffer.
+    consumeSource(r0, m_blockSize + m_kernelSize / 2);
+    
+    // Step (2)
+    m_virtualSourceIndex = 0;
+
+    while (numberOfDestinationFrames) {
+        while (m_virtualSourceIndex < m_blockSize) {
+            // m_virtualSourceIndex lies in between two kernel offsets so figure out what they are.
+            int sourceIndexI = static_cast<int>(m_virtualSourceIndex);
+            double subsampleRemainder = m_virtualSourceIndex - sourceIndexI;
+
+            double virtualOffsetIndex = subsampleRemainder * m_numberOfKernelOffsets;
+            int offsetIndex = static_cast<int>(virtualOffsetIndex);
+            
+            float* k1 = m_kernelStorage.data() + offsetIndex * m_kernelSize;
+            float* k2 = k1 + m_kernelSize;
+
+            // Initialize input pointer based on quantized m_virtualSourceIndex.
+            float* inputP = r1 + sourceIndexI;
+
+            // We'll compute "convolutions" for the two kernels which straddle m_virtualSourceIndex
+            float sum1 = 0;
+            float sum2 = 0;
+
+            // Figure out how much to weight each kernel's "convolution".
+            double kernelInterpolationFactor = virtualOffsetIndex - offsetIndex;
+
+            // Generate a single output sample. 
+            int n = m_kernelSize;
+
+            // FIXME: add SIMD optimizations for the following. The scalar code-path can probably also be optimized better.
+
+#define CONVOLVE_ONE_SAMPLE      \
+            input = *inputP++;   \
+            sum1 += input * *k1; \
+            sum2 += input * *k2; \
+            ++k1;                \
+            ++k2;
+
+            {
+                float input;
+                
+                // Optimize size 32 and size 64 kernels by unrolling the while loop.
+                // A 20 - 30% speed improvement was measured in some cases by using this approach.
+                
+                if (n == 32) {
+                    CONVOLVE_ONE_SAMPLE // 1
+                    CONVOLVE_ONE_SAMPLE // 2
+                    CONVOLVE_ONE_SAMPLE // 3
+                    CONVOLVE_ONE_SAMPLE // 4
+                    CONVOLVE_ONE_SAMPLE // 5
+                    CONVOLVE_ONE_SAMPLE // 6
+                    CONVOLVE_ONE_SAMPLE // 7
+                    CONVOLVE_ONE_SAMPLE // 8
+                    CONVOLVE_ONE_SAMPLE // 9
+                    CONVOLVE_ONE_SAMPLE // 10
+                    CONVOLVE_ONE_SAMPLE // 11
+                    CONVOLVE_ONE_SAMPLE // 12
+                    CONVOLVE_ONE_SAMPLE // 13
+                    CONVOLVE_ONE_SAMPLE // 14
+                    CONVOLVE_ONE_SAMPLE // 15
+                    CONVOLVE_ONE_SAMPLE // 16
+                    CONVOLVE_ONE_SAMPLE // 17
+                    CONVOLVE_ONE_SAMPLE // 18
+                    CONVOLVE_ONE_SAMPLE // 19
+                    CONVOLVE_ONE_SAMPLE // 20
+                    CONVOLVE_ONE_SAMPLE // 21
+                    CONVOLVE_ONE_SAMPLE // 22
+                    CONVOLVE_ONE_SAMPLE // 23
+                    CONVOLVE_ONE_SAMPLE // 24
+                    CONVOLVE_ONE_SAMPLE // 25
+                    CONVOLVE_ONE_SAMPLE // 26
+                    CONVOLVE_ONE_SAMPLE // 27
+                    CONVOLVE_ONE_SAMPLE // 28
+                    CONVOLVE_ONE_SAMPLE // 29
+                    CONVOLVE_ONE_SAMPLE // 30
+                    CONVOLVE_ONE_SAMPLE // 31
+                    CONVOLVE_ONE_SAMPLE // 32
+                } else if (n == 64) {
+                    CONVOLVE_ONE_SAMPLE // 1
+                    CONVOLVE_ONE_SAMPLE // 2
+                    CONVOLVE_ONE_SAMPLE // 3
+                    CONVOLVE_ONE_SAMPLE // 4
+                    CONVOLVE_ONE_SAMPLE // 5
+                    CONVOLVE_ONE_SAMPLE // 6
+                    CONVOLVE_ONE_SAMPLE // 7
+                    CONVOLVE_ONE_SAMPLE // 8
+                    CONVOLVE_ONE_SAMPLE // 9
+                    CONVOLVE_ONE_SAMPLE // 10
+                    CONVOLVE_ONE_SAMPLE // 11
+                    CONVOLVE_ONE_SAMPLE // 12
+                    CONVOLVE_ONE_SAMPLE // 13
+                    CONVOLVE_ONE_SAMPLE // 14
+                    CONVOLVE_ONE_SAMPLE // 15
+                    CONVOLVE_ONE_SAMPLE // 16
+                    CONVOLVE_ONE_SAMPLE // 17
+                    CONVOLVE_ONE_SAMPLE // 18
+                    CONVOLVE_ONE_SAMPLE // 19
+                    CONVOLVE_ONE_SAMPLE // 20
+                    CONVOLVE_ONE_SAMPLE // 21
+                    CONVOLVE_ONE_SAMPLE // 22
+                    CONVOLVE_ONE_SAMPLE // 23
+                    CONVOLVE_ONE_SAMPLE // 24
+                    CONVOLVE_ONE_SAMPLE // 25
+                    CONVOLVE_ONE_SAMPLE // 26
+                    CONVOLVE_ONE_SAMPLE // 27
+                    CONVOLVE_ONE_SAMPLE // 28
+                    CONVOLVE_ONE_SAMPLE // 29
+                    CONVOLVE_ONE_SAMPLE // 30
+                    CONVOLVE_ONE_SAMPLE // 31
+                    CONVOLVE_ONE_SAMPLE // 32
+                    CONVOLVE_ONE_SAMPLE // 33
+                    CONVOLVE_ONE_SAMPLE // 34
+                    CONVOLVE_ONE_SAMPLE // 35
+                    CONVOLVE_ONE_SAMPLE // 36
+                    CONVOLVE_ONE_SAMPLE // 37
+                    CONVOLVE_ONE_SAMPLE // 38
+                    CONVOLVE_ONE_SAMPLE // 39
+                    CONVOLVE_ONE_SAMPLE // 40
+                    CONVOLVE_ONE_SAMPLE // 41
+                    CONVOLVE_ONE_SAMPLE // 42
+                    CONVOLVE_ONE_SAMPLE // 43
+                    CONVOLVE_ONE_SAMPLE // 44
+                    CONVOLVE_ONE_SAMPLE // 45
+                    CONVOLVE_ONE_SAMPLE // 46
+                    CONVOLVE_ONE_SAMPLE // 47
+                    CONVOLVE_ONE_SAMPLE // 48
+                    CONVOLVE_ONE_SAMPLE // 49
+                    CONVOLVE_ONE_SAMPLE // 50
+                    CONVOLVE_ONE_SAMPLE // 51
+                    CONVOLVE_ONE_SAMPLE // 52
+                    CONVOLVE_ONE_SAMPLE // 53
+                    CONVOLVE_ONE_SAMPLE // 54
+                    CONVOLVE_ONE_SAMPLE // 55
+                    CONVOLVE_ONE_SAMPLE // 56
+                    CONVOLVE_ONE_SAMPLE // 57
+                    CONVOLVE_ONE_SAMPLE // 58
+                    CONVOLVE_ONE_SAMPLE // 59
+                    CONVOLVE_ONE_SAMPLE // 60
+                    CONVOLVE_ONE_SAMPLE // 61
+                    CONVOLVE_ONE_SAMPLE // 62
+                    CONVOLVE_ONE_SAMPLE // 63
+                    CONVOLVE_ONE_SAMPLE // 64
+                } else {
+                    while (n--) {
+                        // Non-optimized using actual while loop.
+                        CONVOLVE_ONE_SAMPLE
+                    }
+                }
+            }
+
+            // Linearly interpolate the two "convolutions".
+            double result = (1.0 - kernelInterpolationFactor) * sum1 + kernelInterpolationFactor * sum2;
+
+            *destination++ = result;
+
+            --numberOfDestinationFrames;
+            if (!numberOfDestinationFrames)
+                return;
+
+            // Advance the virtual index.
+            m_virtualSourceIndex += m_scaleFactor;
+        }
+
+        // Wrap back around to the start.
+        m_virtualSourceIndex -= m_blockSize;
+
+        // Step (3) Copy r3 to r1 and r4 to r2.
+        // This wraps the last input frames back to the start of the buffer.
+        memcpy(r1, r3, sizeof(float) * (m_kernelSize / 2));
+        memcpy(r2, r4, sizeof(float) * (m_kernelSize / 2));
+
+        // Step (4)
+        // Refresh the buffer with more input.
+        consumeSource(r5, m_blockSize);
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/Source/WebCore/platform/audio/SincResampler.h b/Source/WebCore/platform/audio/SincResampler.h
new file mode 100644
index 0000000..92adb95
--- /dev/null
+++ b/Source/WebCore/platform/audio/SincResampler.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SincResampler_h
+#define SincResampler_h
+
+#include "AudioArray.h"
+
+namespace WebCore {
+
+// SincResampler is a high-quality sample-rate converter.
+
+class SincResampler {
+public:   
+    // scaleFactor == sourceSampleRate / destinationSampleRate
+    // kernelSize can be adjusted for quality (higher is better)
+    // numberOfKernelOffsets is used for interpolation and is the number of sub-sample kernel shifts.
+    SincResampler(double scaleFactor, unsigned kernelSize = 64, unsigned numberOfKernelOffsets = 32);
+    
+    // Processes numberOfSourceFrames from source to produce numberOfSourceFrames / scaleFactor frames in destination.
+    void process(float* source, float* destination, unsigned numberOfSourceFrames);
+    
+    // FIXME: we can add a process() method which takes an input source callback function for streaming applications
+    // where the entire input buffer is not all available.
+    
+protected:
+    void initializeKernel();
+    void consumeSource(float* buffer, unsigned numberOfSourceFrames);
+    
+    double m_scaleFactor;
+    unsigned m_kernelSize;
+    unsigned m_numberOfKernelOffsets;
+
+    // m_kernelStorage has m_numberOfKernelOffsets kernels back-to-back, each of size m_kernelSize.
+    // The kernel offsets are sub-sample shifts of a windowed sinc() shifted from 0.0 to 1.0 sample.
+    AudioFloatArray m_kernelStorage;
+    
+    // m_virtualSourceIndex is an index on the source input buffer with sub-sample precision.
+    // It must be double precision to avoid drift.
+    double m_virtualSourceIndex;
+    
+    // This is the number of destination frames we generate per processing pass on the buffer.
+    unsigned m_blockSize;
+
+    // Source is copied into this buffer for each processing pass.
+    AudioFloatArray m_inputBuffer;
+
+    float* m_source;
+    unsigned m_sourceFramesAvailable;
+};
+
+} // namespace WebCore
+
+#endif // SincResampler_h
diff --git a/Source/WebCore/platform/audio/chromium/AudioBusChromium.cpp b/Source/WebCore/platform/audio/chromium/AudioBusChromium.cpp
index de44b1c..f34dc77 100644
--- a/Source/WebCore/platform/audio/chromium/AudioBusChromium.cpp
+++ b/Source/WebCore/platform/audio/chromium/AudioBusChromium.cpp
@@ -36,22 +36,30 @@ namespace WebCore {
 
 PassOwnPtr<AudioBus> AudioBus::loadPlatformResource(const char* name, double sampleRate)
 {
-    return PlatformBridge::loadPlatformAudioResource(name, sampleRate);
+    // FIXME: the sampleRate parameter is ignored. It should be removed from the API.
+    OwnPtr<AudioBus> audioBus = PlatformBridge::loadPlatformAudioResource(name, sampleRate);
+    if (!audioBus.get())
+        return 0;
+    
+    // If the bus is already at the requested sample-rate then return as is.
+    if (audioBus->sampleRate() == sampleRate)
+        return audioBus.release();
+    
+    return AudioBus::createBySampleRateConverting(audioBus.get(), false, sampleRate);
 }
 
 PassOwnPtr<AudioBus> createBusFromInMemoryAudioFile(const void* data, size_t dataSize, bool mixToMono, double sampleRate)
 {
+    // FIXME: the sampleRate parameter is ignored. It should be removed from the API.
     OwnPtr<AudioBus> audioBus = PlatformBridge::decodeAudioFileData(static_cast<const char*>(data), dataSize, sampleRate);
-    if (audioBus.get() && audioBus->numberOfChannels() == 2 && mixToMono) {
-        OwnPtr<AudioBus> monoAudioBus = adoptPtr(new AudioBus(1, audioBus->length()));
-
-        // FIXME: AudioBus::copyFrom() should be able to do a downmix to mono.
-        // for now simply copy the left channel.
-        monoAudioBus->channel(0)->copyFrom(audioBus->channel(0));
-        return monoAudioBus.release();
-    }
+    if (!audioBus.get())
+      return 0;
+      
+    // If the bus needs no conversion then return as is.
+    if ((!mixToMono || audioBus->numberOfChannels() == 1) && audioBus->sampleRate() == sampleRate)
+        return audioBus.release();
     
-    return audioBus.release();
+    return AudioBus::createBySampleRateConverting(audioBus.get(), mixToMono, sampleRate);    
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/audio/mac/AudioDestinationMac.cpp b/Source/WebCore/platform/audio/mac/AudioDestinationMac.cpp
index 523729f..d4ecaba 100644
--- a/Source/WebCore/platform/audio/mac/AudioDestinationMac.cpp
+++ b/Source/WebCore/platform/audio/mac/AudioDestinationMac.cpp
@@ -51,8 +51,8 @@ double AudioDestination::hardwareSampleRate()
     AudioDeviceID deviceID = kAudioDeviceUnknown;
     UInt32 infoSize = sizeof(deviceID);
 
-    AudioObjectPropertyAddress defaultInputDeviceAddress = { kAudioHardwarePropertyDefaultInputDevice, kAudioObjectPropertyScopeGlobal, kAudioObjectPropertyElementMaster };
-    OSStatus result = AudioObjectGetPropertyData(kAudioObjectSystemObject, &defaultInputDeviceAddress, 0, 0, &infoSize, (void*)&deviceID);
+    AudioObjectPropertyAddress defaultOutputDeviceAddress = { kAudioHardwarePropertyDefaultOutputDevice, kAudioObjectPropertyScopeGlobal, kAudioObjectPropertyElementMaster };
+    OSStatus result = AudioObjectGetPropertyData(kAudioObjectSystemObject, &defaultOutputDeviceAddress, 0, 0, &infoSize, (void*)&deviceID);
     if (result)
         return 0.0; // error
 
diff --git a/Source/WebCore/platform/brew/FileSystemBrew.cpp b/Source/WebCore/platform/brew/FileSystemBrew.cpp
index 61d568d..251c004 100644
--- a/Source/WebCore/platform/brew/FileSystemBrew.cpp
+++ b/Source/WebCore/platform/brew/FileSystemBrew.cpp
@@ -186,7 +186,7 @@ String directoryName(const String& path)
     return dirName;
 }
 
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
+String openTemporaryFile(const String& prefix, PlatformFileHandle& handle)
 {
     // BREW does not have a system-wide temporary directory,
     // use "fs:/~/tmp" as our temporary directory.
@@ -199,24 +199,24 @@ CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
 
     // Loop until we find a temporary filename that does not exist.
     int number = static_cast<int>(randomNumber() * 10000);
-    CString filename;
+    String filename;
     do {
         StringBuilder builder;
         builder.append(tempPath);
         builder.append('/');
         builder.append(prefix);
         builder.append(String::number(number));
-        filename = builder.toString().utf8();
+        filename = builder.toString();
         number++;
-    } while (IFILEMGR_Test(fileMgr.get(), filename.data()) == SUCCESS);
+    } while (IFILEMGR_Test(fileMgr.get(), filename.utf8().data()) == SUCCESS);
 
-    IFile* tempFile = IFILEMGR_OpenFile(fileMgr.get(), filename.data(), _OFM_CREATE);
+    IFile* tempFile = IFILEMGR_OpenFile(fileMgr.get(), filename.utf8().data(), _OFM_CREATE);
     if (tempFile) {
         handle = tempFile;
         return filename;
     }
 
-    return CString();
+    return String();
 }
 
 void closeFile(PlatformFileHandle& handle)
diff --git a/Source/WebCore/platform/brew/LocalizedStringsBrew.cpp b/Source/WebCore/platform/brew/LocalizedStringsBrew.cpp
index c4dac1a..ba5d4a9 100644
--- a/Source/WebCore/platform/brew/LocalizedStringsBrew.cpp
+++ b/Source/WebCore/platform/brew/LocalizedStringsBrew.cpp
@@ -206,7 +206,7 @@ String contextMenuItemTagSearchWeb()
     return "Search web";
 }
 
-String contextMenuItemTagLookUpInDictionary()
+String contextMenuItemTagLookUpInDictionary(const String&)
 {
     return "Lookup in dictionary";
 }
diff --git a/Source/WebCore/platform/cf/BinaryPropertyList.cpp b/Source/WebCore/platform/cf/BinaryPropertyList.cpp
index 41769e8..65be70a 100644
--- a/Source/WebCore/platform/cf/BinaryPropertyList.cpp
+++ b/Source/WebCore/platform/cf/BinaryPropertyList.cpp
@@ -92,7 +92,7 @@ struct IntegerArrayHash {
 
 unsigned IntegerArrayHash::hash(const IntegerArray& array)
 {
-    return WTF::StringHasher::createBlobHash(array.integers(), array.size());
+    return StringHasher::hashMemory(array.integers(), array.size() * sizeof(int));
 }
 
 bool IntegerArrayHash::equal(const IntegerArray& a, const IntegerArray& b)
diff --git a/Source/WebCore/platform/cf/SchedulePair.h b/Source/WebCore/platform/cf/SchedulePair.h
index 8361856..cb34d7d 100644
--- a/Source/WebCore/platform/cf/SchedulePair.h
+++ b/Source/WebCore/platform/cf/SchedulePair.h
@@ -73,7 +73,7 @@ struct SchedulePairHash {
     static unsigned hash(const RefPtr<SchedulePair>& pair)
     {
         uintptr_t hashCodes[2] = { reinterpret_cast<uintptr_t>(pair->runLoop()), pair->mode() ? CFHash(pair->mode()) : 0 };
-        return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+        return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
     }
 
     static bool equal(const RefPtr<SchedulePair>& a, const RefPtr<SchedulePair>& b) { return a == b; }
diff --git a/Source/WebCore/platform/cf/SharedBufferCF.cpp b/Source/WebCore/platform/cf/SharedBufferCF.cpp
index 18a65c2..319f484 100644
--- a/Source/WebCore/platform/cf/SharedBufferCF.cpp
+++ b/Source/WebCore/platform/cf/SharedBufferCF.cpp
@@ -91,4 +91,30 @@ void SharedBuffer::clearPlatformData()
     m_cfData = 0;
 }
 
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+void SharedBuffer::append(CFDataRef data)
+{
+    ASSERT(data);
+    m_dataArray.append(data);
+    m_size += CFDataGetLength(data);
+}
+
+void SharedBuffer::copyDataArrayAndClear(char *destination, unsigned bytesToCopy) const
+{
+    if (m_dataArray.isEmpty())
+        return;
+
+    CFIndex bytesLeft = bytesToCopy;
+    Vector<RetainPtr<CFDataRef> >::const_iterator end = m_dataArray.end();
+    for (Vector<RetainPtr<CFDataRef> >::const_iterator it = m_dataArray.begin(); it != end; ++it) {
+        CFIndex dataLen = CFDataGetLength(it->get());
+        ASSERT(bytesLeft >= dataLen);
+        memcpy(destination, CFDataGetBytePtr(it->get()), dataLen);
+        destination += dataLen;
+        bytesLeft -= dataLen;
+    }
+    m_dataArray.clear();
+}
+#endif
+
 }
diff --git a/Source/WebCore/platform/cf/win/CertificateCFWin.cpp b/Source/WebCore/platform/cf/win/CertificateCFWin.cpp
new file mode 100644
index 0000000..88ea933
--- /dev/null
+++ b/Source/WebCore/platform/cf/win/CertificateCFWin.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CertificateCFWin.h"
+
+namespace WebCore {
+
+static void deallocCertContext(void* ptr, void* info)
+{
+    if (ptr)
+        CertFreeCertificateContext(static_cast<PCCERT_CONTEXT>(ptr));
+}
+
+static CFAllocatorRef createCertContextDeallocator()
+{
+    CFAllocatorContext allocContext = {
+        0, 0, 0, 0, 0, 0, 0, deallocCertContext, 0
+    };
+    return CFAllocatorCreate(kCFAllocatorDefault, &allocContext);
+}
+
+RetainPtr<CFDataRef> copyCertificateToData(PCCERT_CONTEXT certificate)
+{
+    static CFAllocatorRef certDealloc = createCertContextDeallocator();
+    PCCERT_CONTEXT certificateCopy = CertDuplicateCertificateContext(certificate);
+    return RetainPtr<CFDataRef>(AdoptCF, CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, reinterpret_cast<const UInt8*>(certificateCopy), sizeof(*certificateCopy), certDealloc));
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/cf/win/CertificateCFWin.h b/Source/WebCore/platform/cf/win/CertificateCFWin.h
new file mode 100644
index 0000000..b3ada0d
--- /dev/null
+++ b/Source/WebCore/platform/cf/win/CertificateCFWin.h
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CertificateCFWin_h
+#define CertificateCFWin_h
+
+#include <windows.h>
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+RetainPtr<CFDataRef> copyCertificateToData(PCCERT_CONTEXT);
+
+} // namespace WebCore
+
+#endif // CertificateCFWin_h
diff --git a/Source/WebCore/platform/chromium/ClipboardChromium.cpp b/Source/WebCore/platform/chromium/ClipboardChromium.cpp
index 7e58f03..6756313 100644
--- a/Source/WebCore/platform/chromium/ClipboardChromium.cpp
+++ b/Source/WebCore/platform/chromium/ClipboardChromium.cpp
@@ -31,6 +31,7 @@
 #include "ChromiumDataObject.h"
 #include "ClipboardMimeTypes.h"
 #include "ClipboardUtilitiesChromium.h"
+#include "DataTransferItemsChromium.h"
 #include "Document.h"
 #include "DragData.h"
 #include "Element.h"
@@ -342,4 +343,22 @@ bool ClipboardChromium::hasData()
     return m_dataObject->hasData();
 }
 
+#if ENABLE(DATA_TRANSFER_ITEMS)
+PassRefPtr<DataTransferItems> ClipboardChromium::items()
+{
+    RefPtr<DataTransferItemsChromium> items = DataTransferItemsChromium::create(this, m_frame->document()->scriptExecutionContext());
+
+    if (!m_dataObject)
+        return items;
+
+    if (isForCopyAndPaste() && policy() == ClipboardReadable) {
+        // Iterate through the types and add them.
+        HashSet<String> types = m_dataObject->types();
+        for (HashSet<String>::const_iterator it = types.begin(); it != types.end(); ++it)
+            items->addPasteboardItem(*it);
+    }
+    return items;
+}
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/ClipboardChromium.h b/Source/WebCore/platform/chromium/ClipboardChromium.h
index d30a1c4..61db0a5 100644
--- a/Source/WebCore/platform/chromium/ClipboardChromium.h
+++ b/Source/WebCore/platform/chromium/ClipboardChromium.h
@@ -80,6 +80,10 @@ namespace WebCore {
 
         virtual bool hasData();
 
+#if ENABLE(DATA_TRANSFER_ITEMS)
+        virtual PassRefPtr<DataTransferItems> items();
+#endif
+
     private:
         ClipboardChromium(ClipboardType, PassRefPtr<ChromiumDataObject>, ClipboardAccessPolicy, Frame*);
 
diff --git a/Source/WebCore/platform/chromium/DataTransferItemChromium.cpp b/Source/WebCore/platform/chromium/DataTransferItemChromium.cpp
new file mode 100644
index 0000000..7857336
--- /dev/null
+++ b/Source/WebCore/platform/chromium/DataTransferItemChromium.cpp
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DataTransferItemChromium.h"
+
+#if ENABLE(DATA_TRANSFER_ITEMS)
+
+#include "Clipboard.h"
+#include "ClipboardMimeTypes.h"
+#include "PlatformBridge.h"
+#include "StringCallback.h"
+
+namespace WebCore {
+
+PassRefPtr<DataTransferItemChromium> DataTransferItemChromium::createFromPasteboard(PassRefPtr<Clipboard> owner, ScriptExecutionContext* context, const String& type)
+{
+    if (type == mimeTypeTextPlain || type == mimeTypeTextHTML)
+        return adoptRef(new DataTransferItemChromium(owner, context, PasteboardSource, DataTransferItem::kindString, type, ""));
+    return adoptRef(new DataTransferItemChromium(owner, context, PasteboardSource, DataTransferItem::kindFile, type, ""));
+}
+
+PassRefPtr<DataTransferItemChromium> DataTransferItemChromium::create(PassRefPtr<Clipboard> owner,
+                                                                      ScriptExecutionContext* context,
+                                                                      const String& data,
+                                                                      const String& type)
+{
+    return adoptRef(new DataTransferItemChromium(owner, context, InternalSource, DataTransferItem::kindString, type, data));
+}
+
+DataTransferItemChromium::DataTransferItemChromium(PassRefPtr<Clipboard> owner, ScriptExecutionContext* context, DataSource source, const String& kind, const String& type, const String& data)
+    : m_owner(owner)
+    , m_context(context)
+    , m_source(source)
+    , m_kind(kind)
+    , m_type(type)
+    , m_data(data)
+{
+}
+
+String DataTransferItemChromium::kind() const
+{
+    if (m_owner->policy() == ClipboardNumb)
+        return String();
+    return m_kind;
+}
+
+String DataTransferItemChromium::type() const
+{
+    if (m_owner->policy() == ClipboardNumb)
+        return String();
+    return m_type;
+}
+
+void DataTransferItemChromium::getAsString(PassRefPtr<StringCallback> callback)
+{
+    if ((m_owner->policy() != ClipboardReadable && m_owner->policy() != ClipboardWritable)
+        || m_kind != kindString)
+        return;
+    if (m_source == InternalSource) {
+        callback->scheduleCallback(m_context, m_data);
+        return;
+    }
+    // This is ugly but there's no real alternative.
+    if (m_type == mimeTypeTextPlain) {
+        callback->scheduleCallback(m_context, PlatformBridge::clipboardReadPlainText(PasteboardPrivate::StandardBuffer));
+        return;
+    }
+    if (m_type == mimeTypeTextHTML) {
+        String html;
+        KURL ignoredSourceURL;
+        PlatformBridge::clipboardReadHTML(PasteboardPrivate::StandardBuffer, &html, &ignoredSourceURL);
+        callback->scheduleCallback(m_context, html);
+        return;
+    }
+    ASSERT_NOT_REACHED();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(DATA_TRANSFER_ITEMS)
diff --git a/Source/WebCore/platform/chromium/DataTransferItemChromium.h b/Source/WebCore/platform/chromium/DataTransferItemChromium.h
new file mode 100644
index 0000000..77f74f2
--- /dev/null
+++ b/Source/WebCore/platform/chromium/DataTransferItemChromium.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DataTransferItemChromium_h
+#define DataTransferItemChromium_h
+
+#if ENABLE(DATA_TRANSFER_ITEMS)
+
+#include "DataTransferItem.h"
+#include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class Clipboard;
+class ScriptExecutionContext;
+
+class DataTransferItemChromium : public DataTransferItem {
+public:
+    static PassRefPtr<DataTransferItemChromium> createFromPasteboard(PassRefPtr<Clipboard> owner, ScriptExecutionContext*, const String& type);
+    static PassRefPtr<DataTransferItemChromium> create(PassRefPtr<Clipboard> owner, ScriptExecutionContext*, const String& data, const String& type);
+
+    virtual String kind() const;
+    virtual String type() const;
+
+    virtual void getAsString(PassRefPtr<StringCallback>);
+
+private:
+    enum DataSource {
+        PasteboardSource,
+        InternalSource,
+    };
+
+    DataTransferItemChromium(PassRefPtr<Clipboard> owner, ScriptExecutionContext*, DataSource, const String& kind, const String& type, const String& data);
+
+    const RefPtr<Clipboard> m_owner;
+    ScriptExecutionContext* m_context;
+    const DataSource m_source;
+    const String m_kind;
+    const String m_type;
+    const String m_data;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(DATA_TRANSFER_ITEMS)
+
+#endif // DataTransferItem_h
diff --git a/Source/WebCore/platform/chromium/DataTransferItemsChromium.cpp b/Source/WebCore/platform/chromium/DataTransferItemsChromium.cpp
new file mode 100644
index 0000000..418b8b5
--- /dev/null
+++ b/Source/WebCore/platform/chromium/DataTransferItemsChromium.cpp
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DataTransferItemsChromium.h"
+
+#if ENABLE(DATA_TRANSFER_ITEMS)
+
+#include "Clipboard.h"
+#include "DataTransferItemChromium.h"
+#include "ExceptionCode.h"
+
+namespace WebCore {
+
+PassRefPtr<DataTransferItemsChromium> DataTransferItemsChromium::create(PassRefPtr<Clipboard> owner, ScriptExecutionContext* context)
+{
+    return adoptRef(new DataTransferItemsChromium(owner, context));
+}
+
+DataTransferItemsChromium::DataTransferItemsChromium(PassRefPtr<Clipboard> owner, ScriptExecutionContext* context)
+    : m_owner(owner)
+    , m_context(context)
+{
+}
+
+unsigned long DataTransferItemsChromium::length() const
+{
+    if (m_owner->policy() == ClipboardNumb)
+        return 0;
+    return m_items.size();
+}
+
+PassRefPtr<DataTransferItem> DataTransferItemsChromium::item(unsigned long index) const
+{
+    if (m_owner->policy() == ClipboardNumb || index >= length())
+        return 0;
+    return m_items[index];
+}
+
+void DataTransferItemsChromium::deleteItem(unsigned long index, ExceptionCode& ec)
+{
+    if (m_owner->policy() != ClipboardWritable) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+
+    if (index >= length())
+        return;
+
+    m_items.remove(index);
+}
+
+void DataTransferItemsChromium::clear()
+{
+    if (m_owner->policy() != ClipboardWritable)
+        return;
+
+    m_items.clear();
+}
+
+void DataTransferItemsChromium::add(const String& data, const String& type, ExceptionCode& ec)
+{
+    if (m_owner->policy() != ClipboardWritable)
+        return;
+
+    // Only one 'string' item with a given type is allowed in the collection.
+    for (size_t i = 0; i < m_items.size(); ++i) {
+        if (m_items[i]->type() == type && m_items[i]->kind() == DataTransferItem::kindString) {
+            ec = INVALID_STATE_ERR;
+            return;
+        }
+    }
+
+    m_items.append(DataTransferItemChromium::create(m_owner, m_context, data, type));
+}
+
+void DataTransferItemsChromium::addPasteboardItem(const String& type)
+{
+    m_items.append(DataTransferItemChromium::createFromPasteboard(m_owner, m_context, type));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(DATA_TRANSFER_ITEMS)
diff --git a/Source/WebCore/platform/chromium/DataTransferItemsChromium.h b/Source/WebCore/platform/chromium/DataTransferItemsChromium.h
new file mode 100644
index 0000000..51c4fdb
--- /dev/null
+++ b/Source/WebCore/platform/chromium/DataTransferItemsChromium.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DataTransferItemsChromium_h
+#define DataTransferItemsChromium_h
+
+#if ENABLE(DATA_TRANSFER_ITEMS)
+
+#include "DataTransferItems.h"
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Clipboard;
+class DataTransferItemChromium;
+class ScriptExecutionContext;
+
+typedef int ExceptionCode;
+
+class DataTransferItemsChromium : public DataTransferItems {
+public:
+    static PassRefPtr<DataTransferItemsChromium> create(PassRefPtr<Clipboard>, ScriptExecutionContext*);
+
+    virtual unsigned long length() const;
+    virtual PassRefPtr<DataTransferItem> item(unsigned long index) const;
+    virtual void deleteItem(unsigned long index, ExceptionCode&);
+    virtual void clear();
+
+    virtual void add(const String& data, const String& type, ExceptionCode&);
+
+private:
+    friend class ClipboardChromium;
+
+    DataTransferItemsChromium(PassRefPtr<Clipboard>, ScriptExecutionContext*);
+
+    virtual void addPasteboardItem(const String& type);
+
+    RefPtr<Clipboard> m_owner;
+    // Indirectly owned by our parent.
+    ScriptExecutionContext* m_context;
+    Vector<RefPtr<DataTransferItemChromium> > m_items;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(DATA_TRANSFER_ITEMS)
+
+#endif // DataTransferItemsChromium_h
+
diff --git a/Source/WebCore/platform/chromium/FileSystemChromium.cpp b/Source/WebCore/platform/chromium/FileSystemChromium.cpp
index faf5e92..5e03c5b 100644
--- a/Source/WebCore/platform/chromium/FileSystemChromium.cpp
+++ b/Source/WebCore/platform/chromium/FileSystemChromium.cpp
@@ -112,4 +112,11 @@ int writeToFile(PlatformFileHandle handle, const char* data, int length)
     return PlatformBridge::writeToFile(handle, data, length);
 }
 
+Vector<String> listDirectory(const String& path, const String& filter)
+{
+    notImplemented();
+
+    return Vector<String>();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/PasteboardPrivate.h b/Source/WebCore/platform/chromium/PasteboardPrivate.h
index 1de7fe3..5f167ba 100644
--- a/Source/WebCore/platform/chromium/PasteboardPrivate.h
+++ b/Source/WebCore/platform/chromium/PasteboardPrivate.h
@@ -36,6 +36,7 @@ namespace WebCore {
     class PasteboardPrivate {
     public:
         enum ClipboardFormat {
+            PlainTextFormat,
             HTMLFormat,
             BookmarkFormat,
             WebSmartPasteFormat,
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
index 29e8b44..7229c51 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
@@ -35,7 +35,7 @@
 #include "PlatformContextSkia.h"
 #include "PlatformMouseEvent.h"
 #include "Scrollbar.h"
-#include "WindowsVersion.h"
+#include "SystemInfo.h"
 
 namespace WebCore {
 
@@ -70,7 +70,7 @@ int ScrollbarThemeChromiumWin::scrollbarThickness(ScrollbarControlSize controlSi
 
 bool ScrollbarThemeChromiumWin::invalidateOnMouseEnterExit()
 {
-    return isVistaOrNewer();
+    return windowsVersion() >= WindowsVista;
 }
 
 bool ScrollbarThemeChromiumWin::shouldSnapBackToDragOrigin(Scrollbar* scrollbar, const PlatformMouseEvent& evt)
@@ -160,12 +160,12 @@ int ScrollbarThemeChromiumWin::getThemeState(Scrollbar* scrollbar, ScrollbarPart
     if (scrollbar->pressedPart() == ThumbPart) {
         if (part == ThumbPart)
             return SCRBS_PRESSED;
-        return isVistaOrNewer() ? SCRBS_HOVER : SCRBS_NORMAL;
+        return (windowsVersion() < WindowsVista) ? SCRBS_NORMAL : SCRBS_HOVER;
     }
     if (!scrollbar->enabled())
         return SCRBS_DISABLED;
     if (scrollbar->hoveredPart() != part || part == BackTrackPart || part == ForwardTrackPart)
-        return (scrollbar->hoveredPart() == NoPart || !isVistaOrNewer()) ? SCRBS_NORMAL : SCRBS_HOVER;
+        return (scrollbar->hoveredPart() == NoPart || (windowsVersion() < WindowsVista)) ? SCRBS_NORMAL : SCRBS_HOVER;
     if (scrollbar->pressedPart() == NoPart)
         return SCRBS_HOT;
     return (scrollbar->pressedPart() == part) ? SCRBS_PRESSED : SCRBS_NORMAL;
@@ -179,43 +179,43 @@ int ScrollbarThemeChromiumWin::getThemeArrowState(Scrollbar* scrollbar, Scrollba
     if (part == BackButtonStartPart || part == ForwardButtonStartPart) {
         if (scrollbar->orientation() == HorizontalScrollbar) {
             if (scrollbar->pressedPart() == ThumbPart)
-                return !isVistaOrNewer() ? ABS_LEFTNORMAL : ABS_LEFTHOVER;
+                return (windowsVersion() < WindowsVista) ? ABS_LEFTNORMAL : ABS_LEFTHOVER;
             if (!scrollbar->enabled())
                 return ABS_LEFTDISABLED;
             if (scrollbar->hoveredPart() != part)
-                return ((scrollbar->hoveredPart() == NoPart) || !isVistaOrNewer()) ? ABS_LEFTNORMAL : ABS_LEFTHOVER;
+                return ((scrollbar->hoveredPart() == NoPart) || (windowsVersion() < WindowsVista)) ? ABS_LEFTNORMAL : ABS_LEFTHOVER;
             if (scrollbar->pressedPart() == NoPart)
                 return ABS_LEFTHOT;
             return (scrollbar->pressedPart() == part) ?
                 ABS_LEFTPRESSED : ABS_LEFTNORMAL;
         }
         if (scrollbar->pressedPart() == ThumbPart)
-            return !isVistaOrNewer() ? ABS_UPNORMAL : ABS_UPHOVER;
+            return (windowsVersion() < WindowsVista) ? ABS_UPNORMAL : ABS_UPHOVER;
         if (!scrollbar->enabled())
             return ABS_UPDISABLED;
         if (scrollbar->hoveredPart() != part)
-            return ((scrollbar->hoveredPart() == NoPart) || !isVistaOrNewer()) ? ABS_UPNORMAL : ABS_UPHOVER;
+            return ((scrollbar->hoveredPart() == NoPart) || (windowsVersion() < WindowsVista)) ? ABS_UPNORMAL : ABS_UPHOVER;
         if (scrollbar->pressedPart() == NoPart)
             return ABS_UPHOT;
         return (scrollbar->pressedPart() == part) ? ABS_UPPRESSED : ABS_UPNORMAL;
     }
     if (scrollbar->orientation() == HorizontalScrollbar) {
         if (scrollbar->pressedPart() == ThumbPart)
-            return !isVistaOrNewer() ? ABS_RIGHTNORMAL : ABS_RIGHTHOVER;
+            return (windowsVersion() < WindowsVista) ? ABS_RIGHTNORMAL : ABS_RIGHTHOVER;
         if (!scrollbar->enabled())
             return ABS_RIGHTDISABLED;
         if (scrollbar->hoveredPart() != part)
-            return ((scrollbar->hoveredPart() == NoPart) || !isVistaOrNewer()) ? ABS_RIGHTNORMAL : ABS_RIGHTHOVER;
+            return ((scrollbar->hoveredPart() == NoPart) || (windowsVersion() < WindowsVista)) ? ABS_RIGHTNORMAL : ABS_RIGHTHOVER;
         if (scrollbar->pressedPart() == NoPart)
             return ABS_RIGHTHOT;
         return (scrollbar->pressedPart() == part) ? ABS_RIGHTPRESSED : ABS_RIGHTNORMAL;
     }
     if (scrollbar->pressedPart() == ThumbPart)
-        return !isVistaOrNewer() ? ABS_DOWNNORMAL : ABS_DOWNHOVER;
+        return (windowsVersion() < WindowsVista) ? ABS_DOWNNORMAL : ABS_DOWNHOVER;
     if (!scrollbar->enabled())
         return ABS_DOWNDISABLED;
     if (scrollbar->hoveredPart() != part)
-        return ((scrollbar->hoveredPart() == NoPart) || !isVistaOrNewer()) ? ABS_DOWNNORMAL : ABS_DOWNHOVER;
+        return ((scrollbar->hoveredPart() == NoPart) || (windowsVersion() < WindowsVista)) ? ABS_DOWNNORMAL : ABS_DOWNHOVER;
     if (scrollbar->pressedPart() == NoPart)
         return ABS_DOWNHOT;
     return (scrollbar->pressedPart() == part) ? ABS_DOWNPRESSED : ABS_DOWNNORMAL;
diff --git a/Source/WebCore/platform/chromium/TraceEvent.h b/Source/WebCore/platform/chromium/TraceEvent.h
new file mode 100644
index 0000000..9b92d58
--- /dev/null
+++ b/Source/WebCore/platform/chromium/TraceEvent.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef TraceEvent_h
+#define TraceEvent_h
+
+#include "PlatformBridge.h"
+
+// Implementation detail: trace event macros create temporary variables
+// to keep instrumentation overhead low. These macros give each temporary
+// variable a unique name based on the line number to prevent name collissions.
+#define TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER3(a, b) a##b
+#define TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER2(a, b) TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER3(a, b)
+#define TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER(name_prefix) TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER2(name_prefix, __LINE__)
+
+// Issues PlatformBridge::traceEventBegin and traceEventEnd calls for the enclosing scope
+#define TRACE_EVENT(name, id, extra) WebCore::internal::ScopeTracer TRACE_EVENT_MAKE_UNIQUE_IDENTIFIER(__traceEventScope)(name, id, extra);
+
+namespace WebCore {
+
+namespace internal {
+
+// Used by TRACE_EVENT macro. Do not use directly.
+class ScopeTracer {
+public:
+    ScopeTracer(const char* name, void*, const char* extra);
+    ~ScopeTracer();
+
+private:
+    const char* m_name;
+    void* m_id;
+    OwnPtr<char*> m_extra;
+};
+
+inline ScopeTracer::ScopeTracer(const char* name, void* id, const char* extra)
+    : m_name(name)
+    , m_id(id)
+{
+    PlatformBridge::traceEventBegin(name, id, extra); \
+    if (extra)
+        m_extra = adoptPtr(strdup(extra));
+}
+
+inline ScopeTracer::~ScopeTracer()
+{
+    PlatformBridge::traceEventEnd(m_name, m_id, m_extra.get());
+}
+
+} // namespace internal
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/chromium/WindowsVersion.cpp b/Source/WebCore/platform/chromium/WindowsVersion.cpp
deleted file mode 100644
index a9632cb..0000000
--- a/Source/WebCore/platform/chromium/WindowsVersion.cpp
+++ /dev/null
@@ -1,52 +0,0 @@
-// Copyright (c) 2008, Google Inc. All rights reserved.
-// 
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-// 
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//     * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived from
-// this software without specific prior written permission.
-// 
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-#include "config.h"
-#include "WindowsVersion.h"
-
-#include <windows.h>
-
-namespace WebCore {
-
-bool isVistaOrNewer()
-{
-    // Cache the result to avoid asking every time.
-    static bool haveResult = false;
-    static bool result = false;
-    if (!haveResult) {
-        OSVERSIONINFO versionInfo;
-        versionInfo.dwOSVersionInfoSize = sizeof(versionInfo);
-        GetVersionEx(&versionInfo);
-
-        haveResult = true;
-        result = versionInfo.dwMajorVersion >= 6;
-    }
-    return result;
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/platform/efl/ContextMenuEfl.cpp b/Source/WebCore/platform/efl/ContextMenuEfl.cpp
index a5c6524..45d1758 100644
--- a/Source/WebCore/platform/efl/ContextMenuEfl.cpp
+++ b/Source/WebCore/platform/efl/ContextMenuEfl.cpp
@@ -2,7 +2,7 @@
  *  Copyright (C) 2007 Holger Hans Peter Freyther
  *  Copyright (C) 2008 INdT - Instituto Nokia de Tecnologia
  *  Copyright (C) 2009-2010 ProFUSION embedded systems
- *  Copyright (C) 2009-2010 Samsung Electronics
+ *  Copyright (C) 2011 Samsung Electronics
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -26,16 +26,12 @@
 
 namespace WebCore {
 
+#if USE(CROSS_PLATFORM_CONTEXT_MENUS)
 ContextMenu::ContextMenu(void* menu)
 {
     getContextMenuItems(menu, m_items);
 }
 
-ContextMenu::ContextMenu()
-{
-    notImplemented();
-}
-
 void ContextMenu::getContextMenuItems(void* menu, Vector<ContextMenuItem>& items)
 {
     notImplemented();
@@ -51,5 +47,11 @@ void* ContextMenu::nativeMenu() const
 {
     return createNativeMenuFromItems(m_items);
 }
+#else
+ContextMenu::ContextMenu()
+{
+    notImplemented();
+}
+#endif
 
 }
diff --git a/Source/WebCore/platform/efl/ContextMenuItemEfl.cpp b/Source/WebCore/platform/efl/ContextMenuItemEfl.cpp
index 5ce8fab..425c6a6 100644
--- a/Source/WebCore/platform/efl/ContextMenuItemEfl.cpp
+++ b/Source/WebCore/platform/efl/ContextMenuItemEfl.cpp
@@ -3,7 +3,7 @@
  * Copyright (C) 2007 Staikos Computing Services Inc. <info@staikos.net>
  * Copyright (C) 2008 INdT - Instituto Nokia de Tecnologia
  * Copyright (C) 2009-2010 ProFUSION embedded systems
- * Copyright (C) 2009-2010 Samsung Electronics
+ * Copyright (C) 2011 Samsung Electronics
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,11 +34,13 @@
 
 namespace WebCore {
 
-ContextMenuItem::ContextMenuItem(void* const&)
+#if USE(CROSS_PLATFORM_CONTEXT_MENUS)
+void* ContextMenuItem::nativeMenuItem() const
 {
     notImplemented();
+    return 0;
 }
-
+#else
 ContextMenuItem::ContextMenuItem(ContextMenuItemType, ContextMenuAction, const String&, ContextMenu*)
 {
     notImplemented();
@@ -49,12 +51,6 @@ ContextMenuItem::~ContextMenuItem()
     notImplemented();
 }
 
-void* ContextMenuItem::nativeMenuItem() const
-{
-    notImplemented();
-    return 0;
-}
-
 ContextMenuItemType ContextMenuItem::type() const
 {
     notImplemented();
@@ -98,5 +94,5 @@ void ContextMenuItem::setSubMenu(ContextMenu*)
 {
     notImplemented();
 }
-
+#endif
 }
diff --git a/Source/WebCore/platform/efl/FileSystemEfl.cpp b/Source/WebCore/platform/efl/FileSystemEfl.cpp
index cb117bc..01c6c67 100644
--- a/Source/WebCore/platform/efl/FileSystemEfl.cpp
+++ b/Source/WebCore/platform/efl/FileSystemEfl.cpp
@@ -67,7 +67,7 @@ CString fileSystemRepresentation(const String& path)
 #endif
 }
 
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
+String openTemporaryFile(const String& prefix, PlatformFileHandle& handle)
 {
     char buffer[PATH_MAX];
     const char* tmpDir = getenv("TMPDIR");
@@ -75,18 +75,18 @@ CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
     if (!tmpDir)
         tmpDir = "/tmp";
 
-    if (snprintf(buffer, PATH_MAX, "%s/%sXXXXXX", tmpDir, prefix) >= PATH_MAX)
+    if (snprintf(buffer, PATH_MAX, "%s/%sXXXXXX", tmpDir, prefix.utf8().data()) >= PATH_MAX)
         goto end;
 
     handle = mkstemp(buffer);
     if (handle < 0)
         goto end;
 
-    return CString(buffer);
+    return String::fromUTF8(buffer);
 
 end:
     handle = invalidPlatformFileHandle;
-    return CString();
+    return String();
 }
 
 bool unloadModule(PlatformModule module)
diff --git a/Source/WebCore/platform/efl/GeolocationServiceEfl.cpp b/Source/WebCore/platform/efl/GeolocationServiceEfl.cpp
new file mode 100644
index 0000000..0c0e744
--- /dev/null
+++ b/Source/WebCore/platform/efl/GeolocationServiceEfl.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2008 Holger Hans Peter Freyther
+ * Copyright (C) 2011 Samsung Electronics
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "GeolocationServiceEfl.h"
+
+#if ENABLE(GEOLOCATION)
+#include "NotImplemented.h"
+#include "PositionOptions.h"
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+GeolocationService::FactoryFunction* GeolocationService::s_factoryFunction = &GeolocationServiceEfl::create;
+
+GeolocationService* GeolocationServiceEfl::create(GeolocationServiceClient* client)
+{
+    return new GeolocationServiceEfl(client);
+}
+
+GeolocationServiceEfl::GeolocationServiceEfl(GeolocationServiceClient* client)
+    : GeolocationService(client)
+{
+}
+
+GeolocationServiceEfl::~GeolocationServiceEfl()
+{
+    notImplemented();
+}
+
+bool GeolocationServiceEfl::startUpdating(PositionOptions* options)
+{
+    notImplemented();
+    return false;
+}
+
+void GeolocationServiceEfl::stopUpdating()
+{
+    notImplemented();
+}
+
+void GeolocationServiceEfl::suspend()
+{
+    notImplemented();
+}
+
+void GeolocationServiceEfl::resume()
+{
+    notImplemented();
+}
+
+Geoposition* GeolocationServiceEfl::lastPosition() const
+{
+    return m_lastPosition.get();
+}
+
+PositionError* GeolocationServiceEfl::lastError() const
+{
+    return m_lastError.get();
+}
+
+}
+#endif // ENABLE(GEOLOCATION)
diff --git a/Source/WebCore/platform/efl/GeolocationServiceEfl.h b/Source/WebCore/platform/efl/GeolocationServiceEfl.h
new file mode 100644
index 0000000..e7ac66c
--- /dev/null
+++ b/Source/WebCore/platform/efl/GeolocationServiceEfl.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2008 Holger Hans Peter Freyther
+ * Copyright (C) 2011 Samsung Electronics
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef GeolocationServiceEfl_h
+#define GeolocationServiceEfl_h
+
+#if ENABLE(GEOLOCATION)
+#include "GeolocationService.h"
+#include "Geoposition.h"
+#include "PositionError.h"
+#include "RefPtr.h"
+
+namespace WebCore {
+
+class GeolocationServiceEfl : public GeolocationService {
+public:
+    static GeolocationService* create(GeolocationServiceClient*);
+    ~GeolocationServiceEfl();
+
+    virtual bool startUpdating(PositionOptions*);
+    virtual void stopUpdating();
+
+    virtual void suspend();
+    virtual void resume();
+
+    virtual Geoposition* lastPosition() const;
+    virtual PositionError* lastError() const;
+
+private:
+    GeolocationServiceEfl(GeolocationServiceClient*);
+
+    RefPtr<Geoposition> m_lastPosition;
+    RefPtr<PositionError> m_lastError;
+
+};
+
+}
+#endif // ENABLE(GEOLOCATION)
+#endif
diff --git a/Source/WebCore/platform/efl/LocalizedStringsEfl.cpp b/Source/WebCore/platform/efl/LocalizedStringsEfl.cpp
index 7e852f4..36a9f01 100644
--- a/Source/WebCore/platform/efl/LocalizedStringsEfl.cpp
+++ b/Source/WebCore/platform/efl/LocalizedStringsEfl.cpp
@@ -241,7 +241,7 @@ String contextMenuItemTagSearchWeb()
     return String::fromUTF8("Search the Web");
 }
 
-String contextMenuItemTagLookUpInDictionary()
+String contextMenuItemTagLookUpInDictionary(const String&)
 {
     return String::fromUTF8("Look Up in Dictionary");
 }
diff --git a/Source/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp b/Source/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp
index 2888b22..10121df 100644
--- a/Source/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp
+++ b/Source/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp
@@ -188,15 +188,15 @@ static int windowsKeyCodeForEvasKeyName(String& keyName)
     return 0;
 }
 
-PlatformKeyboardEvent::PlatformKeyboardEvent(const Evas_Event_Key_Down* ev)
+PlatformKeyboardEvent::PlatformKeyboardEvent(const Evas_Event_Key_Down* event)
     : m_type(KeyDown)
-    , m_text(String::fromUTF8(ev->string))
-    , m_shiftKey(evas_key_modifier_is_set(ev->modifiers, "Shift"))
-    , m_ctrlKey(evas_key_modifier_is_set(ev->modifiers, "Control"))
-    , m_altKey(evas_key_modifier_is_set(ev->modifiers, "Alt"))
-    , m_metaKey(evas_key_modifier_is_set(ev->modifiers, "Meta"))
+    , m_text(String::fromUTF8(event->string))
+    , m_shiftKey(evas_key_modifier_is_set(event->modifiers, "Shift"))
+    , m_ctrlKey(evas_key_modifier_is_set(event->modifiers, "Control"))
+    , m_altKey(evas_key_modifier_is_set(event->modifiers, "Alt"))
+    , m_metaKey(evas_key_modifier_is_set(event->modifiers, "Meta"))
 {
-    String keyName = String(ev->key);
+    String keyName = String(event->key);
     m_keyIdentifier = keyIdentifierForEvasKeyName(keyName);
     m_windowsVirtualKeyCode = windowsKeyCodeForEvasKeyName(keyName);
 
@@ -205,15 +205,15 @@ PlatformKeyboardEvent::PlatformKeyboardEvent(const Evas_Event_Key_Down* ev)
     m_autoRepeat = false;
 }
 
-PlatformKeyboardEvent::PlatformKeyboardEvent(const Evas_Event_Key_Up* ev)
+PlatformKeyboardEvent::PlatformKeyboardEvent(const Evas_Event_Key_Up* event)
     : m_type(KeyUp)
-    , m_text(String::fromUTF8(ev->string))
-    , m_shiftKey(evas_key_modifier_is_set(ev->modifiers, "Shift"))
-    , m_ctrlKey(evas_key_modifier_is_set(ev->modifiers, "Control"))
-    , m_altKey(evas_key_modifier_is_set(ev->modifiers, "Alt"))
-    , m_metaKey(evas_key_modifier_is_set(ev->modifiers, "Meta"))
+    , m_text(String::fromUTF8(event->string))
+    , m_shiftKey(evas_key_modifier_is_set(event->modifiers, "Shift"))
+    , m_ctrlKey(evas_key_modifier_is_set(event->modifiers, "Control"))
+    , m_altKey(evas_key_modifier_is_set(event->modifiers, "Alt"))
+    , m_metaKey(evas_key_modifier_is_set(event->modifiers, "Meta"))
 {
-    String keyName = String(ev->key);
+    String keyName = String(event->key);
     m_keyIdentifier = keyIdentifierForEvasKeyName(keyName);
     m_windowsVirtualKeyCode = windowsKeyCodeForEvasKeyName(keyName);
 
diff --git a/Source/WebCore/platform/efl/PlatformMouseEventEfl.cpp b/Source/WebCore/platform/efl/PlatformMouseEventEfl.cpp
index 53de522..172b493 100644
--- a/Source/WebCore/platform/efl/PlatformMouseEventEfl.cpp
+++ b/Source/WebCore/platform/efl/PlatformMouseEventEfl.cpp
@@ -47,44 +47,44 @@ void PlatformMouseEvent::setClickCount(unsigned int flags)
         m_clickCount = 1;
 }
 
-PlatformMouseEvent::PlatformMouseEvent(const Evas_Event_Mouse_Down* ev, IntPoint pos)
-    : m_position(IntPoint(ev->canvas.x - pos.x(), ev->canvas.y - pos.y()))
-    , m_globalPosition(IntPoint(ev->canvas.x, ev->canvas.y))
-    , m_button(MouseButton(ev->button - 1))
+PlatformMouseEvent::PlatformMouseEvent(const Evas_Event_Mouse_Down* event, IntPoint position)
+    : m_position(IntPoint(event->canvas.x - position.x(), event->canvas.y - position.y()))
+    , m_globalPosition(IntPoint(event->canvas.x, event->canvas.y))
+    , m_button(MouseButton(event->button - 1))
     , m_eventType(MouseEventPressed)
-    , m_shiftKey(evas_key_modifier_is_set(ev->modifiers, "Shift"))
-    , m_ctrlKey(evas_key_modifier_is_set(ev->modifiers, "Control"))
-    , m_altKey(evas_key_modifier_is_set(ev->modifiers, "Alt"))
-    , m_metaKey(evas_key_modifier_is_set(ev->modifiers, "Meta"))
+    , m_shiftKey(evas_key_modifier_is_set(event->modifiers, "Shift"))
+    , m_ctrlKey(evas_key_modifier_is_set(event->modifiers, "Control"))
+    , m_altKey(evas_key_modifier_is_set(event->modifiers, "Alt"))
+    , m_metaKey(evas_key_modifier_is_set(event->modifiers, "Meta"))
     , m_timestamp(currentTime())
 {
-    setClickCount(ev->flags);
+    setClickCount(event->flags);
 }
 
-PlatformMouseEvent::PlatformMouseEvent(const Evas_Event_Mouse_Up* ev, IntPoint pos)
-    : m_position(IntPoint(ev->canvas.x - pos.x(), ev->canvas.y - pos.y()))
-    , m_globalPosition(IntPoint(ev->canvas.x, ev->canvas.y))
-    , m_button(MouseButton(ev->button - 1))
+PlatformMouseEvent::PlatformMouseEvent(const Evas_Event_Mouse_Up* event, IntPoint position)
+    : m_position(IntPoint(event->canvas.x - position.x(), event->canvas.y - position.y()))
+    , m_globalPosition(IntPoint(event->canvas.x, event->canvas.y))
+    , m_button(MouseButton(event->button - 1))
     , m_eventType(MouseEventReleased)
-    , m_shiftKey(evas_key_modifier_is_set(ev->modifiers, "Shift"))
-    , m_ctrlKey(evas_key_modifier_is_set(ev->modifiers, "Control"))
-    , m_altKey(evas_key_modifier_is_set(ev->modifiers, "Alt"))
-    , m_metaKey(evas_key_modifier_is_set(ev->modifiers, "Meta"))
+    , m_shiftKey(evas_key_modifier_is_set(event->modifiers, "Shift"))
+    , m_ctrlKey(evas_key_modifier_is_set(event->modifiers, "Control"))
+    , m_altKey(evas_key_modifier_is_set(event->modifiers, "Alt"))
+    , m_metaKey(evas_key_modifier_is_set(event->modifiers, "Meta"))
     , m_timestamp(currentTime())
 {
-    setClickCount(ev->flags);
+    setClickCount(event->flags);
 }
 
-PlatformMouseEvent::PlatformMouseEvent(const Evas_Event_Mouse_Move* ev, IntPoint pos)
-    : m_position(IntPoint(ev->cur.canvas.x - pos.x(), ev->cur.canvas.y - pos.y()))
-    , m_globalPosition(IntPoint(ev->cur.canvas.x, ev->cur.canvas.y))
-    , m_button(MouseButton(ev->buttons - 1))
+PlatformMouseEvent::PlatformMouseEvent(const Evas_Event_Mouse_Move* event, IntPoint position)
+    : m_position(IntPoint(event->cur.canvas.x - position.x(), event->cur.canvas.y - position.y()))
+    , m_globalPosition(IntPoint(event->cur.canvas.x, event->cur.canvas.y))
+    , m_button(MouseButton(event->buttons - 1))
     , m_eventType(MouseEventMoved)
     , m_clickCount(0)
-    , m_shiftKey(evas_key_modifier_is_set(ev->modifiers, "Shift"))
-    , m_ctrlKey(evas_key_modifier_is_set(ev->modifiers, "Control"))
-    , m_altKey(evas_key_modifier_is_set(ev->modifiers, "Alt"))
-    , m_metaKey(evas_key_modifier_is_set(ev->modifiers, "Meta"))
+    , m_shiftKey(evas_key_modifier_is_set(event->modifiers, "Shift"))
+    , m_ctrlKey(evas_key_modifier_is_set(event->modifiers, "Control"))
+    , m_altKey(evas_key_modifier_is_set(event->modifiers, "Alt"))
+    , m_metaKey(evas_key_modifier_is_set(event->modifiers, "Meta"))
     , m_timestamp(currentTime())
 {
 }
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.cpp b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
index 3e8a646..439e377 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.cpp
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.cpp
@@ -38,11 +38,21 @@
 #include "RenderObject.h"
 #include "RenderProgress.h"
 #include "RenderSlider.h"
+#include "UserAgentStyleSheets.h"
 #include <wtf/text/CString.h>
 
 #include <Ecore_Evas.h>
 #include <Edje.h>
+
+#if ENABLE(VIDEO)
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
+#endif
+
 namespace WebCore {
+#if ENABLE(VIDEO)
+using namespace HTMLNames;
+#endif
 
 // TODO: change from object count to ecore_evas size (bytes)
 // TODO: as objects are webpage/user defined and they can be very large.
@@ -273,7 +283,7 @@ bool RenderThemeEfl::paintThemePart(RenderObject* object, FormType type, const P
 
     applyEdjeStateFromForm(entry->o, controlStatesForRenderer(object));
 
-    cairo = info.context->platformContext();
+    cairo = info.context->platformContext()->cr();
     ASSERT(cairo);
 
     // Currently, only sliders needs this message; if other widget ever needs special
@@ -592,6 +602,10 @@ const char* RenderThemeEfl::edjeGroupFromFormType(FormType type) const
         W("search/cancel_button"),
         W("slider/vertical"),
         W("slider/horizontal"),
+#if ENABLE(VIDEO)
+        W("mediacontrol/playpause_button"),
+        W("mediacontrol/mute_button"),
+#endif
 #undef W
         0
     };
@@ -1044,10 +1058,32 @@ bool RenderThemeEfl::paintProgressBar(RenderObject* object, const PaintInfo& inf
 #endif
 
 #if ENABLE(VIDEO)
+bool RenderThemeEfl::emitMediaButtonSignal(FormType formType, MediaControlElementType mediaElementType, const IntRect& rect)
+{
+    ThemePartCacheEntry* entry;
+
+    entry = cacheThemePartGet(formType, rect.size());
+    ASSERT(entry);
+    if (!entry)
+        return false;
+
+    if (mediaElementType == MediaPlayButton)
+        edje_object_signal_emit(entry->o, "play", "");
+    else if (mediaElementType == MediaPauseButton)
+        edje_object_signal_emit(entry->o, "pause", "");
+    else if (mediaElementType == MediaMuteButton)
+        edje_object_signal_emit(entry->o, "mute", "");
+    else if (mediaElementType == MediaUnMuteButton)
+        edje_object_signal_emit(entry->o, "sound", "");
+    else 
+        return false;
+
+    return true;
+}
+
 String RenderThemeEfl::extraMediaControlsStyleSheet()
 {
-    notImplemented();
-    return String();
+    return String(mediaControlsEflUserAgentStyleSheet, sizeof(mediaControlsEflUserAgentStyleSheet));
 }
 
 String RenderThemeEfl::formatMediaControlsCurrentTime(float currentTime, float duration) const
@@ -1064,14 +1100,29 @@ bool RenderThemeEfl::paintMediaFullscreenButton(RenderObject* object, const Pain
 
 bool RenderThemeEfl::paintMediaMuteButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
-    notImplemented();
-    return false;
+    Node* mediaNode = object->node() ? object->node()->shadowAncestorNode() : 0;
+    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
+        return false;
+
+    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
+
+    if (!emitMediaButtonSignal(MediaMuteUnMuteButton, mediaElement->muted() ? MediaMuteButton : MediaUnMuteButton, rect))
+        return false;
+
+    return paintThemePart(object, MediaMuteUnMuteButton, info, rect);
 }
 
 bool RenderThemeEfl::paintMediaPlayButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
-    notImplemented();
-    return false;
+    Node* node = object->node();
+    if (!node)
+        return false;
+
+    MediaControlPlayButtonElement* button = static_cast<MediaControlPlayButtonElement*>(node);
+    if (!emitMediaButtonSignal(MediaPlayPauseButton, button->displayType(), rect))
+        return false;
+
+    return paintThemePart(object, MediaPlayPauseButton, info, rect);
 }
 
 bool RenderThemeEfl::paintMediaSeekBackButton(RenderObject* object, const PaintInfo& info, const IntRect& rect)
diff --git a/Source/WebCore/platform/efl/RenderThemeEfl.h b/Source/WebCore/platform/efl/RenderThemeEfl.h
index 9970096..fe8e2d2 100644
--- a/Source/WebCore/platform/efl/RenderThemeEfl.h
+++ b/Source/WebCore/platform/efl/RenderThemeEfl.h
@@ -30,6 +30,9 @@
 #ifndef RenderThemeEfl_h
 #define RenderThemeEfl_h
 
+#if ENABLE(VIDEO)
+#include "MediaControlElements.h"
+#endif
 #include "RenderTheme.h"
 
 #include <cairo.h>
@@ -55,6 +58,10 @@ enum FormType { // KEEP IN SYNC WITH edjeGroupFromFormType()
     SearchFieldCancelButton,
     SliderVertical,
     SliderHorizontal,
+#if ENABLE(VIDEO)
+    MediaPlayPauseButton,
+    MediaMuteUnMuteButton,
+#endif
     FormTypeLast
 };
 
@@ -182,6 +189,10 @@ private:
     void applyEdjeStateFromForm(Evas_Object*, ControlStates);
     bool paintThemePart(RenderObject*, FormType, const PaintInfo&, const IntRect&);
 
+#if ENABLE(VIDEO)
+    bool emitMediaButtonSignal(FormType, MediaControlElementType, const IntRect&);
+#endif
+
     Page* m_page;
     Color m_activeSelectionBackgroundColor;
     Color m_activeSelectionForegroundColor;
diff --git a/Source/WebCore/platform/efl/ScrollbarEfl.cpp b/Source/WebCore/platform/efl/ScrollbarEfl.cpp
index e71d1e3..162c2a1 100644
--- a/Source/WebCore/platform/efl/ScrollbarEfl.cpp
+++ b/Source/WebCore/platform/efl/ScrollbarEfl.cpp
@@ -64,50 +64,50 @@ ScrollbarEfl::~ScrollbarEfl()
     setEvasObject(0);
 }
 
-static void scrollbarEflEdjeMessage(void* data, Evas_Object* o, Edje_Message_Type type, int id, void* msg)
+static void scrollbarEflEdjeMessage(void* data, Evas_Object* object, Edje_Message_Type messageType, int id, void* message)
 {
     ScrollbarEfl* that = static_cast<ScrollbarEfl*>(data);
-    Edje_Message_Float* m;
-    int v;
+    Edje_Message_Float* messageFloat;
+    int value;
 
     if (!id) {
         EINA_LOG_ERR("Unknown message id '%d' from scroll bar theme.", id);
         return;
     }
 
-    if (type != EDJE_MESSAGE_FLOAT) {
+    if (messageType != EDJE_MESSAGE_FLOAT) {
         EINA_LOG_ERR("Message id '%d' of incorrect type from scroll bar theme. "
                      "Expected '%d', got '%d'.",
-                     id, EDJE_MESSAGE_FLOAT, type);
+                     id, EDJE_MESSAGE_FLOAT, messageType);
         return;
     }
 
-    m = static_cast<Edje_Message_Float*>(msg);
-    v = m->val * (that->totalSize() - that->visibleSize());
-    that->scrollableArea()->scrollToOffsetWithoutAnimation(that->orientation(), v);
+    messageFloat = static_cast<Edje_Message_Float*>(message);
+    value = messageFloat->val * (that->totalSize() - that->visibleSize());
+    that->scrollableArea()->scrollToOffsetWithoutAnimation(that->orientation(), value);
 }
 
 void ScrollbarEfl::setParent(ScrollView* view)
 {
-    Evas_Object* o = evasObject();
+    Evas_Object* object = evasObject();
     Evas_Coord w, h;
 
     Widget::setParent(view);
 
-    if (!o) {
+    if (!object) {
         if (!view)
             return;
 
-        o = edje_object_add(view->evas());
-        if (!o) {
+        object = edje_object_add(view->evas());
+        if (!object) {
             EINA_LOG_ERR("Could not create edje object for view=%p (evas=%p)",
                          view, view->evas());
             return;
         }
-        edje_object_message_handler_set(o, scrollbarEflEdjeMessage, this);
-        setEvasObject(o);
+        edje_object_message_handler_set(object, scrollbarEflEdjeMessage, this);
+        setEvasObject(object);
     } else if (!view) {
-        evas_object_hide(o);
+        evas_object_hide(object);
         return;
     }
 
@@ -117,23 +117,23 @@ void ScrollbarEfl::setParent(ScrollView* view)
 
     if (theme.isEmpty()) {
         EINA_LOG_ERR("Could not load theme '%s': no theme path set.", group);
-        evas_object_hide(o);
+        evas_object_hide(object);
         return;
     }
 
-    if (!edje_object_file_set(o, theme.utf8().data(), group)) {
-        Edje_Load_Error err = edje_object_load_error_get(o);
-        const char* errmsg = edje_load_error_str(err);
+    if (!edje_object_file_set(object, theme.utf8().data(), group)) {
+        Edje_Load_Error err = edje_object_load_error_get(object);
+        const char* errmessage = edje_load_error_str(err);
         EINA_LOG_ERR("Could not load theme '%s' from file '%s': #%d '%s'",
-                     group, theme.utf8().data(), err, errmsg);
+                     group, theme.utf8().data(), err, errmessage);
         return;
     }
 
-    setPlatformWidget(o);
-    evas_object_smart_member_add(o, view->evasObject());
-    evas_object_show(o);
+    setPlatformWidget(object);
+    evas_object_smart_member_add(object, view->evasObject());
+    evas_object_show(object);
 
-    edje_object_size_min_get(o, &w, &h);
+    edje_object_size_min_get(object, &w, &h);
 
     IntRect rect = frameRect();
     rect.setSize(IntSize(w, h));
@@ -168,21 +168,21 @@ void ScrollbarEfl::updateThumbPositionAndProportion()
     m_lastTotalSize = tSize;
     m_lastVisibleSize = vSize;
 
-    Edje_Message_Float_Set* msg = static_cast<Edje_Message_Float_Set*>
+    Edje_Message_Float_Set* message = static_cast<Edje_Message_Float_Set*>
         (alloca(sizeof(Edje_Message_Float_Set) + sizeof(float)));
-    msg->count = 2;
+    message->count = 2;
 
     if (tSize - vSize > 0)
-        msg->val[0] = pos / (float)(tSize - vSize);
+        message->val[0] = pos / static_cast<float>(tSize - vSize);
     else
-        msg->val[0] = 0.0;
+        message->val[0] = 0.0;
 
     if (tSize > 0)
-        msg->val[1] = vSize / (float)tSize;
+        message->val[1] = vSize / static_cast<float>(tSize);
     else
-        msg->val[1] = 0.0;
+        message->val[1] = 0.0;
 
-    edje_object_message_send(platformWidget(), EDJE_MESSAGE_FLOAT_SET, 0, msg);
+    edje_object_message_send(platformWidget(), EDJE_MESSAGE_FLOAT_SET, 0, message);
 }
 
 void ScrollbarEfl::setFrameRect(const IntRect& rect)
@@ -193,10 +193,10 @@ void ScrollbarEfl::setFrameRect(const IntRect& rect)
 
 void ScrollbarEfl::frameRectsChanged()
 {
-    Evas_Object* o = platformWidget();
+    Evas_Object* object = platformWidget();
     Evas_Coord x, y;
 
-    if (!parent() || !o)
+    if (!parent() || !object)
         return;
 
     IntRect rect = frameRect();
@@ -206,11 +206,11 @@ void ScrollbarEfl::frameRectsChanged()
         rect.setLocation(parent()->contentsToWindow(rect.location()));
 
     evas_object_geometry_get(root()->evasObject(), &x, &y, 0, 0);
-    evas_object_move(o, x + rect.x(), y + rect.y());
-    evas_object_resize(o, rect.width(), rect.height());
+    evas_object_move(object, x + rect.x(), y + rect.y());
+    evas_object_resize(object, rect.width(), rect.height());
 }
 
-void ScrollbarEfl::paint(GraphicsContext* context, const IntRect& rect)
+void ScrollbarEfl::paint(GraphicsContext* graphicsContext, const IntRect& damageRect)
 {
 }
 
diff --git a/Source/WebCore/platform/efl/ScrollbarEfl.h b/Source/WebCore/platform/efl/ScrollbarEfl.h
index 09dc64f..1f67d2f 100644
--- a/Source/WebCore/platform/efl/ScrollbarEfl.h
+++ b/Source/WebCore/platform/efl/ScrollbarEfl.h
@@ -49,7 +49,7 @@ public:
 
     virtual void frameRectsChanged();
 
-    virtual void paint(GraphicsContext* context, const IntRect& damageRect);
+    virtual void paint(GraphicsContext*, const IntRect&);
 
 protected:
     ScrollbarEfl(ScrollableArea*, ScrollbarOrientation, ScrollbarControlSize);
@@ -58,7 +58,7 @@ protected:
     virtual void updateThumbPosition();
     virtual void updateThumbProportion();
 
-    virtual void setParent(ScrollView* view);
+    virtual void setParent(ScrollView*);
 
 private:
     int m_lastPos;
diff --git a/Source/WebCore/platform/efl/WidgetEfl.cpp b/Source/WebCore/platform/efl/WidgetEfl.cpp
index 640e6e3..45d4792 100644
--- a/Source/WebCore/platform/efl/WidgetEfl.cpp
+++ b/Source/WebCore/platform/efl/WidgetEfl.cpp
@@ -183,10 +183,10 @@ void Widget::setFrameRect(const IntRect& rect)
 
 void Widget::frameRectsChanged()
 {
-    Evas_Object* o = evasObject();
+    Evas_Object* object = evasObject();
     Evas_Coord x, y;
 
-    if (!parent() || !o)
+    if (!parent() || !object)
         return;
 
     IntRect rect = frameRect();
@@ -196,8 +196,8 @@ void Widget::frameRectsChanged()
         rect.setLocation(parent()->contentsToWindow(rect.location()));
 
     evas_object_geometry_get(root()->evasObject(), &x, &y, 0, 0);
-    evas_object_move(o, x + rect.x(), y + rect.y());
-    evas_object_resize(o, rect.width(), rect.height());
+    evas_object_move(object, x + rect.x(), y + rect.y());
+    evas_object_resize(object, rect.width(), rect.height());
 }
 
 void Widget::setFocus(bool focused)
@@ -332,14 +332,14 @@ Ecore_Evas* Widget::ecoreEvas() const
     return static_cast<Ecore_Evas*>(evas_data_attach_get(evas()));
 }
 
-void Widget::setEvasObject(Evas_Object *o)
+void Widget::setEvasObject(Evas_Object *object)
 {
     // FIXME: study platformWidget() and use it
     // FIXME: right now platformWidget() requires implementing too much
-    if (m_data->m_evasObject == o)
+    if (m_data->m_evasObject == object)
         return;
-    m_data->m_evasObject = o;
-    if (!o) {
+    m_data->m_evasObject = object;
+    if (!object) {
         m_data->m_evas = 0;
 #ifdef HAVE_ECORE_X
         m_data->m_isUsingEcoreX = false;
@@ -347,7 +347,7 @@ void Widget::setEvasObject(Evas_Object *o)
         return;
     }
 
-    m_data->m_evas = evas_object_evas_get(o);
+    m_data->m_evas = evas_object_evas_get(object);
 
 #ifdef HAVE_ECORE_X
     const char *engine = ecore_evas_engine_name_get(ecoreEvas());
diff --git a/Source/WebCore/platform/graphics/BitmapImage.h b/Source/WebCore/platform/graphics/BitmapImage.h
index 14a3094..c8cf0ab 100644
--- a/Source/WebCore/platform/graphics/BitmapImage.h
+++ b/Source/WebCore/platform/graphics/BitmapImage.h
@@ -165,7 +165,7 @@ protected:
     enum RepetitionCountStatus {
       Unknown,    // We haven't checked the source's repetition count.
       Uncertain,  // We have a repetition count, but it might be wrong (some GIFs have a count after the image data, and will report "loop once" until all data has been decoded).
-      Certain,    // The repetition count is known to be correct.
+      Certain     // The repetition count is known to be correct.
     };
 
     BitmapImage(NativeImagePtr, ImageObserver* = 0);
diff --git a/Source/WebCore/platform/graphics/Color.cpp b/Source/WebCore/platform/graphics/Color.cpp
index a1c5cd7..7dea765 100644
--- a/Source/WebCore/platform/graphics/Color.cpp
+++ b/Source/WebCore/platform/graphics/Color.cpp
@@ -27,13 +27,12 @@
 #include "Color.h"
 
 #include "HashTools.h"
-#include "PlatformString.h"
-#include <math.h>
 #include <wtf/Assertions.h>
+#include <wtf/HexNumber.h>
 #include <wtf/MathExtras.h>
+#include <wtf/text/StringBuilder.h>
 
 using namespace std;
-using namespace WTF;
 
 namespace WebCore {
 
@@ -180,14 +179,6 @@ Color::Color(const char* name)
     }
 }
 
-static inline void appendHexNumber(UChar* destination, uint8_t number)
-{
-    static const char hexDigits[17] = "0123456789abcdef";
-
-    destination[0] = hexDigits[number >> 4];
-    destination[1] = hexDigits[number & 0xF];
-}
-
 String Color::serialized() const
 {
     DEFINE_STATIC_LOCAL(const String, commaSpace, (", "));
@@ -195,13 +186,13 @@ String Color::serialized() const
     DEFINE_STATIC_LOCAL(const String, zeroPointZero, ("0.0"));
 
     if (!hasAlpha()) {
-        UChar* characters;
-        String result = String::createUninitialized(7, characters);
-        characters[0] = '#';
-        appendHexNumber(characters + 1, red());
-        appendHexNumber(characters + 3, green());
-        appendHexNumber(characters + 5, blue());
-        return result;
+        StringBuilder builder;
+        builder.reserveCapacity(7);
+        builder.append('#');
+        appendByteAsHex(red(), builder, Lowercase);
+        appendByteAsHex(green(), builder, Lowercase);
+        appendByteAsHex(blue(), builder, Lowercase);
+        return builder.toString();
     }
 
     Vector<UChar> result;
diff --git a/Source/WebCore/platform/graphics/ContextShadow.h b/Source/WebCore/platform/graphics/ContextShadow.h
index c0571f0..850d489 100644
--- a/Source/WebCore/platform/graphics/ContextShadow.h
+++ b/Source/WebCore/platform/graphics/ContextShadow.h
@@ -32,7 +32,7 @@
 #include "Color.h"
 #include "FloatRect.h"
 #include "IntRect.h"
-#include "RefCounted.h"
+#include <wtf/RefCounted.h>
 
 #if PLATFORM(CAIRO)
 typedef struct _cairo cairo_t;
diff --git a/Source/WebCore/platform/graphics/Font.cpp b/Source/WebCore/platform/graphics/Font.cpp
index ee85e45..72e3e3b 100644
--- a/Source/WebCore/platform/graphics/Font.cpp
+++ b/Source/WebCore/platform/graphics/Font.cpp
@@ -177,7 +177,7 @@ float Font::width(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFo
         // If the complex text implementation cannot return fallback fonts, avoid
         // returning them for simple text as well.
         static bool returnFallbackFonts = canReturnFallbackFontsForComplexText();
-        return floatWidthForSimpleText(run, 0, returnFallbackFonts ? fallbackFonts : 0, codePathToUse == SimpleWithGlyphOverflow ? glyphOverflow : 0);
+        return floatWidthForSimpleText(run, 0, returnFallbackFonts ? fallbackFonts : 0, codePathToUse == SimpleWithGlyphOverflow || (glyphOverflow && glyphOverflow->computeBounds) ? glyphOverflow : 0);
     }
 
     return floatWidthForComplexText(run, fallbackFonts, glyphOverflow);
diff --git a/Source/WebCore/platform/graphics/Font.h b/Source/WebCore/platform/graphics/Font.h
index ce03aed..554f8a0 100644
--- a/Source/WebCore/platform/graphics/Font.h
+++ b/Source/WebCore/platform/graphics/Font.h
@@ -61,6 +61,7 @@ struct GlyphOverflow {
         , right(0)
         , top(0)
         , bottom(0)
+        , computeBounds(false)
     {
     }
 
@@ -68,8 +69,10 @@ struct GlyphOverflow {
     int right;
     int top;
     int bottom;
+    bool computeBounds;
 };
 
+
 class Font {
 public:
     Font();
@@ -138,8 +141,6 @@ public:
     const FontData* fontDataAt(unsigned) const;
     GlyphData glyphDataForCharacter(UChar32, bool mirror, FontDataVariant = AutoVariant) const;
     bool primaryFontHasGlyphForCharacter(UChar32) const;
-    // Used for complex text, and does not utilize the glyph map cache.
-    const FontData* fontDataForCharacters(const UChar*, int length) const;
 
     static bool isCJKIdeograph(UChar32);
     static bool isCJKIdeographOrSymbol(UChar32);
@@ -255,12 +256,6 @@ inline const FontData* Font::fontDataAt(unsigned index) const
     return m_fontList->fontDataAt(this, index);
 }
 
-inline const FontData* Font::fontDataForCharacters(const UChar* characters, int length) const
-{
-    ASSERT(m_fontList);
-    return m_fontList->fontDataForCharacters(this, characters, length);
-}
-
 inline bool Font::isFixedPitch() const
 {
     ASSERT(m_fontList);
diff --git a/Source/WebCore/platform/graphics/FontCache.cpp b/Source/WebCore/platform/graphics/FontCache.cpp
index 5b508be..8c5edfe 100644
--- a/Source/WebCore/platform/graphics/FontCache.cpp
+++ b/Source/WebCore/platform/graphics/FontCache.cpp
@@ -57,7 +57,8 @@ struct FontPlatformDataCacheKey {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     FontPlatformDataCacheKey(const AtomicString& family = AtomicString(), unsigned size = 0, unsigned weight = 0, bool italic = false,
-                             bool isPrinterFont = false, FontRenderingMode renderingMode = NormalRenderingMode, FontOrientation orientation = Horizontal, FontWidthVariant widthVariant = RegularWidth)
+                             bool isPrinterFont = false, FontRenderingMode renderingMode = NormalRenderingMode, FontOrientation orientation = Horizontal,
+                             TextOrientation textOrientation = TextOrientationVerticalRight, FontWidthVariant widthVariant = RegularWidth)
         : m_size(size)
         , m_weight(weight)
         , m_family(family)
@@ -65,6 +66,7 @@ public:
         , m_printerFont(isPrinterFont)
         , m_renderingMode(renderingMode)
         , m_orientation(orientation)
+        , m_textOrientation(textOrientation)
         , m_widthVariant(widthVariant)
     {
     }
@@ -76,7 +78,7 @@ public:
     {
         return equalIgnoringCase(m_family, other.m_family) && m_size == other.m_size && 
                m_weight == other.m_weight && m_italic == other.m_italic && m_printerFont == other.m_printerFont &&
-               m_renderingMode == other.m_renderingMode && m_orientation == other.m_orientation && m_widthVariant == other.m_widthVariant;
+               m_renderingMode == other.m_renderingMode && m_orientation == other.m_orientation && m_textOrientation == other.m_textOrientation && m_widthVariant == other.m_widthVariant;
     }
 
     unsigned m_size;
@@ -86,6 +88,7 @@ public:
     bool m_printerFont;
     FontRenderingMode m_renderingMode;
     FontOrientation m_orientation;
+    TextOrientation m_textOrientation;
     FontWidthVariant m_widthVariant;
 
 private:
@@ -99,9 +102,9 @@ inline unsigned computeHash(const FontPlatformDataCacheKey& fontKey)
         fontKey.m_size,
         fontKey.m_weight,
         fontKey.m_widthVariant,
-        static_cast<unsigned>(fontKey.m_orientation) << 3 | static_cast<unsigned>(fontKey.m_italic) << 2 | static_cast<unsigned>(fontKey.m_printerFont) << 1 | static_cast<unsigned>(fontKey.m_renderingMode)
+        static_cast<unsigned>(fontKey.m_textOrientation) << 4 | static_cast<unsigned>(fontKey.m_orientation) << 3 | static_cast<unsigned>(fontKey.m_italic) << 2 | static_cast<unsigned>(fontKey.m_printerFont) << 1 | static_cast<unsigned>(fontKey.m_renderingMode)
     };
-    return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+    return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
 }
 
 struct FontPlatformDataCacheKeyHash {
@@ -198,7 +201,8 @@ FontPlatformData* FontCache::getCachedFontPlatformData(const FontDescription& fo
     }
 
     FontPlatformDataCacheKey key(familyName, fontDescription.computedPixelSize(), fontDescription.weight(), fontDescription.italic(),
-                                 fontDescription.usePrinterFont(), fontDescription.renderingMode(), fontDescription.orientation(), fontDescription.widthVariant());
+                                 fontDescription.usePrinterFont(), fontDescription.renderingMode(), fontDescription.orientation(),
+                                 fontDescription.textOrientation(), fontDescription.widthVariant());
     FontPlatformData* result = 0;
     bool foundResult;
     FontPlatformDataCache::iterator it = gFontPlatformDataCache->find(key);
diff --git a/Source/WebCore/platform/graphics/FontDescription.h b/Source/WebCore/platform/graphics/FontDescription.h
index 283d297..5b05f14 100644
--- a/Source/WebCore/platform/graphics/FontDescription.h
+++ b/Source/WebCore/platform/graphics/FontDescription.h
@@ -31,6 +31,7 @@
 #include "FontSmoothingMode.h"
 #include "FontTraitsMask.h"
 #include "FontWidthVariant.h"
+#include "TextOrientation.h"
 #include "TextRenderingMode.h"
 
 namespace WebCore {
@@ -58,6 +59,7 @@ public:
         : m_specifiedSize(0)
         , m_computedSize(0)
         , m_orientation(Horizontal)
+        , m_textOrientation(TextOrientationVerticalRight)
         , m_widthVariant(RegularWidth)
         , m_italic(false)
         , m_smallCaps(false)
@@ -99,6 +101,7 @@ public:
     FontTraitsMask traitsMask() const;
     bool isSpecifiedFont() const { return m_isSpecifiedFont; }
     FontOrientation orientation() const { return m_orientation; }
+    TextOrientation textOrientation() const { return m_textOrientation; }
     FontWidthVariant widthVariant() const { return m_widthVariant; }
 
     void setFamily(const FontFamily& family) { m_familyList = family; }
@@ -120,6 +123,7 @@ public:
     void setTextRenderingMode(TextRenderingMode rendering) { m_textRendering = rendering; }
     void setIsSpecifiedFont(bool isSpecifiedFont) { m_isSpecifiedFont = isSpecifiedFont; }
     void setOrientation(FontOrientation orientation) { m_orientation = orientation; }
+    void setTextOrientation(TextOrientation textOrientation) { m_textOrientation = textOrientation; }
     void setWidthVariant(FontWidthVariant widthVariant) { m_widthVariant = widthVariant; }
 
 private:
@@ -129,8 +133,9 @@ private:
                              // rounding, minimum font sizes, and zooming.
     float m_computedSize;    // Computed size adjusted for the minimum font size and the zoom factor.  
 
-    FontOrientation m_orientation;
-    
+    FontOrientation m_orientation; // Whether the font is rendering on a horizontal line or a vertical line.
+    TextOrientation m_textOrientation; // Only used by vertical text. Determines the default orientation for non-ideograph glyphs.
+
     FontWidthVariant m_widthVariant;
 
     bool m_italic : 1;
@@ -169,6 +174,7 @@ inline bool FontDescription::operator==(const FontDescription& other) const
         && m_textRendering == other.m_textRendering
         && m_isSpecifiedFont == other.m_isSpecifiedFont
         && m_orientation == other.m_orientation
+        && m_textOrientation == other.m_textOrientation
         && m_widthVariant == other.m_widthVariant;
 }
 
diff --git a/Source/WebCore/platform/graphics/FontFallbackList.cpp b/Source/WebCore/platform/graphics/FontFallbackList.cpp
index 649c117..7df58d9 100644
--- a/Source/WebCore/platform/graphics/FontFallbackList.cpp
+++ b/Source/WebCore/platform/graphics/FontFallbackList.cpp
@@ -111,23 +111,6 @@ const FontData* FontFallbackList::fontDataAt(const Font* font, unsigned realized
     return result;
 }
 
-const FontData* FontFallbackList::fontDataForCharacters(const Font* font, const UChar* characters, int length) const
-{
-    // This method is only called when the primary font does not contain the characters we need.
-    // Begin our search at position 1.
-    unsigned realizedFontIndex = 1;
-    const FontData* fontData = fontDataAt(font, realizedFontIndex);
-    while (fontData && !fontData->containsCharacters(characters, length))
-        fontData = fontDataAt(font, ++realizedFontIndex);
-    
-    if (!fontData) {
-        ASSERT(fontCache()->generation() == m_generation);
-        fontData = fontCache()->getFontDataForCharacters(*font, characters, length);
-    }
-
-    return fontData;
-}
-
 void FontFallbackList::setPlatformFont(const FontPlatformData& platformData)
 {
     m_familyIndex = cAllFamiliesScanned;
diff --git a/Source/WebCore/platform/graphics/FontFallbackList.h b/Source/WebCore/platform/graphics/FontFallbackList.h
index a10f5af..e18477c 100644
--- a/Source/WebCore/platform/graphics/FontFallbackList.h
+++ b/Source/WebCore/platform/graphics/FontFallbackList.h
@@ -65,8 +65,7 @@ private:
 
     const FontData* primaryFontData(const Font* f) const { return fontDataAt(f, 0); }
     const FontData* fontDataAt(const Font*, unsigned index) const;
-    const FontData* fontDataForCharacters(const Font*, const UChar*, int length) const;
-    
+
     void setPlatformFont(const FontPlatformData&);
 
     void releaseFontData();
diff --git a/Source/WebCore/platform/graphics/FontFastPath.cpp b/Source/WebCore/platform/graphics/FontFastPath.cpp
index e62df61..b741ca0 100644
--- a/Source/WebCore/platform/graphics/FontFastPath.cpp
+++ b/Source/WebCore/platform/graphics/FontFastPath.cpp
@@ -77,17 +77,57 @@ GlyphData Font::glyphDataForCharacter(UChar32 c, bool mirror, FontDataVariant va
             page = node->page();
             if (page) {
                 GlyphData data = page->glyphDataForCharacter(c);
+                if (data.fontData && (data.fontData->platformData().orientation() == Horizontal || data.fontData->isTextOrientationFallback()))
+                    return data;
+                
                 if (data.fontData) {
-                    if (data.fontData->platformData().orientation() == Vertical && data.fontData->orientation() == Horizontal && Font::isCJKIdeographOrSymbol(c)) {
-                        const SimpleFontData* ideographFontData = data.fontData->brokenIdeographFontData();
-                        GlyphPageTreeNode* ideographNode = GlyphPageTreeNode::getRootChild(ideographFontData, pageNumber);
-                        const GlyphPage* ideographPage = ideographNode->page();
-                        if (ideographPage) {
-                            GlyphData data = ideographPage->glyphDataForCharacter(c);
-                            if (data.fontData)
-                                return data;
+                    if (isCJKIdeographOrSymbol(c)) {
+                        if (!data.fontData->hasVerticalGlyphs()) {
+                            // Use the broken ideograph font data. The broken ideograph font will use the horizontal width of glyphs
+                            // to make sure you get a square (even for broken glyphs like symbols used for punctuation).
+                            const SimpleFontData* brokenIdeographFontData = data.fontData->brokenIdeographFontData();
+                            GlyphPageTreeNode* brokenIdeographNode = GlyphPageTreeNode::getRootChild(brokenIdeographFontData, pageNumber);
+                            const GlyphPage* brokenIdeographPage = brokenIdeographNode->page();
+                            if (brokenIdeographPage) {
+                                GlyphData brokenIdeographData = brokenIdeographPage->glyphDataForCharacter(c);
+                                if (brokenIdeographData.fontData)
+                                    return brokenIdeographData;
+                            }
+                            
+                            // Shouldn't be possible to even reach this point.
+                            ASSERT_NOT_REACHED();
+                        }
+                    } else {
+                        if (m_fontDescription.textOrientation() == TextOrientationVerticalRight) {
+                            const SimpleFontData* verticalRightFontData = data.fontData->verticalRightOrientationFontData();
+                            GlyphPageTreeNode* verticalRightNode = GlyphPageTreeNode::getRootChild(verticalRightFontData, pageNumber);
+                            const GlyphPage* verticalRightPage = verticalRightNode->page();
+                            if (verticalRightPage) {
+                                GlyphData verticalRightData = verticalRightPage->glyphDataForCharacter(c);
+                                // If the glyphs are distinct, we will make the assumption that the font has a vertical-right glyph baked
+                                // into it.
+                                if (data.glyph != verticalRightData.glyph)
+                                    return data;
+                                // The glyphs are identical, meaning that we should just use the horizontal glyph.
+                                if (verticalRightData.fontData)
+                                    return verticalRightData;
+                            }
+                        } else if (m_fontDescription.textOrientation() == TextOrientationUpright) {
+                            const SimpleFontData* uprightFontData = data.fontData->uprightOrientationFontData();
+                            GlyphPageTreeNode* uprightNode = GlyphPageTreeNode::getRootChild(uprightFontData, pageNumber);
+                            const GlyphPage* uprightPage = uprightNode->page();
+                            if (uprightPage) {
+                                GlyphData uprightData = uprightPage->glyphDataForCharacter(c);
+                                // If the glyphs are the same, then we know we can just use the horizontal glyph rotated vertically to be upright.
+                                if (data.glyph == uprightData.glyph)
+                                    return data;
+                                // The glyphs are distinct, meaning that the font has a vertical-right glyph baked into it. We can't use that
+                                // glyph, so we fall back to the upright data and use the horizontal glyph.
+                                if (uprightData.fontData)
+                                    return uprightData;
+                            }
                         }
-                        
+
                         // Shouldn't be possible to even reach this point.
                         ASSERT_NOT_REACHED();
                     }
@@ -364,7 +404,7 @@ void Font::drawGlyphBuffer(GraphicsContext* context, const GlyphBuffer& glyphBuf
 
 inline static float offsetToMiddleOfGlyph(const SimpleFontData* fontData, Glyph glyph)
 {
-    if (fontData->orientation() == Horizontal) {
+    if (fontData->platformData().orientation() == Horizontal) {
         FloatRect bounds = fontData->boundsForGlyph(glyph);
         return bounds.x() + bounds.width() / 2;
     }
@@ -412,8 +452,8 @@ float Font::floatWidthForSimpleText(const TextRun& run, GlyphBuffer* glyphBuffer
     it.advance(run.length(), glyphBuffer);
 
     if (glyphOverflow) {
-        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-it.minGlyphBoundingBoxY()) - fontMetrics().ascent());
-        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(it.maxGlyphBoundingBoxY()) - fontMetrics().descent());
+        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-it.minGlyphBoundingBoxY()) - (glyphOverflow->computeBounds ? 0 : fontMetrics().ascent()));
+        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(it.maxGlyphBoundingBoxY()) - (glyphOverflow->computeBounds ? 0 : fontMetrics().descent()));
         glyphOverflow->left = ceilf(it.firstGlyphOverflow());
         glyphOverflow->right = ceilf(it.lastGlyphOverflow());
     }
diff --git a/Source/WebCore/platform/graphics/FontPlatformData.cpp b/Source/WebCore/platform/graphics/FontPlatformData.cpp
new file mode 100644
index 0000000..5a61cdf
--- /dev/null
+++ b/Source/WebCore/platform/graphics/FontPlatformData.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2011 Brent Fulgham
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "FontPlatformData.h"
+
+#include "PlatformString.h"
+#include <wtf/HashMap.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/Vector.h>
+#include <wtf/text/StringHash.h>
+
+using namespace std;
+
+namespace WebCore {
+
+FontPlatformData::FontPlatformData(const FontPlatformData& source)
+    : m_syntheticBold(source.m_syntheticBold)
+    , m_syntheticOblique(source.m_syntheticOblique)
+    , m_orientation(source.m_orientation)
+    , m_textOrientation(source.m_textOrientation)
+    , m_size(source.m_size)
+    , m_widthVariant(source.m_widthVariant)
+    , m_isColorBitmapFont(source.m_isColorBitmapFont)
+{
+    platformDataInit(source);
+}
+
+const FontPlatformData& FontPlatformData::operator=(const FontPlatformData& other)
+{
+    // Check for self-assignment.
+    if (this == &other)
+        return *this;
+
+    m_syntheticBold = other.m_syntheticBold;
+    m_syntheticOblique = other.m_syntheticOblique;
+    m_orientation = other.m_orientation;
+    m_textOrientation = other.m_textOrientation;
+    m_size = other.m_size;
+    m_widthVariant = other.m_widthVariant;
+    m_isColorBitmapFont = other.m_isColorBitmapFont;
+
+    return platformDataAssign(other);
+}
+
+}
diff --git a/Source/WebCore/platform/graphics/FontPlatformData.h b/Source/WebCore/platform/graphics/FontPlatformData.h
new file mode 100644
index 0000000..78c86ef
--- /dev/null
+++ b/Source/WebCore/platform/graphics/FontPlatformData.h
@@ -0,0 +1,359 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc.
+ * Copyright (C) 2006 Michael Emmel mike.emmel@gmail.com
+ * Copyright (C) 2007 Holger Hans Peter Freyther
+ * Copyright (C) 2007 Pioneer Research Center USA, Inc.
+ * Copyright (C) 2010, 2011 Brent Fulgham <bfulgham@webkit.org>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+// FIXME: This is temporary until all ports switch to using this file.
+#if PLATFORM(CHROMIUM) && !OS(DARWIN)
+#include "chromium/FontPlatformData.h"
+#elif PLATFORM(QT)
+#include "qt/FontPlatformData.h"
+#elif PLATFORM(WIN) && OS(WINCE)
+#include "wince/FontPlatformData.h"
+#elif PLATFORM(WX)
+#include "wx/FontPlatformData.h"
+#elif (PLATFORM(EFL) || PLATFORM(GTK)) && USE(FREETYPE)
+#include "freetype/FontPlatformData.h"
+#elif (PLATFORM(EFL) || PLATFORM(GTK)) && USE(PANGO)
+#include "pango/FontPlatformData.h"
+#else
+
+#ifndef FontPlatformData_h
+#define FontPlatformData_h
+
+#include "FontOrientation.h"
+#include "FontWidthVariant.h"
+#include "GlyphBuffer.h"
+#include "TextOrientation.h"
+
+#if PLATFORM(WIN)
+#include "RefCountedGDIHandle.h"
+#endif
+
+#if PLATFORM(CAIRO)
+#include "HashFunctions.h"
+#include <cairo.h>
+#endif
+
+#if OS(DARWIN)
+#ifdef __OBJC__
+@class NSFont;
+#else
+class NSFont;
+#endif
+
+typedef struct CGFont* CGFontRef;
+#ifndef BUILDING_ON_TIGER
+typedef const struct __CTFont* CTFontRef;
+#endif
+
+#include <CoreFoundation/CFBase.h>
+#include <objc/objc-auto.h>
+#endif
+
+#include <wtf/Forward.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/text/StringImpl.h>
+
+#if PLATFORM(CHROMIUM) && OS(DARWIN)
+#include "CrossProcessFontLoading.h"  
+#endif
+
+#if PLATFORM(WIN)
+typedef struct HFONT__* HFONT;
+#endif
+
+#if PLATFORM(CG)
+typedef struct CGFont* CGFontRef;
+#if OS(DARWIN)
+#ifndef BUILDING_ON_TIGER
+typedef const struct __CTFont* CTFontRef;
+typedef UInt32 ATSUFontID;
+typedef UInt32 ATSFontRef;
+#endif
+#endif
+#endif
+
+namespace WebCore {
+
+class FontDescription;
+
+#if OS(DARWIN) && !defined(BUILDING_ON_TIGER)
+inline CTFontRef toCTFontRef(NSFont *nsFont) { return reinterpret_cast<CTFontRef>(nsFont); }
+#endif
+
+class FontPlatformData {
+public:
+    FontPlatformData(WTF::HashTableDeletedValueType)
+        : m_syntheticBold(false)
+        , m_syntheticOblique(false)
+        , m_orientation(Horizontal)
+        , m_textOrientation(TextOrientationVerticalRight)
+        , m_size(0)
+        , m_widthVariant(RegularWidth)
+#if PLATFORM(WIN)
+        , m_font(WTF::HashTableDeletedValue)
+#elif OS(DARWIN)
+        , m_font(hashTableDeletedFontValue())
+#endif
+#if PLATFORM(CG) && (defined(BUILDING_ON_TIGER) || PLATFORM(WIN))
+        , m_cgFont(0)
+#elif PLATFORM(CAIRO)
+        , m_scaledFont(hashTableDeletedFontValue())
+#endif
+        , m_isColorBitmapFont(false)
+#if PLATFORM(WIN)
+        , m_useGDI(false)
+#endif
+        {
+        }
+
+    FontPlatformData()
+        : m_syntheticBold(false)
+        , m_syntheticOblique(false)
+        , m_orientation(Horizontal)
+        , m_textOrientation(TextOrientationVerticalRight)
+        , m_size(0)
+        , m_widthVariant(RegularWidth)
+#if OS(DARWIN)
+        , m_font(0)
+#endif
+#if PLATFORM(CG) && (defined(BUILDING_ON_TIGER) || PLATFORM(WIN))
+        , m_cgFont(0)
+#elif PLATFORM(CAIRO)
+        , m_scaledFont(0)
+#endif
+        , m_isColorBitmapFont(false)
+#if PLATFORM(WIN)
+        , m_useGDI(false)
+#endif
+    {
+    }
+
+    FontPlatformData(const FontPlatformData&);
+    FontPlatformData(const FontDescription&, const AtomicString& family);
+    FontPlatformData(float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation = Horizontal,
+                     TextOrientation textOrientation = TextOrientationVerticalRight, FontWidthVariant widthVariant = RegularWidth)
+        : m_syntheticBold(syntheticBold)
+        , m_syntheticOblique(syntheticOblique)
+        , m_orientation(orientation)
+        , m_textOrientation(textOrientation)
+        , m_size(size)
+        , m_widthVariant(widthVariant)
+#if OS(DARWIN)
+        , m_font(0)
+#endif
+#if PLATFORM(CG) && (defined(BUILDING_ON_TIGER) || PLATFORM(WIN))
+        , m_cgFont(0)
+#elif PLATFORM(CAIRO)
+        , m_scaledFont(0)
+#endif
+        , m_isColorBitmapFont(false)
+#if PLATFORM(WIN)
+        , m_useGDI(false)
+#endif
+    {
+    }
+
+#if OS(DARWIN)
+    FontPlatformData(NSFont*, float size, bool syntheticBold = false, bool syntheticOblique = false, FontOrientation = Horizontal,
+                     TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth);
+    FontPlatformData(CGFontRef cgFont, float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation,
+                     TextOrientation textOrientation, FontWidthVariant widthVariant)
+        : m_syntheticBold(syntheticBold)
+        , m_syntheticOblique(syntheticOblique)
+        , m_orientation(orientation)
+        , m_textOrientation(textOrientation)
+        , m_size(size)
+        , m_widthVariant(widthVariant)
+        , m_font(0)
+        , m_cgFont(cgFont)
+        , m_isColorBitmapFont(false)
+    {
+    }
+#endif
+#if PLATFORM(WIN)
+    FontPlatformData(HFONT, float size, bool syntheticBold, bool syntheticOblique, bool useGDI);
+#if PLATFORM(CG)
+    FontPlatformData(HFONT, CGFontRef, float size, bool syntheticBold, bool syntheticOblique, bool useGDI);
+#endif
+#endif
+#if PLATFORM(CAIRO)
+    FontPlatformData(cairo_font_face_t*, float size, bool bold, bool italic);
+#endif
+
+    ~FontPlatformData();
+
+#if PLATFORM(WIN)
+    HFONT hfont() const { return m_font ? m_font->handle() : 0; }
+    bool useGDI() const { return m_useGDI; }
+#elif OS(DARWIN)
+    NSFont* font() const { return m_font; }
+    void setFont(NSFont*);
+#endif
+
+#if PLATFORM(CG)
+#if OS(DARWIN)
+#ifndef BUILDING_ON_TIGER
+    CGFontRef cgFont() const { return m_cgFont.get(); }
+#else
+    CGFontRef cgFont() const { return m_cgFont; }
+#endif
+    CTFontRef ctFont() const;
+
+    bool roundsGlyphAdvances() const;
+    bool allowsLigatures() const;
+#else
+    CGFontRef cgFont() const { return m_cgFont.get(); }
+#endif
+#endif
+
+    bool isFixedPitch() const;
+    float size() const { return m_size; }
+    void setSize(float size) { m_size = size; }
+    bool syntheticBold() const { return m_syntheticBold; }
+    bool syntheticOblique() const { return m_syntheticOblique; }
+    bool isColorBitmapFont() const { return m_isColorBitmapFont; }
+    FontOrientation orientation() const { return m_orientation; }
+    TextOrientation textOrientation() const { return m_textOrientation; }
+    FontWidthVariant widthVariant() const { return m_widthVariant; }
+
+    void setOrientation(FontOrientation orientation) { m_orientation = orientation; }
+
+#if PLATFORM(CAIRO)
+    cairo_scaled_font_t* scaledFont() const { return m_scaledFont; }
+#endif
+
+    unsigned hash() const
+    {
+#if PLATFORM(WIN) && !PLATFORM(CAIRO)
+        return m_font ? m_font->hash() : 0;
+#elif OS(DARWIN)
+        ASSERT(m_font || !m_cgFont);
+        uintptr_t hashCodes[3] = { (uintptr_t)m_font, m_widthVariant, m_textOrientation << 3 | m_orientation << 2 | m_syntheticBold << 1 | m_syntheticOblique };
+        return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
+#elif PLATFORM(CAIRO)
+        return PtrHash<cairo_scaled_font_t*>::hash(m_scaledFont);
+#endif
+    }
+
+    const FontPlatformData& operator=(const FontPlatformData&);
+
+    bool operator==(const FontPlatformData& other) const
+    {
+        return platformIsEqual(other)
+            && m_size == other.m_size
+            && m_syntheticBold == other.m_syntheticBold
+            && m_syntheticOblique == other.m_syntheticOblique
+            && m_isColorBitmapFont == other.m_isColorBitmapFont
+            && m_orientation == other.m_orientation
+            && m_textOrientation == other.m_textOrientation
+            && m_widthVariant == other.m_widthVariant;
+    }
+
+    bool isHashTableDeletedValue() const
+    {
+#if PLATFORM(WIN) && !PLATFORM(CAIRO)
+        return m_font.isHashTableDeletedValue();
+#elif OS(DARWIN)
+        return m_font == hashTableDeletedFontValue();
+#elif PLATFORM(CAIRO)
+        return m_scaledFont == hashTableDeletedFontValue();
+#endif
+    }
+
+
+#ifndef NDEBUG
+    String description() const;
+#endif
+
+private:
+    bool platformIsEqual(const FontPlatformData&) const;
+    void platformDataInit(const FontPlatformData&);
+    const FontPlatformData& platformDataAssign(const FontPlatformData&);
+#if OS(DARWIN)
+    // Load various data about the font specified by |nsFont| with the size fontSize into the following output paramters:
+    // Note: Callers should always take into account that for the Chromium port, |outNSFont| isn't necessarily the same
+    // font as |nsFont|. This because the sandbox may block loading of the original font.
+    // * outNSFont - The font that was actually loaded, for the Chromium port this may be different than nsFont.
+    // The caller is responsible for calling CFRelease() on this parameter when done with it.
+    // * cgFont - CGFontRef representing the input font at the specified point size.
+    void loadFont(NSFont*, float fontSize, NSFont*& outNSFont, CGFontRef&);
+    static NSFont* hashTableDeletedFontValue() { return reinterpret_cast<NSFont *>(-1); }
+#elif PLATFORM(WIN)
+    void platformDataInit(HFONT, float size, HDC, WCHAR* faceName);
+#endif
+
+#if PLATFORM(CAIRO)
+    static cairo_scaled_font_t* hashTableDeletedFontValue() { return reinterpret_cast<cairo_scaled_font_t*>(-1); }
+#endif
+
+public:
+    bool m_syntheticBold;
+    bool m_syntheticOblique;
+    FontOrientation m_orientation;
+    TextOrientation m_textOrientation;
+    float m_size;
+    FontWidthVariant m_widthVariant;
+
+private:
+#if OS(DARWIN)
+    NSFont* m_font;
+#elif PLATFORM(WIN)
+    RefPtr<RefCountedGDIHandle<HFONT> > m_font;
+#endif
+
+#if PLATFORM(CG)
+#if PLATFORM(WIN)
+    RetainPtr<CGFontRef> m_cgFont;
+#else
+#ifndef BUILDING_ON_TIGER
+    RetainPtr<CGFontRef> m_cgFont;
+#else
+    CGFontRef m_cgFont; // It is not necessary to refcount this, since either an NSFont owns it or some CachedFont has it referenced.
+#endif
+    mutable RetainPtr<CTFontRef> m_CTFont;
+#endif
+#endif
+
+#if PLATFORM(CAIRO)
+    cairo_scaled_font_t* m_scaledFont;
+#endif
+
+#if PLATFORM(CHROMIUM) && OS(DARWIN)
+    RefPtr<MemoryActivatedFont> m_inMemoryFont;
+#endif
+
+    bool m_isColorBitmapFont;
+
+#if PLATFORM(WIN)
+    bool m_useGDI;
+#endif
+};
+
+} // namespace WebCore
+
+#endif // FontPlatformData_h
+
+#endif
diff --git a/Source/WebCore/platform/graphics/GraphicsContext.h b/Source/WebCore/platform/graphics/GraphicsContext.h
index 5eafa16..c555a5f 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext.h
@@ -42,8 +42,9 @@ typedef struct CGContext PlatformGraphicsContext;
 #elif PLATFORM(CAIRO)
 namespace WebCore {
 class ContextShadow;
+class PlatformContextCairo;
 }
-typedef struct _cairo PlatformGraphicsContext;
+typedef WebCore::PlatformContextCairo PlatformGraphicsContext;
 #elif PLATFORM(OPENVG)
 namespace WebCore {
 class SurfaceOpenVG;
@@ -279,6 +280,9 @@ namespace WebCore {
         
         void setIsCALayerContext(bool);
         bool isCALayerContext() const;
+
+        void setIsAcceleratedContext(bool);
+        bool isAcceleratedContext() const;
 #endif
 
 #if PLATFORM(ANDROID)
@@ -522,6 +526,7 @@ namespace WebCore {
 #endif
 
 #if PLATFORM(CAIRO)
+        GraphicsContext(cairo_t*);
         void pushImageMask(cairo_surface_t*, const FloatRect&);
 #endif
 
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.h b/Source/WebCore/platform/graphics/GraphicsContext3D.h
index a9db650..351b445 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.h
@@ -51,8 +51,8 @@
 @class CALayer;
 @class WebGLLayer;
 #else
-typedef void* CALayer;
-typedef void* WebGLLayer;
+class CALayer;
+class WebGLLayer;
 #endif
 #elif PLATFORM(QT)
 QT_BEGIN_NAMESPACE
@@ -420,6 +420,7 @@ public:
             , antialias(true)
             , premultipliedAlpha(true)
             , canRecoverFromContextLoss(true)
+            , preserveDrawingBuffer(false)
         {
         }
 
@@ -429,6 +430,7 @@ public:
         bool antialias;
         bool premultipliedAlpha;
         bool canRecoverFromContextLoss;
+        bool preserveDrawingBuffer;
     };
 
     enum RenderStyle {
@@ -449,8 +451,8 @@ public:
 
 #if PLATFORM(MAC)
     PlatformGraphicsContext3D platformGraphicsContext3D() const { return m_contextObj; }
-    Platform3DObject platformTexture() const { return m_texture; }
-    CALayer* platformLayer() const { return static_cast<CALayer*>(m_webGLLayer.get()); }
+    Platform3DObject platformTexture() const { return m_compositorTexture; }
+    CALayer* platformLayer() const { return reinterpret_cast<CALayer*>(m_webGLLayer.get()); }
 #elif PLATFORM(CHROMIUM)
     PlatformGraphicsContext3D platformGraphicsContext3D() const;
     Platform3DObject platformTexture() const;
@@ -461,7 +463,7 @@ public:
     PlatformGraphicsContext3D platformGraphicsContext3D();
     Platform3DObject platformTexture() const;
 #if USE(ACCELERATED_COMPOSITING)
-    PlatformLayer* platformLayer() const { return 0; }
+    PlatformLayer* platformLayer() const;
 #endif
 #else
     PlatformGraphicsContext3D platformGraphicsContext3D() const { return NullPlatformGraphicsContext3D; }
@@ -756,10 +758,14 @@ public:
                        int canvasWidth, int canvasHeight, CGContextRef context);
 #endif
 
+    void markContextChanged();
+    void markLayerComposited();
+    bool layerComposited() const;
+
     void paintRenderingResultsToCanvas(CanvasRenderingContext* context);
+    PassRefPtr<ImageData> paintRenderingResultsToImageData();
 
 #if PLATFORM(QT)
-    void paint(QPainter* painter, const QRect& rect) const;
     bool paintsIntoCanvasBuffer() const { return true; }
 #elif PLATFORM(CHROMIUM)
     bool paintsIntoCanvasBuffer() const;
@@ -859,6 +865,10 @@ public:
     // could not be honored based on the capabilities of the OpenGL
     // implementation.
     void validateAttributes();
+
+    // Read rendering results into a pixel array with the same format as the
+    // backbuffer.
+    void readRenderingResults(unsigned char* pixels, int pixelsSize);
 #endif
 
     int m_currentWidth, m_currentHeight;
@@ -881,12 +891,16 @@ public:
 
     CGLContextObj m_contextObj;
     RetainPtr<WebGLLayer> m_webGLLayer;
-    GC3Duint m_texture;
+    GC3Duint m_texture, m_compositorTexture;
     GC3Duint m_fbo;
     GC3Duint m_depthStencilBuffer;
+    bool m_layerComposited;
+    GC3Duint m_internalColorFormat;
 
-    // For tracking which FBO is bound
+    // For tracking which FBO/texture is bound
     GC3Duint m_boundFBO;
+    GC3Denum m_activeTexture;
+    GC3Duint m_boundTexture0;
 
     // For multisampling
     GC3Duint m_multisampleFBO;
diff --git a/Source/WebCore/platform/graphics/GraphicsLayer.h b/Source/WebCore/platform/graphics/GraphicsLayer.h
index e3a62b6..4f234d4 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayer.h
+++ b/Source/WebCore/platform/graphics/GraphicsLayer.h
@@ -46,12 +46,11 @@
 
 #if PLATFORM(MAC)
 #ifdef __OBJC__
-@class WebLayer;
 @class CALayer;
-typedef CALayer PlatformLayer;
 #else
-typedef void* PlatformLayer;
+class CALayer;
 #endif
+typedef CALayer PlatformLayer;
 #elif PLATFORM(WIN)
 typedef struct _CACFLayer PlatformLayer;
 #elif PLATFORM(QT)
diff --git a/Source/WebCore/platform/graphics/ImageBuffer.h b/Source/WebCore/platform/graphics/ImageBuffer.h
index 48878da..860f574 100644
--- a/Source/WebCore/platform/graphics/ImageBuffer.h
+++ b/Source/WebCore/platform/graphics/ImageBuffer.h
@@ -132,6 +132,10 @@ namespace WebCore {
         ImageBuffer(const IntSize&, ColorSpace colorSpace, RenderingMode renderingMode, bool& success);
     };
 
+#if PLATFORM(CG) || USE(SKIA)
+    String ImageDataToDataURL(const ImageData& input, const String& mimeType, const double* quality);
+#endif
+
 } // namespace WebCore
 
 #endif // ImageBuffer_h
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.cpp b/Source/WebCore/platform/graphics/MediaPlayer.cpp
index 70576a5..03004b6 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/Source/WebCore/platform/graphics/MediaPlayer.cpp
@@ -47,6 +47,9 @@
 
 #if PLATFORM(MAC)
 #include "MediaPlayerPrivateQTKit.h"
+#if USE(AVFOUNDATION)
+#include "MediaPlayerPrivateAVFoundationObjC.h"
+#endif
 #define PlatformMediaEngineClassName MediaPlayerPrivateQTKit
 #elif OS(WINCE) && !PLATFORM(QT)
 #include "MediaPlayerPrivateWinCE.h"
@@ -82,7 +85,7 @@ public:
 
     virtual void load(const String&) { }
     virtual void cancelLoad() { }
-    
+
     virtual void prepareToPlay() { }
     virtual void play() { }
     virtual void pause() { }    
@@ -189,11 +192,15 @@ static Vector<MediaPlayerFactory*>& installedMediaEngines()
         MediaPlayerPrivateGStreamer::registerMediaEngine(addMediaEngine);
 #endif
 
+#if USE(AVFOUNDATION) && PLATFORM(MAC)
+        MediaPlayerPrivateAVFoundationObjC::registerMediaEngine(addMediaEngine);
+#endif
+
 #if !PLATFORM(GTK) && !PLATFORM(EFL) && !(PLATFORM(QT) && USE(GSTREAMER))
         PlatformMediaEngineClassName::registerMediaEngine(addMediaEngine);
 #endif
     }
-    
+
     return installedEngines;
 }
 
@@ -241,7 +248,7 @@ static MediaPlayerFactory* bestMediaEngineForTypeAndCodecs(const String& type, c
         if (!codecs.isEmpty())
             return 0;
     }
-    
+
     MediaPlayerFactory* engine = 0;
     MediaPlayer::SupportsType supported = MediaPlayer::IsNotSupported;
     unsigned count = engines.size();
@@ -292,6 +299,7 @@ MediaPlayer::MediaPlayer(MediaPlayerClient* client)
     , m_muted(false)
     , m_preservesPitch(true)
     , m_privateBrowsing(false)
+    , m_shouldPrepareToRender(false)
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     , m_playerProxy(0)
 #endif
@@ -351,7 +359,7 @@ void MediaPlayer::loadWithNextMediaEngine(MediaPlayerFactory* current)
         engine = nextMediaEngine(current);
     else
         engine = bestMediaEngineForTypeAndCodecs(m_contentMIMEType, m_contentTypeCodecs, current);
-    
+
     // Don't delete and recreate the player unless it comes from a different engine.
     if (!engine) {
         m_currentMediaEngine = engine;
@@ -368,6 +376,8 @@ void MediaPlayer::loadWithNextMediaEngine(MediaPlayerFactory* current)
         m_private->setPrivateBrowsingMode(m_privateBrowsing);
         m_private->setPreload(m_preload);
         m_private->setPreservesPitch(preservesPitch());
+        if (m_shouldPrepareToRender)
+            m_private->prepareForRendering();
     }
 
     if (m_private)
@@ -383,17 +393,18 @@ bool MediaPlayer::hasAvailableVideoFrame() const
 {
     return m_private->hasAvailableVideoFrame();
 }
-    
+
 void MediaPlayer::prepareForRendering()
 {
-    return m_private->prepareForRendering();
+    m_shouldPrepareToRender = true;
+    m_private->prepareForRendering();
 }
-    
+
 bool MediaPlayer::canLoadPoster() const
 {
     return m_private->canLoadPoster();
 }
-    
+
 void MediaPlayer::setPoster(const String& url)
 {
     m_private->setPoster(url);
@@ -408,7 +419,7 @@ void MediaPlayer::prepareToPlay()
 {
     m_private->prepareToPlay();
 }
-    
+
 void MediaPlayer::play()
 {
     m_private->play();
@@ -478,7 +489,7 @@ bool MediaPlayer::inMediaDocument()
 {
     Frame* frame = m_frameView ? m_frameView->frame() : 0;
     Document* document = frame ? frame->document() : 0;
-    
+
     return document && document->isMediaDocument();
 }
 
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.h b/Source/WebCore/platform/graphics/MediaPlayer.h
index f41af01..5872c88 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.h
+++ b/Source/WebCore/platform/graphics/MediaPlayer.h
@@ -46,8 +46,10 @@
 #endif
 
 #ifdef __OBJC__
+@class AVPlayer;
 @class QTMovie;
 #else
+class AVPlayer;
 class QTMovie;
 #endif
 class QTMovieGWorld;
@@ -71,6 +73,7 @@ struct PlatformMedia {
         GStreamerGWorldType,
         ChromiumMediaPlayerType,
         QtMediaPlayerType,
+        AVFoundationMediaPlayerType,
     } type;
 
     union {
@@ -80,6 +83,7 @@ struct PlatformMedia {
         GStreamerGWorld* gstreamerGWorld;
         MediaPlayerPrivateInterface* chromiumMediaPlayer;
         MediaPlayerPrivateInterface* qtMediaPlayer;
+        AVPlayer* avfMediaPlayer;
     } media;
 };
 
@@ -115,10 +119,10 @@ public:
 
     // time has jumped, eg. not as a result of normal playback
     virtual void mediaPlayerTimeChanged(MediaPlayer*) { }
-    
+
     // the media file duration has changed, or is now known
     virtual void mediaPlayerDurationChanged(MediaPlayer*) { }
-    
+
     // the playback rate has changed
     virtual void mediaPlayerRateChanged(MediaPlayer*) { }
 
@@ -178,49 +182,53 @@ public:
     IntSize naturalSize();
     bool hasVideo() const;
     bool hasAudio() const;
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
     enum MediaElementType { Video, Audio };
     void setMediaElementType(MediaElementType type) { m_mediaElementType = type; }
     MediaElementType mediaElementType() { return m_mediaElementType; }
 #endif
     
+=======
+
+>>>>>>> webkit.org at r82507
     void setFrameView(FrameView* frameView) { m_frameView = frameView; }
     FrameView* frameView() { return m_frameView; }
     bool inMediaDocument();
-    
+
     IntSize size() const { return m_size; }
     void setSize(const IntSize& size);
-    
+
     void load(const String& url, const ContentType&);
     void cancelLoad();
-    
+
     bool visible() const;
     void setVisible(bool);
-    
+
     void prepareToPlay();
     void play();
     void pause();    
-    
+
     bool paused() const;
     bool seeking() const;
-    
+
     float duration() const;
     float currentTime() const;
     void seek(float time);
 
     float startTime() const;
-    
+
     float rate() const;
     void setRate(float);
 
     bool preservesPitch() const;    
     void setPreservesPitch(bool);
-    
+
     PassRefPtr<TimeRanges> buffered();
     float maxTimeSeekable();
 
     unsigned bytesLoaded();
-    
+
     float volume() const;
     void setVolume(float);
 
@@ -235,13 +243,13 @@ public:
 
     void paint(GraphicsContext*, const IntRect&);
     void paintCurrentFrameInContext(GraphicsContext*, const IntRect&);
-    
+
     enum NetworkState { Empty, Idle, Loading, Loaded, FormatError, NetworkError, DecodeError };
     NetworkState networkState();
 
     enum ReadyState  { HaveNothing, HaveMetadata, HaveCurrentData, HaveFutureData, HaveEnoughData };
     ReadyState readyState();
-    
+
     enum MovieLoadType { Unknown, Download, StoredStream, LiveStream };
     MovieLoadType movieLoadType() const;
 
@@ -320,6 +328,7 @@ private:
     bool m_muted;
     bool m_preservesPitch;
     bool m_privateBrowsing;
+    bool m_shouldPrepareToRender;
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     WebMediaPlayerProxy* m_playerProxy;    // not owned or used, passed to m_private
 #endif
diff --git a/Source/WebCore/platform/graphics/Path.cpp b/Source/WebCore/platform/graphics/Path.cpp
index 55760b1..f7aedbe 100644
--- a/Source/WebCore/platform/graphics/Path.cpp
+++ b/Source/WebCore/platform/graphics/Path.cpp
@@ -83,14 +83,14 @@ static void pathLengthApplierFunction(void* info, const PathElement* element)
     }
 }
 
-float Path::length()
+float Path::length() const
 {
     PathTraversalState traversalState(PathTraversalState::TraversalTotalLength);
     apply(&traversalState, pathLengthApplierFunction);
     return traversalState.m_totalLength;
 }
 
-FloatPoint Path::pointAtLength(float length, bool& ok)
+FloatPoint Path::pointAtLength(float length, bool& ok) const
 {
     PathTraversalState traversalState(PathTraversalState::TraversalPointAtLength);
     traversalState.m_desiredLength = length;
@@ -99,10 +99,10 @@ FloatPoint Path::pointAtLength(float length, bool& ok)
     return traversalState.m_current;
 }
 
-float Path::normalAngleAtLength(float length, bool& ok)
+float Path::normalAngleAtLength(float length, bool& ok) const
 {
     PathTraversalState traversalState(PathTraversalState::TraversalNormalAngleAtLength);
-    traversalState.m_desiredLength = length;
+    traversalState.m_desiredLength = length ? length : std::numeric_limits<float>::epsilon();
     apply(&traversalState, pathLengthApplierFunction);
     ok = traversalState.m_success;
     return traversalState.m_normalAngle;
diff --git a/Source/WebCore/platform/graphics/Path.h b/Source/WebCore/platform/graphics/Path.h
index 31f2cd6..c2ca576 100644
--- a/Source/WebCore/platform/graphics/Path.h
+++ b/Source/WebCore/platform/graphics/Path.h
@@ -112,11 +112,11 @@ namespace WebCore {
         bool contains(const FloatPoint&, WindRule rule = RULE_NONZERO) const;
         bool strokeContains(StrokeStyleApplier*, const FloatPoint&) const;
         FloatRect boundingRect() const;
-        FloatRect strokeBoundingRect(StrokeStyleApplier* = 0);
+        FloatRect strokeBoundingRect(StrokeStyleApplier* = 0) const;
         
-        float length();
-        FloatPoint pointAtLength(float length, bool& ok);
-        float normalAngleAtLength(float length, bool& ok);
+        float length() const;
+        FloatPoint pointAtLength(float length, bool& ok) const;
+        float normalAngleAtLength(float length, bool& ok) const;
 
         void clear();
         bool isEmpty() const;
diff --git a/Source/WebCore/platform/graphics/SimpleFontData.cpp b/Source/WebCore/platform/graphics/SimpleFontData.cpp
index aaab666..82f770d 100644
--- a/Source/WebCore/platform/graphics/SimpleFontData.cpp
+++ b/Source/WebCore/platform/graphics/SimpleFontData.cpp
@@ -47,15 +47,16 @@ using namespace std;
 
 namespace WebCore {
 
-SimpleFontData::SimpleFontData(const FontPlatformData& platformData, bool isCustomFont, bool isLoading)
+SimpleFontData::SimpleFontData(const FontPlatformData& platformData, bool isCustomFont, bool isLoading, bool isTextOrientationFallback)
     : m_maxCharWidth(-1)
     , m_avgCharWidth(-1)
-    , m_orientation(platformData.orientation())
     , m_platformData(platformData)
     , m_treatAsFixedPitch(false)
     , m_isCustomFont(isCustomFont)
     , m_isLoading(isLoading)
-    , m_isBrokenIdeographFont(false)
+    , m_isTextOrientationFallback(isTextOrientationFallback)
+    , m_isBrokenIdeographFallback(false)
+    , m_hasVerticalGlyphs(false)
 {
     platformInit();
     platformGlyphInit();
@@ -64,13 +65,14 @@ SimpleFontData::SimpleFontData(const FontPlatformData& platformData, bool isCust
 
 #if ENABLE(SVG_FONTS)
 SimpleFontData::SimpleFontData(PassOwnPtr<SVGFontData> svgFontData, int size, bool syntheticBold, bool syntheticItalic)
-    : m_orientation(Horizontal)
-    , m_platformData(FontPlatformData(size, syntheticBold, syntheticItalic))
+    : m_platformData(FontPlatformData(size, syntheticBold, syntheticItalic))
     , m_treatAsFixedPitch(false)
     , m_svgFontData(svgFontData)
     , m_isCustomFont(true)
     , m_isLoading(false)
-    , m_isBrokenIdeographFont(false)
+    , m_isTextOrientationFallback(false)
+    , m_isBrokenIdeographFallback(false)
+    , m_hasVerticalGlyphs(false)
 {
     SVGFontFaceElement* svgFontFaceElement = m_svgFontData->svgFontFaceElement();
     unsigned unitsPerEm = svgFontFaceElement->unitsPerEm();
@@ -202,14 +204,34 @@ bool SimpleFontData::isSegmented() const
     return false;
 }
 
+SimpleFontData* SimpleFontData::verticalRightOrientationFontData() const
+{
+    if (!m_derivedFontData)
+        m_derivedFontData = DerivedFontData::create(isCustomFont());
+    if (!m_derivedFontData->verticalRightOrientation) {
+        FontPlatformData verticalRightPlatformData(m_platformData);
+        verticalRightPlatformData.setOrientation(Horizontal);
+        m_derivedFontData->verticalRightOrientation = new SimpleFontData(verticalRightPlatformData, isCustomFont(), false, true);
+    }
+    return m_derivedFontData->verticalRightOrientation.get();
+}
+
+SimpleFontData* SimpleFontData::uprightOrientationFontData() const
+{
+    if (!m_derivedFontData)
+        m_derivedFontData = DerivedFontData::create(isCustomFont());
+    if (!m_derivedFontData->uprightOrientation)
+        m_derivedFontData->uprightOrientation = new SimpleFontData(m_platformData, isCustomFont(), false, true);
+    return m_derivedFontData->uprightOrientation.get();
+}
+
 SimpleFontData* SimpleFontData::brokenIdeographFontData() const
 {
     if (!m_derivedFontData)
         m_derivedFontData = DerivedFontData::create(isCustomFont());
     if (!m_derivedFontData->brokenIdeograph) {
         m_derivedFontData->brokenIdeograph = new SimpleFontData(m_platformData, isCustomFont(), false);
-        m_derivedFontData->brokenIdeograph->m_orientation = Vertical;
-        m_derivedFontData->brokenIdeograph->m_isBrokenIdeographFont = true;
+        m_derivedFontData->brokenIdeograph->m_isBrokenIdeographFallback = true;
     }
     return m_derivedFontData->brokenIdeograph.get();
 }
@@ -242,6 +264,10 @@ SimpleFontData::DerivedFontData::~DerivedFontData()
         GlyphPageTreeNode::pruneTreeCustomFontData(emphasisMark.get());
     if (brokenIdeograph)
         GlyphPageTreeNode::pruneTreeCustomFontData(brokenIdeograph.get());
+    if (verticalRightOrientation)
+        GlyphPageTreeNode::pruneTreeCustomFontData(verticalRightOrientation.get());
+    if (uprightOrientation)
+        GlyphPageTreeNode::pruneTreeCustomFontData(uprightOrientation.get());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/SimpleFontData.h b/Source/WebCore/platform/graphics/SimpleFontData.h
index 93d33bb..dfb4be3 100644
--- a/Source/WebCore/platform/graphics/SimpleFontData.h
+++ b/Source/WebCore/platform/graphics/SimpleFontData.h
@@ -71,7 +71,7 @@ enum Pitch { UnknownPitch, FixedPitch, VariablePitch };
 
 class SimpleFontData : public FontData {
 public:
-    SimpleFontData(const FontPlatformData&, bool isCustomFont = false, bool isLoading = false);
+    SimpleFontData(const FontPlatformData&, bool isCustomFont = false, bool isLoading = false, bool isTextOrientationFallback = false);
 #if ENABLE(SVG_FONTS)
     SimpleFontData(PassOwnPtr<SVGFontData>, int size, bool syntheticBold, bool syntheticItalic);
 #endif
@@ -97,11 +97,13 @@ public:
         return const_cast<SimpleFontData*>(this);
     }
 
+    SimpleFontData* verticalRightOrientationFontData() const;
+    SimpleFontData* uprightOrientationFontData() const;
     SimpleFontData* brokenIdeographFontData() const;
-    
-    // FIXME: Use the actual metrics for fonts with vertical tables instead of just hard-coding.  If the font is horizontally oriented or
-    // a broken ideographic font, then just hard-code to split ascent/descent down the middle.  Otherwise we should actually use the metrics
-    // from the font itself.
+
+    bool hasVerticalGlyphs() const { return m_hasVerticalGlyphs; }
+    bool isTextOrientationFallback() const { return m_isTextOrientationFallback; }
+
     const FontMetrics& fontMetrics() const { return m_fontMetrics; }
     float maxCharWidth() const { return m_maxCharWidth; }
     float avgCharWidth() const { return m_avgCharWidth; }
@@ -137,8 +139,6 @@ public:
     virtual bool isLoading() const { return m_isLoading; }
     virtual bool isSegmented() const;
 
-    bool isBrokenIdeographFont() const { return m_isBrokenIdeographFont; }
-
     const GlyphData& missingGlyphData() const { return m_missingGlyphData; }
 
 #ifndef NDEBUG
@@ -152,7 +152,7 @@ public:
 #endif
 
 #if PLATFORM(MAC) || USE(CORE_TEXT)
-    CFDictionaryRef getCFStringAttributes(TypesettingFeatures) const;
+    CFDictionaryRef getCFStringAttributes(TypesettingFeatures, FontOrientation) const;
 #endif
 
 #if USE(ATSUI)
@@ -183,8 +183,6 @@ public:
     wxFont* getWxFont() const { return m_platformData.font(); }
 #endif
 
-    FontOrientation orientation() const { return m_orientation; }
-
 private:
     void platformInit();
     void platformGlyphInit();
@@ -209,9 +207,6 @@ private:
     float m_maxCharWidth;
     float m_avgCharWidth;
     
-    FontOrientation m_orientation; // This is our supported orientation according to the tables in the font.  FontPlatformData will just always have the desired orientation.
-                                   // This value represents what we actually support.
-
     FontPlatformData m_platformData;
 
     mutable OwnPtr<GlyphMetricsMap<FloatRect> > m_glyphToBoundsMap;
@@ -225,8 +220,11 @@ private:
 
     bool m_isCustomFont;  // Whether or not we are custom font loaded via @font-face
     bool m_isLoading; // Whether or not this custom font is still in the act of loading.
-    bool m_isBrokenIdeographFont;
-
+    
+    bool m_isTextOrientationFallback;
+    bool m_isBrokenIdeographFallback;
+    bool m_hasVerticalGlyphs;
+    
     Glyph m_spaceGlyph;
     float m_spaceWidth;
 
@@ -242,6 +240,8 @@ private:
         OwnPtr<SimpleFontData> smallCaps;
         OwnPtr<SimpleFontData> emphasisMark;
         OwnPtr<SimpleFontData> brokenIdeograph;
+        OwnPtr<SimpleFontData> verticalRightOrientation;
+        OwnPtr<SimpleFontData> uprightOrientation;
 
     private:
         DerivedFontData(bool custom)
diff --git a/Source/WebCore/platform/graphics/TextRun.h b/Source/WebCore/platform/graphics/TextRun.h
index 4e0980b..ec763b9 100644
--- a/Source/WebCore/platform/graphics/TextRun.h
+++ b/Source/WebCore/platform/graphics/TextRun.h
@@ -33,17 +33,21 @@ class RenderSVGResource;
 
 class TextRun {
 public:
-    enum TrailingExpansionBehavior {
-        AllowTrailingExpansion,
-        ForbidTrailingExpansion
+    enum ExpansionBehaviorFlags {
+        ForbidTrailingExpansion = 0 << 0,
+        AllowTrailingExpansion = 1 << 0,
+        ForbidLeadingExpansion = 0 << 1,
+        AllowLeadingExpansion = 1 << 1,
     };
 
-    TextRun(const UChar* c, int len, bool allowTabs = false, float xpos = 0, float expansion = 0, TrailingExpansionBehavior trailingExpansionBehavior = AllowTrailingExpansion, bool rtl = false, bool directionalOverride = false)
+    typedef unsigned ExpansionBehavior;
+
+    TextRun(const UChar* c, int len, bool allowTabs = false, float xpos = 0, float expansion = 0, ExpansionBehavior expansionBehavior = AllowTrailingExpansion | ForbidLeadingExpansion, bool rtl = false, bool directionalOverride = false)
         : m_characters(c)
         , m_len(len)
         , m_xpos(xpos)
         , m_expansion(expansion)
-        , m_trailingExpansionBehavior(trailingExpansionBehavior)
+        , m_expansionBehavior(expansionBehavior)
 #if ENABLE(SVG)
         , m_horizontalGlyphStretch(1)
 #endif
@@ -58,12 +62,12 @@ public:
     {
     }
 
-    TextRun(const String& s, bool allowTabs = false, float xpos = 0, float expansion = 0, TrailingExpansionBehavior trailingExpansionBehavior = AllowTrailingExpansion, bool rtl = false, bool directionalOverride = false)
+    TextRun(const String& s, bool allowTabs = false, float xpos = 0, float expansion = 0, ExpansionBehavior expansionBehavior = AllowTrailingExpansion | ForbidLeadingExpansion, bool rtl = false, bool directionalOverride = false)
         : m_characters(s.characters())
         , m_len(s.length())
         , m_xpos(xpos)
         , m_expansion(expansion)
-        , m_trailingExpansionBehavior(trailingExpansionBehavior)
+        , m_expansionBehavior(expansionBehavior)
 #if ENABLE(SVG)
         , m_horizontalGlyphStretch(1)
 #endif
@@ -94,7 +98,8 @@ public:
     bool allowTabs() const { return m_allowTabs; }
     float xPos() const { return m_xpos; }
     float expansion() const { return m_expansion; }
-    bool allowsTrailingExpansion() const { return m_trailingExpansionBehavior == AllowTrailingExpansion; }
+    bool allowsLeadingExpansion() const { return m_expansionBehavior & AllowLeadingExpansion; }
+    bool allowsTrailingExpansion() const { return m_expansionBehavior & AllowTrailingExpansion; }
     bool rtl() const { return m_rtl; }
     bool ltr() const { return !m_rtl; }
     bool directionalOverride() const { return m_directionalOverride; }
@@ -121,7 +126,7 @@ private:
     // the text line is not the same as left start of the containing block.
     float m_xpos;  
     float m_expansion;
-    TrailingExpansionBehavior m_trailingExpansionBehavior;
+    ExpansionBehavior m_expansionBehavior;
 #if ENABLE(SVG)
     float m_horizontalGlyphStretch;
 #endif
diff --git a/Source/WebCore/platform/graphics/Tile.h b/Source/WebCore/platform/graphics/Tile.h
index c623ec9..02076d2 100644
--- a/Source/WebCore/platform/graphics/Tile.h
+++ b/Source/WebCore/platform/graphics/Tile.h
@@ -49,7 +49,7 @@ public:
     
     bool isDirty() const;
     void invalidate(const IntRect&);
-    void updateBackBuffer();
+    Vector<IntRect> updateBackBuffer();
     void swapBackBufferToFront();
     bool isReadyToPaint() const;
     void paint(GraphicsContext*, const IntRect&);
diff --git a/Source/WebCore/platform/graphics/TiledBackingStore.cpp b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
index 4d69334..ac7e9c6 100644
--- a/Source/WebCore/platform/graphics/TiledBackingStore.cpp
+++ b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
@@ -102,8 +102,6 @@ void TiledBackingStore::updateTileBuffers()
         if (!it->second->isDirty())
             continue;
         dirtyTiles.append(it->second);
-        // FIXME: should not request system repaint for the full tile.
-        paintedArea.append(mapToContents(it->second->rect()));
     }
     
     if (dirtyTiles.isEmpty()) {
@@ -115,11 +113,11 @@ void TiledBackingStore::updateTileBuffers()
     // one by one and then swapped to front in one go. This would minimize the time spent
     // blocking on tile updates.
     unsigned size = dirtyTiles.size();
-    for (unsigned n = 0; n < size; ++n)
-        dirtyTiles[n]->updateBackBuffer();
-
-    for (unsigned n = 0; n < size; ++n)
+    for (unsigned n = 0; n < size; ++n) {
+        Vector<IntRect> paintedRects = dirtyTiles[n]->updateBackBuffer();
+        paintedArea.append(paintedRects);
         dirtyTiles[n]->swapBackBufferToFront();
+    }
 
     m_client->tiledBackingStorePaintEnd(paintedArea);
 }
diff --git a/Source/WebCore/platform/graphics/WOFFFileFormat.cpp b/Source/WebCore/platform/graphics/WOFFFileFormat.cpp
index b1400ba..80a6dcb 100644
--- a/Source/WebCore/platform/graphics/WOFFFileFormat.cpp
+++ b/Source/WebCore/platform/graphics/WOFFFileFormat.cpp
@@ -248,7 +248,7 @@ bool convertWOFFToSfnt(SharedBuffer* woff, Vector<char>& sfnt)
 
     return sfnt.size() == totalSfntSize;
 }
+    
+} // namespace WebCore
 
 #endif // !ENABLE(OPENTYPE_SANITIZER)
-
-} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/WidthIterator.cpp b/Source/WebCore/platform/graphics/WidthIterator.cpp
index 27b0627..750a4ac 100644
--- a/Source/WebCore/platform/graphics/WidthIterator.cpp
+++ b/Source/WebCore/platform/graphics/WidthIterator.cpp
@@ -47,7 +47,7 @@ WidthIterator::WidthIterator(const Font* font, const TextRun& run, HashSet<const
     , m_end(run.length())
     , m_currentCharacter(0)
     , m_runWidthSoFar(0)
-    , m_isAfterExpansion(true)
+    , m_isAfterExpansion(!run.allowsLeadingExpansion())
     , m_fallbackFonts(fallbackFonts)
     , m_accountForGlyphBounds(accountForGlyphBounds)
     , m_maxGlyphBoundingBoxY(numeric_limits<float>::min())
@@ -62,7 +62,7 @@ WidthIterator::WidthIterator(const Font* font, const TextRun& run, HashSet<const
     if (!m_expansion)
         m_expansionPerOpportunity = 0;
     else {
-        bool isAfterExpansion = true;
+        bool isAfterExpansion = m_isAfterExpansion;
         unsigned expansionOpportunityCount = Font::expansionOpportunityCount(m_run.characters(), m_end, m_run.ltr() ? LTR : RTL, isAfterExpansion);
         if (isAfterExpansion && !m_run.allowsTrailingExpansion())
             expansionOpportunityCount--;
@@ -164,18 +164,24 @@ void WidthIterator::advance(int offset, GlyphBuffer* glyphBuffer)
             bool treatAsSpace = Font::treatAsSpace(c);
             if (treatAsSpace || (expandAroundIdeographs && Font::isCJKIdeographOrSymbol(c))) {
                 // Distribute the run's total expansion evenly over all expansion opportunities in the run.
-                if (m_expansion && (m_run.allowsTrailingExpansion() || (m_run.ltr() && currentCharacter + clusterLength < static_cast<size_t>(m_run.length()))
-                    || (m_run.rtl() && currentCharacter))) {
+                if (m_expansion) {
                     if (!treatAsSpace && !m_isAfterExpansion) {
                         // Take the expansion opportunity before this ideograph.
                         m_expansion -= m_expansionPerOpportunity;
                         m_runWidthSoFar += m_expansionPerOpportunity;
-                        if (glyphBuffer)
-                            glyphBuffer->expandLastAdvance(m_expansionPerOpportunity);
+                        if (glyphBuffer) {
+                            if (glyphBuffer->isEmpty())
+                                glyphBuffer->add(fontData->spaceGlyph(), fontData, m_expansionPerOpportunity);
+                            else
+                                glyphBuffer->expandLastAdvance(m_expansionPerOpportunity);
+                        }
+                    }
+                    if (m_run.allowsTrailingExpansion() || (m_run.ltr() && currentCharacter + clusterLength < static_cast<size_t>(m_run.length()))
+                        || (m_run.rtl() && currentCharacter)) {
+                        m_expansion -= m_expansionPerOpportunity;
+                        width += m_expansionPerOpportunity;
+                        m_isAfterExpansion = true;
                     }
-                    m_expansion -= m_expansionPerOpportunity;
-                    width += m_expansionPerOpportunity;
-                    m_isAfterExpansion = true;
                 } else
                     m_isAfterExpansion = false;
 
diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp
new file mode 100644
index 0000000..eb96532
--- /dev/null
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp
@@ -0,0 +1,731 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(VIDEO) && USE(AVFOUNDATION)
+
+#include "MediaPlayerPrivateAVFoundation.h"
+
+#include "ApplicationCacheHost.h"
+#include "DocumentLoader.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "GraphicsLayer.h"
+#include "KURL.h"
+#include "Logging.h"
+#include "SoftLinking.h"
+#include "TimeRanges.h"
+#include <CoreMedia/CoreMedia.h>
+#include <wtf/UnusedParam.h>
+
+using namespace std;
+
+namespace WebCore {
+
+static const float invalidTime = -1.0f;
+
+MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation(MediaPlayer* player)
+    : m_player(player)
+    , m_queuedNotifications()
+    , m_queueMutex()
+    , m_mainThreadCallPending(false)
+    , m_networkState(MediaPlayer::Empty)
+    , m_readyState(MediaPlayer::HaveNothing)
+    , m_preload(MediaPlayer::Auto)
+    , m_scaleFactor(1, 1)
+    , m_cachedMaxTimeLoaded(0)
+    , m_cachedMaxTimeSeekable(0)
+    , m_cachedDuration(invalidTime)
+    , m_reportedDuration(invalidTime)
+    , m_seekTo(invalidTime)
+    , m_requestedRate(1)
+    , m_delayCallbacks(false)
+    , m_havePreparedToPlay(false)
+    , m_assetIsPlayable(false)
+    , m_visible(false)
+    , m_videoFrameHasDrawn(false)
+    , m_loadingMetadata(false)
+    , m_delayingLoad(false)
+    , m_isAllowedToRender(false)
+    , m_cachedHasAudio(false)
+    , m_cachedHasVideo(false)
+    , m_cachedHasCaptions(false)
+    , m_ignoreLoadStateChanges(false)
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::MediaPlayerPrivateAVFoundation(%p)", this);
+}
+
+MediaPlayerPrivateAVFoundation::~MediaPlayerPrivateAVFoundation()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::~MediaPlayerPrivateAVFoundation(%p)", this);
+    cancelCallOnMainThread(mainThreadCallback, this);
+}
+
+MediaPlayerPrivateAVFoundation::MediaRenderingMode MediaPlayerPrivateAVFoundation::currentRenderingMode() const
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (platformLayer())
+        return MediaRenderingToLayer;
+#endif
+
+    if (hasContextRenderer())
+        return MediaRenderingToContext;
+
+    return MediaRenderingNone;
+}
+
+MediaPlayerPrivateAVFoundation::MediaRenderingMode MediaPlayerPrivateAVFoundation::preferredRenderingMode() const
+{
+    if (!m_player->visible() || !m_player->frameView() || assetStatus() == MediaPlayerAVAssetStatusUnknown)
+        return MediaRenderingNone;
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (supportsAcceleratedRendering() && m_player->mediaPlayerClient()->mediaPlayerRenderingCanBeAccelerated(m_player))
+        return MediaRenderingToLayer;
+#endif
+
+    return MediaRenderingToContext;
+}
+
+void MediaPlayerPrivateAVFoundation::setUpVideoRendering()
+{
+    if (!isReadyForVideoSetup())
+        return;
+
+    MediaRenderingMode currentMode = currentRenderingMode();
+    MediaRenderingMode preferredMode = preferredRenderingMode();
+    if (currentMode == preferredMode && currentMode != MediaRenderingNone)
+        return;
+
+    LOG(Media, "MediaPlayerPrivateAVFoundation::setUpVideoRendering(%p) - current mode = %d, preferred mode = %d", 
+        this, static_cast<int>(currentMode), static_cast<int>(preferredMode));
+
+    if (currentMode != MediaRenderingNone)  
+        tearDownVideoRendering();
+
+    switch (preferredMode) {
+    case MediaRenderingNone:
+    case MediaRenderingToContext:
+        createContextVideoRenderer();
+        break;
+        
+#if USE(ACCELERATED_COMPOSITING)
+    case MediaRenderingToLayer:
+        createVideoLayer();
+        break;
+#endif
+    }
+
+#if USE(ACCELERATED_COMPOSITING)
+    // If using a movie layer, inform the client so the compositing tree is updated.
+    if (currentMode == MediaRenderingToLayer || preferredMode == MediaRenderingToLayer) {
+        LOG(Media, "MediaPlayerPrivateAVFoundation::setUpVideoRendering(%p) - calling mediaPlayerRenderingModeChanged()", this);
+        m_player->mediaPlayerClient()->mediaPlayerRenderingModeChanged(m_player);
+    }
+#endif
+}
+
+void MediaPlayerPrivateAVFoundation::tearDownVideoRendering()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::tearDownVideoRendering(%p)", this);
+
+    destroyContextVideoRenderer();
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (platformLayer())
+        destroyVideoLayer();
+#endif
+}
+
+bool MediaPlayerPrivateAVFoundation::hasSetUpVideoRendering() const
+{
+    return hasLayerRenderer() || hasContextRenderer();
+}
+
+void MediaPlayerPrivateAVFoundation::resumeLoad()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::resumeLoad(%p)", this);
+
+    ASSERT(m_delayingLoad);
+    m_delayingLoad = false;
+
+    if (m_assetURL.length())
+        prepareToPlay();
+}
+
+void MediaPlayerPrivateAVFoundation::load(const String& url)
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::load(%p)", this);
+
+    if (m_networkState != MediaPlayer::Loading) {
+        m_networkState = MediaPlayer::Loading;
+        m_player->networkStateChanged();
+    }
+    if (m_readyState != MediaPlayer::HaveNothing) {
+        m_readyState = MediaPlayer::HaveNothing;
+        m_player->readyStateChanged();
+    }
+
+    m_videoFrameHasDrawn = false;
+    m_assetURL = url;
+
+    // Don't do any more work if the url is empty.
+    if (!url.length())
+        return;
+
+    if (m_preload == MediaPlayer::None) {
+        LOG(Media, "MediaPlayerPrivateAVFoundation::load(%p) - preload==none so returning", this);
+        m_delayingLoad = true;
+        return;
+    }
+
+    prepareToPlay();
+}
+
+void MediaPlayerPrivateAVFoundation::playabilityKnown()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::playabilityKnown(%p)", this);
+
+    updateStates();
+    if (m_assetIsPlayable)
+        return;
+
+    // Nothing more to do if we already have all of the item's metadata.
+    if (assetStatus() > MediaPlayerAVAssetStatusLoading) {
+        LOG(Media, "MediaPlayerPrivateAVFoundation::playabilityKnown(%p) - all metadata loaded", this);
+        return;
+    }
+
+    // At this point we are supposed to load metadata. It is OK to ask the asset to load the same 
+    // information multiple times, because if it has already been loaded the completion handler 
+    // will just be called synchronously.
+    m_loadingMetadata = true;
+    beginLoadingMetadata();
+}
+
+void MediaPlayerPrivateAVFoundation::prepareToPlay()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::prepareToPlay(%p)", this);
+
+    m_preload = MediaPlayer::Auto;
+    if (m_havePreparedToPlay)
+        return;
+    m_havePreparedToPlay = true;
+
+    m_delayingLoad = false;
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    Frame* frame = m_player->frameView() ? m_player->frameView()->frame() : 0;
+    ApplicationCacheHost* cacheHost = frame ? frame->loader()->documentLoader()->applicationCacheHost() : 0;
+    ApplicationCacheResource* resource = 0;
+    if (cacheHost && cacheHost->shouldLoadResourceFromApplicationCache(ResourceRequest(m_assetURL), resource) && resource)
+        createAVPlayerForCacheResource(resource);
+    else
+#endif    
+    createAVPlayerForURL(m_assetURL);
+    checkPlayability();
+}
+
+void MediaPlayerPrivateAVFoundation::paint(GraphicsContext*, const IntRect&)
+{
+    // This is the base class, only need to remember that a frame has been drawn.
+    m_videoFrameHasDrawn = true;
+}
+
+float MediaPlayerPrivateAVFoundation::duration() const
+{
+    if (!metaDataAvailable())
+        return 0;
+
+    if (m_cachedDuration == invalidTime) {
+        m_cachedDuration = platformDuration();
+        LOG(Media, "MediaPlayerPrivateAVFMac::duration(%p) - caching %f", this, m_cachedDuration);
+    }
+
+    return m_cachedDuration;
+}
+
+void MediaPlayerPrivateAVFoundation::seek(float time)
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::seek(%p) - seeking to %f", this, time);
+    if (!metaDataAvailable())
+        return;
+
+    if (time > duration())
+        time = duration();
+
+    m_seekTo = time;
+
+    seekToTime(time);
+}
+
+void MediaPlayerPrivateAVFoundation::setRate(float rate)
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::setRate(%p) - seting to %f", this, rate);
+    m_requestedRate = rate;
+}
+
+bool MediaPlayerPrivateAVFoundation::paused() const
+{
+    if (!metaDataAvailable())
+        return true;
+
+    return rate() == 0;
+}
+
+bool MediaPlayerPrivateAVFoundation::seeking() const
+{
+    if (!metaDataAvailable())
+        return false;
+
+    return m_seekTo != invalidTime;
+}
+
+IntSize MediaPlayerPrivateAVFoundation::naturalSize() const
+{
+    if (!metaDataAvailable())
+        return IntSize();
+
+    // In spite of the name of this method, return the natural size transformed by the 
+    // initial movie scale because the spec says intrinsic size is:
+    //
+    //    ... the dimensions of the resource in CSS pixels after taking into account the resource's 
+    //    dimensions, aspect ratio, clean aperture, resolution, and so forth, as defined for the 
+    //    format used by the resource
+
+    return m_cachedNaturalSize;
+}
+
+void MediaPlayerPrivateAVFoundation::setNaturalSize(IntSize size)
+{
+    IntSize oldSize = m_cachedNaturalSize;
+    m_cachedNaturalSize = size;
+    if (oldSize != m_cachedNaturalSize)
+        m_player->sizeChanged();
+}
+
+PassRefPtr<TimeRanges> MediaPlayerPrivateAVFoundation::buffered() const
+{
+    if (!m_cachedLoadedTimeRanges)
+        m_cachedLoadedTimeRanges = platformBufferedTimeRanges();
+
+    return m_cachedLoadedTimeRanges->copy();
+}
+
+float MediaPlayerPrivateAVFoundation::maxTimeSeekable() const
+{
+    if (!metaDataAvailable())
+        return 0;
+
+    if (!m_cachedMaxTimeSeekable)
+        m_cachedMaxTimeSeekable = platformMaxTimeSeekable();
+
+    LOG(Media, "MediaPlayerPrivateAVFoundation::maxTimeSeekable(%p) - returning %f", this, m_cachedMaxTimeSeekable);
+    return m_cachedMaxTimeSeekable;   
+}
+
+float MediaPlayerPrivateAVFoundation::maxTimeLoaded() const
+{
+    if (!metaDataAvailable())
+        return 0;
+
+    if (!m_cachedMaxTimeLoaded)
+        m_cachedMaxTimeLoaded = platformMaxTimeLoaded();
+
+    return m_cachedMaxTimeLoaded;   
+}
+
+unsigned MediaPlayerPrivateAVFoundation::bytesLoaded() const
+{
+    float dur = duration();
+    if (!dur)
+        return 0;
+    unsigned loaded = totalBytes() * maxTimeLoaded() / dur;
+    LOG(Media, "MediaPlayerPrivateAVFoundation::bytesLoaded(%p) - returning %i", this, loaded);
+    return loaded;
+}
+
+bool MediaPlayerPrivateAVFoundation::isReadyForVideoSetup() const
+{
+    return m_isAllowedToRender && m_readyState >= MediaPlayer::HaveMetadata && m_player->visible();
+}
+
+void MediaPlayerPrivateAVFoundation::prepareForRendering()
+{
+    if (m_isAllowedToRender)
+        return;
+    m_isAllowedToRender = true;
+
+    setUpVideoRendering();
+
+    if (currentRenderingMode() == MediaRenderingToLayer || preferredRenderingMode() == MediaRenderingToLayer)
+        m_player->mediaPlayerClient()->mediaPlayerRenderingModeChanged(m_player);
+}
+
+bool MediaPlayerPrivateAVFoundation::supportsFullscreen() const
+{
+#if ENABLE(FULLSCREEN_API)
+    return true;
+#else
+    // FIXME: WebVideoFullscreenController assumes a QTKit/QuickTime media engine
+    return false;
+#endif
+}
+
+void MediaPlayerPrivateAVFoundation::updateStates()
+{
+    MediaPlayer::NetworkState oldNetworkState = m_networkState;
+    MediaPlayer::ReadyState oldReadyState = m_readyState;
+
+    LOG(Media, "MediaPlayerPrivateAVFoundation::updateStates(%p) - entering with networkState = %i, readyState = %i", 
+        this, static_cast<int>(m_networkState), static_cast<int>(m_readyState));
+
+    if (m_loadingMetadata)
+        m_networkState = MediaPlayer::Loading;
+    else {
+        // -loadValuesAsynchronouslyForKeys:completionHandler: has invoked its handler; test status of keys and determine state.
+        AVAssetStatus avAssetStatus = assetStatus();
+        ItemStatus itemStatus = playerItemStatus();
+        
+        m_assetIsPlayable = (avAssetStatus == MediaPlayerAVAssetStatusPlayable);
+        if (m_readyState < MediaPlayer::HaveMetadata && avAssetStatus > MediaPlayerAVAssetStatusLoading) {
+            if (m_assetIsPlayable) {
+                if (itemStatus == MediaPlayerAVPlayerItemStatusUnknown) {
+                    if (avAssetStatus == MediaPlayerAVAssetStatusFailed || m_preload > MediaPlayer::MetaData) {
+                        // We may have a playable asset that doesn't support inspection prior to playback; go ahead 
+                        // and create the AVPlayerItem now. When the AVPlayerItem becomes ready to play, we will 
+                        // have access to its metadata. Or we may have been asked to become ready to play immediately.
+                        m_networkState = MediaPlayer::Loading;
+                        prepareToPlay();
+                    } else
+                        m_networkState = MediaPlayer::Idle;
+                }
+                if (avAssetStatus == MediaPlayerAVAssetStatusLoaded)
+                    m_readyState = MediaPlayer::HaveMetadata;
+            } else {
+                // FIX ME: fetch the error associated with the @"playable" key to distinguish between format 
+                // and network errors.
+                m_networkState = MediaPlayer::FormatError;
+            }
+        }
+        
+        if (avAssetStatus >= MediaPlayerAVAssetStatusLoaded && itemStatus > MediaPlayerAVPlayerItemStatusUnknown) {
+            if (seeking())
+                m_readyState = m_readyState >= MediaPlayer::HaveMetadata ? MediaPlayer::HaveMetadata : MediaPlayer::HaveNothing;
+            else {
+                float maxLoaded = maxTimeLoaded();
+                switch (itemStatus) {
+                case MediaPlayerAVPlayerItemStatusUnknown:
+                    break;
+                case MediaPlayerAVPlayerItemStatusFailed:
+                    m_networkState = MediaPlayer::DecodeError;
+                    break;
+                case MediaPlayerAVPlayerItemStatusPlaybackLikelyToKeepUp:
+                    m_readyState = MediaPlayer::HaveEnoughData;
+                    break;
+                case MediaPlayerAVPlayerItemStatusReadyToPlay:
+                case MediaPlayerAVPlayerItemStatusPlaybackBufferEmpty:
+                case MediaPlayerAVPlayerItemStatusPlaybackBufferFull:
+                    if (maxLoaded > currentTime())
+                        m_readyState = MediaPlayer::HaveFutureData;
+                    else
+                        m_readyState = MediaPlayer::HaveCurrentData;
+                    break;
+                }
+
+                if (itemStatus >= MediaPlayerAVPlayerItemStatusReadyToPlay)
+                    m_networkState = (maxLoaded == duration()) ? MediaPlayer::Loaded : MediaPlayer::Loading;
+            }
+        }
+    }
+
+    if (isReadyForVideoSetup() && currentRenderingMode() != preferredRenderingMode())
+        setUpVideoRendering();
+
+    if (m_networkState != oldNetworkState)
+        m_player->networkStateChanged();
+
+    if (m_readyState != oldReadyState)
+        m_player->readyStateChanged();
+
+    LOG(Media, "MediaPlayerPrivateAVFoundation::updateStates(%p) - exiting with networkState = %i, readyState = %i", 
+        this, static_cast<int>(m_networkState), static_cast<int>(m_readyState));
+}
+
+void MediaPlayerPrivateAVFoundation::setSize(const IntSize&) 
+{ 
+}
+
+void MediaPlayerPrivateAVFoundation::setVisible(bool visible)
+{
+    if (m_visible == visible)
+        return;
+
+    m_visible = visible;
+    if (visible)
+        setUpVideoRendering();
+    else
+        tearDownVideoRendering();
+}
+
+bool MediaPlayerPrivateAVFoundation::hasAvailableVideoFrame() const
+{
+    if (currentRenderingMode() == MediaRenderingToLayer)
+        return videoLayerIsReadyToDisplay();
+
+    // When using the software renderer we hope someone will signal that a frame is available so we might as well
+    // wait until we know that a frame has been drawn.
+    return m_videoFrameHasDrawn;
+}
+
+void MediaPlayerPrivateAVFoundation::acceleratedRenderingStateChanged()
+{
+    // Set up or change the rendering path if necessary.
+    setUpVideoRendering();
+}
+
+void MediaPlayerPrivateAVFoundation::metadataLoaded()
+{
+    m_loadingMetadata = false;
+    updateStates();
+}
+
+void MediaPlayerPrivateAVFoundation::loadStateChanged()
+{
+    if (m_ignoreLoadStateChanges)
+        return;
+    updateStates();
+}
+
+void MediaPlayerPrivateAVFoundation::rateChanged()
+{
+    updateStates();
+    m_player->rateChanged();
+}
+
+void MediaPlayerPrivateAVFoundation::loadedTimeRangesChanged()
+{
+    m_cachedLoadedTimeRanges = 0;
+    m_cachedMaxTimeLoaded = 0;
+    updateStates();
+
+    // For some media files, reported duration is estimated and updated as media is loaded
+    // so report duration changed when the estimate is upated.
+    float dur = duration();
+    if (dur != m_reportedDuration) {
+        if (m_reportedDuration != invalidTime)
+            m_player->durationChanged();
+        m_reportedDuration = dur;
+    }
+}
+
+void MediaPlayerPrivateAVFoundation::seekableTimeRangesChanged()
+{
+    m_cachedMaxTimeSeekable = 0;
+}
+
+void MediaPlayerPrivateAVFoundation::timeChanged(double time)
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::timeChanged(%p) - time = %f", this, time);
+
+    if (m_seekTo == invalidTime)
+        return;
+
+    // AVFoundation may call our observer more than once during a seek, and we can't currently tell
+    // if we will be able to seek to an exact time, so assume that we are done seeking if we are
+    // "close enough" to the seek time.
+    const double smallSeekDelta = 1.0 / 100;
+
+    float currentRate = rate();
+    if ((currentRate > 0 && time >= m_seekTo) || (currentRate < 0 && time <= m_seekTo) || (abs(m_seekTo - time) <= smallSeekDelta)) {
+        m_seekTo = invalidTime;
+        updateStates();
+        m_player->timeChanged();
+    }
+}
+
+void MediaPlayerPrivateAVFoundation::didEnd()
+{
+    // Hang onto the current time and use it as duration from now on since we are definitely at
+    // the end of the movie. Do this because the initial duration is sometimes an estimate.
+    float now = currentTime();
+    if (now > 0)
+        m_cachedDuration = now;
+
+    updateStates();
+    m_player->timeChanged();
+}
+
+void MediaPlayerPrivateAVFoundation::repaint()
+{
+    m_videoFrameHasDrawn = true;
+    m_player->repaint();
+}
+
+MediaPlayer::MovieLoadType MediaPlayerPrivateAVFoundation::movieLoadType() const
+{
+    if (!metaDataAvailable() || assetStatus() == MediaPlayerAVAssetStatusUnknown)
+        return MediaPlayer::Unknown;
+
+    if (isinf(duration()))
+        return MediaPlayer::LiveStream;
+
+    return MediaPlayer::Download;
+}
+
+void MediaPlayerPrivateAVFoundation::setPreload(MediaPlayer::Preload preload)
+{
+    m_preload = preload;
+    if (m_delayingLoad && m_preload != MediaPlayer::None)
+        resumeLoad();
+}
+
+void MediaPlayerPrivateAVFoundation::setDelayCallbacks(bool delay)
+{
+    MutexLocker lock(m_queueMutex);
+    if (delay)
+        ++m_delayCallbacks;
+    else {
+        ASSERT(m_delayCallbacks);
+        --m_delayCallbacks;
+    }
+}
+
+void MediaPlayerPrivateAVFoundation::mainThreadCallback(void* context)
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::mainThreadCallback(%p)", context);
+    MediaPlayerPrivateAVFoundation* player = static_cast<MediaPlayerPrivateAVFoundation*>(context);
+    player->clearMainThreadPendingFlag();
+    player->dispatchNotification();
+}
+
+void MediaPlayerPrivateAVFoundation::clearMainThreadPendingFlag()
+{
+    MutexLocker lock(m_queueMutex);
+    m_mainThreadCallPending = false;
+}
+
+void MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification(Notification::Type type, double time)
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification(%p) - notification %d", this, static_cast<int>(type));
+    m_queueMutex.lock();
+
+    // It is important to always process the properties in the order that we are notified, 
+    // so always go through the queue because notifications happen on different threads.
+    m_queuedNotifications.append(Notification(type, time));
+
+    bool delayDispatch = m_delayCallbacks || !isMainThread();
+    if (delayDispatch && !m_mainThreadCallPending) {
+        m_mainThreadCallPending = true;
+        callOnMainThread(mainThreadCallback, this);
+    }
+
+    m_queueMutex.unlock();
+
+    if (delayDispatch) {
+        LOG(Media, "MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification(%p) - early return", this);
+        return;
+    }
+
+    dispatchNotification();
+}
+
+void MediaPlayerPrivateAVFoundation::dispatchNotification()
+{
+    ASSERT(isMainThread());
+
+    Notification notification = Notification();
+    {
+        MutexLocker lock(m_queueMutex);
+        
+        if (m_queuedNotifications.isEmpty())
+            return;
+        
+        if (!m_delayCallbacks) {
+            // Only dispatch one notification callback per invocation because they can cause recursion.
+            notification = m_queuedNotifications.first();
+            m_queuedNotifications.remove(0);
+        }
+        
+        if (!m_queuedNotifications.isEmpty() && !m_mainThreadCallPending)
+            callOnMainThread(mainThreadCallback, this);
+        
+        if (!notification.isValid())
+            return;
+    }
+
+    LOG(Media, "MediaPlayerPrivateAVFoundation::dispatchNotification(%p) - dispatching %d", this, static_cast<int>(notification.type()));
+
+    switch (notification.type()) {
+    case Notification::ItemDidPlayToEndTime:
+        didEnd();
+        break;
+    case Notification::ItemTracksChanged:
+        tracksChanged();
+        break;
+    case Notification::ItemStatusChanged:
+        loadStateChanged();
+        break;
+    case Notification::ItemSeekableTimeRangesChanged:
+        seekableTimeRangesChanged();
+        loadStateChanged();
+        break;
+    case Notification::ItemLoadedTimeRangesChanged:
+        loadedTimeRangesChanged();
+        loadStateChanged();
+        break;
+    case Notification::ItemPresentationSizeChanged:
+        sizeChanged();
+        break;
+    case Notification::ItemIsPlaybackLikelyToKeepUpChanged:
+        loadStateChanged();
+        break;
+    case Notification::ItemIsPlaybackBufferEmptyChanged:
+        loadStateChanged();
+        break;
+    case Notification::ItemIsPlaybackBufferFullChanged:
+        loadStateChanged();
+        break;
+    case Notification::PlayerRateChanged:
+        rateChanged();
+        break;
+    case Notification::PlayerTimeChanged:
+        timeChanged(notification.time());
+        break;
+    case Notification::AssetMetadataLoaded:
+        metadataLoaded();
+        break;
+    case Notification::AssetPlayabilityKnown:
+        playabilityKnown();
+        break;
+    case Notification::None:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
new file mode 100644
index 0000000..a768ab4
--- /dev/null
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h
@@ -0,0 +1,262 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MediaPlayerPrivateAVFoundation_h
+#define MediaPlayerPrivateAVFoundation_h
+
+#if ENABLE(VIDEO) && USE(AVFOUNDATION)
+
+#include "FloatSize.h"
+#include "MediaPlayerPrivate.h"
+#include "Timer.h"
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+class ApplicationCacheResource;
+
+class MediaPlayerPrivateAVFoundation : public MediaPlayerPrivateInterface {
+public:
+
+    virtual void repaint();
+    virtual void metadataLoaded();
+    virtual void loadStateChanged();
+    virtual void playabilityKnown();
+    virtual void rateChanged();
+    virtual void loadedTimeRangesChanged();
+    virtual void seekableTimeRangesChanged();
+    virtual void timeChanged(double);
+    virtual void didEnd();
+
+    class Notification {
+    public:
+        enum Type {
+            None,
+            ItemDidPlayToEndTime,
+            ItemTracksChanged,
+            ItemStatusChanged,
+            ItemSeekableTimeRangesChanged,
+            ItemLoadedTimeRangesChanged,
+            ItemPresentationSizeChanged,
+            ItemIsPlaybackLikelyToKeepUpChanged,
+            ItemIsPlaybackBufferEmptyChanged,
+            ItemIsPlaybackBufferFullChanged,
+            AssetMetadataLoaded,
+            AssetPlayabilityKnown,
+            PlayerRateChanged,
+            PlayerTimeChanged
+        };
+        
+        Notification()
+            : m_type(None)
+            , m_time(0)
+        {
+        }
+
+        Notification(Type type, double time)
+            : m_type(type)
+            , m_time(time)
+        {
+        }
+        
+        Type type() { return m_type; }
+        bool isValid() { return m_type != None; }
+        double time() { return m_time; }
+        
+    private:
+        Type m_type;
+        double m_time;
+    };
+
+    void scheduleMainThreadNotification(Notification::Type, double time = 0);
+    void dispatchNotification();
+    void clearMainThreadPendingFlag();
+
+protected:
+    MediaPlayerPrivateAVFoundation(MediaPlayer*);
+    virtual ~MediaPlayerPrivateAVFoundation();
+
+    // MediaPlayerPrivatePrivateInterface overrides.
+    virtual void load(const String& url);
+    virtual void cancelLoad() = 0;
+
+    virtual void prepareToPlay();
+    virtual PlatformMedia platformMedia() const = 0;
+
+    virtual void play() = 0;
+    virtual void pause() = 0;
+
+    virtual IntSize naturalSize() const;
+    virtual bool hasVideo() const { return m_cachedHasVideo; }
+    virtual bool hasAudio() const { return m_cachedHasAudio; }
+    virtual void setVisible(bool);
+    virtual float duration() const;
+    virtual float currentTime() const = 0;
+    virtual void seek(float);
+    virtual bool seeking() const;
+    virtual void setRate(float);
+    virtual bool paused() const;
+    virtual void setVolume(float) = 0;
+    virtual bool hasClosedCaptions() const { return m_cachedHasCaptions; }
+    virtual void setClosedCaptionsVisible(bool) = 0;
+    virtual MediaPlayer::NetworkState networkState() const { return m_networkState; }
+    virtual MediaPlayer::ReadyState readyState() const { return m_readyState; }
+    virtual float maxTimeSeekable() const;
+    virtual PassRefPtr<TimeRanges> buffered() const;
+    virtual unsigned bytesLoaded() const;
+    virtual void setSize(const IntSize&);
+    virtual void paint(GraphicsContext*, const IntRect&);
+    virtual void paintCurrentFrameInContext(GraphicsContext*, const IntRect&) = 0;
+    virtual void setPreload(MediaPlayer::Preload);
+    virtual bool hasAvailableVideoFrame() const;
+#if USE(ACCELERATED_COMPOSITING)
+    virtual PlatformLayer* platformLayer() const { return 0; }
+    virtual bool supportsAcceleratedRendering() const = 0;
+    virtual void acceleratedRenderingStateChanged();
+#endif
+    virtual bool hasSingleSecurityOrigin() const { return true; }
+    virtual MediaPlayer::MovieLoadType movieLoadType() const;
+    virtual void prepareForRendering();
+    virtual float mediaTimeForTimeValue(float) const = 0;
+
+    virtual bool supportsFullscreen() const;
+
+    // Required interfaces for concrete derived classes.
+    virtual void createAVPlayerForURL(const String& url) = 0;
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    virtual void createAVPlayerForCacheResource(ApplicationCacheResource*) = 0;
+#endif
+
+    enum ItemStatus {
+        MediaPlayerAVPlayerItemStatusUnknown,
+        MediaPlayerAVPlayerItemStatusFailed,
+        MediaPlayerAVPlayerItemStatusReadyToPlay,
+        MediaPlayerAVPlayerItemStatusPlaybackBufferEmpty,
+        MediaPlayerAVPlayerItemStatusPlaybackBufferFull,
+        MediaPlayerAVPlayerItemStatusPlaybackLikelyToKeepUp,
+    };
+    virtual ItemStatus playerItemStatus() const = 0;
+
+    enum AVAssetStatus {
+        MediaPlayerAVAssetStatusUnknown,
+        MediaPlayerAVAssetStatusLoading,
+        MediaPlayerAVAssetStatusFailed,
+        MediaPlayerAVAssetStatusCancelled,
+        MediaPlayerAVAssetStatusLoaded,
+        MediaPlayerAVAssetStatusPlayable,
+    };
+    virtual AVAssetStatus assetStatus() const = 0;
+
+    virtual void checkPlayability() = 0;
+    virtual float rate() const = 0;
+    virtual void seekToTime(float time) = 0;
+    virtual unsigned totalBytes() const = 0;
+    virtual PassRefPtr<TimeRanges> platformBufferedTimeRanges() const = 0;
+    virtual float platformMaxTimeSeekable() const = 0;
+    virtual float platformMaxTimeLoaded() const = 0;
+    virtual float platformDuration() const = 0;
+
+    virtual void beginLoadingMetadata() = 0;
+    virtual void tracksChanged() = 0;
+    virtual void sizeChanged() = 0;
+
+    virtual void createContextVideoRenderer() = 0;
+    virtual void destroyContextVideoRenderer() = 0;
+
+    virtual void createVideoLayer() = 0;
+    virtual void destroyVideoLayer() = 0;
+    virtual bool videoLayerIsReadyToDisplay() const = 0;
+
+    virtual bool hasContextRenderer() const = 0;
+    virtual bool hasLayerRenderer() const = 0;
+
+protected:
+    void resumeLoad();
+    void updateStates();
+
+    void setHasVideo(bool b) { m_cachedHasVideo = b; };
+    void setHasAudio(bool b) { m_cachedHasAudio = b; }
+    void setHasClosedCaptions(bool b) { m_cachedHasCaptions = b; }
+    void setDelayCallbacks(bool);
+    void setIgnoreLoadStateChanges(bool delay) { m_ignoreLoadStateChanges = delay; }
+    void setNaturalSize(IntSize);
+
+    enum MediaRenderingMode { MediaRenderingNone, MediaRenderingToContext, MediaRenderingToLayer };
+    MediaRenderingMode currentRenderingMode() const;
+    MediaRenderingMode preferredRenderingMode() const;
+
+    bool metaDataAvailable() const { return m_readyState >= MediaPlayer::HaveMetadata; }
+    float requestedRate() const { return m_requestedRate; }
+    float maxTimeLoaded() const;
+    bool isReadyForVideoSetup() const;
+    virtual void setUpVideoRendering();
+    virtual void tearDownVideoRendering();
+    bool hasSetUpVideoRendering() const;
+
+    static void mainThreadCallback(void*);
+
+private:
+
+    MediaPlayer* m_player;
+
+    Vector<Notification> m_queuedNotifications;
+    Mutex m_queueMutex;
+    bool m_mainThreadCallPending;
+
+    mutable RefPtr<TimeRanges> m_cachedLoadedTimeRanges;
+
+    MediaPlayer::NetworkState m_networkState;
+    MediaPlayer::ReadyState m_readyState;
+
+    String m_assetURL;
+    MediaPlayer::Preload m_preload;
+    FloatSize m_scaleFactor;
+
+    IntSize m_cachedNaturalSize;
+    mutable float m_cachedMaxTimeLoaded;
+    mutable float m_cachedMaxTimeSeekable;
+    mutable float m_cachedDuration;
+    float m_reportedDuration;
+
+    float m_seekTo;
+    float m_requestedRate;
+    int m_delayCallbacks;
+    bool m_havePreparedToPlay;
+    bool m_assetIsPlayable;
+    bool m_visible;
+    bool m_videoFrameHasDrawn;
+    bool m_loadingMetadata;
+    bool m_delayingLoad;
+    bool m_isAllowedToRender;
+    bool m_cachedHasAudio;
+    bool m_cachedHasVideo;
+    bool m_cachedHasCaptions;
+    bool m_ignoreLoadStateChanges;
+};
+
+}
+
+#endif
+#endif
diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h
new file mode 100644
index 0000000..cc00c15
--- /dev/null
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.h
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MediaPlayerPrivateAVFoundationObjC_h
+#define MediaPlayerPrivateAVFoundationObjC_h
+
+#if ENABLE(VIDEO) && USE(AVFOUNDATION)
+
+#include "MediaPlayerPrivateAVFoundation.h"
+
+#ifdef __OBJC__
+@class AVAsset;
+@class AVPlayer;
+@class AVPlayerItem;
+@class AVPlayerLayer;
+@class AVAssetImageGenerator;
+@class WebCoreAVFMovieObserver;
+#else
+class AVAsset;
+class AVPlayer;
+class AVPlayerItem;
+class AVPlayerLayer;
+class AVAssetImageGenerator;
+class WebCoreAVFMovieObserver;
+typedef struct objc_object *id;
+#endif
+
+namespace WebCore {
+
+class ApplicationCacheResource;
+
+class MediaPlayerPrivateAVFoundationObjC : public MediaPlayerPrivateAVFoundation {
+public:
+
+    static void registerMediaEngine(MediaEngineRegistrar);
+
+    void setAsset(id);
+    virtual void tracksChanged();
+
+private:
+    MediaPlayerPrivateAVFoundationObjC(MediaPlayer*);
+    ~MediaPlayerPrivateAVFoundationObjC();
+
+    // engine support
+    static MediaPlayerPrivateInterface* create(MediaPlayer* player);
+    static void getSupportedTypes(HashSet<String>& types);
+    static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
+    static bool isAvailable();
+
+    virtual void cancelLoad();
+
+    virtual PlatformMedia platformMedia() const;
+
+    virtual void play();
+    virtual void pause();
+    virtual float currentTime() const;
+    virtual void setVolume(float);
+    virtual void setClosedCaptionsVisible(bool);
+    virtual void paint(GraphicsContext*, const IntRect&);
+    virtual void paintCurrentFrameInContext(GraphicsContext*, const IntRect&);
+    virtual PlatformLayer* platformLayer() const;
+    virtual bool supportsAcceleratedRendering() const { return true; }
+    virtual float mediaTimeForTimeValue(float) const;
+
+    virtual void createAVPlayer();
+    virtual void createAVPlayerForURL(const String& url);
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    virtual void createAVPlayerForCacheResource(ApplicationCacheResource*);
+#endif
+    virtual MediaPlayerPrivateAVFoundation::ItemStatus playerItemStatus() const;
+    virtual MediaPlayerPrivateAVFoundation::AVAssetStatus assetStatus() const;
+
+    virtual void checkPlayability();
+    virtual float rate() const;
+    virtual void seekToTime(float time);
+    virtual unsigned totalBytes() const;
+    virtual PassRefPtr<TimeRanges> platformBufferedTimeRanges() const;
+    virtual float platformMaxTimeSeekable() const;
+    virtual float platformDuration() const;
+    virtual float platformMaxTimeLoaded() const;
+    virtual void beginLoadingMetadata();
+    virtual void sizeChanged();
+
+    virtual void createContextVideoRenderer();
+    virtual void destroyContextVideoRenderer();
+
+    virtual void createVideoLayer();
+    virtual void destroyVideoLayer();
+    virtual bool videoLayerIsReadyToDisplay() const;
+
+    virtual bool hasContextRenderer() const;
+    virtual bool hasLayerRenderer() const;
+
+    RetainPtr<CGImageRef> createImageForTimeInRect(float, const IntRect&);
+
+    MediaPlayer* m_player;
+    RetainPtr<AVAsset> m_avAsset;
+    RetainPtr<AVPlayer> m_avPlayer;
+    RetainPtr<AVPlayerItem> m_avPlayerItem;
+    RetainPtr<AVPlayerLayer> m_videoLayer;
+    RetainPtr<WebCoreAVFMovieObserver> m_objcObserver;
+    RetainPtr<AVAssetImageGenerator> m_imageGenerator;
+    id m_timeObserver;
+};
+
+}
+
+#endif
+#endif
diff --git a/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm
new file mode 100644
index 0000000..55eb433
--- /dev/null
+++ b/Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundationObjC.mm
@@ -0,0 +1,811 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "config.h"
+
+#if ENABLE(VIDEO) && USE(AVFOUNDATION)
+
+#import "MediaPlayerPrivateAVFoundationObjC.h"
+
+#import "ApplicationCacheResource.h"
+#import "BlockExceptions.h"
+#import "FloatConversion.h"
+#import "FrameView.h"
+#import "FloatConversion.h"
+#import "GraphicsContext.h"
+#import "KURL.h"
+#import "Logging.h"
+#import "SoftLinking.h"
+#import "TimeRanges.h"
+#import "WebCoreSystemInterface.h"
+#import <objc/objc-runtime.h>
+#import <wtf/UnusedParam.h>
+
+#import <CoreMedia/CoreMedia.h>
+#import <AVFoundation/AVFoundation.h>
+
+SOFT_LINK_FRAMEWORK(AVFoundation)
+SOFT_LINK_FRAMEWORK(CoreMedia)
+
+SOFT_LINK(CoreMedia, CMTimeCompare, int32_t, (CMTime time1, CMTime time2), (time1, time2))
+SOFT_LINK(CoreMedia, CMTimeMakeWithSeconds, CMTime, (Float64 seconds, int32_t preferredTimeScale), (seconds, preferredTimeScale))
+SOFT_LINK(CoreMedia, CMTimeGetSeconds, Float64, (CMTime time), (time))
+SOFT_LINK(CoreMedia, CMTimeRangeGetEnd, CMTime, (CMTimeRange range), (range))
+
+SOFT_LINK_CLASS(AVFoundation, AVPlayer)
+SOFT_LINK_CLASS(AVFoundation, AVPlayerItem)
+SOFT_LINK_CLASS(AVFoundation, AVPlayerLayer)
+SOFT_LINK_CLASS(AVFoundation, AVURLAsset)
+SOFT_LINK_CLASS(AVFoundation, AVAssetImageGenerator)
+
+SOFT_LINK_POINTER(AVFoundation, AVMediaCharacteristicVisual, NSString *)
+SOFT_LINK_POINTER(AVFoundation, AVMediaCharacteristicAudible, NSString *)
+SOFT_LINK_POINTER(AVFoundation, AVMediaTypeClosedCaption, NSString *)
+SOFT_LINK_POINTER(AVFoundation, AVPlayerItemDidPlayToEndTimeNotification, NSString *)
+SOFT_LINK_POINTER(AVFoundation, AVAssetImageGeneratorApertureModeCleanAperture, NSString *)
+
+SOFT_LINK_CONSTANT(CoreMedia, kCMTimeZero, CMTime)
+
+#define AVPlayer getAVPlayerClass()
+#define AVPlayerItem getAVPlayerItemClass()
+#define AVPlayerLayer getAVPlayerLayerClass()
+#define AVURLAsset getAVURLAssetClass()
+#define AVAssetImageGenerator getAVAssetImageGeneratorClass()
+
+#define AVMediaCharacteristicVisual getAVMediaCharacteristicVisual()
+#define AVMediaCharacteristicAudible getAVMediaCharacteristicAudible()
+#define AVMediaTypeClosedCaption getAVMediaTypeClosedCaption()
+#define AVPlayerItemDidPlayToEndTimeNotification getAVPlayerItemDidPlayToEndTimeNotification()
+#define AVAssetImageGeneratorApertureModeCleanAperture getAVAssetImageGeneratorApertureModeCleanAperture()
+
+#define kCMTimeZero getkCMTimeZero()
+
+using namespace WebCore;
+using namespace std;
+
+enum MediaPlayerAVFoundationObservationContext {
+    MediaPlayerAVFoundationObservationContextPlayerItem,
+    MediaPlayerAVFoundationObservationContextPlayer
+};
+
+@interface WebCoreAVFMovieObserver : NSObject
+{
+    MediaPlayerPrivateAVFoundationObjC* m_callback;
+    int m_delayCallbacks;
+}
+-(id)initWithCallback:(MediaPlayerPrivateAVFoundationObjC*)callback;
+-(void)disconnect;
+-(void)playableKnown;
+-(void)metadataLoaded;
+-(void)timeChanged:(double)time;
+-(void)didEnd:(NSNotification *)notification;
+-(void)observeValueForKeyPath:keyPath ofObject:(id)object change:(NSDictionary *)change context:(MediaPlayerAVFoundationObservationContext)context;
+@end
+
+namespace WebCore {
+
+static NSArray *assetMetadataKeyNames();
+static NSArray *itemKVOProperties();
+
+#if !LOG_DISABLED
+static const char *boolString(bool val)
+{
+    return val ? "true" : "false";
+}
+#endif
+
+static const float invalidTime = -1.0f;
+
+MediaPlayerPrivateInterface* MediaPlayerPrivateAVFoundationObjC::create(MediaPlayer* player) 
+{ 
+    return new MediaPlayerPrivateAVFoundationObjC(player);
+}
+
+void MediaPlayerPrivateAVFoundationObjC::registerMediaEngine(MediaEngineRegistrar registrar)
+{
+    if (isAvailable())
+        registrar(create, getSupportedTypes, supportsType, 0, 0, 0);
+}
+
+MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC(MediaPlayer* player)
+    : MediaPlayerPrivateAVFoundation(player)
+    , m_objcObserver(AdoptNS, [[WebCoreAVFMovieObserver alloc] initWithCallback:this])
+    , m_timeObserver(0)
+{
+}
+
+MediaPlayerPrivateAVFoundationObjC::~MediaPlayerPrivateAVFoundationObjC()
+{
+    cancelLoad();
+    [m_objcObserver.get() disconnect];
+}
+
+void MediaPlayerPrivateAVFoundationObjC::cancelLoad()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::cancelLoad(%p)", this);
+    tearDownVideoRendering();
+
+    [[NSNotificationCenter defaultCenter] removeObserver:m_objcObserver.get()];
+
+    // Tell our observer to do nothing when our cancellation of pending loading calls its completion handler.
+    setIgnoreLoadStateChanges(true);
+    if (m_avAsset) {
+        [m_avAsset.get() cancelLoading];
+        m_avAsset = nil;
+    }
+    if (m_avPlayerItem) {
+        for (NSString *keyName in itemKVOProperties())
+            [m_avPlayerItem.get() removeObserver:m_objcObserver.get() forKeyPath:keyName];
+        
+        m_avPlayerItem = nil;
+    }
+    if (m_avPlayer) {
+        if (m_timeObserver)
+            [m_avPlayer.get() removeTimeObserver:m_timeObserver];
+        [m_avPlayer.get() removeObserver:m_objcObserver.get() forKeyPath:@"rate"];
+        m_avPlayer = nil;
+    }
+    setIgnoreLoadStateChanges(false);
+}
+
+bool MediaPlayerPrivateAVFoundationObjC::hasLayerRenderer() const
+{
+    return m_videoLayer;
+}
+
+bool MediaPlayerPrivateAVFoundationObjC::hasContextRenderer() const
+{
+    return m_imageGenerator;
+}
+
+void MediaPlayerPrivateAVFoundationObjC::createContextVideoRenderer()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::createContextVideoRenderer(%p)", this);
+
+    if (!m_avAsset || m_imageGenerator)
+        return;
+
+    m_imageGenerator = [AVAssetImageGenerator assetImageGeneratorWithAsset:m_avAsset.get()];
+
+    [m_imageGenerator.get() setApertureMode:AVAssetImageGeneratorApertureModeCleanAperture];
+    [m_imageGenerator.get() setAppliesPreferredTrackTransform:YES];
+
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::createImageGenerator(%p) - returning %p", this, m_imageGenerator.get());
+}
+
+void MediaPlayerPrivateAVFoundationObjC::destroyContextVideoRenderer()
+{
+    if (!m_imageGenerator)
+        return;
+
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::destroyContextVideoRenderer(%p) - destroying", this, m_imageGenerator.get());
+
+    m_imageGenerator = 0;
+}
+
+void MediaPlayerPrivateAVFoundationObjC::createVideoLayer()
+{
+    if (!m_avPlayer)
+        return;
+
+    if (!m_videoLayer) {
+        m_videoLayer.adoptNS([[AVPlayerLayer alloc] init]);
+        [m_videoLayer.get() setPlayer:m_avPlayer.get()];
+        LOG(Media, "MediaPlayerPrivateAVFoundationObjC::createVideoLayer(%p) - returning", this, m_videoLayer.get());
+    }
+}
+
+void MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer()
+{
+    if (!m_videoLayer)
+        return;
+
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer(%p) - destroying", this, m_videoLayer.get());
+
+    [m_videoLayer.get() setPlayer:nil];
+
+    m_videoLayer = 0;
+}
+
+bool MediaPlayerPrivateAVFoundationObjC::videoLayerIsReadyToDisplay() const
+{
+    return (m_videoLayer && [m_videoLayer.get() isReadyForDisplay]);
+}
+
+void MediaPlayerPrivateAVFoundationObjC::createAVPlayerForURL(const String& url)
+{
+    setDelayCallbacks(true);
+
+    if (!m_avAsset) {
+        NSURL *cocoaURL = KURL(ParsedURLString, url);
+        m_avAsset.adoptNS([[AVURLAsset alloc] initWithURL:cocoaURL options:nil]);
+    }
+    
+    createAVPlayer();
+}
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+void MediaPlayerPrivateAVFoundationObjC::createAVPlayerForCacheResource(ApplicationCacheResource* resource)
+{
+    // AVFoundation can't open arbitrary data pointers, so if this ApplicationCacheResource doesn't 
+    // have a valid local path, just open the resource's original URL.
+    if (resource->path().isEmpty()) {
+        createAVPlayerForURL(resource->url());
+        return;
+    }
+    
+    setDelayCallbacks(true);
+
+    if (!m_avAsset) {
+        NSURL* localURL = [NSURL fileURLWithPath:resource->path()];
+        m_avAsset.adoptNS([[AVURLAsset alloc] initWithURL:localURL options:nil]);
+    }
+
+    createAVPlayer();
+}
+#endif
+
+void MediaPlayerPrivateAVFoundationObjC::createAVPlayer()
+{
+    if (!m_avPlayer) {
+        m_avPlayer.adoptNS([[AVPlayer alloc] init]);
+        
+        [m_avPlayer.get() addObserver:m_objcObserver.get() forKeyPath:@"rate" options:nil context:(void *)MediaPlayerAVFoundationObservationContextPlayer];
+        
+        // Add a time observer, ask to be called infrequently because we don't really want periodic callbacks but
+        // our observer will also be called whenever a seek happens.
+        const double veryLongInterval = 60*60*60*24*30;
+        WebCoreAVFMovieObserver *observer = m_objcObserver.get();
+        m_timeObserver = [m_avPlayer.get() addPeriodicTimeObserverForInterval:CMTimeMakeWithSeconds(veryLongInterval, 10) queue:nil usingBlock:^(CMTime time){
+            [observer timeChanged:CMTimeGetSeconds(time)];
+        }];
+    }
+
+    if (!m_avPlayerItem) {
+        // Create the player item so we can media data. 
+        m_avPlayerItem.adoptNS([[AVPlayerItem alloc] initWithAsset:m_avAsset.get()]);
+        
+        [[NSNotificationCenter defaultCenter] addObserver:m_objcObserver.get()selector:@selector(didEnd:) name:AVPlayerItemDidPlayToEndTimeNotification object:m_avPlayerItem.get()];
+
+        for (NSString *keyName in itemKVOProperties())
+            [m_avPlayerItem.get() addObserver:m_objcObserver.get() forKeyPath:keyName options:nil context:(void *)MediaPlayerAVFoundationObservationContextPlayerItem];
+
+        [m_avPlayer.get() replaceCurrentItemWithPlayerItem:m_avPlayerItem.get()];
+    }
+
+    setDelayCallbacks(false);
+}
+
+void MediaPlayerPrivateAVFoundationObjC::checkPlayability()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::checkPlayability(%p)", this);
+
+    [m_avAsset.get() loadValuesAsynchronouslyForKeys:[NSArray arrayWithObject:@"playable"] completionHandler:^{
+        [m_objcObserver.get() playableKnown];
+    }];
+}
+
+void MediaPlayerPrivateAVFoundationObjC::beginLoadingMetadata()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::playabilityKnown(%p) - requesting metadata loading", this);
+    [m_avAsset.get() loadValuesAsynchronouslyForKeys:[assetMetadataKeyNames() retain] completionHandler:^{
+        [m_objcObserver.get() metadataLoaded];
+    }];
+}
+
+MediaPlayerPrivateAVFoundation::ItemStatus MediaPlayerPrivateAVFoundationObjC::playerItemStatus() const
+{
+    if (!m_avPlayerItem)
+        return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusUnknown;
+
+    AVPlayerItemStatus status = [m_avPlayerItem.get() status];
+    if (status == AVPlayerItemStatusUnknown)
+        return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusUnknown;
+    if (status == AVPlayerItemStatusFailed)
+        return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusFailed;
+    if ([m_avPlayerItem.get() isPlaybackLikelyToKeepUp])
+        return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusPlaybackLikelyToKeepUp;
+    if ([m_avPlayerItem.get() isPlaybackBufferFull])
+        return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusPlaybackBufferFull;
+    if ([m_avPlayerItem.get() isPlaybackBufferEmpty])
+        return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusPlaybackBufferEmpty;
+
+    return MediaPlayerPrivateAVFoundation::MediaPlayerAVPlayerItemStatusReadyToPlay;
+}
+
+PlatformMedia MediaPlayerPrivateAVFoundationObjC::platformMedia() const
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::platformMedia(%p)", this);
+    PlatformMedia pm;
+    pm.type = PlatformMedia::AVFoundationMediaPlayerType;
+    pm.media.avfMediaPlayer = m_avPlayer.get();
+    return pm;
+}
+
+PlatformLayer* MediaPlayerPrivateAVFoundationObjC::platformLayer() const
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::platformLayer(%p)", this);
+    return m_videoLayer.get();
+}
+
+void MediaPlayerPrivateAVFoundationObjC::play()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::play(%p)", this);
+    if (!metaDataAvailable())
+        return;
+
+    setDelayCallbacks(true);
+    [m_avPlayer.get() setRate:requestedRate()];
+    setDelayCallbacks(false);
+}
+
+void MediaPlayerPrivateAVFoundationObjC::pause()
+{
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::pause(%p)", this);
+    if (!metaDataAvailable())
+        return;
+
+    setDelayCallbacks(true);
+    [m_avPlayer.get() setRate:nil];
+    setDelayCallbacks(false);
+}
+
+float MediaPlayerPrivateAVFoundationObjC::platformDuration() const
+{
+    if (!metaDataAvailable() || !m_avPlayerItem)
+        return 0;
+    
+    float duration;
+    CMTime cmDuration = [m_avPlayerItem.get() duration];
+    if (CMTIME_IS_NUMERIC(cmDuration))
+        duration = narrowPrecisionToFloat(CMTimeGetSeconds(cmDuration));
+    else if (CMTIME_IS_INDEFINITE(cmDuration))
+        duration = numeric_limits<float>::infinity();
+    else {
+        LOG(Media, "MediaPlayerPrivateAVFoundationObjC::duration(%p) - invalid duration, returning 0", this);
+        return 0;
+    }
+
+    return duration;
+}
+
+float MediaPlayerPrivateAVFoundationObjC::currentTime() const
+{
+    if (!metaDataAvailable() || !m_avPlayerItem)
+        return 0;
+
+    CMTime itemTime = [m_avPlayerItem.get() currentTime];
+    if (CMTIME_IS_NUMERIC(itemTime))
+        return narrowPrecisionToFloat(CMTimeGetSeconds(itemTime));
+
+    return 0;
+}
+
+void MediaPlayerPrivateAVFoundationObjC::seekToTime(float time)
+{
+    // setCurrentTime generates several event callbacks, update afterwards.
+    setDelayCallbacks(true);
+
+    float now = currentTime();
+    if (time != now)
+        [m_avPlayerItem.get() seekToTime:CMTimeMakeWithSeconds(time, 600) toleranceBefore:kCMTimeZero toleranceAfter:kCMTimeZero];
+    else {
+        // Force a call to the "time changed" notifier manually because a seek to the current time is a noop 
+        // so the seek will never seem to complete.
+        [m_objcObserver.get() timeChanged:now];
+    }
+
+    setDelayCallbacks(false);
+}
+
+void MediaPlayerPrivateAVFoundationObjC::setVolume(float volume)
+{
+    if (!metaDataAvailable())
+        return;
+
+    [m_avPlayer.get() setVolume:volume];
+}
+
+void MediaPlayerPrivateAVFoundationObjC::setClosedCaptionsVisible(bool closedCaptionsVisible)
+{
+    if (!metaDataAvailable())
+        return;
+
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::setClosedCaptionsVisible(%p) - setting to %s", this, boolString(closedCaptionsVisible));
+    [m_avPlayer.get() setClosedCaptionDisplayEnabled:closedCaptionsVisible];
+}
+
+float MediaPlayerPrivateAVFoundationObjC::rate() const
+{
+    if (!metaDataAvailable())
+        return 0;
+
+    return [m_avPlayer.get() rate];
+}
+
+PassRefPtr<TimeRanges> MediaPlayerPrivateAVFoundationObjC::platformBufferedTimeRanges() const
+{
+    RefPtr<TimeRanges> timeRanges = TimeRanges::create();
+
+    if (!m_avPlayerItem)
+        return timeRanges.release();
+
+    NSArray *loadedRanges = [m_avPlayerItem.get() loadedTimeRanges];
+    for (NSValue *thisRangeValue in loadedRanges) {
+        CMTimeRange timeRange = [thisRangeValue CMTimeRangeValue];
+        if (CMTIMERANGE_IS_VALID(timeRange) && !CMTIMERANGE_IS_EMPTY(timeRange)) {
+            float rangeStart = narrowPrecisionToFloat(CMTimeGetSeconds(timeRange.start));
+            float rangeEnd = narrowPrecisionToFloat(CMTimeGetSeconds(CMTimeRangeGetEnd(timeRange)));
+            timeRanges->add(rangeStart, rangeEnd);
+        }
+    }
+    return timeRanges.release();
+}
+
+float MediaPlayerPrivateAVFoundationObjC::platformMaxTimeSeekable() const
+{
+    NSArray *seekableRanges = [m_avPlayerItem.get() seekableTimeRanges];
+    if (!seekableRanges)
+        return 0;
+
+    float maxTimeSeekable = 0;
+    for (NSValue *thisRangeValue in seekableRanges) {
+        CMTimeRange timeRange = [thisRangeValue CMTimeRangeValue];
+        if (!CMTIMERANGE_IS_VALID(timeRange) || CMTIMERANGE_IS_EMPTY(timeRange))
+            continue;
+        
+        float endOfRange = narrowPrecisionToFloat(CMTimeGetSeconds(CMTimeRangeGetEnd(timeRange)));
+        if (maxTimeSeekable < endOfRange)
+            maxTimeSeekable = endOfRange;
+    }
+    return maxTimeSeekable;   
+}
+
+float MediaPlayerPrivateAVFoundationObjC::platformMaxTimeLoaded() const
+{
+    NSArray *loadedRanges = [m_avPlayerItem.get() loadedTimeRanges];
+    if (!loadedRanges)
+        return 0;
+
+    float maxTimeLoaded = 0;
+    for (NSValue *thisRangeValue in loadedRanges) {
+        CMTimeRange timeRange = [thisRangeValue CMTimeRangeValue];
+        if (!CMTIMERANGE_IS_VALID(timeRange) || CMTIMERANGE_IS_EMPTY(timeRange))
+            continue;
+        
+        float endOfRange = narrowPrecisionToFloat(CMTimeGetSeconds(CMTimeRangeGetEnd(timeRange)));
+        if (maxTimeLoaded < endOfRange)
+            maxTimeLoaded = endOfRange;
+    }
+
+    return maxTimeLoaded;   
+}
+
+unsigned MediaPlayerPrivateAVFoundationObjC::totalBytes() const
+{
+    if (!metaDataAvailable())
+        return 0;
+
+    long long totalMediaSize = 0;
+    NSArray *tracks = [m_avAsset.get() tracks];
+    for (AVAssetTrack *thisTrack in tracks)
+        totalMediaSize += [thisTrack totalSampleDataLength];
+
+    return static_cast<unsigned>(totalMediaSize);
+}
+
+void MediaPlayerPrivateAVFoundationObjC::setAsset(id asset)
+{
+    m_avAsset = asset;
+}
+
+MediaPlayerPrivateAVFoundation::AVAssetStatus MediaPlayerPrivateAVFoundationObjC::assetStatus() const
+{
+    if (!m_avAsset)
+        return MediaPlayerAVAssetStatusUnknown;
+
+    for (NSString *keyName in assetMetadataKeyNames()) {
+        AVKeyValueStatus keyStatus = [m_avAsset.get() statusOfValueForKey:keyName error:nil];
+        if (keyStatus < AVKeyValueStatusLoaded)
+            return MediaPlayerAVAssetStatusLoading;// At least one key is not loaded yet.
+        
+        if (keyStatus == AVKeyValueStatusFailed)
+            return MediaPlayerAVAssetStatusFailed; // At least one key could not be loaded.
+        if (keyStatus == AVKeyValueStatusCancelled)
+            return MediaPlayerAVAssetStatusCancelled; // Loading of at least one key was cancelled.
+    }
+
+    if ([[m_avAsset.get() valueForKey:@"playable"] boolValue])
+        return MediaPlayerAVAssetStatusPlayable;
+
+    return MediaPlayerAVAssetStatusLoaded;
+}
+
+void MediaPlayerPrivateAVFoundationObjC::paintCurrentFrameInContext(GraphicsContext* context, const IntRect& rect)
+{
+    if (!metaDataAvailable() || context->paintingDisabled())
+        return;
+
+    paint(context, rect);
+}
+
+void MediaPlayerPrivateAVFoundationObjC::paint(GraphicsContext* context, const IntRect& rect)
+{
+    if (!metaDataAvailable() || context->paintingDisabled())
+        return;
+
+    setDelayCallbacks(true);
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+
+    RetainPtr<CGImageRef> image = createImageForTimeInRect(currentTime(), rect);
+    if (image) {
+        context->save();
+        context->translate(rect.x(), rect.y() + rect.height());
+        context->scale(FloatSize(1.0f, -1.0f));
+        context->setImageInterpolationQuality(InterpolationLow);
+        IntRect paintRect(IntPoint(0, 0), IntSize(rect.width(), rect.height()));
+        CGContextDrawImage(context->platformContext(), CGRectMake(0, 0, paintRect.width(), paintRect.height()), image.get());
+        context->restore();
+        image = 0;
+    }
+
+    END_BLOCK_OBJC_EXCEPTIONS;
+    setDelayCallbacks(false);
+
+    MediaPlayerPrivateAVFoundation::paint(context, rect);
+}
+
+static HashSet<String> mimeTypeCache()
+{
+    DEFINE_STATIC_LOCAL(HashSet<String>, cache, ());
+    static bool typeListInitialized = false;
+
+    if (typeListInitialized)
+        return cache;
+    typeListInitialized = true;
+
+    NSArray *types = [AVURLAsset audiovisualMIMETypes];
+    for (NSString *mimeType in types)
+        cache.add(mimeType);
+
+    return cache;
+} 
+
+RetainPtr<CGImageRef> MediaPlayerPrivateAVFoundationObjC::createImageForTimeInRect(float time, const IntRect& rect)
+{
+    if (!m_imageGenerator)
+        createContextVideoRenderer();
+    ASSERT(m_imageGenerator);
+
+#if !LOG_DISABLED
+    double start = WTF::currentTime();
+#endif
+
+    [m_imageGenerator.get() setMaximumSize:CGSize(rect.size())];
+    CGImageRef image = [m_imageGenerator.get() copyCGImageAtTime:CMTimeMakeWithSeconds(time, 600) actualTime:nil error:nil];
+
+#if !LOG_DISABLED
+    double duration = WTF::currentTime() - start;
+    LOG(Media, "MediaPlayerPrivateAVFoundationObjC::createImageForTimeInRect(%p) - creating image took %.4f", this, narrowPrecisionToFloat(duration));
+#endif
+
+    return image;
+}
+
+void MediaPlayerPrivateAVFoundationObjC::getSupportedTypes(HashSet<String>& supportedTypes)
+{
+    supportedTypes = mimeTypeCache();
+} 
+
+MediaPlayer::SupportsType MediaPlayerPrivateAVFoundationObjC::supportsType(const String& type, const String& codecs)
+{
+    // Only return "IsSupported" if there is no codecs parameter for now as there is no way to ask if it supports an
+    // extended MIME type until rdar://6220037 is fixed.
+    if (mimeTypeCache().contains(type))
+        return codecs.isEmpty() ? MediaPlayer::MayBeSupported : MediaPlayer::IsSupported;
+
+    return MediaPlayer::IsNotSupported;
+}
+
+bool MediaPlayerPrivateAVFoundationObjC::isAvailable()
+{
+    return true;
+}
+
+float MediaPlayerPrivateAVFoundationObjC::mediaTimeForTimeValue(float timeValue) const
+{
+    if (!metaDataAvailable())
+        return timeValue;
+
+    // FIXME - impossible to implement until rdar://8721510 is fixed.
+    return timeValue;
+}
+
+void MediaPlayerPrivateAVFoundationObjC::tracksChanged()
+{
+    // This is called whenever the tracks collection changes so cache hasVideo and hasAudio since we get
+    // asked about those fairly fequently.
+    setHasVideo([[m_avAsset.get() tracksWithMediaCharacteristic:AVMediaCharacteristicVisual] count]);
+    setHasAudio([[m_avAsset.get() tracksWithMediaCharacteristic:AVMediaCharacteristicAudible] count]);
+    setHasClosedCaptions([[m_avAsset.get() tracksWithMediaType:AVMediaTypeClosedCaption] count]);
+
+    sizeChanged();
+}
+
+void MediaPlayerPrivateAVFoundationObjC::sizeChanged()
+{
+    NSArray *tracks = [m_avAsset.get() tracks];
+
+    // Some assets don't report track properties until they are completely ready to play, but we
+    // want to report a size as early as possible so use presentationSize when an asset has no tracks.
+    if (![tracks count]) {
+        setNaturalSize(IntSize([m_avPlayerItem.get() presentationSize]));
+        return;
+    }
+
+    // AVAsset's 'naturalSize' property only considers the movie's first video track, so we need to compute
+    // the union of all visual track rects.
+    CGRect trackUnionRect = CGRectZero;
+    for (AVAssetTrack *track in tracks) {
+        CGSize trackSize = [track naturalSize];
+        CGRect trackRect = CGRectMake(0, 0, trackSize.width, trackSize.height);
+        trackUnionRect = CGRectUnion(trackUnionRect, CGRectApplyAffineTransform(trackRect, [track preferredTransform]));
+    }
+
+    // The movie is always displayed at 0,0 so move the track rect to the origin before using width and height.
+    trackUnionRect = CGRectOffset(trackUnionRect, trackUnionRect.origin.x, trackUnionRect.origin.y);
+    
+    // Also look at the asset's preferred transform so we account for a movie matrix.
+    CGSize naturalSize = CGSizeApplyAffineTransform(trackUnionRect.size, [m_avAsset.get() preferredTransform]);
+
+    // Cache the natural size (setNaturalSize will notify the player if it has changed).
+    setNaturalSize(IntSize(naturalSize));
+}
+
+NSArray* assetMetadataKeyNames()
+{
+    static NSArray* keys;
+    if (!keys) {
+        keys = [[NSArray alloc] initWithObjects:@"duration",
+                    @"naturalSize",
+                    @"preferredTransform",
+                    @"preferredVolume",
+                    @"preferredRate",
+                    @"playable",
+                    @"tracks",
+                   nil];
+    }
+    return keys;
+}
+
+NSArray* itemKVOProperties()
+{
+    static NSArray* keys;
+    if (!keys) {
+        keys = [[NSArray alloc] initWithObjects:@"presentationSize",
+                @"status",
+                @"asset",
+                @"tracks",
+                @"seekableTimeRanges",
+                @"loadedTimeRanges",
+                @"playbackLikelyToKeepUp",
+                @"playbackBufferFull",
+                @"playbackBufferEmpty",
+                nil];
+    }
+    return keys;
+}
+
+} // namespace WebCore
+
+@implementation WebCoreAVFMovieObserver
+
+- (id)initWithCallback:(MediaPlayerPrivateAVFoundationObjC*)callback
+{
+    m_callback = callback;
+    return [super init];
+}
+
+- (void)disconnect
+{
+    [NSObject cancelPreviousPerformRequestsWithTarget:self];
+    m_callback = 0;
+}
+
+- (void)metadataLoaded
+{
+    if (!m_callback)
+        return;
+
+    m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::AssetMetadataLoaded);
+}
+
+- (void)playableKnown
+{
+    if (!m_callback)
+        return;
+
+    m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::AssetPlayabilityKnown);
+}
+
+- (void)timeChanged:(double)time
+{
+    if (!m_callback)
+        return;
+
+    m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::PlayerTimeChanged, time);
+}
+
+- (void)didEnd:(NSNotification *)unusedNotification
+{
+    UNUSED_PARAM(unusedNotification);
+    if (!m_callback)
+        return;
+    m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemDidPlayToEndTime);
+}
+
+- (void)observeValueForKeyPath:keyPath ofObject:(id)object change:(NSDictionary *)change context:(MediaPlayerAVFoundationObservationContext)context
+{
+    UNUSED_PARAM(change);
+
+    LOG(Media, "WebCoreAVFMovieObserver:observeValueForKeyPath(%p) - keyPath = %s", self, [keyPath UTF8String]);
+
+    if (!m_callback)
+        return;
+
+    if (context == MediaPlayerAVFoundationObservationContextPlayerItem) {
+        // A value changed for an AVPlayerItem
+        if ([keyPath isEqualToString:@"status"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemStatusChanged);
+        else if ([keyPath isEqualToString:@"playbackLikelyToKeepUp"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemIsPlaybackLikelyToKeepUpChanged);
+        else if ([keyPath isEqualToString:@"playbackBufferEmpty"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemIsPlaybackBufferEmptyChanged);
+        else if ([keyPath isEqualToString:@"playbackBufferFull"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemIsPlaybackBufferFullChanged);
+        else if ([keyPath isEqualToString:@"asset"])
+            m_callback->setAsset([object asset]);
+        else if ([keyPath isEqualToString:@"loadedTimeRanges"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemLoadedTimeRangesChanged);
+        else if ([keyPath isEqualToString:@"seekableTimeRanges"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemSeekableTimeRangesChanged);
+        else if ([keyPath isEqualToString:@"tracks"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemTracksChanged);
+        else if ([keyPath isEqualToString:@"presentationSize"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::ItemPresentationSizeChanged);
+
+        return;
+    }
+
+    if (context == MediaPlayerAVFoundationObservationContextPlayer) {
+        // A value changed for an AVPlayer.
+        if ([keyPath isEqualToString:@"rate"])
+            m_callback->scheduleMainThreadNotification(MediaPlayerPrivateAVFoundation::Notification::PlayerRateChanged);
+}
+}
+
+@end
+
+#endif
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
index e9663a6..427c7bf 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
@@ -550,11 +550,17 @@ void GraphicsLayerCA::setNeedsDisplay()
     setNeedsDisplayInRect(hugeRect);
 }
 
-void GraphicsLayerCA::setNeedsDisplayInRect(const FloatRect& rect)
+void GraphicsLayerCA::setNeedsDisplayInRect(const FloatRect& r)
 {
     if (!drawsContent())
         return;
 
+    FloatRect rect(r);
+    FloatRect layerBounds(FloatPoint(), m_size);
+    rect.intersect(layerBounds);
+    if (rect.isEmpty())
+        return;
+    
     const size_t maxDirtyRects = 32;
     
     for (size_t i = 0; i < m_dirtyRects.size(); ++i) {
@@ -1601,9 +1607,11 @@ bool GraphicsLayerCA::createTransformAnimationsFromKeyframes(const KeyframeValue
         TransformOperation::OperationType transformOp = isMatrixAnimation ? TransformOperation::MATRIX_3D : functionList[animationIndex];
         RefPtr<PlatformCAAnimation> caAnimation;
 
-#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)
+#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD) || PLATFORM(WIN)
         // CA applies animations in reverse order (<rdar://problem/7095638>) so we need the last one we add (per property)
         // to be non-additive.
+        // FIXME: This fix has not been added to QuartzCore on Windows yet (<rdar://problem/9112233>) so we expect the
+        // reversed animation behavior
         bool additive = animationIndex < (numAnimations - 1);
 #else
         bool additive = animationIndex > 0;
diff --git a/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h b/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h
index a8528fd..8b5a460 100644
--- a/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h
+++ b/Source/WebCore/platform/graphics/ca/PlatformCAAnimation.h
@@ -38,11 +38,10 @@
 #if PLATFORM(MAC)
 #ifdef __OBJC__
 @class CAPropertyAnimation;
-typedef CAPropertyAnimation* PlatformAnimationRef;
 #else
-typedef void* CAPropertyAnimation; // So the m_animation declaration works
-typedef void* PlatformAnimationRef;
+class CAPropertyAnimation;
 #endif
+typedef CAPropertyAnimation* PlatformAnimationRef;
 #elif PLATFORM(WIN)
 typedef struct _CACFAnimation* CACFAnimationRef;
 typedef CACFAnimationRef PlatformAnimationRef;
diff --git a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp
index f2e1950..75f4a10 100644
--- a/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/CACFLayerTreeHost.cpp
@@ -307,13 +307,14 @@ void CACFLayerTreeHost::contextDidChange()
 
 void CACFLayerTreeHost::notifyAnimationsStarted()
 {
+    // Send currentTime to the pending animations. This function is called by CACF in a callback
+    // which occurs after the drawInContext calls. So currentTime is very close to the time
+    // the animations actually start
     double currentTime = WTF::currentTime();
-    double time = currentTime + lastCommitTime() - CACurrentMediaTime();
-    ASSERT(time <= currentTime);
 
     HashSet<RefPtr<PlatformCALayer> >::iterator end = m_pendingAnimatedLayers.end();
     for (HashSet<RefPtr<PlatformCALayer> >::iterator it = m_pendingAnimatedLayers.begin(); it != end; ++it)
-        (*it)->animationStarted(time);
+        (*it)->animationStarted(currentTime);
 
     m_pendingAnimatedLayers.clear();
 }
diff --git a/Source/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp b/Source/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp
index b0588d6..0f90ce4 100644
--- a/Source/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp
@@ -34,6 +34,7 @@
 #include "GraphicsContext.h"
 #include "OwnPtrCairo.h"
 #include "Path.h"
+#include "PlatformContextCairo.h"
 #include "Timer.h"
 #include <cairo.h>
 
@@ -88,7 +89,7 @@ PlatformContext ContextShadow::beginShadowLayer(GraphicsContext* context, const
     adjustBlurDistance(context);
 
     double x1, x2, y1, y2;
-    cairo_clip_extents(context->platformContext(), &x1, &y1, &x2, &y2);
+    cairo_clip_extents(context->platformContext()->cr(), &x1, &y1, &x2, &y2);
     IntRect layerRect = calculateLayerBoundingRect(context, layerArea, IntRect(x1, y1, x2 - x1, y2 - y1));
 
     // Don't paint if we are totally outside the clip region.
@@ -120,7 +121,7 @@ void ContextShadow::endShadowLayer(GraphicsContext* context)
         cairo_surface_mark_dirty(m_layerImage);
     }
 
-    cairo_t* cr = context->platformContext();
+    cairo_t* cr = context->platformContext()->cr();
     cairo_save(cr);
     setSourceRGBAFromColor(cr, m_color);
     cairo_mask_surface(cr, m_layerImage, m_layerOrigin.x(), m_layerOrigin.y());
@@ -198,7 +199,7 @@ void ContextShadow::drawRectShadow(GraphicsContext* context, const IntRect& rect
     int internalShadowHeight = radiusTwice + max(topLeftRadius.height(), topRightRadius.height()) +
         max(bottomLeftRadius.height(), bottomRightRadius.height());
 
-    cairo_t* cr = context->platformContext();
+    cairo_t* cr = context->platformContext()->cr();
 
     // drawShadowedRect still does not work with rotations.
     // https://bugs.webkit.org/show_bug.cgi?id=45042
diff --git a/Source/WebCore/platform/graphics/cairo/FontCairo.cpp b/Source/WebCore/platform/graphics/cairo/FontCairo.cpp
index 2d79499..58a7fd2 100644
--- a/Source/WebCore/platform/graphics/cairo/FontCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/FontCairo.cpp
@@ -36,6 +36,7 @@
 #include "GlyphBuffer.h"
 #include "Gradient.h"
 #include "GraphicsContext.h"
+#include "PlatformContextCairo.h"
 #include "ImageBuffer.h"
 #include "Pattern.h"
 #include "SimpleFontData.h"
@@ -64,7 +65,7 @@ static void drawGlyphsToContext(cairo_t* context, const SimpleFontData* font, Gl
     }
 }
 
-static void drawGlyphsShadow(GraphicsContext* graphicsContext, cairo_t* context, const FloatPoint& point, const SimpleFontData* font, GlyphBufferGlyph* glyphs, int numGlyphs)
+static void drawGlyphsShadow(GraphicsContext* graphicsContext, const FloatPoint& point, const SimpleFontData* font, GlyphBufferGlyph* glyphs, int numGlyphs)
 {
     ContextShadow* shadow = graphicsContext->contextShadow();
     ASSERT(shadow);
@@ -74,6 +75,7 @@ static void drawGlyphsShadow(GraphicsContext* graphicsContext, cairo_t* context,
 
     if (!shadow->mustUseContextShadow(graphicsContext)) {
         // Optimize non-blurry shadows, by just drawing text without the ContextShadow.
+        cairo_t* context = graphicsContext->platformContext()->cr();
         cairo_save(context);
         cairo_translate(context, shadow->m_offset.width(), shadow->m_offset.height());
         setSourceRGBAFromColor(context, shadow->m_color);
@@ -106,9 +108,10 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
         offset += glyphBuffer.advanceAt(from + i);
     }
 
-    cairo_t* cr = context->platformContext();
-    drawGlyphsShadow(context, cr, point, font, glyphs, numGlyphs);
+    PlatformContextCairo* platformContext = context->platformContext();
+    drawGlyphsShadow(context, point, font, glyphs, numGlyphs);
 
+    cairo_t* cr = platformContext->cr();
     cairo_save(cr);
     prepareContextForGlyphDrawing(cr, font, point);
     if (context->textDrawingMode() & TextModeFill) {
diff --git a/Source/WebCore/platform/graphics/cairo/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/cairo/FontCustomPlatformData.h
index 5807102..f8f3c99 100644
--- a/Source/WebCore/platform/graphics/cairo/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/cairo/FontCustomPlatformData.h
@@ -25,6 +25,7 @@
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
 #include "FontWidthVariant.h"
+#include "TextOrientation.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 
@@ -41,7 +42,7 @@ struct FontCustomPlatformData {
 public:
     FontCustomPlatformData(FT_Face, SharedBuffer*);
     ~FontCustomPlatformData();
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
     static bool supportsFormat(const String&);
 
 private:
diff --git a/Source/WebCore/platform/graphics/cairo/GradientCairo.cpp b/Source/WebCore/platform/graphics/cairo/GradientCairo.cpp
index 4e6ed07..225046a 100644
--- a/Source/WebCore/platform/graphics/cairo/GradientCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/GradientCairo.cpp
@@ -29,6 +29,7 @@
 
 #include "CSSParser.h"
 #include "GraphicsContext.h"
+#include "PlatformContextCairo.h"
 #include <cairo.h>
 
 namespace WebCore {
@@ -87,7 +88,7 @@ void Gradient::setPlatformGradientSpaceTransform(const AffineTransform& gradient
 
 void Gradient::fill(GraphicsContext* context, const FloatRect& rect)
 {
-    cairo_t* cr = context->platformContext();
+    cairo_t* cr = context->platformContext()->cr();
 
     context->save();
     cairo_set_source(cr, platformGradient());
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp b/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
index e69a7a5..0fc94df 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
@@ -47,6 +47,7 @@
 #include "NotImplemented.h"
 #include "Path.h"
 #include "Pattern.h"
+#include "PlatformContextCairo.h"
 #include "RefPtrCairo.h"
 #include "SimpleFontData.h"
 #include <cairo.h>
@@ -148,7 +149,7 @@ static inline void drawPathShadow(GraphicsContext* context, PathDrawingStyle dra
         return;
 
     // Calculate the extents of the rendered solid paths.
-    cairo_t* cairoContext = context->platformContext();
+    cairo_t* cairoContext = context->platformContext()->cr();
     OwnPtr<cairo_path_t> path(cairo_copy_path(cairoContext));
 
     FloatRect solidFigureExtents;
@@ -199,12 +200,18 @@ static void strokeCurrentCairoPath(GraphicsContext* context,  cairo_t* cairoCont
     cairo_new_path(cairoContext);
 }
 
-void GraphicsContext::platformInit(PlatformGraphicsContext* cr)
+GraphicsContext::GraphicsContext(cairo_t* cr)
 {
-    m_data = new GraphicsContextPlatformPrivate;
-    m_data->cr = cairo_reference(cr);
-    m_data->syncContext(cr);
-    setPaintingDisabled(!cr);
+    m_data = new GraphicsContextPlatformPrivate(new PlatformContextCairo(cr));
+}
+
+void GraphicsContext::platformInit(PlatformContextCairo* platformContext)
+{
+    m_data = new GraphicsContextPlatformPrivate(platformContext);
+    if (platformContext)
+        m_data->syncContext(platformContext->cr());
+    else
+        setPaintingDisabled(true);
 }
 
 void GraphicsContext::platformDestroy()
@@ -214,20 +221,20 @@ void GraphicsContext::platformDestroy()
 
 AffineTransform GraphicsContext::getCTM() const
 {
-    cairo_t* cr = platformContext();
+    cairo_t* cr = platformContext()->cr();
     cairo_matrix_t m;
     cairo_get_matrix(cr, &m);
     return AffineTransform(m.xx, m.yx, m.xy, m.yy, m.x0, m.y0);
 }
 
-cairo_t* GraphicsContext::platformContext() const
+PlatformContextCairo* GraphicsContext::platformContext() const
 {
-    return m_data->cr;
+    return m_data->platformContext;
 }
 
 void GraphicsContext::savePlatformState()
 {
-    cairo_save(m_data->cr);
+    cairo_save(platformContext()->cr());
     m_data->save();
     m_data->shadowStack.append(m_data->shadow);
     m_data->maskImageStack.append(ImageMaskInformation());
@@ -235,7 +242,8 @@ void GraphicsContext::savePlatformState()
 
 void GraphicsContext::restorePlatformState()
 {
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
+
     const ImageMaskInformation& maskInformation = m_data->maskImageStack.last();
     if (maskInformation.isValid()) {
         const FloatRect& maskRect = maskInformation.maskRect();
@@ -251,7 +259,7 @@ void GraphicsContext::restorePlatformState()
         m_data->shadowStack.removeLast();
     }
 
-    cairo_restore(m_data->cr);
+    cairo_restore(cr);
     m_data->restore();
 }
 
@@ -261,7 +269,7 @@ void GraphicsContext::drawRect(const IntRect& rect)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
 
     if (fillColor().alpha())
@@ -289,7 +297,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
     if (style == NoStroke)
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
 
     float width = strokeThickness();
@@ -376,7 +384,7 @@ void GraphicsContext::drawEllipse(const IntRect& rect)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
     float yRadius = .5 * rect.height();
     float xRadius = .5 * rect.width();
@@ -415,7 +423,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
     float fa = startAngle;
     float falen =  fa + angleSpan;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
 
     if (w != h)
@@ -492,7 +500,7 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     if (npoints <= 1)
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
 
     cairo_save(cr);
     cairo_set_antialias(cr, shouldAntialias ? CAIRO_ANTIALIAS_DEFAULT : CAIRO_ANTIALIAS_NONE);
@@ -522,7 +530,7 @@ void GraphicsContext::clipConvexPolygon(size_t numPoints, const FloatPoint* poin
     if (numPoints <= 1)
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
 
     cairo_new_path(cr);
     cairo_fill_rule_t savedFillRule = cairo_get_fill_rule(cr);
@@ -542,7 +550,7 @@ void GraphicsContext::fillPath(const Path& path)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     setPathOnCairoContext(cr, path.platformPath()->context());
     fillCurrentCairoPath(this, cr);
 }
@@ -552,7 +560,7 @@ void GraphicsContext::strokePath(const Path& path)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     setPathOnCairoContext(cr, path.platformPath()->context());
     strokeCurrentCairoPath(this, cr);
 }
@@ -562,7 +570,7 @@ void GraphicsContext::fillRect(const FloatRect& rect)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
     cairo_rectangle(cr, rect.x(), rect.y(), rect.width(), rect.height());
     fillCurrentCairoPath(this, cr);
@@ -578,7 +586,7 @@ void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorS
         m_data->shadow.drawRectShadow(this, enclosingIntRect(rect));
 
     if (color.alpha())
-        fillRectSourceOver(m_data->cr, rect, color);
+        fillRectSourceOver(platformContext()->cr(), rect, color);
 }
 
 void GraphicsContext::clip(const FloatRect& rect)
@@ -586,7 +594,7 @@ void GraphicsContext::clip(const FloatRect& rect)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_rectangle(cr, rect.x(), rect.y(), rect.width(), rect.height());
     cairo_fill_rule_t savedFillRule = cairo_get_fill_rule(cr);
     cairo_set_fill_rule(cr, CAIRO_FILL_RULE_WINDING);
@@ -600,7 +608,7 @@ void GraphicsContext::clipPath(const Path& path, WindRule clipRule)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     setPathOnCairoContext(cr, path.platformPath()->context());
     cairo_set_fill_rule(cr, clipRule == RULE_EVENODD ? CAIRO_FILL_RULE_EVEN_ODD : CAIRO_FILL_RULE_WINDING);
     cairo_clip(cr);
@@ -638,7 +646,7 @@ void GraphicsContext::drawFocusRing(const Path& path, int width, int /* offset *
     adjustFocusRingColor(ringColor);
     adjustFocusRingLineWidth(width);
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
     appendWebCorePathToCairoContext(cr, path);
     setSourceRGBAFromColor(cr, ringColor);
@@ -655,7 +663,7 @@ void GraphicsContext::drawFocusRing(const Vector<IntRect>& rects, int width, int
 
     unsigned rectCount = rects.size();
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
     cairo_push_group(cr);
     cairo_new_path(cr);
@@ -732,7 +740,7 @@ void GraphicsContext::drawLineForTextChecking(const FloatPoint& origin, float wi
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
 
     switch (style) {
@@ -762,7 +770,7 @@ FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect)
     FloatRect result;
     double x = frect.x();
     double y = frect.y();
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_user_to_device(cr, &x, &y);
     x = round(x);
     y = round(y);
@@ -799,7 +807,7 @@ void GraphicsContext::translate(float x, float y)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_translate(cr, x, y);
     m_data->translate(x, y);
 }
@@ -821,7 +829,7 @@ void GraphicsContext::setPlatformStrokeThickness(float strokeThickness)
     if (paintingDisabled())
         return;
 
-    cairo_set_line_width(m_data->cr, strokeThickness);
+    cairo_set_line_width(platformContext()->cr(), strokeThickness);
 }
 
 void GraphicsContext::setPlatformStrokeStyle(StrokeStyle strokeStyle)
@@ -835,16 +843,16 @@ void GraphicsContext::setPlatformStrokeStyle(StrokeStyle strokeStyle)
     switch (strokeStyle) {
     case NoStroke:
         // FIXME: is it the right way to emulate NoStroke?
-        cairo_set_line_width(m_data->cr, 0);
+        cairo_set_line_width(platformContext()->cr(), 0);
         break;
     case SolidStroke:
-        cairo_set_dash(m_data->cr, 0, 0, 0);
+        cairo_set_dash(platformContext()->cr(), 0, 0, 0);
         break;
     case DottedStroke:
-        cairo_set_dash(m_data->cr, dotPattern, 2, 0);
+        cairo_set_dash(platformContext()->cr(), dotPattern, 2, 0);
         break;
     case DashedStroke:
-        cairo_set_dash(m_data->cr, dashPattern, 2, 0);
+        cairo_set_dash(platformContext()->cr(), dashPattern, 2, 0);
         break;
     }
 }
@@ -859,7 +867,7 @@ void GraphicsContext::concatCTM(const AffineTransform& transform)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     const cairo_matrix_t matrix = cairo_matrix_t(transform);
     cairo_transform(cr, &matrix);
     m_data->concatCTM(transform);
@@ -870,7 +878,7 @@ void GraphicsContext::setCTM(const AffineTransform& transform)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     const cairo_matrix_t matrix = cairo_matrix_t(transform);
     cairo_set_matrix(cr, &matrix);
     m_data->setCTM(transform);
@@ -881,7 +889,7 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     clip(rect);
 
     Path p;
@@ -928,7 +936,7 @@ void GraphicsContext::beginTransparencyLayer(float opacity)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_push_group(cr);
     m_data->layers.append(opacity);
     m_data->beginTransparencyLayer();
@@ -939,7 +947,7 @@ void GraphicsContext::endTransparencyLayer()
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
 
     cairo_pop_group_to_source(cr);
     cairo_paint_with_alpha(cr, m_data->layers.last());
@@ -952,7 +960,7 @@ void GraphicsContext::clearRect(const FloatRect& rect)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
 
     cairo_save(cr);
     cairo_rectangle(cr, rect.x(), rect.y(), rect.width(), rect.height());
@@ -966,7 +974,7 @@ void GraphicsContext::strokeRect(const FloatRect& rect, float width)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
     cairo_rectangle(cr, rect.x(), rect.y(), rect.width(), rect.height());
     cairo_set_line_width(cr, width);
@@ -991,12 +999,12 @@ void GraphicsContext::setLineCap(LineCap lineCap)
         cairoCap = CAIRO_LINE_CAP_SQUARE;
         break;
     }
-    cairo_set_line_cap(m_data->cr, cairoCap);
+    cairo_set_line_cap(platformContext()->cr(), cairoCap);
 }
 
 void GraphicsContext::setLineDash(const DashArray& dashes, float dashOffset)
 {
-    cairo_set_dash(m_data->cr, dashes.data(), dashes.size(), dashOffset);
+    cairo_set_dash(platformContext()->cr(), dashes.data(), dashes.size(), dashOffset);
 }
 
 void GraphicsContext::setLineJoin(LineJoin lineJoin)
@@ -1016,7 +1024,7 @@ void GraphicsContext::setLineJoin(LineJoin lineJoin)
         cairoJoin = CAIRO_LINE_JOIN_BEVEL;
         break;
     }
-    cairo_set_line_join(m_data->cr, cairoJoin);
+    cairo_set_line_join(platformContext()->cr(), cairoJoin);
 }
 
 void GraphicsContext::setMiterLimit(float miter)
@@ -1024,7 +1032,7 @@ void GraphicsContext::setMiterLimit(float miter)
     if (paintingDisabled())
         return;
 
-    cairo_set_miter_limit(m_data->cr, miter);
+    cairo_set_miter_limit(platformContext()->cr(), miter);
 }
 
 void GraphicsContext::setAlpha(float alpha)
@@ -1042,7 +1050,7 @@ void GraphicsContext::setPlatformCompositeOperation(CompositeOperator op)
     if (paintingDisabled())
         return;
 
-    cairo_set_operator(m_data->cr, toCairoOperator(op));
+    cairo_set_operator(platformContext()->cr(), toCairoOperator(op));
 }
 
 void GraphicsContext::clip(const Path& path)
@@ -1050,7 +1058,7 @@ void GraphicsContext::clip(const Path& path)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     OwnPtr<cairo_path_t> p(cairo_copy_path(path.platformPath()->context()));
     cairo_append_path(cr, p.get());
     cairo_fill_rule_t savedFillRule = cairo_get_fill_rule(cr);
@@ -1070,7 +1078,7 @@ void GraphicsContext::clipOut(const Path& path)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     double x1, y1, x2, y2;
     cairo_clip_extents(cr, &x1, &y1, &x2, &y2);
     cairo_rectangle(cr, x1, y1, x2 - x1, y2 - y1);
@@ -1087,7 +1095,7 @@ void GraphicsContext::rotate(float radians)
     if (paintingDisabled())
         return;
 
-    cairo_rotate(m_data->cr, radians);
+    cairo_rotate(platformContext()->cr(), radians);
     m_data->rotate(radians);
 }
 
@@ -1096,7 +1104,7 @@ void GraphicsContext::scale(const FloatSize& size)
     if (paintingDisabled())
         return;
 
-    cairo_scale(m_data->cr, size.width(), size.height());
+    cairo_scale(platformContext()->cr(), size.width(), size.height());
     m_data->scale(size);
 }
 
@@ -1105,7 +1113,7 @@ void GraphicsContext::clipOut(const IntRect& r)
     if (paintingDisabled())
         return;
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     double x1, y1, x2, y2;
     cairo_clip_extents(cr, &x1, &y1, &x2, &y2);
     cairo_rectangle(cr, x1, y1, x2 - x1, y2 - y1);
@@ -1132,7 +1140,7 @@ void GraphicsContext::fillRoundedRect(const IntRect& r, const IntSize& topLeft,
     if (hasShadow())
         m_data->shadow.drawRectShadow(this, r, topLeft, topRight, bottomLeft, bottomRight);
 
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_save(cr);
     Path path;
     path.addRoundedRect(r, topLeft, topRight, bottomLeft, bottomRight);
@@ -1170,7 +1178,7 @@ void GraphicsContext::setPlatformShouldAntialias(bool enable)
     // When true, use the default Cairo backend antialias mode (usually this
     // enables standard 'grayscale' antialiasing); false to explicitly disable
     // antialiasing. This is the same strategy as used in drawConvexPolygon().
-    cairo_set_antialias(m_data->cr, enable ? CAIRO_ANTIALIAS_DEFAULT : CAIRO_ANTIALIAS_NONE);
+    cairo_set_antialias(platformContext()->cr(), enable ? CAIRO_ANTIALIAS_DEFAULT : CAIRO_ANTIALIAS_NONE);
 }
 
 void GraphicsContext::setImageInterpolationQuality(InterpolationQuality)
@@ -1196,7 +1204,7 @@ void GraphicsContext::pushImageMask(cairo_surface_t* surface, const FloatRect& r
     // We want to allow the clipped elements to composite with the surface as it
     // is now, but they are isolated in another group. To make this work, we're
     // going to blit the current surface contents onto the new group once we push it.
-    cairo_t* cr = m_data->cr;
+    cairo_t* cr = platformContext()->cr();
     cairo_surface_t* currentTarget = cairo_get_target(cr);
     cairo_surface_flush(currentTarget);
 
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h b/Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
index 924f69a..2bc290b 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
@@ -31,6 +31,7 @@
 #include "GraphicsContext.h"
 
 #include "ContextShadow.h"
+#include "PlatformContextCairo.h"
 #include "RefPtrCairo.h"
 #include <cairo.h>
 #include <math.h>
@@ -67,8 +68,8 @@ private:
 
 class GraphicsContextPlatformPrivate {
 public:
-    GraphicsContextPlatformPrivate()
-        : cr(0)
+    GraphicsContextPlatformPrivate(PlatformContextCairo* newPlatformContext)
+        : platformContext(newPlatformContext)
 #if PLATFORM(GTK)
         , expose(0)
 #elif PLATFORM(WIN)
@@ -82,7 +83,6 @@ public:
 
     ~GraphicsContextPlatformPrivate()
     {
-        cairo_destroy(cr);
     }
 
 #if PLATFORM(WIN)
@@ -99,7 +99,7 @@ public:
     void setCTM(const AffineTransform&);
     void beginTransparencyLayer() { m_transparencyCount++; }
     void endTransparencyLayer() { m_transparencyCount--; }
-    void syncContext(PlatformGraphicsContext* cr);
+    void syncContext(cairo_t* cr);
 #else
     // On everything else, we do nothing.
     void save() {}
@@ -114,12 +114,11 @@ public:
     void setCTM(const AffineTransform&) {}
     void beginTransparencyLayer() {}
     void endTransparencyLayer() {}
-    void syncContext(PlatformGraphicsContext* cr) {}
+    void syncContext(cairo_t* cr) {}
 #endif
 
-    cairo_t* cr;
+    PlatformContextCairo* platformContext;
     Vector<float> layers;
-
     ContextShadow shadow;
     Vector<ContextShadow> shadowStack;
     Vector<ImageMaskInformation> maskImageStack;
@@ -133,6 +132,23 @@ public:
 #endif
 };
 
+// This is a specialized private section for the Cairo GraphicsContext, which knows how
+// to clean up the heap allocated PlatformContextCairo that we must use for the top-level
+// GraphicsContext.
+class GraphicsContextPlatformPrivateToplevel : public GraphicsContextPlatformPrivate {
+public:
+    GraphicsContextPlatformPrivateToplevel(PlatformContextCairo* platformContext)
+        : GraphicsContextPlatformPrivate(platformContext)
+    {
+    }
+
+    ~GraphicsContextPlatformPrivateToplevel()
+    {
+        delete platformContext;
+    }
+};
+
+
 } // namespace WebCore
 
 #endif // GraphicsContextPlatformPrivateCairo_h
diff --git a/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp b/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
index 9ee8a94..1d5d492 100644
--- a/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
@@ -37,7 +37,9 @@
 #include "MIMETypeRegistry.h"
 #include "NotImplemented.h"
 #include "Pattern.h"
+#include "PlatformContextCairo.h"
 #include "PlatformString.h"
+#include "RefPtrCairo.h"
 #include <cairo.h>
 #include <wtf/Vector.h>
 
@@ -66,6 +68,7 @@ namespace WebCore {
 
 ImageBufferData::ImageBufferData(const IntSize& size)
     : m_surface(0)
+    , m_platformContext(0)
 {
 }
 
@@ -80,9 +83,9 @@ ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace, RenderingMode, bool& s
     if (cairo_surface_status(m_data.m_surface) != CAIRO_STATUS_SUCCESS)
         return;  // create will notice we didn't set m_initialized and fail.
 
-    cairo_t* cr = cairo_create(m_data.m_surface);
-    m_context.set(new GraphicsContext(cr));
-    cairo_destroy(cr);  // The context is now owned by the GraphicsContext.
+    RefPtr<cairo_t> cr = adoptRef(cairo_create(m_data.m_surface));
+    m_data.m_platformContext.setCr(cr.get());
+    m_context.set(new GraphicsContext(&m_data.m_platformContext));
     success = true;
 }
 
@@ -301,7 +304,7 @@ static cairo_status_t writeFunction(void* closure, const unsigned char* data, un
 
 String ImageBuffer::toDataURL(const String& mimeType, const double*) const
 {
-    cairo_surface_t* image = cairo_get_target(context()->platformContext());
+    cairo_surface_t* image = cairo_get_target(context()->platformContext()->cr());
     if (!image)
         return "data:,";
 
diff --git a/Source/WebCore/platform/graphics/cairo/ImageBufferData.h b/Source/WebCore/platform/graphics/cairo/ImageBufferData.h
index 49f15df..42867d1 100644
--- a/Source/WebCore/platform/graphics/cairo/ImageBufferData.h
+++ b/Source/WebCore/platform/graphics/cairo/ImageBufferData.h
@@ -26,7 +26,9 @@
 #ifndef ImageBufferData_h
 #define ImageBufferData_h
 
-#include "cairo.h"
+#include "PlatformContextCairo.h"
+
+typedef struct _cairo_surface cairo_surface_t;
 
 namespace WebCore {
 
@@ -37,6 +39,7 @@ public:
     ImageBufferData(const IntSize&);
 
     cairo_surface_t* m_surface;
+    PlatformContextCairo m_platformContext;
 };
 
 }  // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/cairo/ImageCairo.cpp b/Source/WebCore/platform/graphics/cairo/ImageCairo.cpp
index e51d65a..d3a52ce 100644
--- a/Source/WebCore/platform/graphics/cairo/ImageCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/ImageCairo.cpp
@@ -36,6 +36,7 @@
 #include "ContextShadow.h"
 #include "FloatRect.h"
 #include "GraphicsContext.h"
+#include "PlatformContextCairo.h"
 #include "ImageBuffer.h"
 #include "ImageObserver.h"
 #include "RefPtrCairo.h"
@@ -114,7 +115,7 @@ void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const Flo
 
     IntSize selfSize = size();
 
-    cairo_t* cr = context->platformContext();
+    cairo_t* cr = context->platformContext()->cr();
     context->save();
 
     // Set the compositing operation.
@@ -169,8 +170,7 @@ void Image::drawPattern(GraphicsContext* context, const FloatRect& tileRect, con
     if (!image) // If it's too early we won't have an image yet.
         return;
 
-    cairo_t* cr = context->platformContext();
-
+    cairo_t* cr = context->platformContext()->cr();
     drawPatternToCairoContext(cr, image, size(), tileRect, patternTransform, phase, toCairoOperator(op), destRect);
 
     if (imageObserver())
diff --git a/Source/WebCore/platform/graphics/cairo/OwnPtrCairo.cpp b/Source/WebCore/platform/graphics/cairo/OwnPtrCairo.cpp
index 94f6809..1594e7b 100644
--- a/Source/WebCore/platform/graphics/cairo/OwnPtrCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/OwnPtrCairo.cpp
@@ -20,7 +20,7 @@
 #include "config.h"
 #include "OwnPtrCairo.h"
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 #include <cairo-ft.h>
 #include <fontconfig/fcfreetype.h>
 #endif
@@ -29,7 +29,7 @@
 
 namespace WTF {
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 template <> void deleteOwnedPtr<FcObjectSet>(FcObjectSet* ptr)
 {
     if (ptr)
diff --git a/Source/WebCore/platform/graphics/cairo/OwnPtrCairo.h b/Source/WebCore/platform/graphics/cairo/OwnPtrCairo.h
index 035d80e..e1dd370 100644
--- a/Source/WebCore/platform/graphics/cairo/OwnPtrCairo.h
+++ b/Source/WebCore/platform/graphics/cairo/OwnPtrCairo.h
@@ -22,7 +22,7 @@
 
 #include "OwnPtr.h"
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 typedef struct _FcObjectSet FcObjectSet;
 typedef struct _FcFontSet FcFontSet;
 #endif
@@ -31,7 +31,7 @@ typedef struct cairo_path cairo_path_t;
 
 namespace WTF {
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 template <> void deleteOwnedPtr<FcObjectSet>(FcObjectSet*);
 template <> void deleteOwnedPtr<FcFontSet>(FcFontSet*);
 #endif
diff --git a/Source/WebCore/platform/graphics/cairo/PathCairo.cpp b/Source/WebCore/platform/graphics/cairo/PathCairo.cpp
index 7a09a52..533df10 100644
--- a/Source/WebCore/platform/graphics/cairo/PathCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/PathCairo.cpp
@@ -281,7 +281,7 @@ FloatRect Path::boundingRect() const
     return FloatRect(x0, y0, x1 - x0, y1 - y0);
 }
 
-FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 {
     cairo_t* cr = platformPath()->context();
     if (applier) {
diff --git a/Source/WebCore/platform/mac/WebCoreKeyGenerator.h b/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.cpp
index c9260e1..ba75162 100644
--- a/Source/WebCore/platform/mac/WebCoreKeyGenerator.h
+++ b/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2011 Igalia S.L.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,10 +23,16 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-@interface WebCoreKeyGenerator : NSObject
+#include "config.h"
+#include "PlatformContextCairo.h"
 
-+ (WebCoreKeyGenerator *)sharedGenerator;
-- (NSArray *)strengthMenuItemTitles;
-- (NSString *)signedPublicKeyAndChallengeStringWithStrengthIndex:(unsigned)index challenge:(NSString *)challenge pageURL:(NSURL *)pageURL;
+#include <cairo.h>
 
-@end
+namespace WebCore {
+
+PlatformContextCairo::PlatformContextCairo(cairo_t* cr)
+    : m_cr(cr)
+{
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.h b/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.h
new file mode 100644
index 0000000..c6cceda
--- /dev/null
+++ b/Source/WebCore/platform/graphics/cairo/PlatformContextCairo.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2011 Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PlatformContextCairo_h
+#define PlatformContextCairo_h
+
+#include "ContextShadow.h"
+#include "RefPtrCairo.h"
+
+namespace WebCore {
+
+// Much like PlatformContextSkia in the Skia port, this class holds information that
+// would normally be private to GraphicsContext, except that we want to allow access
+// to it in Font and Image code. This allows us to separate the concerns of Cairo-specific
+// code from the platform-independent GraphicsContext.
+
+class PlatformContextCairo {
+    WTF_MAKE_NONCOPYABLE(PlatformContextCairo);
+public:
+    PlatformContextCairo(cairo_t*);
+    cairo_t* cr() { return m_cr.get(); }
+    void setCr(cairo_t* cr) { m_cr = cr; }
+
+private:
+    RefPtr<cairo_t> m_cr;
+};
+
+} // namespace WebCore
+
+#endif // PlatformContextCairo_h
diff --git a/Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp b/Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp
index c8b242c..1792002 100644
--- a/Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/RefPtrCairo.cpp
@@ -21,7 +21,7 @@
 
 #include <cairo.h>
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 #include <cairo-ft.h>
 #include <fontconfig/fcfreetype.h>
 #endif
@@ -88,7 +88,7 @@ template<> void derefIfNotNull(cairo_pattern_t* ptr)
         cairo_pattern_destroy(ptr);
 }
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 template<> void refIfNotNull(FcPattern* ptr)
 {
     if (LIKELY(ptr != 0))
diff --git a/Source/WebCore/platform/graphics/cairo/RefPtrCairo.h b/Source/WebCore/platform/graphics/cairo/RefPtrCairo.h
index 204d1e3..540f9dc 100644
--- a/Source/WebCore/platform/graphics/cairo/RefPtrCairo.h
+++ b/Source/WebCore/platform/graphics/cairo/RefPtrCairo.h
@@ -28,7 +28,7 @@ typedef struct _cairo_font_face cairo_font_face_t;
 typedef struct _cairo_scaled_font cairo_scaled_font_t;
 typedef struct _cairo_pattern cairo_pattern_t;
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 typedef struct _FcPattern FcPattern;
 #endif
 
@@ -49,7 +49,7 @@ template<> void derefIfNotNull(cairo_scaled_font_t* ptr);
 template<> void refIfNotNull(cairo_pattern_t*);
 template<> void derefIfNotNull(cairo_pattern_t*);
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 template<> void refIfNotNull(FcPattern* ptr);
 template<> void derefIfNotNull(FcPattern* ptr);
 #endif
diff --git a/Source/WebCore/platform/graphics/cg/FontPlatformData.h b/Source/WebCore/platform/graphics/cg/FontPlatformData.h
deleted file mode 100644
index e21b444..0000000
--- a/Source/WebCore/platform/graphics/cg/FontPlatformData.h
+++ /dev/null
@@ -1,105 +0,0 @@
-/*
- * This file is part of the internal font implementation.  It should not be included by anyone other than
- * FontMac.cpp, FontWin.cpp and Font.cpp.
- *
- * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef FontPlatformData_h
-#define FontPlatformData_h
-
-#include "FontOrientation.h"
-#include "RefCountedGDIHandle.h"
-#include "StringImpl.h"
-#include <wtf/Forward.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-#include <wtf/RetainPtr.h>
-
-typedef struct HFONT__* HFONT;
-typedef struct CGFont* CGFontRef;
-
-namespace WebCore {
-
-class FontDescription;
-
-class FontPlatformData {
-public:
-    FontPlatformData()
-        : m_size(0)
-        , m_syntheticBold(false)
-        , m_syntheticOblique(false)
-        , m_useGDI(false)
-    {
-    }
-
-    FontPlatformData(HFONT, float size, bool bold, bool oblique, bool useGDI);
-    FontPlatformData(float size, bool bold, bool oblique);
-
-    FontPlatformData(HFONT, CGFontRef, float size, bool bold, bool oblique, bool useGDI);
-    ~FontPlatformData();
-
-    FontPlatformData(WTF::HashTableDeletedValueType) : m_font(WTF::HashTableDeletedValue) { }
-    bool isHashTableDeletedValue() const { return m_font.isHashTableDeletedValue(); }
-
-    HFONT hfont() const { return m_font->handle(); }
-    CGFontRef cgFont() const { return m_cgFont.get(); }
-
-    float size() const { return m_size; }
-    void setSize(float size) { m_size = size; }
-    bool syntheticBold() const { return m_syntheticBold; }
-    bool syntheticOblique() const { return m_syntheticOblique; }
-    bool useGDI() const { return m_useGDI; }
-
-    FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
-
-    unsigned hash() const
-    {
-        return m_font->hash();
-    }
-
-    bool operator==(const FontPlatformData& other) const
-    { 
-        return m_font == other.m_font
-            && m_cgFont == other.m_cgFont
-            && m_size == other.m_size
-            && m_syntheticBold == other.m_syntheticBold
-            && m_syntheticOblique == other.m_syntheticOblique
-            && m_useGDI == other.m_useGDI;
-    }
-
-#ifndef NDEBUG
-    String description() const;
-#endif
-
-private:
-    void platformDataInit(HFONT, float size, HDC, WCHAR* faceName);
-
-    RefPtr<RefCountedGDIHandle<HFONT> > m_font;
-    RetainPtr<CGFontRef> m_cgFont;
-
-    float m_size;
-    bool m_syntheticBold;
-    bool m_syntheticOblique;
-    bool m_useGDI;
-};
-
-} // namespace WebCore
-
-#endif
diff --git a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index dbcab45..7799137 100644
--- a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -695,7 +695,7 @@ void GraphicsContext::fillRect(const FloatRect& rect)
     if (m_state.fillPattern)
         applyFillPattern();
 
-    bool drawOwnShadow = hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms; // Don't use ShadowBlur for canvas yet.
+    bool drawOwnShadow = !isAcceleratedContext() && hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms; // Don't use ShadowBlur for canvas yet.
     if (drawOwnShadow) {
         float shadowBlur = m_state.shadowsUseLegacyRadius ? radiusToLegacyRadius(m_state.shadowBlur) : m_state.shadowBlur;
         // Turn off CG shadows.
@@ -724,7 +724,7 @@ void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorS
     if (oldFillColor != color || oldColorSpace != colorSpace)
         setCGFillColor(context, color, colorSpace);
 
-    bool drawOwnShadow = hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms; // Don't use ShadowBlur for canvas yet.
+    bool drawOwnShadow = !isAcceleratedContext() && hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms; // Don't use ShadowBlur for canvas yet.
     if (drawOwnShadow) {
         float shadowBlur = m_state.shadowsUseLegacyRadius ? radiusToLegacyRadius(m_state.shadowBlur) : m_state.shadowBlur;
         // Turn off CG shadows.
@@ -759,7 +759,7 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLef
     Path path;
     path.addRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight);
 
-    bool drawOwnShadow = hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms; // Don't use ShadowBlur for canvas yet.
+    bool drawOwnShadow = !isAcceleratedContext() && hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms; // Don't use ShadowBlur for canvas yet.
     if (drawOwnShadow) {
         float shadowBlur = m_state.shadowsUseLegacyRadius ? radiusToLegacyRadius(m_state.shadowBlur) : m_state.shadowBlur;
 
@@ -803,7 +803,7 @@ void GraphicsContext::fillRectWithRoundedHole(const IntRect& rect, const Rounded
     setFillColor(color, colorSpace);
 
     // fillRectWithRoundedHole() assumes that the edges of rect are clipped out, so we only care about shadows cast around inside the hole.
-    bool drawOwnShadow = hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms;
+    bool drawOwnShadow = !isAcceleratedContext() && hasBlurredShadow(m_state) && !m_state.shadowsIgnoreTransforms;
     if (drawOwnShadow) {
         float shadowBlur = m_state.shadowsUseLegacyRadius ? radiusToLegacyRadius(m_state.shadowBlur) : m_state.shadowBlur;
 
@@ -929,8 +929,7 @@ void GraphicsContext::setPlatformShadow(const FloatSize& offset, float blur, con
 
         CGFloat smallEigenvalue = narrowPrecisionToCGFloat(sqrt(0.5 * ((A + D) - sqrt(4 * B * C + (A - D) * (A - D)))));
 
-        // Extreme "blur" values can make text drawing crash or take crazy long times, so clamp
-        blurRadius = min(blur * smallEigenvalue, narrowPrecisionToCGFloat(1000.0));
+        blurRadius = blur * smallEigenvalue;
 
         CGSize offsetInBaseSpace = CGSizeApplyAffineTransform(offset, userToBaseCTM);
 
@@ -938,6 +937,9 @@ void GraphicsContext::setPlatformShadow(const FloatSize& offset, float blur, con
         yOffset = offsetInBaseSpace.height;
     }
 
+    // Extreme "blur" values can make text drawing crash or take crazy long times, so clamp
+    blurRadius = min(blurRadius, narrowPrecisionToCGFloat(1000.0));
+
     // Work around <rdar://problem/5539388> by ensuring that the offsets will get truncated
     // to the desired integer.
     static const CGFloat extraShadowOffset = narrowPrecisionToCGFloat(1.0 / 128);
@@ -1343,14 +1345,30 @@ void GraphicsContext::setAllowsFontSmoothing(bool allowsFontSmoothing)
 #endif
 }
 
-void GraphicsContext::setIsCALayerContext(bool)
+void GraphicsContext::setIsCALayerContext(bool isLayerContext)
 {
-    m_data->m_isCALayerContext = true;
+    if (isLayerContext)
+        m_data->m_contextFlags |= IsLayerCGContext;
+    else
+        m_data->m_contextFlags &= ~IsLayerCGContext;
 }
 
 bool GraphicsContext::isCALayerContext() const
 {
-    return m_data->m_isCALayerContext;
+    return m_data->m_contextFlags & IsLayerCGContext;
+}
+
+void GraphicsContext::setIsAcceleratedContext(bool isAccelerated)
+{
+    if (isAccelerated)
+        m_data->m_contextFlags |= IsAcceleratedCGContext;
+    else
+        m_data->m_contextFlags &= ~IsAcceleratedCGContext;
+}
+
+bool GraphicsContext::isAcceleratedContext() const
+{
+    return m_data->m_contextFlags & IsAcceleratedCGContext;
 }
 
 void GraphicsContext::setPlatformTextDrawingMode(TextDrawingModeFlags mode)
diff --git a/Source/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h b/Source/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
index f9255df..722f5a0 100644
--- a/Source/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
+++ b/Source/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
@@ -31,9 +31,16 @@
 
 namespace WebCore {
 
+enum GraphicsContextCGFlag {
+    IsLayerCGContext = 1 << 0,
+    IsAcceleratedCGContext = 1 << 1
+};
+
+typedef unsigned GraphicsContextCGFlags;
+
 class GraphicsContextPlatformPrivate {
 public:
-    GraphicsContextPlatformPrivate(CGContextRef cgContext, bool isLayerContext = false)
+    GraphicsContextPlatformPrivate(CGContextRef cgContext, GraphicsContextCGFlags flags = 0)
         : m_cgContext(cgContext)
 #if PLATFORM(WIN)
         , m_hdc(0)
@@ -41,7 +48,7 @@ public:
         , m_shouldIncludeChildWindows(false)
 #endif
         , m_userToDeviceTransformKnownToBeIdentity(false)
-        , m_isCALayerContext(isLayerContext)
+        , m_contextFlags(flags)
     {
     }
     
@@ -87,7 +94,7 @@ public:
 
     RetainPtr<CGContextRef> m_cgContext;
     bool m_userToDeviceTransformKnownToBeIdentity;
-    bool m_isCALayerContext;
+    GraphicsContextCGFlags m_contextFlags;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp b/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
index 7c8e313..3c8f959 100644
--- a/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
@@ -32,6 +32,7 @@
 #include "BitmapImage.h"
 #include "GraphicsContext.h"
 #include "GraphicsContextCG.h"
+#include "ImageData.h"
 #include "MIMETypeRegistry.h"
 #include <ApplicationServices/ApplicationServices.h>
 #include <wtf/Assertions.h>
@@ -498,21 +499,8 @@ static RetainPtr<CFStringRef> utiFromMIMEType(const String& mimeType)
 #endif
 }
 
-String ImageBuffer::toDataURL(const String& mimeType, const double* quality) const
+static String CGImageToDataURL(CGImageRef image, const String& mimeType, const double* quality)
 {
-    ASSERT(MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType));
-
-    RetainPtr<CGImageRef> image;
-    if (!m_accelerateRendering)
-        image.adoptCF(CGBitmapContextCreateImage(context()->platformContext()));
-#if USE(IOSURFACE_CANVAS_BACKING_STORE)
-    else
-        image.adoptCF(wkIOSurfaceContextCreateImage(context()->platformContext()));
-#endif
-
-    if (!image)
-        return "data:,";
-
     RetainPtr<CFMutableDataRef> data(AdoptCF, CFDataCreateMutable(kCFAllocatorDefault, 0));
     if (!data)
         return "data:,";
@@ -533,7 +521,7 @@ String ImageBuffer::toDataURL(const String& mimeType, const double* quality) con
         imageProperties.adoptCF(CFDictionaryCreate(0, &key, &value, 1, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
     }
 
-    CGImageDestinationAddImage(destination.get(), image.get(), imageProperties.get());
+    CGImageDestinationAddImage(destination.get(), image, imageProperties.get());
     CGImageDestinationFinalize(destination.get());
 
     Vector<char> out;
@@ -541,4 +529,46 @@ String ImageBuffer::toDataURL(const String& mimeType, const double* quality) con
 
     return makeString("data:", mimeType, ";base64,", out);
 }
+
+String ImageBuffer::toDataURL(const String& mimeType, const double* quality) const
+{
+    ASSERT(MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType));
+
+    RetainPtr<CGImageRef> image;
+    if (!m_accelerateRendering)
+        image.adoptCF(CGBitmapContextCreateImage(context()->platformContext()));
+#if USE(IOSURFACE_CANVAS_BACKING_STORE)
+    else
+        image.adoptCF(wkIOSurfaceContextCreateImage(context()->platformContext()));
+#endif
+
+    if (!image)
+        return "data:,";
+
+    return CGImageToDataURL(image.get(), mimeType, quality);
+}
+
+String ImageDataToDataURL(const ImageData& source, const String& mimeType, const double* quality)
+{
+    ASSERT(MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType));
+        
+    RetainPtr<CGImageRef> image;
+    RetainPtr<CGDataProviderRef> dataProvider;
+    
+    dataProvider.adoptCF(CGDataProviderCreateWithData(0, source.data()->data()->data(),
+                                                      4 * source.width() * source.height(), 0));
+    
+    if (!dataProvider)
+        return "data:,";
+
+    image.adoptCF(CGImageCreate(source.width(), source.height(), 8, 32, 4 * source.width(),
+                                CGColorSpaceCreateDeviceRGB(), kCGBitmapByteOrderDefault | kCGImageAlphaLast,
+                                dataProvider.get(), 0, false, kCGRenderingIntentDefault));
+                                
+        
+    if (!image)
+        return "data:,";
+
+    return CGImageToDataURL(image.get(), mimeType, quality);
+}
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/cg/PathCG.cpp b/Source/WebCore/platform/graphics/cg/PathCG.cpp
index d6a1e6e..b8fc7d4 100644
--- a/Source/WebCore/platform/graphics/cg/PathCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/PathCG.cpp
@@ -166,7 +166,7 @@ FloatRect Path::boundingRect() const
     return CGPathGetBoundingBox(m_path);
 }
 
-FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 {
     CGContextRef context = scratchContext();
 
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
index ad961aa..4cb119a 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
@@ -56,7 +56,7 @@ Canvas2DLayerChromium::~Canvas2DLayerChromium()
         layerRendererContext()->deleteTexture(m_textureId);
 }
 
-void Canvas2DLayerChromium::updateContentsIfDirty()
+void Canvas2DLayerChromium::updateCompositorResources()
 {
     if (!m_contentsDirty || !m_drawingBuffer)
         return;
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h
index a14cb98..81b118c 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h
@@ -46,7 +46,7 @@ public:
     static PassRefPtr<Canvas2DLayerChromium> create(DrawingBuffer*, GraphicsLayerChromium* owner);
     virtual ~Canvas2DLayerChromium();
     virtual bool drawsContent() const { return true; }
-    virtual void updateContentsIfDirty();
+    virtual void updateCompositorResources();
 
     void setTextureChanged();
     unsigned textureId() const;
@@ -55,8 +55,6 @@ public:
 private:
     explicit Canvas2DLayerChromium(DrawingBuffer*, GraphicsLayerChromium* owner);
     DrawingBuffer* m_drawingBuffer;
-
-    static unsigned m_shaderProgramId;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.cpp
index 0264868..f306207 100644
--- a/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.cpp
@@ -40,8 +40,6 @@
 
 namespace WebCore {
 
-unsigned CanvasLayerChromium::m_shaderProgramId = 0;
-
 CanvasLayerChromium::CanvasLayerChromium(GraphicsLayerChromium* owner)
     : LayerChromium(owner)
     , m_textureChanged(true)
@@ -54,22 +52,18 @@ CanvasLayerChromium::~CanvasLayerChromium()
 {
 }
 
-void CanvasLayerChromium::draw()
+PassRefPtr<CCLayerImpl> CanvasLayerChromium::createCCLayerImpl()
 {
-    ASSERT(layerRenderer());
-    const CanvasLayerChromium::Program* program = layerRenderer()->canvasLayerProgram();
-    ASSERT(program && program->initialized());
-    GraphicsContext3D* context = layerRendererContext();
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textureId));
-    GC3Denum sfactor = m_premultipliedAlpha ? GraphicsContext3D::ONE : GraphicsContext3D::SRC_ALPHA;
-    GLC(context, context->blendFunc(sfactor, GraphicsContext3D::ONE_MINUS_SRC_ALPHA));
-    layerRenderer()->useShader(program->program());
-    GLC(context, context->uniform1i(program->fragmentShader().samplerLocation(), 0));
-    drawTexturedQuad(context, layerRenderer()->projectionMatrix(), ccLayerImpl()->drawTransform(),
-                     bounds().width(), bounds().height(), ccLayerImpl()->drawOpacity(),
-                     program->vertexShader().matrixLocation(),
-                     program->fragmentShader().alphaLocation());
+    return CCCanvasLayerImpl::create(this);
+}
+
+void CanvasLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
+{
+    LayerChromium::pushPropertiesTo(layer);
+
+    CCCanvasLayerImpl* canvasLayer = static_cast<CCCanvasLayerImpl*>(layer);
+    canvasLayer->setTextureId(m_textureId);
+    canvasLayer->setPremultipliedAlpha(m_premultipliedAlpha);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.h b/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.h
index ed3a06f..cb2ccc9 100644
--- a/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.h
@@ -43,9 +43,9 @@ class CanvasLayerChromium : public LayerChromium {
 public:
     virtual ~CanvasLayerChromium();
 
-    virtual void draw();
+    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
 
-    typedef ProgramBinding<VertexShaderPosTex, FragmentShaderRGBATexFlipAlpha> Program;
+    virtual void pushPropertiesTo(CCLayerImpl*);
 
 protected:
     explicit CanvasLayerChromium(GraphicsLayerChromium* owner);
@@ -55,9 +55,6 @@ protected:
     bool m_textureChanged;
     unsigned m_textureId;
     bool m_premultipliedAlpha;
-
-private:
-    static unsigned m_shaderProgramId;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
index 78f93d5..4ea9c92 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
@@ -66,7 +66,7 @@ void ContentLayerChromium::cleanupResources()
     m_contentsTexture.clear();
 }
 
-bool ContentLayerChromium::requiresClippedUpdateRect() const
+bool ContentLayerChromium::requiresClippedUpdateRect()
 {
     // To avoid allocating excessively large textures, switch into "large layer mode" if
     // one of the layer's dimensions is larger than 2000 pixels or the size of
@@ -77,7 +77,7 @@ bool ContentLayerChromium::requiresClippedUpdateRect() const
             || !layerRenderer()->checkTextureSize(bounds()));
 }
 
-void ContentLayerChromium::updateContentsIfDirty()
+void ContentLayerChromium::paintContentsIfDirty()
 {
     RenderLayerBacking* backing = static_cast<RenderLayerBacking*>(m_owner->client());
     if (!backing || backing->paintingGoesToWindow())
@@ -93,34 +93,25 @@ void ContentLayerChromium::updateContentsIfDirty()
 
     // FIXME: Remove this test when tiled layers are implemented.
     if (requiresClippedUpdateRect()) {
-        // A layer with 3D transforms could require an arbitrarily large number
-        // of texels to be repainted, so ignore these layers until tiling is
-        // implemented.
-        if (!ccLayerImpl()->drawTransform().isIdentityOrTranslation()) {
-            m_skipsDraw = true;
-            return;
-        }
-
         // Calculate the region of this layer that is currently visible.
         const IntRect clipRect = ccLayerImpl()->targetRenderSurface()->contentRect();
 
         TransformationMatrix layerOriginTransform = ccLayerImpl()->drawTransform();
         layerOriginTransform.translate3d(-0.5 * bounds().width(), -0.5 * bounds().height(), 0);
 
-        // For now we apply the large layer treatment only for layers that are either untransformed
-        // or are purely translated. Their matrix is expected to be invertible.
-        ASSERT(layerOriginTransform.isInvertible());
-
+        // We compute the visible portion of the layer by back-mapping the current RenderSurface
+        // content area to the layer. To do that, we invert the drawing matrix of the layer
+        // and project the content area rectangle to it. If the layer transform is not invertible
+        // then we skip rendering the layer.
+        if (!layerOriginTransform.isInvertible()) {
+            m_skipsDraw = true;
+            return;
+        }
         TransformationMatrix targetToLayerMatrix = layerOriginTransform.inverse();
-        IntRect visibleRectInLayerCoords = targetToLayerMatrix.mapRect(clipRect);
+        FloatQuad mappedClipToLayer = targetToLayerMatrix.projectQuad(FloatRect(clipRect));
+        IntRect visibleRectInLayerCoords = mappedClipToLayer.enclosingBoundingBox();
         visibleRectInLayerCoords.intersect(IntRect(0, 0, bounds().width(), bounds().height()));
 
-        // For normal layers, the center of the texture corresponds with the center of the layer.
-        // In large layers the center of the texture is the center of the visible region so we have
-        // to keep track of the offset in order to render correctly.
-        IntRect visibleRectInSurfaceCoords = layerOriginTransform.mapRect(visibleRectInLayerCoords);
-        m_layerCenterInSurfaceCoords = FloatRect(visibleRectInSurfaceCoords).center();
-
         // If this is still too large to render, then skip the layer completely.
         if (!layerRenderer()->checkTextureSize(visibleRectInLayerCoords.size())) {
             m_skipsDraw = true;
@@ -256,9 +247,14 @@ void ContentLayerChromium::draw()
     GLC(context, context->blendFunc(GraphicsContext3D::ONE, GraphicsContext3D::ONE_MINUS_SRC_ALPHA));
 
     if (requiresClippedUpdateRect()) {
-        float m43 = ccLayerImpl()->drawTransform().m43();
-        TransformationMatrix transform;
-        transform.translate3d(m_layerCenterInSurfaceCoords.x(), m_layerCenterInSurfaceCoords.y(), m43);
+        // Compute the offset between the layer's center point and the center of the visible portion
+        // of the layer.
+        FloatPoint visibleRectCenterOffset = FloatRect(m_visibleRectInLayerCoords).center();
+        visibleRectCenterOffset.move(-0.5 * bounds().width(), -0.5 * bounds().height());
+
+        TransformationMatrix transform = ccLayerImpl()->drawTransform();
+        transform.translate(visibleRectCenterOffset.x(), visibleRectCenterOffset.y());
+
         drawTexturedQuad(context, layerRenderer()->projectionMatrix(),
                          transform, m_visibleRectInLayerCoords.width(),
                          m_visibleRectInLayerCoords.height(), ccLayerImpl()->drawOpacity(),
@@ -273,6 +269,11 @@ void ContentLayerChromium::draw()
     unreserveContentsTexture();
 }
 
+void ContentLayerChromium::updateCompositorResources()
+{
+    updateTextureIfNeeded();
+}
+
 void ContentLayerChromium::unreserveContentsTexture()
 {
     if (!m_skipsDraw && m_contentsTexture)
@@ -281,8 +282,6 @@ void ContentLayerChromium::unreserveContentsTexture()
 
 void ContentLayerChromium::bindContentsTexture()
 {
-    updateTextureIfNeeded();
-
     if (!m_skipsDraw && m_contentsTexture)
         m_contentsTexture->bindTexture();
 }
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
index 6f070c2..cf296ab 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
@@ -50,7 +50,8 @@ public:
 
     virtual ~ContentLayerChromium();
 
-    virtual void updateContentsIfDirty();
+    virtual void paintContentsIfDirty();
+    virtual void updateCompositorResources();
     virtual void unreserveContentsTexture();
     virtual void bindContentsTexture();
 
@@ -63,7 +64,7 @@ protected:
     explicit ContentLayerChromium(GraphicsLayerChromium* owner);
 
     virtual void cleanupResources();
-    bool requiresClippedUpdateRect() const;
+    bool requiresClippedUpdateRect();
     void resizeUploadBuffer(const IntSize&);
 
     virtual const char* layerTypeAsString() const { return "ContentLayer"; }
@@ -82,7 +83,6 @@ private:
     PlatformCanvas m_canvas;
 
     IntRect m_visibleRectInLayerCoords;
-    FloatPoint m_layerCenterInSurfaceCoords;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/CrossProcessFontLoading.mm b/Source/WebCore/platform/graphics/chromium/CrossProcessFontLoading.mm
index 227fbe4..b442d53 100644
--- a/Source/WebCore/platform/graphics/chromium/CrossProcessFontLoading.mm
+++ b/Source/WebCore/platform/graphics/chromium/CrossProcessFontLoading.mm
@@ -29,7 +29,7 @@
 #import "config.h"
 #import "CrossProcessFontLoading.h"
 
-#import "../graphics/cocoa/FontPlatformData.h"
+#import "../graphics/FontPlatformData.h"
 #import "PlatformBridge.h"
 #import <AppKit/NSFont.h>
 #import <wtf/HashMap.h>
diff --git a/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp b/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
index d956841..e559edb 100644
--- a/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
@@ -46,10 +46,6 @@
 
 namespace WebCore {
 
-#if ENABLE(SKIA_GPU)
-extern GrContext* GetGlobalGrContext();
-#endif
-
 struct DrawingBufferInternal {
     unsigned offscreenColorTexture;
 #if USE(ACCELERATED_COMPOSITING)
@@ -91,6 +87,9 @@ DrawingBuffer::DrawingBuffer(GraphicsContext3D* context,
     , m_multisampleFBO(0)
     , m_multisampleColorBuffer(0)
     , m_internal(new DrawingBufferInternal)
+#if ENABLE(SKIA_GPU)
+    , m_grContext(0)
+#endif
 {
     if (!m_context->getExtensions()->supports("GL_CHROMIUM_copy_texture_to_parent_texture")) {
         m_context.clear();
@@ -137,7 +136,8 @@ void DrawingBuffer::publishToPlatformLayer()
     // would insert a fence into the child command stream that the compositor could wait for.
     m_context->makeContextCurrent();
 #if ENABLE(SKIA_GPU)
-    GetGlobalGrContext()->flush(false);
+    if (m_grContext)
+        m_grContext->flush(0);
 #endif
     static_cast<Extensions3DChromium*>(m_context->getExtensions())->copyTextureToParentTextureCHROMIUM(m_colorBuffer, parentTexture);
     m_context->flush();
@@ -166,4 +166,13 @@ Platform3DObject DrawingBuffer::platformColorBuffer() const
     return m_colorBuffer;
 }
 
+#if ENABLE(SKIA_GPU)
+void DrawingBuffer::setGrContext(GrContext* context)
+{
+    // We just take a ptr without referencing it, as we require that we never outlive
+    // the SharedGraphicsContext3D object that is giving us the context.
+    m_grContext = context;
+}
+#endif
+
 }
diff --git a/Source/WebCore/platform/graphics/chromium/FontCacheLinux.cpp b/Source/WebCore/platform/graphics/chromium/FontCacheLinux.cpp
index bbe6d62..598ae86 100644
--- a/Source/WebCore/platform/graphics/chromium/FontCacheLinux.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontCacheLinux.cpp
@@ -153,7 +153,8 @@ FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontD
                              fontDescription.computedSize(),
                              (style & SkTypeface::kBold) && !tf->isBold(),
                              (style & SkTypeface::kItalic) && !tf->isItalic(),
-                             fontDescription.orientation());
+                             fontDescription.orientation(),
+                             fontDescription.textOrientation());
     tf->unref();
     return result;
 }
diff --git a/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
index e57a84c..3c254dc 100644
--- a/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
@@ -196,7 +196,7 @@ class TransparencyAwareGlyphPainter : public TransparencyAwareFontPainter {
     // left of m_point. We express it this way so that if we're using the Skia
     // drawing path we can use floating-point positioning, even though we have
     // to use integer positioning in the GDI path.
-    bool drawGlyphs(int numGlyphs, const WORD* glyphs, const int* advances, int startAdvance) const;
+    bool drawGlyphs(int numGlyphs, const WORD* glyphs, const int* advances, float startAdvance) const;
 
  private:
     virtual IntRect estimateTextBounds();
@@ -256,11 +256,11 @@ IntRect TransparencyAwareGlyphPainter::estimateTextBounds()
 bool TransparencyAwareGlyphPainter::drawGlyphs(int numGlyphs,
                                                const WORD* glyphs,
                                                const int* advances,
-                                               int startAdvance) const
+                                               float startAdvance) const
 {
     if (!m_useGDI) {
         SkPoint origin = m_point;
-        origin.fX += startAdvance;
+        origin.fX += SkFloatToScalar(startAdvance);
         return paintSkiaText(m_graphicsContext, m_font->platformData().hfont(),
                              numGlyphs, glyphs, advances, 0, &origin);
     }
@@ -400,17 +400,25 @@ void Font::drawGlyphs(GraphicsContext* graphicsContext,
     Vector<WORD, kMaxBufferLength> glyphs;
     Vector<int, kMaxBufferLength> advances;
     int glyphIndex = 0;  // The starting glyph of the current chunk.
-    int curAdvance = 0;  // How far from the left the current chunk is.
+
+    // In order to round all offsets to the correct pixel boundary, this code keeps track of the absolute position
+    // of each glyph in floating point units and rounds to integer advances at the last possible moment.
+
+    float horizontalOffset = point.x(); // The floating point offset of the left side of the current glyph.
+    int lastHorizontalOffsetRounded = lroundf(horizontalOffset); // The rounded offset of the left side of the last glyph rendered.
     while (glyphIndex < numGlyphs) {
         // How many chars will be in this chunk?
         int curLen = std::min(kMaxBufferLength, numGlyphs - glyphIndex);
         glyphs.resize(curLen);
         advances.resize(curLen);
 
-        int curWidth = 0;
+        float currentWidth = 0;
         for (int i = 0; i < curLen; ++i, ++glyphIndex) {
             glyphs[i] = glyphBuffer.glyphAt(from + glyphIndex);
-            advances[i] = static_cast<int>(glyphBuffer.advanceAt(from + glyphIndex));
+            horizontalOffset += glyphBuffer.advanceAt(from + glyphIndex);
+            advances[i] = lroundf(horizontalOffset) - lastHorizontalOffsetRounded;
+            lastHorizontalOffsetRounded += advances[i];
+            currentWidth += glyphBuffer.advanceAt(from + glyphIndex);
             
             // Bug 26088 - very large positive or negative runs can fail to
             // render so we clamp the size here. In the specs, negative
@@ -420,15 +428,14 @@ void Font::drawGlyphs(GraphicsContext* graphicsContext,
             // -32830, so we give ourselves a little breathing room.
             const int maxNegativeRun = -32768;
             const int maxPositiveRun =  32768;
-            if ((curWidth + advances[i] < maxNegativeRun) || (curWidth + advances[i] > maxPositiveRun)) 
+            if ((currentWidth + advances[i] < maxNegativeRun) || (currentWidth + advances[i] > maxPositiveRun)) 
                 advances[i] = 0;
-            curWidth += advances[i];
         }
 
         // Actually draw the glyphs (with retry on failure).
         bool success = false;
         for (int executions = 0; executions < 2; ++executions) {
-            success = painter.drawGlyphs(curLen, &glyphs[0], &advances[0], curAdvance);
+            success = painter.drawGlyphs(curLen, &glyphs[0], &advances[0], horizontalOffset - point.x() - currentWidth);
             if (!success && executions == 0) {
                 // Ask the browser to load the font for us and retry.
                 PlatformBridge::ensureFontLoaded(font->platformData().hfont());
@@ -439,8 +446,6 @@ void Font::drawGlyphs(GraphicsContext* graphicsContext,
 
         if (!success)
             LOG_ERROR("Unable to draw the glyphs after second attempt");
-
-        curAdvance += curWidth;
     }
 }
 
@@ -509,8 +514,7 @@ void Font::drawComplexText(GraphicsContext* graphicsContext,
 
     // Uniscribe counts the coordinates from the upper left, while WebKit uses
     // the baseline, so we have to subtract off the ascent.
-    state.draw(graphicsContext, hdc, static_cast<int>(point.x()),
-               static_cast<int>(point.y() - fontMetrics().ascent()), from, to);
+    state.draw(graphicsContext, hdc, lroundf(point.x()), lroundf(point.y() - fontMetrics().ascent()), from, to);
 
     context->canvas()->endPlatformPaint();
 }
diff --git a/Source/WebCore/platform/graphics/chromium/FontLinux.cpp b/Source/WebCore/platform/graphics/chromium/FontLinux.cpp
index 823dbc9..3c4a494 100644
--- a/Source/WebCore/platform/graphics/chromium/FontLinux.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontLinux.cpp
@@ -98,7 +98,7 @@ void Font::drawGlyphs(GraphicsContext* gc, const SimpleFontData* font,
     SkPoint* vPosBegin = storage2.get();
     SkPoint* vPosEnd = storage3.get();
 
-    bool isVertical = font->orientation() == Vertical;
+    bool isVertical = font->platformData().orientation() == Vertical;
     for (int i = 0; i < numGlyphs; i++) {
         SkScalar myWidth = SkFloatToScalar(adv[i].width());
         pos[i].set(x, y);
diff --git a/Source/WebCore/platform/graphics/chromium/FontPlatformDataChromiumWin.h b/Source/WebCore/platform/graphics/chromium/FontPlatformDataChromiumWin.h
index b6ebb2e..84edebc 100644
--- a/Source/WebCore/platform/graphics/chromium/FontPlatformDataChromiumWin.h
+++ b/Source/WebCore/platform/graphics/chromium/FontPlatformDataChromiumWin.h
@@ -71,6 +71,7 @@ public:
     float size() const { return m_size; }
 
     FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
+    void setOrientation(FontOrientation) { } // FIXME: Implement.
 
     unsigned hash() const
     { 
@@ -105,7 +106,7 @@ private:
         HFONT hfont() const { return m_hfont; }
         unsigned hash() const
         {
-            return WTF::StringHasher::createBlobHash<sizeof(HFONT)>(&m_hfont);
+            return StringHasher::hashMemory<sizeof(HFONT)>(&m_hfont);
         }
 
         bool operator==(const RefCountedHFONT& other) const
diff --git a/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp b/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
index 6f9009f..c3edfac 100644
--- a/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
@@ -76,13 +76,14 @@ FontPlatformData::FontPlatformData(const FontPlatformData& src)
     , m_fakeBold(src.m_fakeBold)
     , m_fakeItalic(src.m_fakeItalic)
     , m_orientation(src.m_orientation)
+    , m_textOrientation(src.m_textOrientation)
     , m_style(src.m_style)
     , m_harfbuzzFace(src.m_harfbuzzFace)
 {
     SkSafeRef(m_typeface);
 }
 
-FontPlatformData::FontPlatformData(SkTypeface* tf, const char* family, float textSize, bool fakeBold, bool fakeItalic, FontOrientation orientation)
+FontPlatformData::FontPlatformData(SkTypeface* tf, const char* family, float textSize, bool fakeBold, bool fakeItalic, FontOrientation orientation, TextOrientation textOrientation)
     : m_typeface(tf)
     , m_family(family)
     , m_textSize(textSize)
@@ -90,6 +91,7 @@ FontPlatformData::FontPlatformData(SkTypeface* tf, const char* family, float tex
     , m_fakeBold(fakeBold)
     , m_fakeItalic(fakeItalic)
     , m_orientation(orientation)
+    , m_textOrientation(textOrientation)
 {
     SkSafeRef(m_typeface);
     querySystemForRenderStyle();
@@ -102,6 +104,8 @@ FontPlatformData::FontPlatformData(const FontPlatformData& src, float textSize)
     , m_emSizeInFontUnits(src.m_emSizeInFontUnits)
     , m_fakeBold(src.m_fakeBold)
     , m_fakeItalic(src.m_fakeItalic)
+    , m_orientation(src.m_orientation)
+    , m_textOrientation(src.m_textOrientation)
     , m_harfbuzzFace(src.m_harfbuzzFace)
 {
     SkSafeRef(m_typeface);
@@ -134,6 +138,7 @@ FontPlatformData& FontPlatformData::operator=(const FontPlatformData& src)
     m_fakeItalic = src.m_fakeItalic;
     m_harfbuzzFace = src.m_harfbuzzFace;
     m_orientation = src.m_orientation;
+    m_textOrientation = src.m_textOrientation;
     m_style = src.m_style;
     m_emSizeInFontUnits = src.m_emSizeInFontUnits;
 
@@ -199,13 +204,14 @@ bool FontPlatformData::operator==(const FontPlatformData& a) const
         && m_fakeBold == a.m_fakeBold
         && m_fakeItalic == a.m_fakeItalic
         && m_orientation == a.m_orientation
+        && m_textOrientation == a.m_textOrientation
         && m_style == a.m_style;
 }
 
 unsigned FontPlatformData::hash() const
 {
     unsigned h = SkTypeface::UniqueID(m_typeface);
-    h ^= 0x01010101 * ((static_cast<int>(m_orientation) << 2) | (static_cast<int>(m_fakeBold) << 1) | static_cast<int>(m_fakeItalic));
+    h ^= 0x01010101 * ((static_cast<int>(m_textOrientation) << 3) | (static_cast<int>(m_orientation) << 2) | (static_cast<int>(m_fakeBold) << 1) | static_cast<int>(m_fakeItalic));
 
     // This memcpy is to avoid a reinterpret_cast that breaks strict-aliasing
     // rules. Memcpy is generally optimized enough so that performance doesn't
diff --git a/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.h b/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.h
index d9ebb61..541aa86 100644
--- a/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.h
+++ b/Source/WebCore/platform/graphics/chromium/FontPlatformDataLinux.h
@@ -33,6 +33,7 @@
 
 #include "FontOrientation.h"
 #include "FontRenderStyle.h"
+#include "TextOrientation.h"
 #include <wtf/Forward.h>
 #include <wtf/RefPtr.h>
 #include <wtf/text/CString.h>
@@ -66,6 +67,8 @@ public:
         , m_emSizeInFontUnits(0)
         , m_fakeBold(false)
         , m_fakeItalic(false)
+        , m_orientation(Horizontal)
+        , m_textOrientation(TextOrientationVerticalRight)
         { }
 
     FontPlatformData()
@@ -75,6 +78,7 @@ public:
         , m_fakeBold(false)
         , m_fakeItalic(false)
         , m_orientation(Horizontal)
+        , m_textOrientation(TextOrientationVerticalRight)
         { }
 
     FontPlatformData(float textSize, bool fakeBold, bool fakeItalic)
@@ -84,10 +88,11 @@ public:
         , m_fakeBold(fakeBold)
         , m_fakeItalic(fakeItalic)
         , m_orientation(Horizontal)
+        , m_textOrientation(TextOrientationVerticalRight)
         { }
 
     FontPlatformData(const FontPlatformData&);
-    FontPlatformData(SkTypeface*, const char* name, float textSize, bool fakeBold, bool fakeItalic, FontOrientation orientation = Horizontal);
+    FontPlatformData(SkTypeface*, const char* name, float textSize, bool fakeBold, bool fakeItalic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight);
     FontPlatformData(const FontPlatformData& src, float textSize);
     ~FontPlatformData();
 
@@ -113,7 +118,8 @@ public:
     int emSizeInFontUnits() const;
 
     FontOrientation orientation() const { return m_orientation; }
-
+    void setOrientation(FontOrientation orientation) { m_orientation = orientation; }
+    
     bool operator==(const FontPlatformData&) const;
     FontPlatformData& operator=(const FontPlatformData&);
     bool isHashTableDeletedValue() const { return m_typeface == hashTableDeletedFontValue(); }
@@ -161,6 +167,7 @@ private:
     bool m_fakeBold;
     bool m_fakeItalic;
     FontOrientation m_orientation;
+    TextOrientation m_textOrientation;
     FontRenderStyle m_style;
     mutable RefPtr<RefCountedHarfbuzzFace> m_harfbuzzFace;
 
diff --git a/Source/WebCore/platform/graphics/chromium/GLES2Canvas.cpp b/Source/WebCore/platform/graphics/chromium/GLES2Canvas.cpp
index 2ff6b8b..cc5a060 100644
--- a/Source/WebCore/platform/graphics/chromium/GLES2Canvas.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GLES2Canvas.cpp
@@ -62,29 +62,51 @@ typedef void (GLAPIENTRY *TESSCB)();
 typedef WTF::Vector<float> FloatVector;
 typedef WTF::Vector<double> DoubleVector;
 
+struct PathAndTransform {
+    PathAndTransform(const Path& p, const AffineTransform& t)
+        : path(p)
+        , transform(t)
+    {
+    }
+    Path path;
+    AffineTransform transform;
+};
+
 struct GLES2Canvas::State {
     State()
         : m_fillColor(0, 0, 0, 255)
+        , m_shadowColor(0, 0, 0, 0)
         , m_alpha(1.0f)
         , m_compositeOp(CompositeSourceOver)
-        , m_clippingEnabled(false)
+        , m_numClippingPaths(0)
+        , m_shadowOffset(0, 0)
+        , m_shadowBlur(0)
+        , m_shadowsIgnoreTransforms(false)
     {
     }
     State(const State& other)
         : m_fillColor(other.m_fillColor)
+        , m_shadowColor(other.m_shadowColor)
         , m_alpha(other.m_alpha)
         , m_compositeOp(other.m_compositeOp)
         , m_ctm(other.m_ctm)
         , m_clippingPaths() // Don't copy; clipping paths are tracked per-state.
-        , m_clippingEnabled(other.m_clippingEnabled)
+        , m_numClippingPaths(other.m_numClippingPaths)
+        , m_shadowOffset(other.m_shadowOffset)
+        , m_shadowBlur(other.m_shadowBlur)
+        , m_shadowsIgnoreTransforms(other.m_shadowsIgnoreTransforms)
     {
     }
     Color m_fillColor;
+    Color m_shadowColor;
     float m_alpha;
     CompositeOperator m_compositeOp;
     AffineTransform m_ctm;
-    WTF::Vector<Path> m_clippingPaths;
-    bool m_clippingEnabled;
+    WTF::Vector<PathAndTransform> m_clippingPaths;
+    int m_numClippingPaths;
+    FloatSize m_shadowOffset;
+    float m_shadowBlur;
+    bool m_shadowsIgnoreTransforms;
 
     // Helper function for applying the state's alpha value to the given input
     // color to produce a new output color. The logic is the same as
@@ -100,7 +122,11 @@ struct GLES2Canvas::State {
         int a = (c.alpha() * s) >> 8;
         return Color(c.red(), c.green(), c.blue(), a);
     }
-
+    bool shadowActive() const
+    {
+        return m_shadowColor.alpha() > 0 && (m_shadowBlur || m_shadowOffset.width() || m_shadowOffset.height());
+    }
+    bool clippingEnabled() { return m_numClippingPaths > 0; }
 };
 
 static inline FloatPoint operator*(const FloatPoint& f, float scale)
@@ -193,12 +219,8 @@ void GLES2Canvas::bindFramebuffer()
 void GLES2Canvas::clearRect(const FloatRect& rect)
 {
     bindFramebuffer();
-    if (m_state->m_ctm.isIdentity() && !m_state->m_clippingEnabled) {
-        m_context->scissor(rect.x(), m_size.height() - rect.height() - rect.y(), rect.width(), rect.height());
-        m_context->enable(GraphicsContext3D::SCISSOR_TEST);
-        m_context->clearColor(Color(RGBA32(0)));
-        m_context->clear(GraphicsContext3D::COLOR_BUFFER_BIT);
-        m_context->disable(GraphicsContext3D::SCISSOR_TEST);
+    if (m_state->m_ctm.isIdentity() && !m_state->clippingEnabled()) {
+        scissorClear(rect.x(), rect.y(), rect.width(), rect.height());
     } else {
         save();
         setCompositeOperation(CompositeClear);
@@ -207,35 +229,66 @@ void GLES2Canvas::clearRect(const FloatRect& rect)
     }
 }
 
+void GLES2Canvas::scissorClear(float x, float y, float width, float height)
+{
+    int intX = static_cast<int>(x + 0.5f);
+    int intY = static_cast<int>(y + 0.5f);
+    int intWidth = static_cast<int>(x + width + 0.5f) - intX;
+    int intHeight = static_cast<int>(y + height + 0.5f) - intY;
+    m_context->scissor(intX, m_size.height() - intHeight - intY, intWidth, intHeight);
+    m_context->enable(GraphicsContext3D::SCISSOR_TEST);
+    m_context->clearColor(Color(RGBA32(0)));
+    m_context->clear(GraphicsContext3D::COLOR_BUFFER_BIT);
+    m_context->disable(GraphicsContext3D::SCISSOR_TEST);
+}
+
 void GLES2Canvas::fillPath(const Path& path)
 {
+    if (m_state->shadowActive()) {
+        beginShadowDraw();
+        fillPathInternal(path, m_state->m_shadowColor);
+        endShadowDraw(path.boundingRect());
+    }
+
+    bindFramebuffer();
     m_context->applyCompositeOperator(m_state->m_compositeOp);
-    applyClipping(m_state->m_clippingEnabled);
-    fillPath(path, m_state->applyAlpha(m_state->m_fillColor));
+    applyClipping(m_state->clippingEnabled());
+
+    fillPathInternal(path, m_state->applyAlpha(m_state->m_fillColor));
 }
 
 void GLES2Canvas::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
+    if (m_state->shadowActive()) {
+        beginShadowDraw();
+        fillRectInternal(rect, m_state->m_shadowColor);
+        endShadowDraw(rect);
+    }
+
+    bindFramebuffer();
     m_context->applyCompositeOperator(m_state->m_compositeOp);
-    applyClipping(m_state->m_clippingEnabled);
-    m_context->useQuadVertices();
+    applyClipping(m_state->clippingEnabled());
+
+    fillRectInternal(rect, color);
+}
+
+void GLES2Canvas::fillRect(const FloatRect& rect)
+{
+    fillRect(rect, m_state->applyAlpha(m_state->m_fillColor), ColorSpaceDeviceRGB);
+}
 
+void GLES2Canvas::fillRectInternal(const FloatRect& rect, const Color& color)
+{
     AffineTransform matrix(m_flipMatrix);
     matrix *= m_state->m_ctm;
     matrix.translate(rect.x(), rect.y());
     matrix.scale(rect.width(), rect.height());
 
+    m_context->useQuadVertices();
     m_context->useFillSolidProgram(matrix, color);
-
-    bindFramebuffer();
     m_context->drawArrays(GraphicsContext3D::TRIANGLE_STRIP, 0, 4);
 }
 
-void GLES2Canvas::fillRect(const FloatRect& rect)
-{
-    fillRect(rect, m_state->applyAlpha(m_state->m_fillColor), ColorSpaceDeviceRGB);
-}
-
 void GLES2Canvas::setFillColor(const Color& color, ColorSpace colorSpace)
 {
     m_state->m_fillColor = color;
@@ -246,6 +299,26 @@ void GLES2Canvas::setAlpha(float alpha)
     m_state->m_alpha = alpha;
 }
 
+void GLES2Canvas::setShadowColor(const Color& color, ColorSpace)
+{
+    m_state->m_shadowColor = color;
+}
+
+void GLES2Canvas::setShadowOffset(const FloatSize& offset)
+{
+    m_state->m_shadowOffset = offset;
+}
+
+void GLES2Canvas::setShadowBlur(float shadowBlur)
+{
+    m_state->m_shadowBlur = shadowBlur;
+}
+
+void GLES2Canvas::setShadowsIgnoreTransforms(bool shadowsIgnoreTransforms)
+{
+    m_state->m_shadowsIgnoreTransforms = shadowsIgnoreTransforms;
+}
+
 void GLES2Canvas::translate(float x, float y)
 {
     m_state->m_ctm.translate(x, y);
@@ -275,12 +348,12 @@ void GLES2Canvas::clipPath(const Path& path)
 {
     bindFramebuffer();
     checkGLError("bindFramebuffer");
-    beginStencilDraw();
+    beginStencilDraw(GraphicsContext3D::INCR);
     // Red is used so we can see it if it ends up in the color buffer.
     Color red(255, 0, 0, 255);
-    fillPath(path, red);
-    m_state->m_clippingPaths.append(path);
-    m_state->m_clippingEnabled = true;
+    fillPathInternal(path, red);
+    m_state->m_clippingPaths.append(PathAndTransform(path, m_state->m_ctm));
+    m_state->m_numClippingPaths++;
 }
 
 void GLES2Canvas::clipOut(const Path& path)
@@ -297,53 +370,48 @@ void GLES2Canvas::save()
 void GLES2Canvas::restore()
 {
     ASSERT(!m_stateStack.isEmpty());
-    bool hadClippingPaths = !m_state->m_clippingPaths.isEmpty();
-    m_stateStack.removeLast();
-    m_state = &m_stateStack.last();
-    if (hadClippingPaths) {
-        m_context->clear(GraphicsContext3D::STENCIL_BUFFER_BIT);
-        beginStencilDraw();
-        StateVector::const_iterator iter;
-        for (iter = m_stateStack.begin(); iter < m_stateStack.end(); ++iter) {
-            const State& state = *iter;
-            const Vector<Path>& clippingPaths = state.m_clippingPaths;
-            Vector<Path>::const_iterator pathIter;
-            for (pathIter = clippingPaths.begin(); pathIter < clippingPaths.end(); ++pathIter) {
-                // Red is used so we can see it if it ends up in the color buffer.
-                Color red(255, 0, 0, 255);
-                fillPath(*pathIter, red);
-            }
+    const Vector<PathAndTransform>& clippingPaths = m_state->m_clippingPaths;
+    if (!clippingPaths.isEmpty()) {
+        beginStencilDraw(GraphicsContext3D::DECR);
+        WTF::Vector<PathAndTransform>::const_iterator pathIter;
+        for (pathIter = clippingPaths.begin(); pathIter < clippingPaths.end(); ++pathIter) {
+            m_state->m_ctm = pathIter->transform;
+            // Red is used so we can see it if it ends up in the color buffer.
+            Color red(255, 0, 0, 255);
+            fillPathInternal(pathIter->path, red);
         }
     }
+    m_stateStack.removeLast();
+    m_state = &m_stateStack.last();
 }
 
 void GLES2Canvas::drawTexturedRect(unsigned texture, const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, ColorSpace colorSpace, CompositeOperator compositeOp)
 {
+    bindFramebuffer();
     m_context->applyCompositeOperator(compositeOp);
     applyClipping(false);
 
-    m_context->useQuadVertices();
     m_context->setActiveTexture(GraphicsContext3D::TEXTURE0);
 
     m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, texture);
 
-    drawQuad(textureSize, srcRect, dstRect, m_state->m_ctm, m_state->m_alpha);
+    drawTexturedQuad(textureSize, srcRect, dstRect, m_state->m_ctm, m_state->m_alpha);
 }
 
 void GLES2Canvas::drawTexturedRect(Texture* texture, const FloatRect& srcRect, const FloatRect& dstRect, ColorSpace colorSpace, CompositeOperator compositeOp)
 {
-    drawTexturedRect(texture, srcRect, dstRect, m_state->m_ctm, m_state->m_alpha, colorSpace, compositeOp, m_state->m_clippingEnabled);
+    drawTexturedRect(texture, srcRect, dstRect, m_state->m_ctm, m_state->m_alpha, colorSpace, compositeOp, m_state->clippingEnabled());
 }
 
 
 void GLES2Canvas::drawTexturedRect(Texture* texture, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform& transform, float alpha, ColorSpace colorSpace, CompositeOperator compositeOp, bool clip)
 {
+    bindFramebuffer();
     m_context->applyCompositeOperator(compositeOp);
     applyClipping(clip);
     const TilingData& tiles = texture->tiles();
     IntRect tileIdxRect = tiles.overlappedTileIndices(srcRect);
 
-    m_context->useQuadVertices();
     m_context->setActiveTexture(GraphicsContext3D::TEXTURE0);
 
     for (int y = tileIdxRect.y(); y <= tileIdxRect.maxY(); y++) {
@@ -367,13 +435,18 @@ void GLES2Canvas::drawTexturedRectTile(Texture* texture, int tile, const FloatRe
 
     IntRect tileBoundsWithBorder = tiles.tileBoundsWithBorder(tile);
 
-    drawQuad(tileBoundsWithBorder.size(), srcRectClippedInTileSpace, dstRectIntersected, transform, alpha);
+    drawTexturedQuad(tileBoundsWithBorder.size(), srcRectClippedInTileSpace, dstRectIntersected, transform, alpha);
 }
 
-void GLES2Canvas::drawQuad(const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform& transform, float alpha)
+void GLES2Canvas::convolveRect(unsigned texture, const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, float imageIncrement[2], const float* kernel, int kernelWidth)
 {
+    m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, texture);
+    m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE);
+    m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
+    m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::NEAREST);
+    m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::NEAREST);
+
     AffineTransform matrix(m_flipMatrix);
-    matrix *= transform;
     matrix.translate(dstRect.x(), dstRect.y());
     matrix.scale(dstRect.width(), dstRect.height());
 
@@ -382,13 +455,79 @@ void GLES2Canvas::drawQuad(const IntSize& textureSize, const FloatRect& srcRect,
     texMatrix.translate(srcRect.x(), srcRect.y());
     texMatrix.scale(srcRect.width(), srcRect.height());
 
-    bindFramebuffer();
+    m_context->useQuadVertices();
+    m_context->useConvolutionProgram(matrix, texMatrix, kernel, kernelWidth, imageIncrement);
+    m_context->drawArrays(GraphicsContext3D::TRIANGLE_STRIP, 0, 4);
+    checkGLError("glDrawArrays");
+}
 
+static float gauss(float x, float sigma)
+{
+    return exp(- (x * x) / (2.0f * sigma * sigma));
+}
+
+static void buildKernel(float sigma, float* kernel, int kernelWidth)
+{
+    float halfWidth = (kernelWidth - 1.0f) / 2.0f;
+    float sum = 0.0f;
+    for (int i = 0; i < kernelWidth; ++i) {
+        kernel[i] = gauss(i - halfWidth, sigma);
+        sum += kernel[i];
+    }
+    // Normalize the kernel
+    float scale = 1.0f / sum;
+    for (int i = 0; i < kernelWidth; ++i)
+        kernel[i] *= scale;
+}
+
+void GLES2Canvas::drawTexturedQuad(const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform& transform, float alpha)
+{
+    AffineTransform matrix(m_flipMatrix);
+    matrix *= transform;
+    matrix.translate(dstRect.x(), dstRect.y());
+    matrix.scale(dstRect.width(), dstRect.height());
+
+    AffineTransform texMatrix;
+    texMatrix.scale(1.0f / textureSize.width(), 1.0f / textureSize.height());
+    texMatrix.translate(srcRect.x(), srcRect.y());
+    texMatrix.scale(srcRect.width(), srcRect.height());
+
+    m_context->useQuadVertices();
     m_context->useTextureProgram(matrix, texMatrix, alpha);
     m_context->drawArrays(GraphicsContext3D::TRIANGLE_STRIP, 0, 4);
     checkGLError("glDrawArrays");
 }
 
+void GLES2Canvas::drawTexturedQuadMitchell(const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform& transform, float alpha)
+{
+    static const float mitchellCoefficients[16] = {
+         0.0f / 18.0f,   1.0f / 18.0f,  16.0f / 18.0f,   1.0f / 18.0f,
+         0.0f / 18.0f,   9.0f / 18.0f,   0.0f / 18.0f,  -9.0f / 18.0f,
+        -6.0f / 18.0f,  27.0f / 18.0f, -36.0f / 18.0f,  15.0f / 18.0f,
+         7.0f / 18.0f, -21.0f / 18.0f,  21.0f / 18.0f,  -7.0f / 18.0f,
+    };
+
+    AffineTransform matrix(m_flipMatrix);
+    matrix *= transform;
+    matrix.translate(dstRect.x(), dstRect.y());
+    matrix.scale(dstRect.width(), dstRect.height());
+
+    float imageIncrement[2] = { 1.0f / textureSize.width(), 1.0f / textureSize.height() };
+
+    AffineTransform texMatrix;
+    texMatrix.scale(imageIncrement[0], imageIncrement[1]);
+    texMatrix.translate(srcRect.x(), srcRect.y());
+    texMatrix.scale(srcRect.width(), srcRect.height());
+
+    m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::NEAREST);
+    m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::NEAREST);
+
+    m_context->useQuadVertices();
+    m_context->useBicubicProgram(matrix, texMatrix, mitchellCoefficients, imageIncrement, alpha);
+    m_context->drawArrays(GraphicsContext3D::TRIANGLE_STRIP, 0, 4);
+    checkGLError("glDrawArrays");
+}
+
 void GLES2Canvas::setCompositeOperation(CompositeOperator op)
 {
     m_state->m_compositeOp = op;
@@ -554,12 +693,9 @@ void GLES2Canvas::createVertexBufferFromPath(const Path& path, int* count, unsig
     *count = indices.size();
 }
 
-void GLES2Canvas::fillPath(const Path& path, const Color& color)
+void GLES2Canvas::fillPathInternal(const Path& path, const Color& color)
 {
     if (SharedGraphicsContext3D::useLoopBlinnForPathRendering()) {
-        bindFramebuffer();
-        m_context->applyCompositeOperator(m_state->m_compositeOp);
-
         m_pathCache.clear();
         LoopBlinnPathProcessor processor;
         processor.process(path, m_pathCache);
@@ -590,18 +726,18 @@ void GLES2Canvas::fillPath(const Path& path, const Color& color)
         int count;
         unsigned vertexBuffer, indexBuffer;
         createVertexBufferFromPath(path, &count, &vertexBuffer, &indexBuffer);
+
+        AffineTransform matrix(m_flipMatrix);
+        matrix *= m_state->m_ctm;
+
         m_context->graphicsContext3D()->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, vertexBuffer);
         checkGLError("bindBuffer");
         m_context->graphicsContext3D()->bindBuffer(GraphicsContext3D::ELEMENT_ARRAY_BUFFER, indexBuffer);
         checkGLError("bindBuffer");
 
-        AffineTransform matrix(m_flipMatrix);
-        matrix *= m_state->m_ctm;
-
         m_context->useFillSolidProgram(matrix, color);
         checkGLError("useFillSolidProgram");
 
-        bindFramebuffer();
         m_context->graphicsContext3D()->drawElements(GraphicsContext3D::TRIANGLES, count, GraphicsContext3D::UNSIGNED_SHORT, 0);
         checkGLError("drawArrays");
 
@@ -613,7 +749,141 @@ void GLES2Canvas::fillPath(const Path& path, const Color& color)
     }
 }
 
-void GLES2Canvas::beginStencilDraw()
+FloatRect GLES2Canvas::flipRect(const FloatRect& rect)
+{
+    FloatRect flippedRect(rect);
+    flippedRect.setY(m_size.height() - rect.y());
+    flippedRect.setHeight(-rect.height());
+    return flippedRect;
+}
+
+void GLES2Canvas::clearBorders(const FloatRect& rect, int width)
+{
+    scissorClear(rect.x(), rect.y() - width, rect.width() + width, width);
+    scissorClear(rect.maxX(), rect.y(), width, rect.height() + width);
+    scissorClear(rect.x() - width, rect.maxY(), rect.width() + width, width);
+    scissorClear(rect.x() - width, rect.y() - width, width, rect.height() + width);
+}
+
+void GLES2Canvas::beginShadowDraw()
+{
+    float offsetX = m_state->m_shadowOffset.width();
+    float offsetY = m_state->m_shadowOffset.height();
+    save();
+    if (m_state->m_shadowsIgnoreTransforms) {
+        AffineTransform newCTM;
+        newCTM.translate(offsetX, -offsetY);
+        newCTM *= m_state->m_ctm;
+        m_state->m_ctm = newCTM;
+    } else
+        m_state->m_ctm.translate(offsetX, offsetY);
+
+    if (m_state->m_shadowBlur > 0) {
+        // Draw hard shadow to offscreen buffer 0.
+        DrawingBuffer* dstBuffer = m_context->getOffscreenBuffer(0, m_size);
+        dstBuffer->bind();
+        m_context->applyCompositeOperator(CompositeCopy);
+        applyClipping(false);
+        m_context->clearColor(Color(RGBA32(0)));
+        m_context->clear(GraphicsContext3D::COLOR_BUFFER_BIT);
+    } else {
+        bindFramebuffer();
+        m_context->applyCompositeOperator(m_state->m_compositeOp);
+        applyClipping(m_state->clippingEnabled());
+    }
+}
+
+void GLES2Canvas::endShadowDraw(const FloatRect& boundingBox)
+{
+    if (m_state->m_shadowBlur > 0) {
+        // Buffer 0 contains the primitive drawn with a hard shadow.
+        DrawingBuffer* srcBuffer = m_context->getOffscreenBuffer(0, m_size);
+        DrawingBuffer* dstBuffer = m_context->getOffscreenBuffer(1, m_size);
+
+        float sigma = m_state->m_shadowBlur * 0.333333f;
+        FloatRect shadowBoundingBox(m_state->m_ctm.mapRect(boundingBox));
+        FloatRect rect(FloatPoint(0, 0), m_size);
+        FloatRect srcRect(shadowBoundingBox);
+
+        int scaleFactor = 1;
+        while (sigma > cMaxSigma) {
+            srcRect.scale(0.5f);
+            scaleFactor *= 2;
+            sigma *= 0.5f;
+        }
+        srcRect = enclosingIntRect(srcRect);
+        srcRect.scale(scaleFactor);
+        for (int i = 1; i < scaleFactor; i *= 2) {
+            dstBuffer->bind();
+            m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, srcBuffer->colorBuffer());
+            m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE);
+            m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
+            m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR);
+            m_context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::LINEAR);
+            FloatRect dstRect(srcRect);
+            dstRect.scale(0.5f);
+            // Clear out 1 pixel border for linear filtering.
+            clearBorders(dstRect, 1);
+            drawTexturedQuad(srcBuffer->size(), flipRect(srcRect), dstRect, AffineTransform(), 1.0);
+            srcRect = dstRect;
+            std::swap(srcBuffer, dstBuffer);
+        }
+
+        int halfWidth = static_cast<int>(sigma * 3.0f);
+        int kernelWidth = halfWidth * 2 + 1;
+        OwnArrayPtr<float> kernel = adoptArrayPtr(new float[kernelWidth]);
+        buildKernel(sigma, kernel.get(), kernelWidth);
+
+        if (scaleFactor > 1) {
+            scissorClear(srcRect.maxX(), srcRect.y(), kernelWidth, srcRect.height());
+            scissorClear(srcRect.x() - kernelWidth, srcRect.y(), kernelWidth, srcRect.height());
+        }
+
+        // Blur in X offscreen.
+        dstBuffer->bind();
+        srcRect.inflateX(halfWidth);
+        srcRect.intersect(rect);
+        float imageIncrementX[2] = {1.0f / srcBuffer->size().width(), 0.0f};
+        convolveRect(srcBuffer->colorBuffer(), srcBuffer->size(), flipRect(srcRect), srcRect, imageIncrementX, kernel.get(), kernelWidth);
+
+        if (scaleFactor > 1) {
+            scissorClear(srcRect.x(), srcRect.maxY(), srcRect.width(), kernelWidth);
+            scissorClear(srcRect.x(), srcRect.y() - kernelWidth, srcRect.width(), kernelWidth);
+        }
+        srcRect.inflateY(halfWidth);
+        srcRect.intersect(rect);
+        std::swap(srcBuffer, dstBuffer);
+
+        float imageIncrementY[2] = {0.0f, 1.0f / srcBuffer->size().height()};
+        if (scaleFactor > 1) {
+            // Blur in Y offscreen.
+            dstBuffer->bind();
+            convolveRect(srcBuffer->colorBuffer(), srcBuffer->size(), flipRect(srcRect), srcRect, imageIncrementY, kernel.get(), kernelWidth);
+            // Clear out 2 pixel border for bicubic filtering.
+            clearBorders(srcRect, 2);
+            std::swap(srcBuffer, dstBuffer);
+
+            // Upsample srcBuffer -> main framebuffer using bicubic filtering.
+            bindFramebuffer();
+            m_context->applyCompositeOperator(m_state->m_compositeOp);
+            applyClipping(m_state->clippingEnabled());
+            m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, srcBuffer->colorBuffer());
+            FloatRect dstRect = srcRect;
+            dstRect.scale(scaleFactor);
+            drawTexturedQuadMitchell(srcBuffer->size(), flipRect(srcRect), dstRect, AffineTransform(), 1.0);
+        } else {
+            // Blur in Y directly to framebuffer.
+            bindFramebuffer();
+            m_context->applyCompositeOperator(m_state->m_compositeOp);
+            applyClipping(m_state->clippingEnabled());
+
+            convolveRect(srcBuffer->colorBuffer(), srcBuffer->size(), flipRect(srcRect), srcRect, imageIncrementY, kernel.get(), kernelWidth);
+        }
+    }
+    restore();
+}
+
+void GLES2Canvas::beginStencilDraw(unsigned op)
 {
     // Turn on stencil test.
     m_context->enableStencil(true);
@@ -624,9 +894,7 @@ void GLES2Canvas::beginStencilDraw()
     checkGLError("stencilFunc");
 
     // All writes incremement the stencil buffer.
-    m_context->graphicsContext3D()->stencilOp(GraphicsContext3D::INCR,
-                                              GraphicsContext3D::INCR,
-                                              GraphicsContext3D::INCR);
+    m_context->graphicsContext3D()->stencilOp(op, op, op);
     checkGLError("stencilOp");
 }
 
@@ -635,7 +903,7 @@ void GLES2Canvas::applyClipping(bool enable)
     m_context->enableStencil(enable);
     if (enable) {
         // Enable drawing only where stencil is non-zero.
-        m_context->graphicsContext3D()->stencilFunc(GraphicsContext3D::EQUAL, m_state->m_clippingPaths.size() % 256, 1);
+        m_context->graphicsContext3D()->stencilFunc(GraphicsContext3D::EQUAL, m_state->m_numClippingPaths, -1);
         checkGLError("stencilFunc");
         // Keep all stencil values the same.
         m_context->graphicsContext3D()->stencilOp(GraphicsContext3D::KEEP,
diff --git a/Source/WebCore/platform/graphics/chromium/GLES2Canvas.h b/Source/WebCore/platform/graphics/chromium/GLES2Canvas.h
index 8887a16..f6a8bcf 100644
--- a/Source/WebCore/platform/graphics/chromium/GLES2Canvas.h
+++ b/Source/WebCore/platform/graphics/chromium/GLES2Canvas.h
@@ -64,6 +64,10 @@ public:
     void clearRect(const FloatRect&);
     void setFillColor(const Color&, ColorSpace);
     void setAlpha(float alpha);
+    void setShadowColor(const Color&, ColorSpace);
+    void setShadowOffset(const FloatSize&);
+    void setShadowBlur(float);
+    void setShadowsIgnoreTransforms(bool);
     void setCompositeOperation(CompositeOperator);
     void translate(float x, float y);
     void rotate(float angleInRadians);
@@ -96,12 +100,21 @@ public:
     DrawingBuffer* drawingBuffer() const { return m_drawingBuffer; }
 
 private:
+    void scissorClear(float x, float y, float width, float height);
     void drawTexturedRectTile(Texture* texture, int tile, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform&, float alpha);
-    void drawQuad(const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform&, float alpha);
+    void drawTexturedQuad(const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform&, float alpha);
+    void drawTexturedQuadMitchell(const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, const AffineTransform&, float alpha);
+    void convolveRect(unsigned texture, const IntSize& textureSize, const FloatRect& srcRect, const FloatRect& dstRect, float imageIncrement[2], const float* kernel, int kernelWidth);
+
     void applyCompositeOperator(CompositeOperator);
     void createVertexBufferFromPath(const Path&, int* count, unsigned* vertexBuffer, unsigned* indexBuffer);
-    void fillPath(const Path&, const Color&);
-    void beginStencilDraw();
+    void fillPathInternal(const Path&, const Color&);
+    void fillRectInternal(const FloatRect&, const Color&);
+    FloatRect flipRect(const FloatRect&);
+    void clearBorders(const FloatRect&, int width);
+    void beginShadowDraw();
+    void endShadowDraw(const FloatRect& boundingBox);
+    void beginStencilDraw(unsigned op);
     void applyClipping(bool enable);
     void checkGLError(const char* header);
 
diff --git a/Source/WebCore/platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp b/Source/WebCore/platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp
index ee2b5ab..cfc1754 100644
--- a/Source/WebCore/platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp
@@ -36,8 +36,8 @@
 #include "GlyphPageTreeNode.h"
 #include "PlatformBridge.h"
 #include "SimpleFontData.h"
+#include "SystemInfo.h"
 #include "UniscribeHelperTextRun.h"
-#include "WindowsVersion.h"
 
 namespace WebCore {
 
@@ -134,7 +134,7 @@ static bool fillBMPGlyphs(unsigned offset,
     bool haveGlyphs = false;
     int invalidGlyph = 0xFFFF;
     const DWORD cffTableTag = 0x20464643; // 4-byte identifier for OpenType CFF table ('CFF ').
-    if (!isVistaOrNewer() && !(tm.tmPitchAndFamily & TMPF_TRUETYPE) && (GetFontData(dc, cffTableTag, 0, 0, 0) == GDI_ERROR))
+    if ((windowsVersion() < WindowsVista) && !(tm.tmPitchAndFamily & TMPF_TRUETYPE) && (GetFontData(dc, cffTableTag, 0, 0, 0) == GDI_ERROR))
         invalidGlyph = 0x1F;
 
     Glyph spaceGlyph = 0;  // Glyph for a space. Lazily filled.
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
index 7c42366..60c1332 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
@@ -60,7 +60,7 @@ void ImageLayerChromium::setContents(Image* contents)
     setNeedsDisplay();
 }
 
-void ImageLayerChromium::updateContentsIfDirty()
+void ImageLayerChromium::paintContentsIfDirty()
 {
     ASSERT(layerRenderer());
 
@@ -68,7 +68,7 @@ void ImageLayerChromium::updateContentsIfDirty()
     if (requiresClippedUpdateRect()) {
         // Use the base version of updateContents which draws a subset of the
         // image to a bitmap, as the pixel contents can't be uploaded directly.
-        ContentLayerChromium::updateContentsIfDirty();
+        ContentLayerChromium::paintContentsIfDirty();
         return;
     }
 
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
index cc9064d..6addabc 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
@@ -50,7 +50,7 @@ class ImageLayerChromium : public ContentLayerChromium {
 public:
     static PassRefPtr<ImageLayerChromium> create(GraphicsLayerChromium* owner = 0);
 
-    virtual void updateContentsIfDirty();
+    virtual void paintContentsIfDirty();
     virtual bool drawsContent() const { return m_contents; }
 
     void setContents(Image* image);
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
index 95b7386..bc28239 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -62,6 +62,7 @@ LayerChromium::LayerChromium(GraphicsLayerChromium* owner)
     : m_owner(owner)
     , m_contentsDirty(false)
     , m_maskLayer(0)
+    , m_ccLayerImpl(0)
     , m_superlayer(0)
 #ifndef NDEBUG
     , m_debugID(s_nextLayerDebugID++)
@@ -77,7 +78,7 @@ LayerChromium::LayerChromium(GraphicsLayerChromium* owner)
     , m_opaque(true)
     , m_geometryFlipped(false)
     , m_needsDisplayOnBoundsChange(false)
-    , m_ccLayerImpl(CCLayerImpl::create(this))
+    , m_doubleSided(true)
     , m_replicaLayer(0)
 {
 }
@@ -94,7 +95,8 @@ LayerChromium::~LayerChromium()
 
 void LayerChromium::cleanupResources()
 {
-    m_ccLayerImpl->cleanupResources();
+    if (m_ccLayerImpl)
+        m_ccLayerImpl->cleanupResources();
 }
 
 void LayerChromium::setLayerRenderer(LayerRendererChromium* renderer)
@@ -105,8 +107,7 @@ void LayerChromium::setLayerRenderer(LayerRendererChromium* renderer)
         cleanupResources();
         setNeedsDisplay();
     }
-
-    m_ccLayerImpl->setLayerRenderer(renderer);
+    m_layerRenderer = renderer;
 }
 
 void LayerChromium::setNeedsCommit()
@@ -188,7 +189,7 @@ void LayerChromium::setBounds(const IntSize& size)
 
     bool firstResize = !bounds().width() && !bounds().height() && size.width() && size.height();
 
-    m_ccLayerImpl->setBounds(size);
+    m_bounds = size;
 
     if (firstResize)
         setNeedsDisplay(FloatRect(0, 0, bounds().width(), bounds().height()));
@@ -240,7 +241,6 @@ LayerChromium* LayerChromium::superlayer() const
 void LayerChromium::setName(const String& name)
 {
     m_name = name;
-    m_ccLayerImpl->setName(name);
 }
 
 void LayerChromium::setNeedsDisplay(const FloatRect& dirtyRect)
@@ -288,6 +288,29 @@ void LayerChromium::toGLMatrix(float* flattened, const TransformationMatrix& m)
     flattened[15] = m.m44();
 }
 
+void LayerChromium::pushPropertiesTo(CCLayerImpl* layer)
+{
+    layer->setAnchorPoint(m_anchorPoint);
+    layer->setAnchorPointZ(m_anchorPointZ);
+    layer->setBounds(m_bounds);
+    layer->setDebugBorderColor(m_debugBorderColor);
+    layer->setDebugBorderWidth(m_debugBorderWidth);
+    layer->setDoubleSided(m_doubleSided);
+    layer->setLayerRenderer(m_layerRenderer.get());
+    layer->setMasksToBounds(m_masksToBounds);
+    layer->setName(m_name);
+    layer->setOpacity(m_opacity);
+    layer->setPosition(m_position);
+    layer->setPreserves3D(preserves3D());
+    layer->setSublayerTransform(m_sublayerTransform);
+    layer->setTransform(m_transform);
+
+    if (maskLayer())
+        maskLayer()->pushPropertiesTo(layer->maskLayer());
+    if (replicaLayer())
+        replicaLayer()->pushPropertiesTo(layer->replicaLayer());
+}
+
 GraphicsContext3D* LayerChromium::layerRendererContext() const
 {
     ASSERT(layerRenderer());
@@ -316,31 +339,6 @@ void LayerChromium::drawTexturedQuad(GraphicsContext3D* context, const Transform
     GLC(context, context->drawElements(GraphicsContext3D::TRIANGLES, 6, GraphicsContext3D::UNSIGNED_SHORT, 0));
 }
 
-
-
-// Returns true if any of the layer's descendants has drawable content.
-bool LayerChromium::descendantsDrawContent()
-{
-    const Vector<RefPtr<LayerChromium> >& sublayers = getSublayers();
-    for (size_t i = 0; i < sublayers.size(); ++i)
-        if (sublayers[i]->descendantsDrawContentRecursive())
-            return true;
-    return false;
-}
-
-// Returns true if either this layer or one of its descendants has drawable content.
-bool LayerChromium::descendantsDrawContentRecursive()
-{
-    if (drawsContent())
-        return true;
-
-    const Vector<RefPtr<LayerChromium> >& sublayers = getSublayers();
-    for (size_t i = 0; i < sublayers.size(); ++i)
-        if (sublayers[i]->descendantsDrawContentRecursive())
-            return true;
-    return false;
-}
-
 String LayerChromium::layerTreeAsText() const
 {
     TextStream ts;
@@ -359,7 +357,8 @@ void LayerChromium::dumpLayer(TextStream& ts, int indent) const
     writeIndent(ts, indent);
     ts << layerTypeAsString() << "(" << m_name << ")\n";
     dumpLayerProperties(ts, indent+2);
-    m_ccLayerImpl->dumpLayerProperties(ts, indent+2);
+    if (m_ccLayerImpl)
+        m_ccLayerImpl->dumpLayerProperties(ts, indent+2);
     if (m_replicaLayer) {
         writeIndent(ts, indent+2);
         ts << "Replica:\n";
@@ -385,48 +384,38 @@ void LayerChromium::dumpLayerProperties(TextStream& ts, int indent) const
 
 }
 
-// Begin calls that forward to the CCLayerImpl.
-// ==============================================
-// These exists just for debugging (via drawDebugBorder()).
-void LayerChromium::setBorderColor(const Color& color)
+PassRefPtr<CCLayerImpl> LayerChromium::createCCLayerImpl()
 {
-    m_ccLayerImpl->setDebugBorderColor(color);
-    setNeedsCommit();
+    return CCLayerImpl::create(this);
 }
 
-Color LayerChromium::borderColor() const
+void LayerChromium::createCCLayerImplIfNeeded()
 {
-    return m_ccLayerImpl->debugBorderColor();
+    if (!m_ccLayerImpl)
+        m_ccLayerImpl = createCCLayerImpl();
 }
 
-void LayerChromium::setBorderWidth(float width)
+CCLayerImpl* LayerChromium::ccLayerImpl()
 {
-    m_ccLayerImpl->setDebugBorderWidth(width);
-    setNeedsCommit();
+    return m_ccLayerImpl.get();
 }
 
-float LayerChromium::borderWidth() const
-{
-    return m_ccLayerImpl->debugBorderWidth();
-}
-
-LayerRendererChromium* LayerChromium::layerRenderer() const
+void LayerChromium::setBorderColor(const Color& color)
 {
-    return m_ccLayerImpl->layerRenderer();
+    m_debugBorderColor = color;
+    setNeedsCommit();
 }
 
-void LayerChromium::setDoubleSided(bool doubleSided)
+void LayerChromium::setBorderWidth(float width)
 {
-    m_ccLayerImpl->setDoubleSided(doubleSided);
+    m_debugBorderWidth = width;
     setNeedsCommit();
 }
 
-const IntSize& LayerChromium::bounds() const
+LayerRendererChromium* LayerChromium::layerRenderer() const
 {
-    return m_ccLayerImpl->bounds();
+    return m_layerRenderer.get();
 }
-// ==============================================
-// End calls that forward to the CCLayerImpl.
 
 }
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
index 29a2165..428ce61 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -89,6 +89,9 @@ public:
     void setBackgroundColor(const Color& color) { m_backgroundColor = color; setNeedsCommit(); }
     Color backgroundColor() const { return m_backgroundColor; }
 
+    void setBounds(const IntSize&);
+    const IntSize& bounds() const { return m_bounds; }
+
     void setClearsContext(bool clears) { m_clearsContext = clears; setNeedsCommit(); }
     bool clearsContext() const { return m_clearsContext; }
 
@@ -133,6 +136,9 @@ public:
     void setTransform(const TransformationMatrix& transform) { m_transform = transform; setNeedsCommit(); }
     const TransformationMatrix& transform() const { return m_transform; }
 
+    bool doubleSided() const { return m_doubleSided; }
+    void setDoubleSided(bool doubleSided) { m_doubleSided = doubleSided; setNeedsCommit(); }
+
     // FIXME: This setting is currently ignored.
     void setGeometryFlipped(bool flipped) { m_geometryFlipped = flipped; setNeedsCommit(); }
     bool geometryFlipped() const { return m_geometryFlipped; }
@@ -143,9 +149,6 @@ public:
     // in the LayerRendererChromium.
     virtual void setLayerRenderer(LayerRendererChromium*);
 
-    // Returns true if any of the layer's descendants has content to draw.
-    bool descendantsDrawContent();
-
     void setOwner(GraphicsLayerChromium* owner) { m_owner = owner; }
 
     void setReplicaLayer(LayerChromium* layer) { m_replicaLayer = layer; }
@@ -153,14 +156,14 @@ public:
 
     // These methods typically need to be overwritten by derived classes.
     virtual bool drawsContent() const { return false; }
-    virtual void updateContentsIfDirty() { }
+    virtual void paintContentsIfDirty() { }
+    virtual void updateCompositorResources() { }
     virtual void unreserveContentsTexture() { }
     virtual void bindContentsTexture() { }
     virtual void draw() { }
 
     // These exists just for debugging (via drawDebugBorder()).
     void setBorderColor(const Color&);
-    Color borderColor() const;
 
 #ifndef NDEBUG
     int debugID() const { return m_debugID; }
@@ -170,21 +173,19 @@ public:
     String layerTreeAsText() const;
 
     void setBorderWidth(float);
-    float borderWidth() const;
 
     // Everything from here down in the public section will move to CCLayerImpl.
-
-    CCLayerImpl* ccLayerImpl() const { return m_ccLayerImpl.get(); }
+    CCLayerImpl* ccLayerImpl();
+    void createCCLayerImplIfNeeded();
 
     static void drawTexturedQuad(GraphicsContext3D*, const TransformationMatrix& projectionMatrix, const TransformationMatrix& layerMatrix,
                                  float width, float height, float opacity,
                                  int matrixLocation, int alphaLocation);
 
+    virtual void pushPropertiesTo(CCLayerImpl*);
+
     // Begin calls that forward to the CCLayerImpl.
     LayerRendererChromium* layerRenderer() const;
-    void setDoubleSided(bool);
-    void setBounds(const IntSize&);
-    const IntSize& bounds() const;
     // End calls that forward to the CCLayerImpl.
 
     typedef ProgramBinding<VertexShaderPos, FragmentShaderColor> BorderProgram;
@@ -217,6 +218,11 @@ protected:
     static const unsigned s_positionAttribLocation;
     static const unsigned s_texCoordAttribLocation;
 
+    // Constructs a CCLayerImpl of the correct runtime type for this LayerChromium type.
+    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
+
+    // For now, the LayerChromium directly owns its CCLayerImpl.
+    RefPtr<CCLayerImpl> m_ccLayerImpl;
 private:
     void setNeedsCommit();
 
@@ -233,19 +239,22 @@ private:
     // This should only be called from removeFromSuperlayer.
     void removeSublayer(LayerChromium*);
 
-    bool descendantsDrawContentRecursive();
-
     Vector<RefPtr<LayerChromium> > m_sublayers;
     LayerChromium* m_superlayer;
 
+    RefPtr<LayerRendererChromium> m_layerRenderer;
+
 #ifndef NDEBUG
     int m_debugID;
 #endif
 
     // Layer properties.
+    IntSize m_bounds;
     FloatPoint m_position;
     FloatPoint m_anchorPoint;
     Color m_backgroundColor;
+    Color m_debugBorderColor;
+    float m_debugBorderWidth;
     float m_opacity;
     float m_zPosition;
     float m_anchorPointZ;
@@ -255,13 +264,12 @@ private:
     bool m_opaque;
     bool m_geometryFlipped;
     bool m_needsDisplayOnBoundsChange;
+    bool m_doubleSided;
 
     TransformationMatrix m_transform;
     TransformationMatrix m_sublayerTransform;
 
     FloatRect m_frame;
-    // For now, the LayerChromium directly owns its CCLayerImpl.
-    RefPtr<CCLayerImpl> m_ccLayerImpl;
 
     // Replica layer used for reflections.
     LayerChromium* m_replicaLayer;
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
index e7b299f..fc15abd 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
@@ -36,6 +36,7 @@
 
 #include "cc/CCLayerImpl.h"
 #include "Canvas2DLayerChromium.h"
+#include "FloatQuad.h"
 #include "GeometryBinding.h"
 #include "GraphicsContext3D.h"
 #include "LayerChromium.h"
@@ -43,6 +44,7 @@
 #include "NotImplemented.h"
 #include "TextStream.h"
 #include "TextureManager.h"
+#include "TraceEvent.h"
 #include "WebGLLayerChromium.h"
 #include "cc/CCLayerImpl.h"
 #if USE(SKIA)
@@ -91,21 +93,23 @@ bool LayerRendererChromium::compareLayerZ(const CCLayerImpl* a, const CCLayerImp
     return a->drawDepth() < b->drawDepth();
 }
 
-PassRefPtr<LayerRendererChromium> LayerRendererChromium::create(PassRefPtr<GraphicsContext3D> context)
+PassRefPtr<LayerRendererChromium> LayerRendererChromium::create(PassRefPtr<GraphicsContext3D> context, PassOwnPtr<TilePaintInterface> contentPaint, PassOwnPtr<TilePaintInterface> scrollbarPaint)
 {
     if (!context)
         return 0;
 
-    RefPtr<LayerRendererChromium> layerRenderer(adoptRef(new LayerRendererChromium(context)));
+    RefPtr<LayerRendererChromium> layerRenderer(adoptRef(new LayerRendererChromium(context, contentPaint, scrollbarPaint)));
     if (!layerRenderer->hardwareCompositing())
         return 0;
 
     return layerRenderer.release();
 }
 
-LayerRendererChromium::LayerRendererChromium(PassRefPtr<GraphicsContext3D> context)
-    : m_rootLayer(0)
-    , m_scrollPosition(IntPoint(-1, -1))
+LayerRendererChromium::LayerRendererChromium(PassRefPtr<GraphicsContext3D> context, PassOwnPtr<TilePaintInterface> contentPaint, PassOwnPtr<TilePaintInterface> scrollbarPaint)
+    : m_viewportScrollPosition(IntPoint(-1, -1))
+    , m_rootLayer(0)
+    , m_rootLayerContentPaint(contentPaint)
+    , m_rootLayerScrollbarPaint(scrollbarPaint)
     , m_currentShader(0)
     , m_currentRenderSurface(0)
     , m_offscreenFramebufferId(0)
@@ -114,8 +118,8 @@ LayerRendererChromium::LayerRendererChromium(PassRefPtr<GraphicsContext3D> conte
     , m_defaultRenderSurface(0)
 {
     m_hardwareCompositing = initializeSharedObjects();
-    m_rootLayerTiler = LayerTilerChromium::create(this, IntSize(256, 256), LayerTilerChromium::NoBorderTexels);
-    ASSERT(m_rootLayerTiler);
+    m_rootLayerContentTiler = LayerTilerChromium::create(this, IntSize(256, 256), LayerTilerChromium::NoBorderTexels);
+    ASSERT(m_rootLayerContentTiler);
 
     m_headsUpDisplay = CCHeadsUpDisplay::create(this);
 }
@@ -146,129 +150,149 @@ void LayerRendererChromium::useShader(unsigned programId)
     }
 }
 
-IntRect LayerRendererChromium::verticalScrollbarRect(const IntRect& visibleRect, const IntRect& contentRect)
+IntRect LayerRendererChromium::verticalScrollbarRect() const
 {
-    IntRect verticalScrollbar(IntPoint(contentRect.maxX(), contentRect.y()), IntSize(visibleRect.width() - contentRect.width(), visibleRect.height()));
+    IntRect verticalScrollbar(IntPoint(m_viewportContentRect.maxX(), m_viewportContentRect.y()), IntSize(m_viewportVisibleRect.width() - m_viewportContentRect.width(), m_viewportVisibleRect.height()));
     return verticalScrollbar;
 }
 
-IntRect LayerRendererChromium::horizontalScrollbarRect(const IntRect& visibleRect, const IntRect& contentRect)
+IntRect LayerRendererChromium::horizontalScrollbarRect() const
 {
-    IntRect horizontalScrollbar(IntPoint(contentRect.x(), contentRect.maxY()), IntSize(visibleRect.width(), visibleRect.height() - contentRect.height()));
+    IntRect horizontalScrollbar(IntPoint(m_viewportContentRect.x(), m_viewportContentRect.maxY()), IntSize(m_viewportVisibleRect.width(), m_viewportVisibleRect.height() - m_viewportContentRect.height()));
     return horizontalScrollbar;
 }
 
-void LayerRendererChromium::invalidateRootLayerRect(const IntRect& dirtyRect, const IntRect& visibleRect, const IntRect& contentRect)
+void LayerRendererChromium::invalidateRootLayerRect(const IntRect& dirtyRect)
 {
-    m_rootLayerTiler->invalidateRect(dirtyRect);
+    m_rootLayerContentTiler->invalidateRect(dirtyRect);
+
+    // Scrollbars never need to render beyond the fold, so clip to the viewport.
+    IntRect visibleDirtyRect = dirtyRect;
+    visibleDirtyRect.intersect(m_viewportVisibleRect);
+
     if (m_horizontalScrollbarTiler) {
-        IntRect scrollbar = horizontalScrollbarRect(visibleRect, contentRect);
-        if (dirtyRect.intersects(scrollbar)) {
+        IntRect scrollbar = horizontalScrollbarRect();
+        if (visibleDirtyRect.intersects(scrollbar)) {
             m_horizontalScrollbarTiler->setLayerPosition(scrollbar.location());
-            m_horizontalScrollbarTiler->invalidateRect(dirtyRect);
+            m_horizontalScrollbarTiler->invalidateRect(visibleDirtyRect);
         }
     }
     if (m_verticalScrollbarTiler) {
-        IntRect scrollbar = verticalScrollbarRect(visibleRect, contentRect);
-        if (dirtyRect.intersects(scrollbar)) {
+        IntRect scrollbar = verticalScrollbarRect();
+        if (visibleDirtyRect.intersects(scrollbar)) {
             m_verticalScrollbarTiler->setLayerPosition(scrollbar.location());
-            m_verticalScrollbarTiler->invalidateRect(dirtyRect);
+            m_verticalScrollbarTiler->invalidateRect(visibleDirtyRect);
         }
     }
 }
 
-void LayerRendererChromium::updateRootLayerContents(TilePaintInterface& tilePaint, const IntRect& visibleRect)
+void LayerRendererChromium::updateRootLayerContents()
 {
-    m_rootLayerTiler->update(tilePaint, visibleRect);
+    TRACE_EVENT("LayerRendererChromium::updateRootLayerContents", this, 0);
+    m_rootLayerContentTiler->update(*m_rootLayerContentPaint, m_viewportVisibleRect);
 }
 
-void LayerRendererChromium::updateRootLayerScrollbars(TilePaintInterface& scrollbarPaint, const IntRect& visibleRect, const IntRect& contentRect)
+void LayerRendererChromium::updateRootLayerScrollbars()
 {
-    if (visibleRect.width() > contentRect.width()) {
-        IntRect verticalScrollbar = verticalScrollbarRect(visibleRect, contentRect);
+    TRACE_EVENT("LayerRendererChromium::updateRootLayerScrollbars", this, 0);
+    if (m_viewportVisibleRect.width() > m_viewportContentRect.width()) {
+        IntRect verticalScrollbar = verticalScrollbarRect();
         IntSize tileSize = verticalScrollbar.size().shrunkTo(IntSize(m_maxTextureSize, m_maxTextureSize));
         if (!m_verticalScrollbarTiler)
             m_verticalScrollbarTiler = LayerTilerChromium::create(this, tileSize, LayerTilerChromium::NoBorderTexels);
         else
             m_verticalScrollbarTiler->setTileSize(tileSize);
         m_verticalScrollbarTiler->setLayerPosition(verticalScrollbar.location());
-        m_verticalScrollbarTiler->update(scrollbarPaint, visibleRect);
+        m_verticalScrollbarTiler->update(*m_rootLayerScrollbarPaint, m_viewportVisibleRect);
     } else
         m_verticalScrollbarTiler.clear();
 
-    if (visibleRect.height() > contentRect.height()) {
-        IntRect horizontalScrollbar = horizontalScrollbarRect(visibleRect, contentRect);
+    if (m_viewportVisibleRect.height() > m_viewportContentRect.height()) {
+        IntRect horizontalScrollbar = horizontalScrollbarRect();
         IntSize tileSize = horizontalScrollbar.size().shrunkTo(IntSize(m_maxTextureSize, m_maxTextureSize));
         if (!m_horizontalScrollbarTiler)
             m_horizontalScrollbarTiler = LayerTilerChromium::create(this, tileSize, LayerTilerChromium::NoBorderTexels);
         else
             m_horizontalScrollbarTiler->setTileSize(tileSize);
         m_horizontalScrollbarTiler->setLayerPosition(horizontalScrollbar.location());
-        m_horizontalScrollbarTiler->update(scrollbarPaint, visibleRect);
+        m_horizontalScrollbarTiler->update(*m_rootLayerScrollbarPaint, m_viewportVisibleRect);
     } else
         m_horizontalScrollbarTiler.clear();
 }
 
 void LayerRendererChromium::drawRootLayer()
 {
-    m_rootLayerTiler->draw(m_visibleRect);
+    m_rootLayerContentTiler->draw(m_viewportVisibleRect);
 
     if (m_verticalScrollbarTiler)
-        m_verticalScrollbarTiler->draw(m_visibleRect);
+        m_verticalScrollbarTiler->draw(m_viewportVisibleRect);
 
     if (m_horizontalScrollbarTiler)
-        m_horizontalScrollbarTiler->draw(m_visibleRect);
+        m_horizontalScrollbarTiler->draw(m_viewportVisibleRect);
+}
+
+void LayerRendererChromium::setViewport(const IntRect& visibleRect, const IntRect& contentRect, const IntPoint& scrollPosition)
+{
+    bool visibleRectChanged = m_viewportVisibleRect.size() != visibleRect.size();
+
+    m_viewportVisibleRect = visibleRect;
+    m_viewportContentRect = contentRect;
+    m_viewportScrollPosition = scrollPosition;
+
+    if (visibleRectChanged) {
+        // Reset the current render surface to force an update of the viewport and
+        // projection matrix next time useRenderSurface is called.
+        m_currentRenderSurface = 0;
+
+        m_rootLayerContentTiler->invalidateEntireLayer();
+        if (m_horizontalScrollbarTiler)
+            m_horizontalScrollbarTiler->invalidateEntireLayer();
+        if (m_verticalScrollbarTiler)
+            m_verticalScrollbarTiler->invalidateEntireLayer();
+    }
 }
 
-void LayerRendererChromium::updateAndDrawLayers(const IntRect& visibleRect, const IntRect& contentRect, const IntPoint& scrollPosition,
-                                                TilePaintInterface& tilePaint, TilePaintInterface& scrollbarPaint)
+void LayerRendererChromium::updateAndDrawLayers()
 {
     ASSERT(m_hardwareCompositing);
 
     if (!m_rootLayer)
         return;
 
-    updateRootLayerContents(tilePaint, visibleRect);
+    updateRootLayerContents();
+
     // Recheck that we still have a root layer. This may become null if
     // compositing gets turned off during a paint operation.
     if (!m_rootLayer)
         return;
 
-    updateRootLayerScrollbars(scrollbarPaint, visibleRect, contentRect);
+    updateRootLayerScrollbars();
 
     Vector<CCLayerImpl*> renderSurfaceLayerList;
-    updateLayers(visibleRect, contentRect, scrollPosition, renderSurfaceLayerList);
+    updateLayers(renderSurfaceLayerList);
 
     drawLayers(renderSurfaceLayerList);
+
+    if (isCompositingOffscreen())
+        copyOffscreenTextureToDisplay();
 }
 
-void LayerRendererChromium::updateLayers(const IntRect& visibleRect, const IntRect& contentRect, const IntPoint& scrollPosition,
-                                         Vector<CCLayerImpl*>& renderSurfaceLayerList)
+void LayerRendererChromium::updateLayers(Vector<CCLayerImpl*>& renderSurfaceLayerList)
 {
+    TRACE_EVENT("LayerRendererChromium::updateLayers", this, 0);
+    m_rootLayer->createCCLayerImplIfNeeded();
     CCLayerImpl* rootDrawLayer = m_rootLayer->ccLayerImpl();
 
     if (!rootDrawLayer->renderSurface())
         rootDrawLayer->createRenderSurface();
     ASSERT(rootDrawLayer->renderSurface());
 
-    // If the size of the visible area has changed then allocate a new texture
-    // to store the contents of the root layer and adjust the projection matrix
-    // and viewport.
-
-    rootDrawLayer->renderSurface()->m_contentRect = IntRect(IntPoint(0, 0), visibleRect.size());
+    rootDrawLayer->renderSurface()->m_contentRect = IntRect(IntPoint(0, 0), m_viewportVisibleRect.size());
 
-    if (visibleRect.size() != m_visibleRect.size()) {
-        // Reset the current render surface to force an update of the viewport and
-        // projection matrix next time useRenderSurface is called.
-        m_currentRenderSurface = 0;
-    }
-    m_visibleRect = visibleRect;
-
-    m_scrollPosition = scrollPosition;
     // Scissor out the scrollbars to avoid rendering on top of them.
-    IntRect rootScissorRect(contentRect);
+    IntRect rootScissorRect(m_viewportContentRect);
     // The scissorRect should not include the scroll offset.
-    rootScissorRect.move(-m_scrollPosition.x(), -m_scrollPosition.y());
+    rootScissorRect.move(-m_viewportScrollPosition.x(), -m_viewportScrollPosition.y());
     rootDrawLayer->setScissorRect(rootScissorRect);
 
     m_defaultRenderSurface = rootDrawLayer->renderSurface();
@@ -283,16 +307,19 @@ void LayerRendererChromium::updateLayers(const IntRect& visibleRect, const IntRe
     // concept of a large content layer.
     updatePropertiesAndRenderSurfaces(m_rootLayer.get(), identityMatrix, renderSurfaceLayerList, m_defaultRenderSurface->m_layerList);
 
-    updateContentsRecursive(m_rootLayer.get());
+    paintContentsRecursive(m_rootLayer.get());
+
+    updateCompositorResourcesRecursive(m_rootLayer.get());
 }
 
 void LayerRendererChromium::drawLayers(const Vector<CCLayerImpl*>& renderSurfaceLayerList)
 {
+    TRACE_EVENT("LayerRendererChromium::drawLayers", this, 0);
     CCLayerImpl* rootDrawLayer = m_rootLayer->ccLayerImpl();
     makeContextCurrent();
 
     // The GL viewport covers the entire visible area, including the scrollbars.
-    GLC(m_context.get(), m_context->viewport(0, 0, m_visibleRect.width(), m_visibleRect.height()));
+    GLC(m_context.get(), m_context->viewport(0, 0, m_viewportVisibleRect.width(), m_viewportVisibleRect.height()));
 
     // Bind the common vertex attributes used for drawing all the layers.
     m_sharedGeometry->prepareForDraw();
@@ -363,11 +390,13 @@ void LayerRendererChromium::drawLayers(const Vector<CCLayerImpl*>& renderSurface
 
 void LayerRendererChromium::finish()
 {
+    TRACE_EVENT("LayerRendererChromium::finish", this, 0);
     m_context->finish();
 }
 
 void LayerRendererChromium::present()
 {
+    TRACE_EVENT("LayerRendererChromium::present", this, 0);
     // We're done! Time to swapbuffers!
 
     // Note that currently this has the same effect as swapBuffers; we should
@@ -382,7 +411,7 @@ void LayerRendererChromium::setRootLayer(PassRefPtr<LayerChromium> layer)
     m_rootLayer = layer;
     if (m_rootLayer)
         m_rootLayer->setLayerRenderer(this);
-    m_rootLayerTiler->invalidateEntireLayer();
+    m_rootLayerContentTiler->invalidateEntireLayer();
     if (m_horizontalScrollbarTiler)
         m_horizontalScrollbarTiler->invalidateEntireLayer();
     if (m_verticalScrollbarTiler)
@@ -391,7 +420,7 @@ void LayerRendererChromium::setRootLayer(PassRefPtr<LayerChromium> layer)
 
 void LayerRendererChromium::getFramebufferPixels(void *pixels, const IntRect& rect)
 {
-    ASSERT(rect.maxX() <= visibleRectSize().width() && rect.maxY() <= visibleRectSize().height());
+    ASSERT(rect.maxX() <= m_viewportVisibleRect.width() && rect.maxY() <= m_viewportVisibleRect.height());
 
     if (!pixels)
         return;
@@ -446,8 +475,29 @@ bool LayerRendererChromium::isLayerVisible(LayerChromium* layer, const Transform
 // necessary transformations, scissor rectangles, render surfaces, etc.
 void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* layer, const TransformationMatrix& parentMatrix, Vector<CCLayerImpl*>& renderSurfaceLayerList, Vector<CCLayerImpl*>& layerList)
 {
+    // Make sure we have CCLayerImpls for this subtree.
+    layer->createCCLayerImplIfNeeded();
     layer->setLayerRenderer(this);
+    if (layer->maskLayer()) {
+        layer->maskLayer()->createCCLayerImplIfNeeded();
+        layer->maskLayer()->setLayerRenderer(this);
+    }
+    if (layer->replicaLayer()) {
+        layer->replicaLayer()->createCCLayerImplIfNeeded();
+        layer->replicaLayer()->setLayerRenderer(this);
+    }
+    if (layer->replicaLayer() && layer->replicaLayer()->maskLayer()) {
+        layer->replicaLayer()->maskLayer()->createCCLayerImplIfNeeded();
+        layer->replicaLayer()->maskLayer()->setLayerRenderer(this);
+    }
+
     CCLayerImpl* drawLayer = layer->ccLayerImpl();
+    // Currently we're calling pushPropertiesTo() twice - once here and once in updateCompositorResourcesRecursive().
+    // We should only call pushPropertiesTo() in commit, but because we rely on the draw layer state to update
+    // RenderSurfaces and we rely on RenderSurfaces being up to date in order to paint contents we have
+    // to update the draw layers twice.
+    // FIXME: Remove this call once layer updates no longer depend on render surfaces.
+    layer->pushPropertiesTo(drawLayer);
 
     // Compute the new matrix transformation that will be applied to this layer and
     // all its sublayers. It's important to remember that the layer's position
@@ -467,9 +517,9 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
     // Where: P is the projection matrix
     //        M is the layer's matrix computed above
     //        S is the scale adjustment (to scale up to the layer size)
-    IntSize bounds = layer->bounds();
-    FloatPoint anchorPoint = layer->anchorPoint();
-    FloatPoint position = layer->position();
+    IntSize bounds = drawLayer->bounds();
+    FloatPoint anchorPoint = drawLayer->anchorPoint();
+    FloatPoint position = drawLayer->position();
 
     // Offset between anchor point and the center of the quad.
     float centerOffsetX = (0.5 - anchorPoint.x()) * bounds.width();
@@ -477,16 +527,16 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
 
     TransformationMatrix layerLocalTransform;
     // LT = Tr[l]
-    layerLocalTransform.translate3d(position.x(), position.y(), layer->anchorPointZ());
+    layerLocalTransform.translate3d(position.x(), position.y(), drawLayer->anchorPointZ());
     // LT = Tr[l] * M[l]
-    layerLocalTransform.multiply(layer->transform());
+    layerLocalTransform.multiply(drawLayer->transform());
     // LT = Tr[l] * M[l] * Tr[c]
-    layerLocalTransform.translate3d(centerOffsetX, centerOffsetY, -layer->anchorPointZ());
+    layerLocalTransform.translate3d(centerOffsetX, centerOffsetY, -drawLayer->anchorPointZ());
 
     TransformationMatrix combinedTransform = parentMatrix;
     combinedTransform = combinedTransform.multiply(layerLocalTransform);
 
-    FloatRect layerRect(-0.5 * layer->bounds().width(), -0.5 * layer->bounds().height(), layer->bounds().width(), layer->bounds().height());
+    FloatRect layerRect(-0.5 * drawLayer->bounds().width(), -0.5 * drawLayer->bounds().height(), drawLayer->bounds().width(), drawLayer->bounds().height());
     IntRect transformedLayerRect;
 
     // The layer and its descendants render on a new RenderSurface if any of
@@ -498,12 +548,11 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
     // If a layer preserves-3d then we don't create a RenderSurface for it to avoid flattening
     // out its children. The opacity value of the children layers is multiplied by the opacity
     // of their parent.
-    bool useSurfaceForClipping = layer->masksToBounds() && !isScaleOrTranslation(combinedTransform);
-    bool useSurfaceForOpacity = layer->opacity() != 1 && !layer->preserves3D();
-    bool useSurfaceForMasking = layer->maskDrawLayer();
-    bool useSurfaceForReflection = layer->replicaLayer();
-    if (((useSurfaceForClipping || useSurfaceForOpacity) && layer->descendantsDrawContent())
-        || useSurfaceForMasking || useSurfaceForReflection) {
+    bool useSurfaceForClipping = drawLayer->masksToBounds() && !isScaleOrTranslation(combinedTransform);
+    bool useSurfaceForOpacity = drawLayer->opacity() != 1 && !drawLayer->preserves3D();
+    bool useSurfaceForMasking = drawLayer->maskLayer();
+    bool useSurfaceForReflection = drawLayer->replicaLayer();
+    if (useSurfaceForMasking || useSurfaceForReflection || ((useSurfaceForClipping || useSurfaceForOpacity) && drawLayer->descendantsDrawsContent())) {
         RenderSurfaceChromium* renderSurface = drawLayer->renderSurface();
         if (!renderSurface)
             renderSurface = drawLayer->createRenderSurface();
@@ -516,15 +565,15 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
         transformedLayerRect = IntRect(0, 0, bounds.width(), bounds.height());
 
         // Layer's opacity will be applied when drawing the render surface.
-        renderSurface->m_drawOpacity = layer->opacity();
-        if (layer->superlayer() && layer->superlayer()->preserves3D())
+        renderSurface->m_drawOpacity = drawLayer->opacity();
+        if (drawLayer->superlayer() && drawLayer->superlayer()->preserves3D())
             renderSurface->m_drawOpacity *= drawLayer->superlayer()->drawOpacity();
         drawLayer->setDrawOpacity(1);
 
         TransformationMatrix layerOriginTransform = combinedTransform;
         layerOriginTransform.translate3d(-0.5 * bounds.width(), -0.5 * bounds.height(), 0);
         renderSurface->m_originTransform = layerOriginTransform;
-        if (layerOriginTransform.isInvertible() && layer->superlayer()) {
+        if (layerOriginTransform.isInvertible() && drawLayer->superlayer()) {
             TransformationMatrix parentToLayer = layerOriginTransform.inverse();
 
             drawLayer->setScissorRect(parentToLayer.mapRect(drawLayer->superlayer()->scissorRect()));
@@ -538,17 +587,14 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
 
         renderSurface->m_layerList.clear();
 
-        if (layer->maskDrawLayer()) {
-            renderSurface->m_maskLayer = layer->maskDrawLayer();
-            layer->maskDrawLayer()->setLayerRenderer(this);
-            layer->maskDrawLayer()->setTargetRenderSurface(renderSurface);
+        if (drawLayer->maskLayer()) {
+            renderSurface->m_maskLayer = drawLayer->maskLayer();
+            drawLayer->maskLayer()->setTargetRenderSurface(renderSurface);
         } else
             renderSurface->m_maskLayer = 0;
 
-        if (layer->replicaLayer() && layer->replicaLayer()->maskDrawLayer()) {
-            layer->replicaLayer()->maskDrawLayer()->setLayerRenderer(this);
-            layer->replicaLayer()->maskDrawLayer()->setTargetRenderSurface(renderSurface);
-        }
+        if (drawLayer->replicaLayer() && drawLayer->replicaLayer()->maskLayer())
+            drawLayer->replicaLayer()->maskLayer()->setTargetRenderSurface(renderSurface);
 
         renderSurfaceLayerList.append(drawLayer);
     } else {
@@ -556,10 +602,10 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
         drawLayer->setDrawTransform(combinedTransform);
         transformedLayerRect = enclosingIntRect(drawLayer->drawTransform().mapRect(layerRect));
 
-        drawLayer->setDrawOpacity(layer->opacity());
+        drawLayer->setDrawOpacity(drawLayer->opacity());
 
-        if (layer->superlayer()) {
-            if (layer->superlayer()->preserves3D())
+        if (drawLayer->superlayer()) {
+            if (drawLayer->superlayer()->preserves3D())
                drawLayer->setDrawOpacity(drawLayer->drawOpacity() * drawLayer->superlayer()->drawOpacity());
 
             // Layers inherit the scissor rect from their superlayer.
@@ -571,7 +617,7 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
         if (layer != m_rootLayer)
             drawLayer->clearRenderSurface();
 
-        if (layer->masksToBounds()) {
+        if (drawLayer->masksToBounds()) {
             IntRect scissor = drawLayer->scissorRect();
             scissor.intersect(transformedLayerRect);
             drawLayer->setScissorRect(scissor);
@@ -581,7 +627,7 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
     if (drawLayer->renderSurface())
         drawLayer->setTargetRenderSurface(drawLayer->renderSurface());
     else {
-        ASSERT(layer->superlayer());
+        ASSERT(drawLayer->superlayer());
         drawLayer->setTargetRenderSurface(drawLayer->superlayer()->targetRenderSurface());
     }
 
@@ -595,7 +641,7 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
     TransformationMatrix sublayerMatrix = drawLayer->drawTransform();
 
     // Flatten to 2D if the layer doesn't preserve 3D.
-    if (!layer->preserves3D()) {
+    if (!drawLayer->preserves3D()) {
         sublayerMatrix.setM13(0);
         sublayerMatrix.setM23(0);
         sublayerMatrix.setM31(0);
@@ -606,7 +652,7 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
     }
 
     // Apply the sublayer transform at the center of the layer.
-    sublayerMatrix.multiply(layer->sublayerTransform());
+    sublayerMatrix.multiply(drawLayer->sublayerTransform());
 
     // The origin of the sublayers is the top left corner of the layer, not the
     // center. The matrix passed down to the sublayers is therefore:
@@ -619,6 +665,7 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
 
     const Vector<RefPtr<LayerChromium> >& sublayers = layer->getSublayers();
     for (size_t i = 0; i < sublayers.size(); ++i) {
+        sublayers[i]->createCCLayerImplIfNeeded();
         CCLayerImpl* sublayer = sublayers[i]->ccLayerImpl();
         updatePropertiesAndRenderSurfaces(sublayers[i].get(), sublayerMatrix, renderSurfaceLayerList, descendants);
 
@@ -635,7 +682,7 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
         }
     }
 
-    if (layer->masksToBounds() || useSurfaceForMasking) {
+    if (drawLayer->masksToBounds() || useSurfaceForMasking) {
         IntRect drawableContentRect = drawLayer->drawableContentRect();
         drawableContentRect.intersect(transformedLayerRect);
         drawLayer->setDrawableContentRect(drawableContentRect);
@@ -651,7 +698,7 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
 
         // Don't clip if the layer is reflected as the reflection shouldn't be
         // clipped.
-        if (!layer->replicaLayer()) {
+        if (!drawLayer->replicaLayer()) {
             renderSurface->m_contentRect.intersect(drawLayer->scissorRect());
             FloatPoint clippedSurfaceCenter = renderSurface->contentRectCenter();
             centerOffsetDueToClipping = clippedSurfaceCenter - surfaceCenter;
@@ -675,10 +722,10 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
 
         // Compute the transformation matrix used to draw the replica of the render
         // surface.
-        if (layer->replicaLayer()) {
+        if (drawLayer->replicaLayer()) {
             renderSurface->m_replicaDrawTransform = renderSurface->m_originTransform;
-            renderSurface->m_replicaDrawTransform.translate3d(layer->replicaLayer()->position().x(), layer->replicaLayer()->position().y(), 0);
-            renderSurface->m_replicaDrawTransform.multiply(layer->replicaLayer()->transform());
+            renderSurface->m_replicaDrawTransform.translate3d(drawLayer->replicaLayer()->position().x(), drawLayer->replicaLayer()->position().y(), 0);
+            renderSurface->m_replicaDrawTransform.multiply(drawLayer->replicaLayer()->transform());
             renderSurface->m_replicaDrawTransform.translate3d(surfaceCenter.x() - anchorPoint.x() * bounds.width(), surfaceCenter.y() - anchorPoint.y() * bounds.height(), 0);
         }
     }
@@ -686,8 +733,8 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
     // Compute the depth value of the center of the layer which will be used when
     // sorting the layers for the preserves-3d property.
     const TransformationMatrix& layerDrawMatrix = drawLayer->renderSurface() ? drawLayer->renderSurface()->m_drawTransform : drawLayer->drawTransform();
-    if (layer->superlayer()) {
-        if (!layer->superlayer()->preserves3D())
+    if (drawLayer->superlayer()) {
+        if (!drawLayer->superlayer()->preserves3D())
             drawLayer->setDrawDepth(drawLayer->superlayer()->drawDepth());
         else
             drawLayer->setDrawDepth(layerDrawMatrix.m43());
@@ -697,24 +744,50 @@ void LayerRendererChromium::updatePropertiesAndRenderSurfaces(LayerChromium* lay
     // If preserves-3d then sort all the descendants by the Z coordinate of their
     // center. If the preserves-3d property is also set on the superlayer then
     // skip the sorting as the superlayer will sort all the descendants anyway.
-    if (layer->preserves3D() && (!layer->superlayer() || !layer->superlayer()->preserves3D()))
+    if (drawLayer->preserves3D() && (!drawLayer->superlayer() || !drawLayer->superlayer()->preserves3D()))
         std::stable_sort(&descendants.at(thisLayerIndex), descendants.end(), compareLayerZ);
 }
 
-void LayerRendererChromium::updateContentsRecursive(LayerChromium* layer)
+void LayerRendererChromium::paintContentsRecursive(LayerChromium* layer)
 {
     const Vector<RefPtr<LayerChromium> >& sublayers = layer->getSublayers();
     for (size_t i = 0; i < sublayers.size(); ++i)
-        updateContentsRecursive(sublayers[i].get());
+        paintContentsRecursive(sublayers[i].get());
+
+    if (layer->bounds().isEmpty())
+        return;
 
     if (layer->drawsContent())
-        layer->updateContentsIfDirty();
+        layer->paintContentsIfDirty();
     if (layer->maskLayer() && layer->maskLayer()->drawsContent())
-        layer->maskLayer()->updateContentsIfDirty();
+        layer->maskLayer()->paintContentsIfDirty();
     if (layer->replicaLayer() && layer->replicaLayer()->drawsContent())
-        layer->replicaLayer()->updateContentsIfDirty();
+        layer->replicaLayer()->paintContentsIfDirty();
     if (layer->replicaLayer() && layer->replicaLayer()->maskLayer() && layer->replicaLayer()->maskLayer()->drawsContent())
-        layer->replicaLayer()->maskLayer()->updateContentsIfDirty();
+        layer->replicaLayer()->maskLayer()->paintContentsIfDirty();
+}
+
+void LayerRendererChromium::updateCompositorResourcesRecursive(LayerChromium* layer)
+{
+    const Vector<RefPtr<LayerChromium> >& sublayers = layer->getSublayers();
+    for (size_t i = 0; i < sublayers.size(); ++i)
+        updateCompositorResourcesRecursive(sublayers[i].get());
+
+    if (layer->bounds().isEmpty())
+        return;
+
+    CCLayerImpl* drawLayer = layer->ccLayerImpl();
+
+    if (drawLayer->drawsContent())
+        drawLayer->updateCompositorResources();
+    if (drawLayer->maskLayer() && drawLayer->maskLayer()->drawsContent())
+        drawLayer->maskLayer()->updateCompositorResources();
+    if (drawLayer->replicaLayer() && drawLayer->replicaLayer()->drawsContent())
+        drawLayer->replicaLayer()->updateCompositorResources();
+    if (drawLayer->replicaLayer() && drawLayer->replicaLayer()->maskLayer() && drawLayer->replicaLayer()->maskLayer()->drawsContent())
+        drawLayer->replicaLayer()->maskLayer()->updateCompositorResources();
+
+    layer->pushPropertiesTo(drawLayer);
 }
 
 void LayerRendererChromium::setCompositeOffscreen(bool compositeOffscreen)
@@ -788,22 +861,38 @@ void LayerRendererChromium::drawLayer(CCLayerImpl* layer, RenderSurfaceChromium*
         return;
     }
 
-    if (layer->bounds().isEmpty())
+    if (layer->bounds().isEmpty()) {
+        layer->unreserveContentsTexture();
         return;
+    }
 
     setScissorToRect(layer->scissorRect());
 
     // Check if the layer falls within the visible bounds of the page.
     IntRect layerRect = layer->getDrawRect();
     bool isLayerVisible = layer->scissorRect().intersects(layerRect);
-    if (!isLayerVisible)
+    if (!isLayerVisible) {
+        layer->unreserveContentsTexture();
         return;
+    }
 
     // FIXME: Need to take into account the commulative render surface transforms all the way from
     //        the default render surface in order to determine visibility.
-    TransformationMatrix combinedDrawMatrix = (layer->renderSurface() ? layer->renderSurface()->drawTransform().multiply(layer->drawTransform()) : layer->drawTransform());
-    if (!layer->doubleSided() && combinedDrawMatrix.m33() < 0)
-         return;
+    TransformationMatrix combinedDrawMatrix = (layer->targetRenderSurface() ? layer->targetRenderSurface()->drawTransform().multiply(layer->drawTransform()) : layer->drawTransform());
+    
+    if (!layer->doubleSided()) {
+        FloatRect layerRect(FloatPoint(0, 0), FloatSize(layer->bounds()));
+        FloatQuad mappedLayer = combinedDrawMatrix.mapQuad(FloatQuad(layerRect));
+        FloatSize horizontalDir = mappedLayer.p2() - mappedLayer.p1();
+        FloatSize verticalDir = mappedLayer.p4() - mappedLayer.p1();
+        FloatPoint3D xAxis(horizontalDir.width(), horizontalDir.height(), 0);
+        FloatPoint3D yAxis(verticalDir.width(), verticalDir.height(), 0);
+        FloatPoint3D zAxis = xAxis.cross(yAxis);
+        if (zAxis.z() < 0) {
+            layer->unreserveContentsTexture();
+            return;
+        }
+    }
 
     if (layer->drawsContent())
         layer->draw();
@@ -880,10 +969,10 @@ bool LayerRendererChromium::initializeSharedObjects()
     m_sharedGeometry = adoptPtr(new GeometryBinding(m_context.get()));
     m_borderProgram = adoptPtr(new LayerChromium::BorderProgram(m_context.get()));
     m_contentLayerProgram = adoptPtr(new ContentLayerChromium::Program(m_context.get()));
-    m_canvasLayerProgram = adoptPtr(new CanvasLayerChromium::Program(m_context.get()));
-    m_videoLayerRGBAProgram = adoptPtr(new VideoLayerChromium::RGBAProgram(m_context.get()));
-    m_videoLayerYUVProgram = adoptPtr(new VideoLayerChromium::YUVProgram(m_context.get()));
-    m_pluginLayerProgram = adoptPtr(new PluginLayerChromium::Program(m_context.get()));
+    m_canvasLayerProgram = adoptPtr(new CCCanvasLayerImpl::Program(m_context.get()));
+    m_videoLayerRGBAProgram = adoptPtr(new CCVideoLayerImpl::RGBAProgram(m_context.get()));
+    m_videoLayerYUVProgram = adoptPtr(new CCVideoLayerImpl::YUVProgram(m_context.get()));
+    m_pluginLayerProgram = adoptPtr(new CCPluginLayerImpl::Program(m_context.get()));
     m_renderSurfaceProgram = adoptPtr(new RenderSurfaceChromium::Program(m_context.get()));
     m_renderSurfaceMaskProgram = adoptPtr(new RenderSurfaceChromium::MaskProgram(m_context.get()));
     m_tilerProgram = adoptPtr(new LayerTilerChromium::Program(m_context.get()));
@@ -920,7 +1009,7 @@ void LayerRendererChromium::cleanupSharedObjects()
         GLC(m_context.get(), m_context->deleteFramebuffer(m_offscreenFramebufferId));
 
     // Clear tilers before the texture manager, as they have references to textures.
-    m_rootLayerTiler.clear();
+    m_rootLayerContentTiler.clear();
     m_horizontalScrollbarTiler.clear();
     m_verticalScrollbarTiler.clear();
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
index 7e8850a..667ede2 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
@@ -34,16 +34,17 @@
 
 #if USE(ACCELERATED_COMPOSITING)
 
-#include "CanvasLayerChromium.h"
 #include "ContentLayerChromium.h"
 #include "IntRect.h"
 #include "LayerChromium.h"
 #include "LayerTilerChromium.h"
-#include "PluginLayerChromium.h"
 #include "RenderSurfaceChromium.h"
 #include "SkBitmap.h"
 #include "VideoLayerChromium.h"
+#include "cc/CCCanvasLayerImpl.h"
 #include "cc/CCHeadsUpDisplay.h"
+#include "cc/CCPluginLayerImpl.h"
+#include "cc/CCVideoLayerImpl.h"
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/PassOwnPtr.h>
@@ -66,17 +67,18 @@ class CCHeadsUpDisplay;
 // Class that handles drawing of composited render layers using GL.
 class LayerRendererChromium : public RefCounted<LayerRendererChromium> {
 public:
-    static PassRefPtr<LayerRendererChromium> create(PassRefPtr<GraphicsContext3D> graphicsContext3D);
+    static PassRefPtr<LayerRendererChromium> create(PassRefPtr<GraphicsContext3D>, PassOwnPtr<TilePaintInterface> contentPaint, PassOwnPtr<TilePaintInterface> scrollbarPaint);
 
     ~LayerRendererChromium();
 
     GraphicsContext3D* context();
 
-    void invalidateRootLayerRect(const IntRect& dirtyRect, const IntRect& visibleRect, const IntRect& contentRect);
+    void invalidateRootLayerRect(const IntRect& dirtyRect);
+
+    void setViewport(const IntRect& visibleRect, const IntRect& contentRect, const IntPoint& scrollPosition);
 
     // updates and draws the current layers onto the backbuffer
-    void updateAndDrawLayers(const IntRect& visibleRect, const IntRect& contentRect, const IntPoint& scrollPosition,
-                             TilePaintInterface&, TilePaintInterface& scrollbarPaint);
+    void updateAndDrawLayers();
 
     // waits for rendering to finish
     void finish();
@@ -84,7 +86,7 @@ public:
     // puts backbuffer onscreen
     void present();
 
-    IntSize visibleRectSize() const { return m_visibleRect.size(); }
+    IntSize viewportSize() const { return m_viewportVisibleRect.size(); }
 
     void setRootLayer(PassRefPtr<LayerChromium> layer);
     LayerChromium* rootLayer() { return m_rootLayer.get(); }
@@ -94,8 +96,6 @@ public:
 
     void setCompositeOffscreen(bool);
     bool isCompositingOffscreen() const { return m_compositeOffscreen; }
-    LayerTexture* getOffscreenLayerTexture();
-    void copyOffscreenTextureToDisplay();
 
     unsigned createLayerTexture();
     void deleteLayerTexture(unsigned);
@@ -111,13 +111,13 @@ public:
     const GeometryBinding* sharedGeometry() const { return m_sharedGeometry.get(); }
     const LayerChromium::BorderProgram* borderProgram() const { return m_borderProgram.get(); }
     const ContentLayerChromium::Program* contentLayerProgram() const { return m_contentLayerProgram.get(); }
-    const CanvasLayerChromium::Program* canvasLayerProgram() const { return m_canvasLayerProgram.get(); }
-    const VideoLayerChromium::RGBAProgram* videoLayerRGBAProgram() const { return m_videoLayerRGBAProgram.get(); }
-    const VideoLayerChromium::YUVProgram* videoLayerYUVProgram() const { return m_videoLayerYUVProgram.get(); }
-    const PluginLayerChromium::Program* pluginLayerProgram() const { return m_pluginLayerProgram.get(); }
     const RenderSurfaceChromium::Program* renderSurfaceProgram() const { return m_renderSurfaceProgram.get(); }
     const RenderSurfaceChromium::MaskProgram* renderSurfaceMaskProgram() const { return m_renderSurfaceMaskProgram.get(); }
     const LayerTilerChromium::Program* tilerProgram() const { return m_tilerProgram.get(); }
+    const CCCanvasLayerImpl::Program* canvasLayerProgram() const { return m_canvasLayerProgram.get(); }
+    const CCPluginLayerImpl::Program* pluginLayerProgram() const { return m_pluginLayerProgram.get(); }
+    const CCVideoLayerImpl::RGBAProgram* videoLayerRGBAProgram() const { return m_videoLayerRGBAProgram.get(); }
+    const CCVideoLayerImpl::YUVProgram* videoLayerYUVProgram() const { return m_videoLayerYUVProgram.get(); }
 
     void resizeOnscreenContent(const IntSize&);
 
@@ -132,19 +132,21 @@ public:
     String layerTreeAsText() const;
 
 private:
-    explicit LayerRendererChromium(PassRefPtr<GraphicsContext3D> graphicsContext3D);
+    explicit LayerRendererChromium(PassRefPtr<GraphicsContext3D>, PassOwnPtr<TilePaintInterface> contentPaint, PassOwnPtr<TilePaintInterface> scrollbarPaint);
 
-    void updateLayers(const IntRect& visibleRect, const IntRect& contentRect, const IntPoint& scrollPosition,
-                     Vector<CCLayerImpl*>& renderSurfaceLayerList);
-    void updateRootLayerContents(TilePaintInterface&, const IntRect& visibleRect);
-    void updateRootLayerScrollbars(TilePaintInterface& scrollbarPaint, const IntRect& visibleRect, const IntRect& contentRect);
+    void updateLayers(Vector<CCLayerImpl*>& renderSurfaceLayerList);
+    void updateRootLayerContents();
+    void updateRootLayerScrollbars();
     void updatePropertiesAndRenderSurfaces(LayerChromium*, const TransformationMatrix& parentMatrix, Vector<CCLayerImpl*>& renderSurfaceLayerList, Vector<CCLayerImpl*>& layerList);
-    void updateContentsRecursive(LayerChromium*);
+    void paintContentsRecursive(LayerChromium*);
+    void updateCompositorResourcesRecursive(LayerChromium*);
 
     void drawLayers(const Vector<CCLayerImpl*>& renderSurfaceLayerList);
     void drawLayer(CCLayerImpl*, RenderSurfaceChromium*);
 
     void drawRootLayer();
+    LayerTexture* getOffscreenLayerTexture();
+    void copyOffscreenTextureToDisplay();
 
     bool isLayerVisible(LayerChromium*, const TransformationMatrix&, const IntRect& visibleRect);
 
@@ -161,19 +163,22 @@ private:
     bool initializeSharedObjects();
     void cleanupSharedObjects();
 
-    static IntRect verticalScrollbarRect(const IntRect& visibleRect, const IntRect& contentRect);
-    static IntRect horizontalScrollbarRect(const IntRect& visibleRect, const IntRect& contentRect);
+    IntRect verticalScrollbarRect() const;
+    IntRect horizontalScrollbarRect() const;
 
-    IntRect m_visibleRect;
+    IntRect m_viewportVisibleRect;
+    IntRect m_viewportContentRect;
+    IntPoint m_viewportScrollPosition;
 
     TransformationMatrix m_projectionMatrix;
 
     RefPtr<LayerChromium> m_rootLayer;
-    OwnPtr<LayerTilerChromium> m_rootLayerTiler;
+    OwnPtr<TilePaintInterface> m_rootLayerContentPaint;
+    OwnPtr<TilePaintInterface> m_rootLayerScrollbarPaint;
+    OwnPtr<LayerTilerChromium> m_rootLayerContentTiler;
     OwnPtr<LayerTilerChromium> m_horizontalScrollbarTiler;
     OwnPtr<LayerTilerChromium> m_verticalScrollbarTiler;
 
-    IntPoint m_scrollPosition;
     bool m_hardwareCompositing;
 
     unsigned m_currentShader;
@@ -202,13 +207,13 @@ private:
     OwnPtr<GeometryBinding> m_sharedGeometry;
     OwnPtr<LayerChromium::BorderProgram> m_borderProgram;
     OwnPtr<ContentLayerChromium::Program> m_contentLayerProgram;
-    OwnPtr<CanvasLayerChromium::Program> m_canvasLayerProgram;
-    OwnPtr<VideoLayerChromium::RGBAProgram> m_videoLayerRGBAProgram;
-    OwnPtr<VideoLayerChromium::YUVProgram> m_videoLayerYUVProgram;
-    OwnPtr<PluginLayerChromium::Program> m_pluginLayerProgram;
     OwnPtr<RenderSurfaceChromium::Program> m_renderSurfaceProgram;
     OwnPtr<RenderSurfaceChromium::MaskProgram> m_renderSurfaceMaskProgram;
     OwnPtr<LayerTilerChromium::Program> m_tilerProgram;
+    OwnPtr<CCCanvasLayerImpl::Program> m_canvasLayerProgram;
+    OwnPtr<CCVideoLayerImpl::RGBAProgram> m_videoLayerRGBAProgram;
+    OwnPtr<CCVideoLayerImpl::YUVProgram> m_videoLayerYUVProgram;
+    OwnPtr<CCPluginLayerImpl::Program> m_pluginLayerProgram;
 
     OwnPtr<TextureManager> m_textureManager;
 
diff --git a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
index 86592a6..bc37201 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.cpp
@@ -34,6 +34,7 @@
 #include "GraphicsContext3D.h"
 #include "LayerRendererChromium.h"
 #include "LayerTexture.h"
+#include "TraceEvent.h"
 
 #include <wtf/PassOwnArrayPtr.h>
 
@@ -84,58 +85,50 @@ void LayerTilerChromium::reset()
 {
     m_tiles.clear();
     m_unusedTiles.clear();
-
     m_tilingData.setTotalSize(0, 0);
-    m_lastUpdateLayerRect = IntRect();
 }
 
 LayerTilerChromium::Tile* LayerTilerChromium::createTile(int i, int j)
 {
-    const int index = tileIndex(i, j);
-    ASSERT(!m_tiles[index]);
+    ASSERT(!tileAt(i, j));
 
+    RefPtr<Tile> tile;
     if (m_unusedTiles.size() > 0) {
-        m_tiles[index] = m_unusedTiles.last().release();
+        tile = m_unusedTiles.last().release();
         m_unusedTiles.removeLast();
+        ASSERT(tile->refCount() == 1);
     } else {
         GraphicsContext3D* context = layerRendererContext();
         TextureManager* manager = layerRenderer()->textureManager();
-        OwnPtr<Tile> tile = adoptPtr(new Tile(LayerTexture::create(context, manager)));
-        m_tiles[index] = tile.release();
+        tile = adoptRef(new Tile(LayerTexture::create(context, manager)));
     }
+    m_tiles.add(make_pair(i, j), tile);
+
+    tile->moveTo(i, j);
+    tile->m_dirtyLayerRect = tileLayerRect(tile.get());
 
-    m_tiles[index]->m_dirtyLayerRect = tileLayerRect(i, j);
-    return m_tiles[index].get();
+    return tile.get();
 }
 
-void LayerTilerChromium::invalidateTiles(const IntRect& oldLayerRect, const IntRect& newLayerRect)
+void LayerTilerChromium::invalidateTiles(const IntRect& contentRect)
 {
     if (!m_tiles.size())
         return;
 
-    IntRect oldContentRect = layerRectToContentRect(oldLayerRect);
-    int oldLeft, oldTop, oldRight, oldBottom;
-    contentRectToTileIndices(oldContentRect, oldLeft, oldTop, oldRight, oldBottom);
-
-    IntRect newContentRect = layerRectToContentRect(newLayerRect);
-    int newLeft, newTop, newRight, newBottom;
-    contentRectToTileIndices(newContentRect, newLeft, newTop, newRight, newBottom);
-
-    // Iterating through just the old tile indices is an optimization to avoid
-    // iterating through the entire m_tiles array.
-    for (int j = oldTop; j <= oldBottom; ++j) {
-        for (int i = oldLeft; i <= oldRight; ++i) {
-            if (i >= newLeft && i <= newRight && j >= newTop && j <= newBottom)
-                continue;
-
-            const int index = tileIndex(i, j);
-            if (m_tiles[index])
-                m_unusedTiles.append(m_tiles[index].release());
-        }
+    Vector<TileMapKey> removeKeys;
+    for (TileMap::iterator iter = m_tiles.begin(); iter != m_tiles.end(); ++iter) {
+        Tile* tile = iter->second.get();
+        IntRect tileRect = tileContentRect(tile);
+        if (tileRect.intersects(contentRect))
+            continue;
+        removeKeys.append(iter->first);
     }
+
+    for (size_t i = 0; i < removeKeys.size(); ++i)
+        m_unusedTiles.append(m_tiles.take(removeKeys[i]));
 }
 
-void LayerTilerChromium::contentRectToTileIndices(const IntRect& contentRect, int &left, int &top, int &right, int &bottom) const
+void LayerTilerChromium::contentRectToTileIndices(const IntRect& contentRect, int& left, int& top, int& right, int& bottom) const
 {
     const IntRect layerRect = contentRectToLayerRect(contentRect);
 
@@ -163,36 +156,28 @@ IntRect LayerTilerChromium::layerRectToContentRect(const IntRect& layerRect) con
     return contentRect;
 }
 
-int LayerTilerChromium::tileIndex(int i, int j) const
+LayerTilerChromium::Tile* LayerTilerChromium::tileAt(int i, int j) const
 {
-    return m_tilingData.tileIndex(i, j);
+    Tile* tile = m_tiles.get(make_pair(i, j)).get();
+    ASSERT(!tile || tile->refCount() == 1);
+    return tile;
 }
 
-IntRect LayerTilerChromium::tileContentRect(int i, int j) const
+IntRect LayerTilerChromium::tileContentRect(const Tile* tile) const
 {
-    IntRect contentRect = tileLayerRect(i, j);
+    IntRect contentRect = tileLayerRect(tile);
     contentRect.move(m_layerPosition.x(), m_layerPosition.y());
     return contentRect;
 }
 
-IntRect LayerTilerChromium::tileLayerRect(int i, int j) const
+IntRect LayerTilerChromium::tileLayerRect(const Tile* tile) const
 {
-    const int index = m_tilingData.tileIndex(i, j);
+    const int index = m_tilingData.tileIndex(tile->i(), tile->j());
     IntRect layerRect = m_tilingData.tileBoundsWithBorder(index);
     layerRect.setSize(m_tileSize);
     return layerRect;
 }
 
-IntSize LayerTilerChromium::layerSize() const
-{
-    return IntSize(m_tilingData.totalSizeX(), m_tilingData.totalSizeY());
-}
-
-IntSize LayerTilerChromium::layerTileSize() const
-{
-    return IntSize(m_tilingData.numTilesX(), m_tilingData.numTilesY());
-}
-
 void LayerTilerChromium::invalidateRect(const IntRect& contentRect)
 {
     if (contentRect.isEmpty())
@@ -202,16 +187,16 @@ void LayerTilerChromium::invalidateRect(const IntRect& contentRect)
 
     // Dirty rects are always in layer space, as the layer could be repositioned
     // after invalidation.
-    IntRect layerRect = contentRectToLayerRect(contentRect);
+    const IntRect layerRect = contentRectToLayerRect(contentRect);
 
     int left, top, right, bottom;
     contentRectToTileIndices(contentRect, left, top, right, bottom);
     for (int j = top; j <= bottom; ++j) {
         for (int i = left; i <= right; ++i) {
-            Tile* tile = m_tiles[tileIndex(i, j)].get();
+            Tile* tile = tileAt(i, j);
             if (!tile)
                 continue;
-            IntRect bound = tileLayerRect(i, j);
+            IntRect bound = tileLayerRect(tile);
             bound.intersect(layerRect);
             tile->m_dirtyLayerRect.unite(bound);
         }
@@ -220,14 +205,13 @@ void LayerTilerChromium::invalidateRect(const IntRect& contentRect)
 
 void LayerTilerChromium::invalidateEntireLayer()
 {
-    for (size_t i = 0; i < m_tiles.size(); ++i) {
-        if (m_tiles[i])
-            m_unusedTiles.append(m_tiles[i].release());
+    for (TileMap::iterator iter = m_tiles.begin(); iter != m_tiles.end(); ++iter) {
+        ASSERT(iter->second->refCount() == 1);
+        m_unusedTiles.append(iter->second.release());
     }
     m_tiles.clear();
 
     m_tilingData.setTotalSize(0, 0);
-    m_lastUpdateLayerRect = IntRect();
 }
 
 void LayerTilerChromium::update(TilePaintInterface& painter, const IntRect& contentRect)
@@ -237,10 +221,7 @@ void LayerTilerChromium::update(TilePaintInterface& painter, const IntRect& cont
 
     // Invalidate old tiles that were previously used but aren't in use this
     // frame so that they can get reused for new tiles.
-    IntRect layerRect = contentRectToLayerRect(contentRect);
-    invalidateTiles(m_lastUpdateLayerRect, layerRect);
-    m_lastUpdateLayerRect = layerRect;
-
+    invalidateTiles(contentRect);
     growLayerToContain(contentRect);
 
     // Create tiles as needed, expanding a dirty rect to contain all
@@ -250,11 +231,11 @@ void LayerTilerChromium::update(TilePaintInterface& painter, const IntRect& cont
     contentRectToTileIndices(contentRect, left, top, right, bottom);
     for (int j = top; j <= bottom; ++j) {
         for (int i = left; i <= right; ++i) {
-            Tile* tile = m_tiles[tileIndex(i, j)].get();
+            Tile* tile = tileAt(i, j);
             if (!tile)
                 tile = createTile(i, j);
             if (!tile->texture()->isValid(m_tileSize, GraphicsContext3D::RGBA))
-                tile->m_dirtyLayerRect = tileLayerRect(i, j);
+                tile->m_dirtyLayerRect = tileLayerRect(tile);
             dirtyLayerRect.unite(tile->m_dirtyLayerRect);
         }
     }
@@ -267,10 +248,16 @@ void LayerTilerChromium::update(TilePaintInterface& painter, const IntRect& cont
     m_canvas.resize(paintRect.size());
     PlatformCanvas::Painter canvasPainter(&m_canvas);
     canvasPainter.context()->translate(-paintRect.x(), -paintRect.y());
-    painter.paint(*canvasPainter.context(), paintRect);
+    {
+        TRACE_EVENT("LayerTilerChromium::update::paint", this, 0);
+        painter.paint(*canvasPainter.context(), paintRect);
+    }
 
     PlatformCanvas::AutoLocker locker(&m_canvas);
-    updateFromPixels(paintRect, locker.pixels());
+    {
+        TRACE_EVENT("LayerTilerChromium::updateFromPixels", this, 0);
+        updateFromPixels(paintRect, locker.pixels());
+    }
 }
 
 void LayerTilerChromium::updateFromPixels(const IntRect& paintRect, const uint8_t* paintPixels)
@@ -285,14 +272,14 @@ void LayerTilerChromium::updateFromPixels(const IntRect& paintRect, const uint8_
     contentRectToTileIndices(paintRect, left, top, right, bottom);
     for (int j = top; j <= bottom; ++j) {
         for (int i = left; i <= right; ++i) {
-            Tile* tile = m_tiles[tileIndex(i, j)].get();
+            Tile* tile = tileAt(i, j);
             if (!tile)
                 CRASH();
             if (!tile->dirty())
                 continue;
 
             // Calculate page-space rectangle to copy from.
-            IntRect sourceRect = tileContentRect(i, j);
+            IntRect sourceRect = tileContentRect(tile);
             const IntPoint anchor = sourceRect.location();
             sourceRect.intersect(layerRectToContentRect(tile->m_dirtyLayerRect));
             if (sourceRect.isEmpty())
@@ -366,8 +353,7 @@ void LayerTilerChromium::draw(const IntRect& contentRect)
     contentRectToTileIndices(contentRect, left, top, right, bottom);
     for (int j = top; j <= bottom; ++j) {
         for (int i = left; i <= right; ++i) {
-            const int index = tileIndex(i, j);
-            Tile* tile = m_tiles[index].get();
+            Tile* tile = tileAt(i, j);
             ASSERT(tile);
 
             tile->texture()->bindTexture();
@@ -376,11 +362,11 @@ void LayerTilerChromium::draw(const IntRect& contentRect)
 
             // Don't use tileContentRect here, as that contains the full
             // rect with border texels which shouldn't be drawn.
-            IntRect tileRect = m_tilingData.tileBounds(index);
+            IntRect tileRect = m_tilingData.tileBounds(m_tilingData.tileIndex(tile->i(), tile->j()));
             tileRect.move(m_layerPosition.x(), m_layerPosition.y());
             tileMatrix.translate3d(tileRect.x() - contentRect.x() + tileRect.width() / 2.0, tileRect.y() - contentRect.y() + tileRect.height() / 2.0, 0);
 
-            IntPoint texOffset = m_tilingData.textureOffset(i, j);
+            IntPoint texOffset = m_tilingData.textureOffset(tile->i(), tile->j());
             float tileWidth = static_cast<float>(m_tileSize.width());
             float tileHeight = static_cast<float>(m_tileSize.height());
             float texTranslateX = texOffset.x() / tileWidth;
@@ -395,37 +381,15 @@ void LayerTilerChromium::draw(const IntRect& contentRect)
     }
 }
 
-void LayerTilerChromium::resizeLayer(const IntSize& size)
-{
-    if (layerSize() == size)
-        return;
-
-    const IntSize oldTileSize = layerTileSize();
-    m_tilingData.setTotalSize(size.width(), size.height());
-    const IntSize newTileSize = layerTileSize();
-
-    if (oldTileSize == newTileSize)
-        return;
-
-    if (newTileSize.height() && (newTileSize.width() > INT_MAX / newTileSize.height()))
-        CRASH();
-
-    Vector<OwnPtr<Tile> > newTiles;
-    newTiles.resize(newTileSize.width() * newTileSize.height());
-    for (int j = 0; j < oldTileSize.height(); ++j)
-        for (int i = 0; i < oldTileSize.width(); ++i)
-            newTiles[i + j * newTileSize.width()].swap(m_tiles[i + j * oldTileSize.width()]);
-    m_tiles.swap(newTiles);
-}
-
 void LayerTilerChromium::growLayerToContain(const IntRect& contentRect)
 {
     // Grow the tile array to contain this content rect.
     IntRect layerRect = contentRectToLayerRect(contentRect);
     IntSize rectSize = IntSize(layerRect.maxX(), layerRect.maxY());
 
-    IntSize newSize = rectSize.expandedTo(layerSize());
-    resizeLayer(newSize);
+    IntSize oldLayerSize(m_tilingData.totalSizeX(), m_tilingData.totalSizeY());
+    IntSize newSize = rectSize.expandedTo(oldLayerSize);
+    m_tilingData.setTotalSize(newSize.width(), newSize.height());
 }
 
 void LayerTilerChromium::drawTexturedQuad(GraphicsContext3D* context, const TransformationMatrix& projectionMatrix, const TransformationMatrix& drawMatrix,
diff --git a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.h
index bdb35a5..2f356e4 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerTilerChromium.h
@@ -33,7 +33,9 @@
 #include "LayerTexture.h"
 #include "PlatformCanvas.h"
 #include "TilingData.h"
+#include <wtf/HashTraits.h>
 #include <wtf/OwnArrayPtr.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
@@ -70,20 +72,26 @@ public:
 private:
     LayerTilerChromium(LayerRendererChromium*, const IntSize& tileSize, BorderTexelOption);
 
-    class Tile {
+    class Tile : public RefCounted<Tile> {
         WTF_MAKE_NONCOPYABLE(Tile);
     public:
-        explicit Tile(PassOwnPtr<LayerTexture> tex) : m_tex(tex) {}
+        explicit Tile(PassOwnPtr<LayerTexture> tex) : m_tex(tex), m_i(-1), m_j(-1) {}
 
         LayerTexture* texture() { return m_tex.get(); }
 
         bool dirty() const { return !m_dirtyLayerRect.isEmpty(); }
         void clearDirty() { m_dirtyLayerRect = IntRect(); }
 
+        int i() const { return m_i; }
+        int j() const { return m_j; }
+        void moveTo(int i, int j) { m_i = i; m_j = j; }
+
         // Layer-space dirty rectangle that needs to be repainted.
         IntRect m_dirtyLayerRect;
     private:
         OwnPtr<LayerTexture> m_tex;
+        int m_i;
+        int m_j;
     };
 
     void drawTexturedQuad(GraphicsContext3D*, const TransformationMatrix& projectionMatrix, const TransformationMatrix& drawMatrix,
@@ -92,40 +100,45 @@ private:
                           float texScaleX, float texScaleY,
                           const LayerTilerChromium::Program*);
 
-    void resizeLayer(const IntSize& size);
     // Grow layer size to contain this rectangle.
     void growLayerToContain(const IntRect& contentRect);
 
     LayerRendererChromium* layerRenderer() const { return m_layerRenderer; }
     GraphicsContext3D* layerRendererContext() const;
     Tile* createTile(int i, int j);
-    // Invalidate any tiles which do not intersect with the newLayerRect.
-    void invalidateTiles(const IntRect& oldLayerRect, const IntRect& newLayerRect);
+    // Invalidate any tiles which do not intersect with the contentRect
+    void invalidateTiles(const IntRect& contentRect);
     void reset();
     void contentRectToTileIndices(const IntRect& contentRect, int &left, int &top, int &right, int &bottom) const;
     IntRect contentRectToLayerRect(const IntRect& contentRect) const;
     IntRect layerRectToContentRect(const IntRect& layerRect) const;
 
-    // Returns the index into m_tiles for a given tile location.
-    int tileIndex(int i, int j) const;
-    // Returns the bounds in content space for a given tile location.
-    IntRect tileContentRect(int i, int j) const;
-    // Returns the bounds in layer space for a given tile location.
-    IntRect tileLayerRect(int i, int j) const;
-
-    IntSize layerSize() const;
-    IntSize layerTileSize() const;
+    Tile* tileAt(int, int) const;
+    IntRect tileContentRect(const Tile*) const;
+    IntRect tileLayerRect(const Tile*) const;
 
     IntSize m_tileSize;
-    IntRect m_lastUpdateLayerRect;
     IntPoint m_layerPosition;
 
     bool m_skipsDraw;
 
-    // Logical 2D array of tiles (dimensions of m_layerTileSize)
-    Vector<OwnPtr<Tile> > m_tiles;
-    // Linear array of unused tiles.
-    Vector<OwnPtr<Tile> > m_unusedTiles;
+    // Default hash key traits for integers disallow 0 and -1 as a key, so
+    // use a custom hash trait which disallows -1 and -2 instead.
+    typedef std::pair<int, int> TileMapKey;
+    struct TileMapKeyTraits : HashTraits<TileMapKey> {
+        static const bool emptyValueIsZero = false;
+        static const bool needsDestruction = false;
+        static TileMapKey emptyValue() { return std::make_pair(-1, -1); }
+        static void constructDeletedValue(TileMapKey& slot) { slot = std::make_pair(-2, -2); }
+        static bool isDeletedValue(TileMapKey value) { return value.first == -2 && value.second == -2; }
+    };
+    // FIXME: The mapped value in TileMap should really be an OwnPtr, as the
+    // refcount of a Tile should never be more than 1. However, HashMap
+    // doesn't easily support OwnPtr as a value.
+    typedef HashMap<TileMapKey, RefPtr<Tile>, DefaultHash<TileMapKey>::Hash, TileMapKeyTraits> TileMap;
+    TileMap m_tiles;
+    // Tightly packed set of unused tiles.
+    Vector<RefPtr<Tile> > m_unusedTiles;
 
     PlatformCanvas m_canvas;
 
diff --git a/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp
index 5d595ad..3667fbb 100644
--- a/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp
@@ -29,10 +29,10 @@
 
 #include "PluginLayerChromium.h"
 
-#include "cc/CCLayerImpl.h"
 #include "GraphicsContext3D.h"
 #include "LayerRendererChromium.h"
-#include <GLES2/gl2.h>
+#include "cc/CCLayerImpl.h"
+#include "cc/CCPluginLayerImpl.h"
 
 namespace WebCore {
 
@@ -43,40 +43,26 @@ PassRefPtr<PluginLayerChromium> PluginLayerChromium::create(GraphicsLayerChromiu
 
 PluginLayerChromium::PluginLayerChromium(GraphicsLayerChromium* owner)
     : LayerChromium(owner)
+    , m_textureId(0)
 {
 }
 
-void PluginLayerChromium::setTextureId(unsigned id)
+PassRefPtr<CCLayerImpl> PluginLayerChromium::createCCLayerImpl()
 {
-    m_textureId = id;
+    return CCPluginLayerImpl::create(this);
 }
 
-void PluginLayerChromium::updateContentsIfDirty()
+void PluginLayerChromium::setTextureId(unsigned id)
 {
+    m_textureId = id;
 }
 
-void PluginLayerChromium::draw()
+void PluginLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
 {
-    ASSERT(layerRenderer());
-    const PluginLayerChromium::Program* program = layerRenderer()->pluginLayerProgram();
-    ASSERT(program && program->initialized());
-    GraphicsContext3D* context = layerRendererContext();
-    GLC(context, context->activeTexture(GL_TEXTURE0));
-    GLC(context, context->bindTexture(GL_TEXTURE_2D, m_textureId));
-    
-    // FIXME: setting the texture parameters every time is redundant. Move this code somewhere
-    // where it will only happen once per texture.
-    GLC(context, context->texParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR));
-    GLC(context, context->texParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR));
-    GLC(context, context->texParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE));
-    GLC(context, context->texParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE));
-    
-    layerRenderer()->useShader(program->program());
-    GLC(context, context->uniform1i(program->fragmentShader().samplerLocation(), 0));
-    drawTexturedQuad(context, layerRenderer()->projectionMatrix(), ccLayerImpl()->drawTransform(),
-                     bounds().width(), bounds().height(), ccLayerImpl()->drawOpacity(),
-                     program->vertexShader().matrixLocation(),
-                     program->fragmentShader().alphaLocation());
+    LayerChromium::pushPropertiesTo(layer);
+
+    CCPluginLayerImpl* pluginLayer = static_cast<CCPluginLayerImpl*>(layer);
+    pluginLayer->setTextureId(m_textureId);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h b/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h
index 8d66f5f..852dc2e 100644
--- a/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h
@@ -38,18 +38,19 @@ class PluginLayerChromium : public LayerChromium {
 public:
     static PassRefPtr<PluginLayerChromium> create(GraphicsLayerChromium* owner = 0);
     virtual bool drawsContent() const { return true; }
-    virtual void updateContentsIfDirty();
-    virtual void draw();
-    
+
+    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
+
     void setTextureId(unsigned textureId);
-        
-    typedef ProgramBinding<VertexShaderPosTex, FragmentShaderRGBATexFlipAlpha> Program;
+    unsigned textureId() const { return m_textureId; }
+
+    virtual void pushPropertiesTo(CCLayerImpl*);
 
 protected:
     virtual const char* layerTypeAsString() const { return "PluginLayer"; }
 
 private:
-    PluginLayerChromium(GraphicsLayerChromium* owner);
+    explicit PluginLayerChromium(GraphicsLayerChromium* owner);
     unsigned m_textureId;
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp b/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
index 49b3462..b7f447b 100644
--- a/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ShaderChromium.cpp
@@ -248,7 +248,7 @@ FragmentShaderYUVVideo::FragmentShaderYUVVideo()
     , m_vTextureLocation(-1)
     , m_alphaLocation(-1)
     , m_ccMatrixLocation(-1)
-    , m_signAdjLocation(-1)
+    , m_yuvAdjLocation(-1)
 {
 }
 
@@ -259,10 +259,10 @@ bool FragmentShaderYUVVideo::init(GraphicsContext3D* context, unsigned program)
     m_vTextureLocation = context->getUniformLocation(program, "v_texture");
     m_alphaLocation = context->getUniformLocation(program, "alpha");
     m_ccMatrixLocation = context->getUniformLocation(program, "cc_matrix");
-    m_signAdjLocation = context->getUniformLocation(program, "adj");
+    m_yuvAdjLocation = context->getUniformLocation(program, "yuv_adj");
 
     return m_yTextureLocation != -1 && m_uTextureLocation != -1 && m_vTextureLocation != -1
-           && m_alphaLocation != -1 && m_ccMatrixLocation != -1 && m_signAdjLocation != -1;
+           && m_alphaLocation != -1 && m_ccMatrixLocation != -1 && m_yuvAdjLocation != -1;
 }
 
 String FragmentShaderYUVVideo::getShaderString() const
@@ -276,14 +276,15 @@ String FragmentShaderYUVVideo::getShaderString() const
         uniform sampler2D u_texture;
         uniform sampler2D v_texture;
         uniform float alpha;
-        uniform float adj;
+        uniform vec3 yuv_adj;
         uniform mat3 cc_matrix;
         void main()
         {
-            float y = texture2D(y_texture, y_texCoord).x;
-            float u = texture2D(u_texture, uv_texCoord).x - adj;
-            float v = texture2D(v_texture, uv_texCoord).x - adj;
-            vec3 rgb = cc_matrix * vec3(y, u, v);
+            float y_raw = texture2D(y_texture, y_texCoord).x;
+            float u_unsigned = texture2D(u_texture, uv_texCoord).x;
+            float v_unsigned = texture2D(v_texture, uv_texCoord).x;
+            vec3 yuv = vec3(y_raw, u_unsigned, v_unsigned) + yuv_adj;
+            vec3 rgb = cc_matrix * yuv;
             gl_FragColor = vec4(rgb, float(1)) * alpha;
         }
     );
diff --git a/Source/WebCore/platform/graphics/chromium/ShaderChromium.h b/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
index 758c62b..3a3e175 100644
--- a/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
@@ -158,7 +158,7 @@ public:
     int vTextureLocation() const { return m_vTextureLocation; }
     int alphaLocation() const { return m_alphaLocation; }
     int ccMatrixLocation() const { return m_ccMatrixLocation; }
-    int signAdjLocation() const { return m_signAdjLocation; }
+    int yuvAdjLocation() const { return m_yuvAdjLocation; }
 
 private:
     int m_yTextureLocation;
@@ -166,7 +166,7 @@ private:
     int m_vTextureLocation;
     int m_alphaLocation;
     int m_ccMatrixLocation;
-    int m_signAdjLocation;
+    int m_yuvAdjLocation;
 };
 
 class FragmentShaderColor {
diff --git a/Source/WebCore/platform/graphics/chromium/SimpleFontDataLinux.cpp b/Source/WebCore/platform/graphics/chromium/SimpleFontDataLinux.cpp
index 9423d1e..7cd47fe 100644
--- a/Source/WebCore/platform/graphics/chromium/SimpleFontDataLinux.cpp
+++ b/Source/WebCore/platform/graphics/chromium/SimpleFontDataLinux.cpp
@@ -113,13 +113,13 @@ void SimpleFontData::platformInit()
     m_fontMetrics.setXHeight(xHeight);
     m_fontMetrics.setLineSpacing(lroundf(ascent) + lroundf(descent) + lroundf(lineGap));
 
-    if (m_orientation == Vertical) {
+    if (platformData().orientation() == Vertical && !isTextOrientationFallback()) {
         static const uint32_t vheaTag = SkSetFourByteTag('v', 'h', 'e', 'a');
         static const uint32_t vorgTag = SkSetFourByteTag('V', 'O', 'R', 'G');
         size_t vheaSize = SkFontHost::GetTableSize(fontID, vheaTag);
         size_t vorgSize = SkFontHost::GetTableSize(fontID, vorgTag);
-        if ((vheaSize <= 0) && (vorgSize <= 0))
-            m_orientation = Horizontal;
+        if ((vheaSize > 0) || (vorgSize > 0))
+            m_hasVerticalGlyphs = true;
     }
 
     // In WebKit/WebCore/platform/graphics/SimpleFontData.cpp, m_spaceWidth is
diff --git a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
index 5d7a6e7..182e730 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
@@ -33,7 +33,6 @@
 #if USE(ACCELERATED_COMPOSITING)
 #include "VideoLayerChromium.h"
 
-#include "cc/CCLayerImpl.h"
 #include "Extensions3DChromium.h"
 #include "GraphicsContext3D.h"
 #include "LayerRendererChromium.h"
@@ -41,17 +40,11 @@
 #include "RenderLayerBacking.h"
 #include "VideoFrameChromium.h"
 #include "VideoFrameProvider.h"
+#include "cc/CCLayerImpl.h"
+#include "cc/CCVideoLayerImpl.h"
 
 namespace WebCore {
 
-// These values are magic numbers that are used in the transformation
-// from YUV to RGB color values.
-const float VideoLayerChromium::yuv2RGB[9] = {
-    1.f, 1.f, 1.f,
-    0.f, -.344f, 1.772f,
-    1.403f, -.714f, 0.f,
-};
-
 PassRefPtr<VideoLayerChromium> VideoLayerChromium::create(GraphicsLayerChromium* owner,
                                                           VideoFrameProvider* provider)
 {
@@ -71,23 +64,37 @@ VideoLayerChromium::VideoLayerChromium(GraphicsLayerChromium* owner, VideoFrameP
 VideoLayerChromium::~VideoLayerChromium()
 {
     cleanupResources();
+    deleteTexturesInUse();
 }
 
-void VideoLayerChromium::cleanupResources()
+PassRefPtr<CCLayerImpl> VideoLayerChromium::createCCLayerImpl()
+{
+    return CCVideoLayerImpl::create(this);
+}
+
+void VideoLayerChromium::deleteTexturesInUse()
 {
-    LayerChromium::cleanupResources();
-    releaseCurrentFrame();
     if (!layerRenderer())
         return;
 
     GraphicsContext3D* context = layerRendererContext();
     for (unsigned plane = 0; plane < VideoFrameChromium::maxPlanes; plane++) {
-        if (m_textures[plane])
-            GLC(context, context->deleteTexture(m_textures[plane]));
+        Texture texture = m_textures[plane];
+        if (!texture.isEmpty && texture.ownedByLayerRenderer)
+            GLC(context, context->deleteTexture(texture.id));
     }
 }
 
-void VideoLayerChromium::updateContentsIfDirty()
+void VideoLayerChromium::cleanupResources()
+{
+    LayerChromium::cleanupResources();
+    if (m_currentFrame)
+        releaseCurrentFrame();
+    else
+        resetFrameParameters();
+}
+
+void VideoLayerChromium::updateCompositorResources()
 {
     if (!m_contentsDirty)
         return;
@@ -116,6 +123,9 @@ void VideoLayerChromium::updateContentsIfDirty()
         return;
     }
 
+    // If the incoming frame is backed by a texture (i.e. decoded in hardware),
+    // then we do not need to allocate a texture via the layer renderer. Instead
+    // we save the texture data then exit.
     if (frame->surfaceType() == VideoFrameChromium::TypeTexture) {
         releaseCurrentFrame();
         saveCurrentFrame(frame);
@@ -136,8 +146,9 @@ void VideoLayerChromium::updateContentsIfDirty()
 
     // Update texture planes.
     for (unsigned plane = 0; plane < frame->planes(); plane++) {
-        ASSERT(frame->requiredTextureSize(plane) == m_textureSizes[plane]);
-        updateTexture(context, m_textures[plane], frame->requiredTextureSize(plane), textureFormat, frame->data(plane));
+        Texture texture = m_textures[plane];
+        ASSERT(frame->requiredTextureSize(plane) == texture.size);
+        updateTexture(context, texture.id, texture.size, textureFormat, frame->data(plane));
     }
 
     m_dirtyRect.setSize(FloatSize());
@@ -146,7 +157,19 @@ void VideoLayerChromium::updateContentsIfDirty()
     m_provider->putCurrentFrame(frame);
 }
 
-unsigned VideoLayerChromium::determineTextureFormat(VideoFrameChromium* frame)
+void VideoLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
+{
+    LayerChromium::pushPropertiesTo(layer);
+
+    CCVideoLayerImpl* videoLayer = static_cast<CCVideoLayerImpl*>(layer);
+    videoLayer->setSkipsDraw(m_skipsDraw);
+    videoLayer->setFrameFormat(m_frameFormat);
+    for (size_t i = 0; i < 3; ++i)
+        videoLayer->setTexture(i, m_textures[i]);
+}
+
+
+unsigned VideoLayerChromium::determineTextureFormat(const VideoFrameChromium* frame)
 {
     switch (frame->format()) {
     case VideoFrameChromium::YV12:
@@ -160,56 +183,68 @@ unsigned VideoLayerChromium::determineTextureFormat(VideoFrameChromium* frame)
     return GraphicsContext3D::INVALID_VALUE;
 }
 
-bool VideoLayerChromium::allocateTexturesIfNeeded(GraphicsContext3D* context, VideoFrameChromium* frame, unsigned textureFormat)
+bool VideoLayerChromium::allocateTexturesIfNeeded(GraphicsContext3D* context, const VideoFrameChromium* frame, unsigned textureFormat)
 {
     ASSERT(context);
     ASSERT(frame);
 
     for (unsigned plane = 0; plane < frame->planes(); plane++) {
-        IntSize planeTextureSize = frame->requiredTextureSize(plane);
+        IntSize requiredTextureSize = frame->requiredTextureSize(plane);
+        Texture texture = m_textures[plane];
 
         // If the renderer cannot handle this large of a texture, return false.
         // FIXME: Remove this test when tiled layers are implemented.
-        if (!layerRenderer()->checkTextureSize(planeTextureSize))
+        if (!layerRenderer()->checkTextureSize(requiredTextureSize))
             return false;
 
-        if (!m_textures[plane])
-            m_textures[plane] = layerRenderer()->createLayerTexture();
-
-        if (!planeTextureSize.isZero() && planeTextureSize != m_textureSizes[plane]) {
-            allocateTexture(context, m_textures[plane], planeTextureSize, textureFormat);
-            m_textureSizes[plane] = planeTextureSize;
-            int frameWidth = frame->width(plane);
-            int frameHeight = frame->height(plane);
-            // When there are dead pixels at the edge of the texture, decrease
-            // the frame width by 1 to prevent the rightmost pixels from
-            // interpolating with the dead pixels.
-            if (frame->hasPaddingBytes(plane))
-                --frameWidth;
-            m_frameSizes[plane] = IntSize(frameWidth, frameHeight);
+        if (texture.isEmpty) {
+            texture.id = layerRenderer()->createLayerTexture();
+            texture.ownedByLayerRenderer = true;
+            texture.isEmpty = false;
+        }
+
+        if (!requiredTextureSize.isZero() && requiredTextureSize != texture.size) {
+            allocateTexture(context, texture.id, requiredTextureSize, textureFormat);
+            texture.size = requiredTextureSize;
+            texture.visibleSize = computeVisibleSize(frame, plane);
         }
+        m_textures[plane] = texture;
     }
 
+    return true;
+}
+
+IntSize VideoLayerChromium::computeVisibleSize(const VideoFrameChromium* frame, unsigned plane)
+{
+    int visibleWidth = frame->width(plane);
+    int visibleHeight = frame->height(plane);
+    // When there are dead pixels at the edge of the texture, decrease
+    // the frame width by 1 to prevent the rightmost pixels from
+    // interpolating with the dead pixels.
+    if (frame->hasPaddingBytes(plane))
+        --visibleWidth;
+
     // In YV12, every 2x2 square of Y values corresponds to one U and
     // one V value. If we decrease the width of the UV plane, we must decrease the
     // width of the Y texture by 2 for proper alignment. This must happen
     // always, even if Y's texture does not have padding bytes.
-    if (frame->format() == VideoFrameChromium::YV12) {
-        int yPlaneOriginalWidth = frame->width(VideoFrameChromium::yPlane);
-        if (frame->hasPaddingBytes(VideoFrameChromium::uPlane))
-            m_frameSizes[VideoFrameChromium::yPlane].setWidth(yPlaneOriginalWidth - 2);
+    if (plane == VideoFrameChromium::yPlane && frame->format() == VideoFrameChromium::YV12) {
+        if (frame->hasPaddingBytes(VideoFrameChromium::uPlane)) {
+            int originalWidth = frame->width(plane);
+            visibleWidth = originalWidth - 2;
+        }
     }
 
-    return true;
+    return IntSize(visibleWidth, visibleHeight);
 }
 
-void VideoLayerChromium::allocateTexture(GraphicsContext3D* context, unsigned textureId, const IntSize& dimensions, unsigned textureFormat)
+void VideoLayerChromium::allocateTexture(GraphicsContext3D* context, unsigned textureId, const IntSize& dimensions, unsigned textureFormat) const
 {
     GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, textureId));
     GLC(context, context->texImage2DResourceSafe(GraphicsContext3D::TEXTURE_2D, 0, textureFormat, dimensions.width(), dimensions.height(), 0, textureFormat, GraphicsContext3D::UNSIGNED_BYTE));
 }
 
-void VideoLayerChromium::updateTexture(GraphicsContext3D* context, unsigned textureId, const IntSize& dimensions, unsigned format, const void* data)
+void VideoLayerChromium::updateTexture(GraphicsContext3D* context, unsigned textureId, const IntSize& dimensions, unsigned format, const void* data) const
 {
     ASSERT(context);
     GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, textureId));
@@ -225,33 +260,6 @@ void VideoLayerChromium::updateTexture(GraphicsContext3D* context, unsigned text
     }
 }
 
-void VideoLayerChromium::draw()
-{
-    if (m_skipsDraw)
-        return;
-
-    ASSERT(layerRenderer());
-    const RGBAProgram* rgbaProgram = layerRenderer()->videoLayerRGBAProgram();
-    ASSERT(rgbaProgram && rgbaProgram->initialized());
-    const YUVProgram* yuvProgram = layerRenderer()->videoLayerYUVProgram();
-    ASSERT(yuvProgram && yuvProgram->initialized());
-
-    switch (m_frameFormat) {
-    case VideoFrameChromium::YV12:
-    case VideoFrameChromium::YV16:
-        drawYUV(yuvProgram);
-        break;
-    case VideoFrameChromium::RGBA:
-        drawRGBA(rgbaProgram);
-        break;
-    default:
-        // FIXME: Implement other paths.
-        notImplemented();
-        break;
-    }
-    releaseCurrentFrame();
-}
-
 void VideoLayerChromium::releaseCurrentFrame()
 {
     if (!m_currentFrame)
@@ -262,86 +270,29 @@ void VideoLayerChromium::releaseCurrentFrame()
     resetFrameParameters();
 }
 
-void VideoLayerChromium::drawYUV(const VideoLayerChromium::YUVProgram* program)
-{
-    GraphicsContext3D* context = layerRendererContext();
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE1));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textures[VideoFrameChromium::yPlane]));
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE2));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textures[VideoFrameChromium::uPlane]));
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE3));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textures[VideoFrameChromium::vPlane]));
-
-    layerRenderer()->useShader(program->program());
-    unsigned yFrameWidth = m_frameSizes[VideoFrameChromium::yPlane].width();
-    unsigned yTextureWidth = m_textureSizes[VideoFrameChromium::yPlane].width();
-    // Arbitrarily take the u sizes because u and v dimensions are identical.
-    unsigned uvFrameWidth = m_frameSizes[VideoFrameChromium::uPlane].width();
-    unsigned uvTextureWidth = m_textureSizes[VideoFrameChromium::uPlane].width();
-
-    float yWidthScaleFactor = static_cast<float>(yFrameWidth) / yTextureWidth;
-    float uvWidthScaleFactor = static_cast<float>(uvFrameWidth) / uvTextureWidth;
-    GLC(context, context->uniform1f(program->vertexShader().yWidthScaleFactorLocation(), yWidthScaleFactor));
-    GLC(context, context->uniform1f(program->vertexShader().uvWidthScaleFactorLocation(), uvWidthScaleFactor));
-
-    GLC(context, context->uniform1i(program->fragmentShader().yTextureLocation(), 1));
-    GLC(context, context->uniform1i(program->fragmentShader().uTextureLocation(), 2));
-    GLC(context, context->uniform1i(program->fragmentShader().vTextureLocation(), 3));
-
-    // This value of 0.5 maps to 128. It is used in the YUV to RGB conversion
-    // formula to turn unsigned u and v values to signed u and v values.
-    // This is loaded as a uniform because certain drivers have problems
-    // reading literal float values.
-    GLC(context, context->uniform1f(program->fragmentShader().signAdjLocation(), 0.5));
-
-    GLC(context, context->uniformMatrix3fv(program->fragmentShader().ccMatrixLocation(), 0, const_cast<float*>(yuv2RGB), 1));
-
-    drawTexturedQuad(context, layerRenderer()->projectionMatrix(), ccLayerImpl()->drawTransform(),
-                     bounds().width(), bounds().height(), ccLayerImpl()->drawOpacity(),
-                     program->vertexShader().matrixLocation(),
-                     program->fragmentShader().alphaLocation());
-
-    // Reset active texture back to texture 0.
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
-}
-
-void VideoLayerChromium::drawRGBA(const VideoLayerChromium::RGBAProgram* program)
-{
-    GraphicsContext3D* context = layerRendererContext();
-    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
-    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textures[VideoFrameChromium::rgbPlane]));
-
-    layerRenderer()->useShader(program->program());
-    unsigned frameWidth = m_frameSizes[VideoFrameChromium::rgbPlane].width();
-    unsigned textureWidth = m_textureSizes[VideoFrameChromium::rgbPlane].width();
-    float widthScaleFactor = static_cast<float>(frameWidth) / textureWidth;
-    GLC(context, context->uniform4f(program->vertexShader().texTransformLocation(), 0, 0, widthScaleFactor, 1));
-
-    GLC(context, context->uniform1i(program->fragmentShader().samplerLocation(), 0));
-
-    drawTexturedQuad(context, layerRenderer()->projectionMatrix(), ccLayerImpl()->drawTransform(),
-                     bounds().width(), bounds().height(), ccLayerImpl()->drawOpacity(),
-                     program->vertexShader().matrixLocation(),
-                     program->fragmentShader().alphaLocation());
-}
-
 void VideoLayerChromium::resetFrameParameters()
 {
+    deleteTexturesInUse();
     for (unsigned plane = 0; plane < VideoFrameChromium::maxPlanes; plane++) {
-        m_textures[plane] = 0;
-        m_textureSizes[plane] = IntSize();
-        m_frameSizes[plane] = IntSize();
+        m_textures[plane].id = 0;
+        m_textures[plane].size = IntSize();
+        m_textures[plane].visibleSize = IntSize();
+        m_textures[plane].ownedByLayerRenderer = false;
+        m_textures[plane].isEmpty = true;
     }
 }
 
 void VideoLayerChromium::saveCurrentFrame(VideoFrameChromium* frame)
 {
     ASSERT(!m_currentFrame);
+    deleteTexturesInUse();
     m_currentFrame = frame;
     for (unsigned plane = 0; plane < frame->planes(); plane++) {
-        m_textures[plane] = frame->texture(plane);
-        m_textureSizes[plane] = frame->requiredTextureSize(plane);
-        m_frameSizes[plane] = m_textureSizes[plane];
+        m_textures[plane].id = frame->texture(plane);
+        m_textures[plane].size = frame->requiredTextureSize(plane);
+        m_textures[plane].visibleSize = computeVisibleSize(frame, plane);
+        m_textures[plane].ownedByLayerRenderer = false;
+        m_textures[plane].isEmpty = false;
     }
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
index 2170e13..ef08bd8 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
@@ -42,19 +42,28 @@ namespace WebCore {
 // A Layer that contains a Video element.
 class VideoLayerChromium : public LayerChromium {
 public:
+    struct Texture {
+        unsigned id;
+        IntSize size;
+        IntSize visibleSize;
+        bool ownedByLayerRenderer;
+        bool isEmpty;
+    };
+
     static PassRefPtr<VideoLayerChromium> create(GraphicsLayerChromium* owner = 0,
                                                  VideoFrameProvider* = 0);
     virtual ~VideoLayerChromium();
-    virtual void updateContentsIfDirty();
+
+    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
+
+    virtual void updateCompositorResources();
     virtual bool drawsContent() const { return true; }
-    virtual void draw();
 
     // This function is called by VideoFrameProvider. When this method is called
     // putCurrentFrame() must be called to return the frame currently held.
     void releaseCurrentFrame();
 
-    typedef ProgramBinding<VertexShaderPosTexTransform, FragmentShaderRGBATexFlipAlpha> RGBAProgram;
-    typedef ProgramBinding<VertexShaderPosTexYUVStretch, FragmentShaderYUVVideo> YUVProgram;
+    virtual void pushPropertiesTo(CCLayerImpl*);
 
 protected:
     virtual void cleanupResources();
@@ -63,27 +72,27 @@ protected:
 private:
     VideoLayerChromium(GraphicsLayerChromium* owner, VideoFrameProvider*);
 
-    static unsigned determineTextureFormat(VideoFrameChromium*);
-    bool allocateTexturesIfNeeded(GraphicsContext3D*, VideoFrameChromium*, unsigned textureFormat);
-    void updateYUVContents(GraphicsContext3D*, const VideoFrameChromium*);
-    void updateRGBAContents(GraphicsContext3D*, const VideoFrameChromium*);
-    void allocateTexture(GraphicsContext3D*, unsigned textureId, const IntSize& dimensions, unsigned textureFormat);
-    void updateTexture(GraphicsContext3D*, unsigned textureId, const IntSize& dimensions, unsigned textureFormat, const void* data);
-    void drawYUV(const YUVProgram*);
-    void drawRGBA(const RGBAProgram*);
+    static unsigned determineTextureFormat(const VideoFrameChromium*);
+    static IntSize computeVisibleSize(const VideoFrameChromium*, unsigned plane);
+    void deleteTexturesInUse();
+
+    bool allocateTexturesIfNeeded(GraphicsContext3D*, const VideoFrameChromium*, unsigned textureFormat);
+    void allocateTexture(GraphicsContext3D*, unsigned textureId, const IntSize& dimensions, unsigned textureFormat) const;
+
+    void updateTexture(GraphicsContext3D*, unsigned textureId, const IntSize& dimensions, unsigned textureFormat, const void* data) const;
+
     void resetFrameParameters();
     void saveCurrentFrame(VideoFrameChromium*);
 
-    static const float yuv2RGB[9];
-
     bool m_skipsDraw;
     VideoFrameChromium::Format m_frameFormat;
     VideoFrameProvider* m_provider;
-    VideoFrameChromium* m_currentFrame;
 
-    unsigned m_textures[3];
-    IntSize m_textureSizes[3];
-    IntSize m_frameSizes[3];
+    Texture m_textures[3];
+
+    // This will be null for the entire duration of video playback if hardware
+    // decoding is not being used.
+    VideoFrameChromium* m_currentFrame;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
index e83d045..652e752 100644
--- a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
@@ -47,10 +47,11 @@ PassRefPtr<WebGLLayerChromium> WebGLLayerChromium::create(GraphicsLayerChromium*
 WebGLLayerChromium::WebGLLayerChromium(GraphicsLayerChromium* owner)
     : CanvasLayerChromium(owner)
     , m_context(0)
+    , m_textureUpdated(false)
 {
 }
 
-void WebGLLayerChromium::updateContentsIfDirty()
+void WebGLLayerChromium::updateCompositorResources()
 {
     if (!m_contentsDirty)
         return;
@@ -68,19 +69,28 @@ void WebGLLayerChromium::updateContentsIfDirty()
         m_textureChanged = false;
     }
     // Update the contents of the texture used by the compositor.
-    if (m_contentsDirty) {
+    if (m_contentsDirty && m_textureUpdated) {
         m_context->prepareTexture();
+        m_context->markLayerComposited();
         m_contentsDirty = false;
+        m_textureUpdated = false;
     }
 }
 
+void WebGLLayerChromium::setTextureUpdated()
+{
+    m_textureUpdated = true;
+}
+
 void WebGLLayerChromium::setContext(const GraphicsContext3D* context)
 {
     m_context = const_cast<GraphicsContext3D*>(context);
 
     unsigned int textureId = m_context->platformTexture();
-    if (textureId != m_textureId)
+    if (textureId != m_textureId) {
         m_textureChanged = true;
+        m_textureUpdated = true;
+    }
     m_textureId = textureId;
     m_premultipliedAlpha = m_context->getContextAttributes().premultipliedAlpha;
 }
diff --git a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h
index 70be876..33db730 100644
--- a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h
@@ -45,7 +45,8 @@ class WebGLLayerChromium : public CanvasLayerChromium {
 public:
     static PassRefPtr<WebGLLayerChromium> create(GraphicsLayerChromium* owner = 0);
     virtual bool drawsContent() const { return m_context; }
-    virtual void updateContentsIfDirty();
+    virtual void updateCompositorResources();
+    void setTextureUpdated();
 
     void setContext(const GraphicsContext3D* context);
 
@@ -55,6 +56,7 @@ protected:
 private:
     explicit WebGLLayerChromium(GraphicsLayerChromium* owner);
     GraphicsContext3D* m_context;
+    bool m_textureUpdated;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp
new file mode 100644
index 0000000..649d049
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "cc/CCCanvasLayerImpl.h"
+
+#include "CanvasLayerChromium.h"
+#include "GraphicsContext3D.h"
+#include "LayerRendererChromium.h"
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+CCCanvasLayerImpl::CCCanvasLayerImpl(LayerChromium* owner)
+    : CCLayerImpl(owner)
+    , m_textureId(0)
+    , m_premultipliedAlpha(true)
+{
+}
+
+CCCanvasLayerImpl::~CCCanvasLayerImpl()
+{
+}
+
+void CCCanvasLayerImpl::draw()
+{
+    ASSERT(layerRenderer());
+    const CCCanvasLayerImpl::Program* program = layerRenderer()->canvasLayerProgram();
+    ASSERT(program && program->initialized());
+    GraphicsContext3D* context = layerRenderer()->context();
+    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
+    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textureId));
+    GC3Denum sfactor = m_premultipliedAlpha ? GraphicsContext3D::ONE : GraphicsContext3D::SRC_ALPHA;
+    GLC(context, context->blendFunc(sfactor, GraphicsContext3D::ONE_MINUS_SRC_ALPHA));
+    layerRenderer()->useShader(program->program());
+    GLC(context, context->uniform1i(program->fragmentShader().samplerLocation(), 0));
+    LayerChromium::drawTexturedQuad(context, layerRenderer()->projectionMatrix(), drawTransform(),
+                                    bounds().width(), bounds().height(), drawOpacity(),
+                                    program->vertexShader().matrixLocation(),
+                                    program->fragmentShader().alphaLocation());
+
+}
+
+
+void CCCanvasLayerImpl::dumpLayerProperties(TextStream& ts, int indent) const
+{
+    writeIndent(ts, indent);
+    ts << "canvas layer texture id: " << m_textureId << " premultiplied: " << m_premultipliedAlpha << "\n";
+    CCLayerImpl::dumpLayerProperties(ts, indent);
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h
new file mode 100644
index 0000000..8cbf8d1
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCCanvasLayerImpl_h
+#define CCCanvasLayerImpl_h
+
+#include "ProgramBinding.h"
+#include "ShaderChromium.h"
+#include "cc/CCLayerImpl.h"
+
+namespace WebCore {
+
+class CCCanvasLayerImpl : public CCLayerImpl {
+public:
+    static PassRefPtr<CCCanvasLayerImpl> create(LayerChromium* owner)
+    {
+        return adoptRef(new CCCanvasLayerImpl(owner));
+    }
+    virtual ~CCCanvasLayerImpl();
+
+    typedef ProgramBinding<VertexShaderPosTex, FragmentShaderRGBATexFlipAlpha> Program;
+
+    virtual void draw();
+
+    virtual void dumpLayerProperties(TextStream&, int indent) const;
+
+    void setTextureId(unsigned id) { m_textureId = id; }
+    void setPremultipliedAlpha(bool premultipliedAlpha) { m_premultipliedAlpha = premultipliedAlpha; }
+private:
+    explicit CCCanvasLayerImpl(LayerChromium*);
+
+    unsigned m_textureId;
+    bool m_premultipliedAlpha;
+};
+
+}
+
+#endif // CCCanvasLayerImpl_h
+
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
index 604ef61..404944b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp
@@ -66,8 +66,8 @@ void CCHeadsUpDisplay::draw()
     // Use a fullscreen texture only if we need to...
     IntSize hudSize;
     if (m_showPlatformLayerTree) {
-        hudSize.setWidth(min(2048, m_layerRenderer->visibleRectSize().width()));
-        hudSize.setHeight(min(2048, m_layerRenderer->visibleRectSize().height()));
+        hudSize.setWidth(min(2048, m_layerRenderer->viewportSize().width()));
+        hudSize.setHeight(min(2048, m_layerRenderer->viewportSize().height()));
     } else {
         hudSize.setWidth(512);
         hudSize.setHeight(128);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
index dbac22a..d56f8ab 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCHeadsUpDisplay.h
@@ -53,7 +53,7 @@ public:
     void setShowPlatformLayerTree(bool enable) { m_showPlatformLayerTree = enable; }
     bool showPlatformLayerTree() const { return m_showPlatformLayerTree; }
 
-    bool enabled() const { return true || m_showPlatformLayerTree || m_showFPSCounter; }
+    bool enabled() const { return m_showPlatformLayerTree || m_showFPSCounter; }
     void draw();
 
 private:
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
index a0ad0fb..9411e5a 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
@@ -62,13 +62,18 @@ namespace WebCore {
 
 CCLayerImpl::CCLayerImpl(LayerChromium* owner)
     : m_owner(owner)
+    , m_anchorPoint(0.5, 0.5)
+    , m_anchorPointZ(0)
+    , m_doubleSided(true)
+    , m_masksToBounds(false)
+    , m_opacity(1.0)
+    , m_preserves3D(false)
 #ifndef NDEBUG
     , m_debugID(owner->debugID())
 #endif
     , m_targetRenderSurface(0)
     , m_drawDepth(0)
     , m_drawOpacity(0)
-    , m_doubleSided(true)
     , m_debugBorderColor(0, 0, 0, 0)
     , m_debugBorderWidth(0)
     , m_renderSurface(0)
@@ -107,7 +112,18 @@ RenderSurfaceChromium* CCLayerImpl::createRenderSurface()
     return m_renderSurface.get();
 }
 
-// These belong on CCLayerImpl, but should be subclased by each type and not defer to the LayerChromium subtypes.
+bool CCLayerImpl::descendantsDrawsContent()
+{
+    const Vector<RefPtr<LayerChromium> >& sublayers = m_owner->getSublayers();
+    for (size_t i = 0; i < sublayers.size(); ++i) {
+        sublayers[i]->createCCLayerImplIfNeeded();
+        if (sublayers[i]->ccLayerImpl()->drawsContent() || sublayers[i]->ccLayerImpl()->descendantsDrawsContent())
+            return true;
+    }
+    return false;
+}
+
+// These belong on CCLayerImpl, but should be overridden by each type and not defer to the LayerChromium subtypes.
 bool CCLayerImpl::drawsContent() const
 {
     return m_owner->drawsContent();
@@ -118,6 +134,11 @@ void CCLayerImpl::draw()
     return m_owner->draw();
 }
 
+void CCLayerImpl::updateCompositorResources()
+{
+    return m_owner->updateCompositorResources();
+}
+
 void CCLayerImpl::unreserveContentsTexture()
 {
     m_owner->unreserveContentsTexture();
@@ -167,7 +188,7 @@ void CCLayerImpl::drawDebugBorder()
     GLC(context, context->drawElements(GraphicsContext3D::LINE_LOOP, 4, GraphicsContext3D::UNSIGNED_SHORT, 6 * sizeof(unsigned short)));
 }
 
-static void writeIndent(TextStream& ts, int indent)
+void CCLayerImpl::writeIndent(TextStream& ts, int indent)
 {
     for (int i = 0; i != indent; ++i)
         ts << "  ";
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
index 6892976..96c4f1b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
@@ -49,7 +49,7 @@ public:
         return adoptRef(new CCLayerImpl(owner));
     }
     // When this class gets subclasses, remember to add 'virtual' here.
-    ~CCLayerImpl();
+    virtual ~CCLayerImpl();
 
 #ifndef NDEBUG
     int debugID() const { return m_debugID; }
@@ -59,13 +59,43 @@ public:
     CCLayerImpl* maskLayer() const;
     CCLayerImpl* replicaLayer() const;
 
-    void draw();
-    bool drawsContent() const;
+    virtual void draw();
+    virtual void updateCompositorResources();
     void unreserveContentsTexture();
     void bindContentsTexture();
 
+    // Returns true if this layer has content to draw.
+    virtual bool drawsContent() const;
+
+    // Returns true if any of the layer's descendants has content to draw.
+    bool descendantsDrawsContent();
+
     void cleanupResources();
 
+    void setAnchorPoint(const FloatPoint& anchorPoint) { m_anchorPoint = anchorPoint; }
+    const FloatPoint& anchorPoint() const { return m_anchorPoint; }
+
+    void setAnchorPointZ(float anchorPointZ) { m_anchorPointZ = anchorPointZ; }
+    float anchorPointZ() const { return m_anchorPointZ; }
+
+    void setMasksToBounds(bool masksToBounds) { m_masksToBounds = masksToBounds; }
+    bool masksToBounds() const { return m_masksToBounds; }
+
+    void setOpacity(float opacity) { m_opacity = opacity; }
+    float opacity() const { return m_opacity; }
+
+    void setPosition(const FloatPoint& position) { m_position = position; }
+    const FloatPoint& position() const { return m_position; }
+
+    void setPreserves3D(bool preserves3D) { m_preserves3D = preserves3D; }
+    bool preserves3D() const { return m_preserves3D; }
+
+    void setSublayerTransform(const TransformationMatrix& sublayerTransform) { m_sublayerTransform = sublayerTransform; }
+    const TransformationMatrix& sublayerTransform() const { return m_sublayerTransform; }
+
+    void setTransform(const TransformationMatrix& transform) { m_transform = transform; }
+    const TransformationMatrix& transform() const { return m_transform; }
+
     void setName(const String& name) { m_name = name; }
     const String& name() const { return m_name; }
 
@@ -108,11 +138,30 @@ public:
 
     virtual void dumpLayerProperties(TextStream&, int indent) const;
 
-private:
+protected:
     // For now, CCLayers are owned directly by a LayerChromium.
     LayerChromium* m_owner;
     explicit CCLayerImpl(LayerChromium*);
 
+    static void writeIndent(TextStream&, int indent);
+
+private:
+    // Properties synchronized from the associated LayerChromium.
+    FloatPoint m_anchorPoint;
+    float m_anchorPointZ;
+    IntSize m_bounds;
+
+    // Whether the "back" of this layer should draw.
+    bool m_doubleSided;
+
+    bool m_masksToBounds;
+    float m_opacity;
+    FloatPoint m_position;
+    bool m_preserves3D;
+    TransformationMatrix m_sublayerTransform;
+    TransformationMatrix m_transform;
+
+    // Properties owned exclusively by this CCLayerImpl.
     // Debugging.
 #ifndef NDEBUG
     int m_debugID;
@@ -131,17 +180,12 @@ private:
     float m_drawDepth;
     float m_drawOpacity;
 
-    // Whether the "back" of this layer should draw.
-    bool m_doubleSided;
-
     // Debug borders.
     Color m_debugBorderColor;
     float m_debugBorderWidth;
 
     TransformationMatrix m_drawTransform;
 
-    IntSize m_bounds;
-
     // The scissor rectangle that should be used when this layer is drawn.
     // Inherited by the parent layer and further restricted if this layer masks
     // to bounds.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp
new file mode 100644
index 0000000..4aef639
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "cc/CCPluginLayerImpl.h"
+
+#include "GraphicsContext3D.h"
+#include "LayerRendererChromium.h"
+#include "PluginLayerChromium.h"
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+CCPluginLayerImpl::CCPluginLayerImpl(LayerChromium* owner)
+    : CCLayerImpl(owner)
+    , m_textureId(0)
+{
+}
+
+CCPluginLayerImpl::~CCPluginLayerImpl()
+{
+}
+
+void CCPluginLayerImpl::draw()
+{
+    ASSERT(layerRenderer());
+    const CCPluginLayerImpl::Program* program = layerRenderer()->pluginLayerProgram();
+    ASSERT(program && program->initialized());
+    GraphicsContext3D* context = layerRenderer()->context();
+    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
+    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textureId));
+
+    // FIXME: setting the texture parameters every time is redundant. Move this code somewhere
+    // where it will only happen once per texture.
+    GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR));
+    GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::LINEAR));
+    GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE));
+    GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE));
+
+    layerRenderer()->useShader(program->program());
+    GLC(context, context->uniform1i(program->fragmentShader().samplerLocation(), 0));
+    LayerChromium::drawTexturedQuad(context, layerRenderer()->projectionMatrix(), drawTransform(),
+                                    bounds().width(), bounds().height(), drawOpacity(),
+                                    program->vertexShader().matrixLocation(),
+                                    program->fragmentShader().alphaLocation());
+}
+
+
+void CCPluginLayerImpl::dumpLayerProperties(TextStream& ts, int indent) const
+{
+    writeIndent(ts, indent);
+    ts << "plugin layer texture id: " << m_textureId << "\n";
+    CCLayerImpl::dumpLayerProperties(ts, indent);
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h
new file mode 100644
index 0000000..65eb5b7
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCPluginLayerImpl_h
+#define CCPluginLayerImpl_h
+
+#include "ProgramBinding.h"
+#include "ShaderChromium.h"
+#include "cc/CCLayerImpl.h"
+
+namespace WebCore {
+
+class CCPluginLayerImpl : public CCLayerImpl {
+public:
+    static PassRefPtr<CCPluginLayerImpl> create(LayerChromium* owner)
+    {
+        return adoptRef(new CCPluginLayerImpl(owner));
+    }
+    virtual ~CCPluginLayerImpl();
+
+    typedef ProgramBinding<VertexShaderPosTex, FragmentShaderRGBATexFlipAlpha> Program;
+
+    virtual void draw();
+
+    virtual void dumpLayerProperties(TextStream&, int indent) const;
+
+    void setTextureId(unsigned id) { m_textureId = id; }
+
+private:
+    explicit CCPluginLayerImpl(LayerChromium*);
+
+    unsigned m_textureId;
+};
+
+}
+
+#endif // CCPluginLayerImpl_h
+
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
new file mode 100644
index 0000000..eb3612b
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
@@ -0,0 +1,173 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "cc/CCVideoLayerImpl.h"
+
+#include "GraphicsContext3D.h"
+#include "LayerRendererChromium.h"
+#include "NotImplemented.h"
+#include "VideoLayerChromium.h"
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+// These values are magic numbers that are used in the transformation
+// from YUV to RGB color values.
+// They are taken from the following webpage:
+// http://www.fourcc.org/fccyvrgb.php
+const float CCVideoLayerImpl::yuv2RGB[9] = {
+    1.164f, 1.164f, 1.164f,
+    0.f, -.391f, 2.018f,
+    1.596f, -.813f, 0.f,
+};
+
+// These values map to 16, 128, and 128 respectively, and are computed
+// as a fraction over 256 (e.g. 16 / 256 = 0.0625).
+// They are used in the YUV to RGBA conversion formula:
+//   Y - 16   : Gives 16 values of head and footroom for overshooting
+//   U - 128  : Turns unsigned U into signed U [-128,127]
+//   V - 128  : Turns unsigned V into signed V [-128,127]
+const float CCVideoLayerImpl::yuvAdjust[3] = {
+    -0.0625f,
+    -0.5f,
+    -0.5f,
+};
+
+CCVideoLayerImpl::CCVideoLayerImpl(LayerChromium* owner)
+    : CCLayerImpl(owner)
+{
+}
+
+CCVideoLayerImpl::~CCVideoLayerImpl()
+{
+    cleanupResources();
+}
+
+void CCVideoLayerImpl::setTexture(size_t i, VideoLayerChromium::Texture texture)
+{
+    ASSERT(i < 3);
+    m_textures[i] = texture;
+}
+
+void CCVideoLayerImpl::draw()
+{
+    if (m_skipsDraw)
+        return;
+
+    ASSERT(layerRenderer());
+    const RGBAProgram* rgbaProgram = layerRenderer()->videoLayerRGBAProgram();
+    ASSERT(rgbaProgram && rgbaProgram->initialized());
+    const YUVProgram* yuvProgram = layerRenderer()->videoLayerYUVProgram();
+    ASSERT(yuvProgram && yuvProgram->initialized());
+
+    switch (m_frameFormat) {
+    case VideoFrameChromium::YV12:
+    case VideoFrameChromium::YV16:
+        drawYUV(yuvProgram);
+        break;
+    case VideoFrameChromium::RGBA:
+        drawRGBA(rgbaProgram);
+        break;
+    default:
+        // FIXME: Implement other paths.
+        notImplemented();
+        break;
+    }
+}
+
+void CCVideoLayerImpl::drawYUV(const CCVideoLayerImpl::YUVProgram* program) const
+{
+    GraphicsContext3D* context = layerRenderer()->context();
+    VideoLayerChromium::Texture yTexture = m_textures[VideoFrameChromium::yPlane];
+    VideoLayerChromium::Texture uTexture = m_textures[VideoFrameChromium::uPlane];
+    VideoLayerChromium::Texture vTexture = m_textures[VideoFrameChromium::vPlane];
+
+    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE1));
+    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, yTexture.id));
+    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE2));
+    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, uTexture.id));
+    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE3));
+    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, vTexture.id));
+
+    layerRenderer()->useShader(program->program());
+
+    float yWidthScaleFactor = static_cast<float>(yTexture.visibleSize.width()) / yTexture.size.width();
+    // Arbitrarily take the u sizes because u and v dimensions are identical.
+    float uvWidthScaleFactor = static_cast<float>(uTexture.visibleSize.width()) / uTexture.size.width();
+    GLC(context, context->uniform1f(program->vertexShader().yWidthScaleFactorLocation(), yWidthScaleFactor));
+    GLC(context, context->uniform1f(program->vertexShader().uvWidthScaleFactorLocation(), uvWidthScaleFactor));
+
+    GLC(context, context->uniform1i(program->fragmentShader().yTextureLocation(), 1));
+    GLC(context, context->uniform1i(program->fragmentShader().uTextureLocation(), 2));
+    GLC(context, context->uniform1i(program->fragmentShader().vTextureLocation(), 3));
+
+    GLC(context, context->uniformMatrix3fv(program->fragmentShader().ccMatrixLocation(), 0, const_cast<float*>(yuv2RGB), 1));
+    GLC(context, context->uniform3fv(program->fragmentShader().yuvAdjLocation(), const_cast<float*>(yuvAdjust), 1));
+
+    LayerChromium::drawTexturedQuad(context, layerRenderer()->projectionMatrix(), drawTransform(),
+                                    bounds().width(), bounds().height(), drawOpacity(),
+                                    program->vertexShader().matrixLocation(),
+                                    program->fragmentShader().alphaLocation());
+
+    // Reset active texture back to texture 0.
+    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
+}
+
+void CCVideoLayerImpl::drawRGBA(const CCVideoLayerImpl::RGBAProgram* program) const
+{
+    GraphicsContext3D* context = layerRenderer()->context();
+    VideoLayerChromium::Texture texture = m_textures[VideoFrameChromium::rgbPlane];
+
+    GLC(context, context->activeTexture(GraphicsContext3D::TEXTURE0));
+    GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, texture.id));
+
+    layerRenderer()->useShader(program->program());
+    float widthScaleFactor = static_cast<float>(texture.visibleSize.width()) / texture.size.width();
+    GLC(context, context->uniform4f(program->vertexShader().texTransformLocation(), 0, 0, widthScaleFactor, 1));
+
+    GLC(context, context->uniform1i(program->fragmentShader().samplerLocation(), 0));
+
+    LayerChromium::drawTexturedQuad(context, layerRenderer()->projectionMatrix(), drawTransform(),
+                                    bounds().width(), bounds().height(), drawOpacity(),
+                                    program->vertexShader().matrixLocation(),
+                                    program->fragmentShader().alphaLocation());
+}
+
+
+void CCVideoLayerImpl::dumpLayerProperties(TextStream& ts, int indent) const
+{
+    writeIndent(ts, indent);
+    ts << "video layer\n";
+    CCLayerImpl::dumpLayerProperties(ts, indent);
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
new file mode 100644
index 0000000..62f8778
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCVideoLayerImpl_h
+#define CCVideoLayerImpl_h
+
+#include "ProgramBinding.h"
+#include "ShaderChromium.h"
+#include "VideoFrameChromium.h"
+#include "VideoLayerChromium.h"
+#include "cc/CCLayerImpl.h"
+
+namespace WebCore {
+
+class VideoFrameProvider;
+
+class CCVideoLayerImpl : public CCLayerImpl {
+public:
+    static PassRefPtr<CCVideoLayerImpl> create(LayerChromium* owner)
+    {
+        return adoptRef(new CCVideoLayerImpl(owner));
+    }
+    virtual ~CCVideoLayerImpl();
+
+    typedef ProgramBinding<VertexShaderPosTexTransform, FragmentShaderRGBATexFlipAlpha> RGBAProgram;
+    typedef ProgramBinding<VertexShaderPosTexYUVStretch, FragmentShaderYUVVideo> YUVProgram;
+
+    virtual void draw();
+
+    virtual void dumpLayerProperties(TextStream&, int indent) const;
+
+    void setSkipsDraw(bool skipsDraw) { m_skipsDraw = skipsDraw; }
+    void setFrameFormat(VideoFrameChromium::Format format) { m_frameFormat = format; }
+    void setTexture(size_t, VideoLayerChromium::Texture);
+
+private:
+    explicit CCVideoLayerImpl(LayerChromium*);
+
+    void drawYUV(const YUVProgram*) const;
+    void drawRGBA(const RGBAProgram*) const;
+
+    static const float yuv2RGB[9];
+    static const float yuvAdjust[3];
+
+    bool m_skipsDraw;
+    VideoFrameChromium::Format m_frameFormat;
+    VideoLayerChromium::Texture m_textures[3];
+};
+
+}
+
+#endif // CCVideoLayerImpl_h
+
diff --git a/Source/WebCore/platform/graphics/cocoa/FontPlatformData.h b/Source/WebCore/platform/graphics/cocoa/FontPlatformData.h
deleted file mode 100644
index ca38029..0000000
--- a/Source/WebCore/platform/graphics/cocoa/FontPlatformData.h
+++ /dev/null
@@ -1,176 +0,0 @@
-/*
- * This file is part of the internal font implementation.
- * It should not be included by source files outside of it.
- *
- * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef FontPlatformData_h
-#define FontPlatformData_h
-
-#include "FontOrientation.h"
-#include "FontWidthVariant.h"
-#include <wtf/text/StringImpl.h>
-
-#ifdef __OBJC__
-@class NSFont;
-#else
-class NSFont;
-#endif
-
-typedef struct CGFont* CGFontRef;
-#ifndef BUILDING_ON_TIGER
-typedef const struct __CTFont* CTFontRef;
-#endif
-
-#include <CoreFoundation/CFBase.h>
-#include <objc/objc-auto.h>
-#include <wtf/Forward.h>
-#include <wtf/RetainPtr.h>
-
-#if PLATFORM(CHROMIUM) && OS(DARWIN)
-#include "CrossProcessFontLoading.h"  
-#endif
-
-
-typedef UInt32 ATSUFontID;
-typedef UInt32 ATSFontRef;
-
-namespace WebCore {
-
-#ifndef BUILDING_ON_TIGER
-inline CTFontRef toCTFontRef(NSFont *nsFont) { return reinterpret_cast<CTFontRef>(nsFont); }
-#endif
-
-class FontPlatformData {
-  public:
-    FontPlatformData(float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation = Horizontal, FontWidthVariant widthVariant = RegularWidth)
-        : m_syntheticBold(syntheticBold)
-        , m_syntheticOblique(syntheticOblique)
-        , m_orientation(orientation)
-        , m_size(size)
-        , m_widthVariant(widthVariant)
-        , m_font(0)
-#ifdef BUILDING_ON_TIGER
-        , m_cgFont(0)
-#endif
-        , m_isColorBitmapFont(false)
-    {
-    }
-
-    FontPlatformData(NSFont*, float size, bool syntheticBold = false, bool syntheticOblique = false, FontOrientation = Horizontal, FontWidthVariant = RegularWidth);
-    
-    FontPlatformData(CGFontRef cgFont, float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation, FontWidthVariant widthVariant)
-        : m_syntheticBold(syntheticBold)
-        , m_syntheticOblique(syntheticOblique)
-        , m_orientation(orientation)
-        , m_size(size)
-        , m_widthVariant(widthVariant)
-        , m_font(0)
-        , m_cgFont(cgFont)
-        , m_isColorBitmapFont(false)
-    {
-    }
-
-    FontPlatformData(const FontPlatformData&);
-    
-    ~FontPlatformData();
-
-    FontPlatformData(WTF::HashTableDeletedValueType) : m_font(hashTableDeletedFontValue()) { }
-    bool isHashTableDeletedValue() const { return m_font == hashTableDeletedFontValue(); }
-
-    float size() const { return m_size; }
-    bool syntheticBold() const { return m_syntheticBold; }
-    bool syntheticOblique() const { return m_syntheticOblique; }
-    FontOrientation orientation() const { return m_orientation; }
-    FontWidthVariant widthVariant() const { return m_widthVariant; }
-
-    bool m_syntheticBold;
-    bool m_syntheticOblique;
-    FontOrientation m_orientation;
-
-    float m_size;
-    
-    FontWidthVariant m_widthVariant;
-
-    unsigned hash() const
-    {
-        ASSERT(m_font != 0 || m_cgFont == 0);
-        uintptr_t hashCodes[3] = { (uintptr_t)m_font, m_widthVariant, m_orientation << 2 | m_syntheticBold << 1 | m_syntheticOblique };
-        return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
-    }
-
-    const FontPlatformData& operator=(const FontPlatformData& f);
-
-    bool operator==(const FontPlatformData& other) const
-    { 
-        return m_font == other.m_font && m_syntheticBold == other.m_syntheticBold && m_syntheticOblique == other.m_syntheticOblique && 
-               m_cgFont == other.m_cgFont && m_size == other.m_size && m_orientation == other.m_orientation && m_widthVariant == other.m_widthVariant;
-    }
-
-    NSFont *font() const { return m_font; }
-    void setFont(NSFont *font);
-
-    CTFontRef ctFont() const;
-
-    bool roundsGlyphAdvances() const;
-    bool allowsLigatures() const;
-    bool isColorBitmapFont() const { return m_isColorBitmapFont; }
-
-#ifndef BUILDING_ON_TIGER
-    CGFontRef cgFont() const { return m_cgFont.get(); }
-#else
-    CGFontRef cgFont() const { return m_cgFont; }
-#endif
-
-#ifndef NDEBUG
-    String description() const;
-#endif
-
-private:
-    static NSFont *hashTableDeletedFontValue() { return reinterpret_cast<NSFont *>(-1); }
-    
-    // Load various data about the font specified by |nsFont| with the size fontSize into the following output paramters:
-    // Note: Callers should always take into account that for the Chromium port, |outNSFont| isn't necessarily the same
-    // font as |nsFont|.  This because the sandbox may block loading of the original font.
-    // * outNSFont - The font that was actually loaded, for the Chromium port this may be different than nsFont.
-    // The caller is responsible for calling CFRelease() on this parameter when done with it.
-    // * cgFont - CGFontRef representing the input font at the specified point size.
-    void loadFont(NSFont* nsFont, float fontSize, NSFont*& outNSFont, CGFontRef& cgFont);
-
-    NSFont *m_font;
-
-#ifndef BUILDING_ON_TIGER
-    RetainPtr<CGFontRef> m_cgFont;
-#else
-    CGFontRef m_cgFont; // It is not necessary to refcount this, since either an NSFont owns it or some CachedFont has it referenced.
-#endif
-
-    mutable RetainPtr<CTFontRef> m_CTFont;
-
-    bool m_isColorBitmapFont;
-    
-#if PLATFORM(CHROMIUM) && OS(DARWIN)
-    RefPtr<MemoryActivatedFont> m_inMemoryFont;
-#endif
-};
-
-} // namespace WebCore
-
-#endif
diff --git a/Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm b/Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm
index b40f698..6a17707 100644
--- a/Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm
+++ b/Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm
@@ -45,9 +45,12 @@ void FontPlatformData::loadFont(NSFont* nsFont, float, NSFont*& outNSFont, CGFon
 }
 #endif  // PLATFORM(MAC)
 
-FontPlatformData::FontPlatformData(NSFont *nsFont, float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation, FontWidthVariant widthVariant)
+FontPlatformData::FontPlatformData(NSFont *nsFont, float size, bool syntheticBold, bool syntheticOblique, FontOrientation orientation,
+                                   TextOrientation textOrientation, FontWidthVariant widthVariant)
     : m_syntheticBold(syntheticBold)
     , m_syntheticOblique(syntheticOblique)
+    , m_orientation(orientation)
+    , m_textOrientation(textOrientation)
     , m_size(size)
     , m_widthVariant(widthVariant)
     , m_font(nsFont)
@@ -64,8 +67,6 @@ FontPlatformData::FontPlatformData(NSFont *nsFont, float size, bool syntheticBol
     CGFontRef cgFont = 0;
     loadFont(nsFont, size, m_font, cgFont);
 
-    m_orientation = orientation;
-
     if (m_font)
         CFRetain(m_font);
 
@@ -76,35 +77,26 @@ FontPlatformData::FontPlatformData(NSFont *nsFont, float size, bool syntheticBol
 #endif
 }
 
-FontPlatformData::FontPlatformData(const FontPlatformData& f)
+FontPlatformData:: ~FontPlatformData()
+{
+    if (m_font && m_font != reinterpret_cast<NSFont *>(-1))
+        CFRelease(m_font);
+}
+
+void FontPlatformData::platformDataInit(const FontPlatformData& f)
 {
     m_font = f.m_font && f.m_font != reinterpret_cast<NSFont *>(-1) ? const_cast<NSFont *>(static_cast<const NSFont *>(CFRetain(f.m_font))) : f.m_font;
 
-    m_syntheticBold = f.m_syntheticBold;
-    m_syntheticOblique = f.m_syntheticOblique;
-    m_size = f.m_size;
-    m_widthVariant = f.m_widthVariant;
     m_cgFont = f.m_cgFont;
-    m_isColorBitmapFont = f.m_isColorBitmapFont;
-    m_orientation = f.m_orientation;
     m_CTFont = f.m_CTFont;
+
 #if PLATFORM(CHROMIUM) && OS(DARWIN)
     m_inMemoryFont = f.m_inMemoryFont;
 #endif
 }
 
-FontPlatformData:: ~FontPlatformData()
+const FontPlatformData& FontPlatformData::platformDataAssign(const FontPlatformData& f)
 {
-    if (m_font && m_font != reinterpret_cast<NSFont *>(-1))
-        CFRelease(m_font);
-}
-
-const FontPlatformData& FontPlatformData::operator=(const FontPlatformData& f)
-{
-    m_syntheticBold = f.m_syntheticBold;
-    m_syntheticOblique = f.m_syntheticOblique;
-    m_size = f.m_size;
-    m_widthVariant = f.m_widthVariant;
     m_cgFont = f.m_cgFont;
     if (m_font == f.m_font)
         return *this;
@@ -113,8 +105,6 @@ const FontPlatformData& FontPlatformData::operator=(const FontPlatformData& f)
     if (m_font && m_font != reinterpret_cast<NSFont *>(-1))
         CFRelease(m_font);
     m_font = f.m_font;
-    m_isColorBitmapFont = f.m_isColorBitmapFont;
-    m_orientation = f.m_orientation;
     m_CTFont = f.m_CTFont;
 #if PLATFORM(CHROMIUM) && OS(DARWIN)
     m_inMemoryFont = f.m_inMemoryFont;
@@ -122,6 +112,12 @@ const FontPlatformData& FontPlatformData::operator=(const FontPlatformData& f)
     return *this;
 }
 
+bool FontPlatformData::platformIsEqual(const FontPlatformData& other) const
+{
+    return m_font == other.m_font
+        && m_cgFont == other.m_cgFont;
+}
+
 void FontPlatformData::setFont(NSFont *font)
 {
     ASSERT_ARG(font, font);
diff --git a/Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp b/Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp
index 841c8a3..b1cf96b 100644
--- a/Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp
+++ b/Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp
@@ -59,7 +59,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
     cairo_font_face_destroy(m_fontFace);
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, TextOrientation, FontWidthVariant, FontRenderingMode)
 {
     return FontPlatformData(m_fontFace, size, bold, italic);
 }
diff --git a/Source/WebCore/platform/graphics/freetype/FontPlatformData.h b/Source/WebCore/platform/graphics/freetype/FontPlatformData.h
index 2841b14..d1cb605 100644
--- a/Source/WebCore/platform/graphics/freetype/FontPlatformData.h
+++ b/Source/WebCore/platform/graphics/freetype/FontPlatformData.h
@@ -71,6 +71,7 @@ public:
     bool hasCompatibleCharmap();
 
     FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
+    void setOrientation(FontOrientation) { } // FIXME: Implement.
 
     cairo_scaled_font_t* scaledFont() const { return m_scaledFont; }
 
diff --git a/Source/WebCore/platform/graphics/gpu/BicubicShader.cpp b/Source/WebCore/platform/graphics/gpu/BicubicShader.cpp
new file mode 100644
index 0000000..40c9843
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gpu/BicubicShader.cpp
@@ -0,0 +1,137 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(ACCELERATED_2D_CANVAS)
+
+#include "BicubicShader.h"
+
+#include "GraphicsContext3D.h"
+
+namespace WebCore {
+
+BicubicShader::BicubicShader(GraphicsContext3D* context, unsigned program)
+    : Shader(context, program)
+    , m_matrixLocation(context->getUniformLocation(program, "matrix"))
+    , m_texMatrixLocation(context->getUniformLocation(program, "texMatrix"))
+    , m_coefficientsLocation(context->getUniformLocation(program, "coefficients"))
+    , m_imageIncrementLocation(context->getUniformLocation(program, "imageIncrement"))
+    , m_imageLocation(context->getUniformLocation(program, "image"))
+    , m_alphaLocation(context->getUniformLocation(program, "alpha"))
+    , m_positionLocation(context->getAttribLocation(program, "position"))
+{
+}
+
+PassOwnPtr<BicubicShader> BicubicShader::create(GraphicsContext3D* context)
+{
+    static const char* vertexShaderSource =
+        "uniform mat3 matrix;\n"
+        "uniform mat3 texMatrix;\n"
+        "attribute vec3 position;\n"
+        "varying vec2 texCoord;\n"
+        "void main() {\n"
+        "    texCoord = (texMatrix * position).xy;\n"
+        "    gl_Position = vec4(matrix * position, 1.0);\n"
+        "}\n";
+    static const char* fragmentShaderSource =
+        "#ifdef GL_ES\n"
+        "precision mediump float;\n"
+        "#endif\n"
+        "uniform sampler2D image;\n"
+        "uniform vec2 imageIncrement;\n"
+        "uniform mat4 coefficients;\n"
+        "uniform float alpha;\n"
+        "varying vec2 texCoord;\n"
+        "vec4 cubicBlend(float t, vec4 c0, vec4 c1, vec4 c2, vec4 c3) {\n"
+        "    vec4 ts = vec4(1.0, t, t * t, t * t * t);\n"
+        "    vec4 result = coefficients * ts;\n"
+        "    return result.w * c0 + result.z * c1 + result.y * c2 + result.x * c3;\n"
+        "}\n"
+        "void main() {\n"
+        "    vec2 imageCoord = texCoord;\n"
+        "    vec2 f = fract(imageCoord / imageIncrement) - vec2(0.5, 0.5);\n"
+        "    vec4 t00 = texture2D(image, imageCoord + imageIncrement * vec2(-1, -1));\n"
+        "    vec4 t10 = texture2D(image, imageCoord + imageIncrement * vec2( 0, -1));\n"
+        "    vec4 t20 = texture2D(image, imageCoord + imageIncrement * vec2( 1, -1));\n"
+        "    vec4 t30 = texture2D(image, imageCoord + imageIncrement * vec2( 2, -1));\n"
+        "    vec4 t0 = cubicBlend(f.x, t00, t10, t20, t30);\n"
+        "    vec4 t01 = texture2D(image, imageCoord + imageIncrement * vec2(-1, 0));\n"
+        "    vec4 t11 = texture2D(image, imageCoord + imageIncrement * vec2( 0, 0));\n"
+        "    vec4 t21 = texture2D(image, imageCoord + imageIncrement * vec2( 1, 0));\n"
+        "    vec4 t31 = texture2D(image, imageCoord + imageIncrement * vec2( 2, 0));\n"
+        "    vec4 t1 = cubicBlend(f.x, t01, t11, t21, t31);\n"
+        "    vec4 t02 = texture2D(image, imageCoord + imageIncrement * vec2(-1, 1));\n"
+        "    vec4 t12 = texture2D(image, imageCoord + imageIncrement * vec2( 0, 1));\n"
+        "    vec4 t22 = texture2D(image, imageCoord + imageIncrement * vec2( 1, 1));\n"
+        "    vec4 t32 = texture2D(image, imageCoord + imageIncrement * vec2( 2, 1));\n"
+        "    vec4 t2 = cubicBlend(f.x, t02, t12, t22, t32);\n"
+        "    vec4 t03 = texture2D(image, imageCoord + imageIncrement * vec2(-1, 2));\n"
+        "    vec4 t13 = texture2D(image, imageCoord + imageIncrement * vec2( 0, 2));\n"
+        "    vec4 t23 = texture2D(image, imageCoord + imageIncrement * vec2( 1, 2));\n"
+        "    vec4 t33 = texture2D(image, imageCoord + imageIncrement * vec2( 2, 2));\n"
+        "    vec4 t3 = cubicBlend(f.x, t03, t13, t23, t33);\n"
+        "    gl_FragColor = cubicBlend(f.y, t0, t1, t2, t3);\n"
+        "}\n";
+
+    unsigned program = loadProgram(context, vertexShaderSource, fragmentShaderSource);
+    if (!program)
+        return 0;
+
+    return new BicubicShader(context, program);
+}
+
+void BicubicShader::use(const AffineTransform& transform, const AffineTransform& texTransform, const float coefficients[16], const float imageIncrement[2], float alpha)
+{
+    m_context->useProgram(m_program);
+    float matrix[9];
+    affineTo3x3(transform, matrix);
+    m_context->uniformMatrix3fv(m_matrixLocation, false /*transpose*/, matrix, 1 /*count*/);
+
+    float texMatrix[9];
+    affineTo3x3(texTransform, texMatrix);
+    m_context->uniformMatrix3fv(m_texMatrixLocation, false /*transpose*/, texMatrix, 1 /*count*/);
+    m_context->uniformMatrix4fv(m_coefficientsLocation, false /*transpose*/, const_cast<float *>(coefficients), 1 /*count*/);
+
+    m_context->uniform2f(m_imageIncrementLocation, imageIncrement[0], imageIncrement[1]);
+
+    // For now, we always use texture unit 0. If that ever changes, we should
+    // expose this parameter to the caller.
+    m_context->uniform1i(m_imageLocation, 0);
+    m_context->uniform1f(m_alphaLocation, alpha);
+
+    m_context->vertexAttribPointer(m_positionLocation, 3, GraphicsContext3D::FLOAT, false, 0, 0);
+
+    m_context->enableVertexAttribArray(m_positionLocation);
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/platform/graphics/gpu/BicubicShader.h b/Source/WebCore/platform/graphics/gpu/BicubicShader.h
new file mode 100644
index 0000000..f7522f4
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gpu/BicubicShader.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BicubicShader_h
+#define BicubicShader_h
+
+#include "Shader.h"
+
+namespace WebCore {
+
+class BicubicShader : public Shader {
+public:
+    static PassOwnPtr<BicubicShader> create(GraphicsContext3D*);
+
+    void use(const AffineTransform&, const AffineTransform& texTransform, const float coefficients[16], const float imageIncrement[2], float alpha);
+
+private:
+    BicubicShader(GraphicsContext3D*, unsigned program);
+
+    int m_matrixLocation;
+    int m_texMatrixLocation;
+    int m_coefficientsLocation;
+    int m_imageIncrementLocation;
+    int m_imageLocation;
+    int m_alphaLocation;
+    int m_positionLocation;
+};
+
+}
+
+#endif // BicubicShader_h
diff --git a/Source/WebCore/platform/graphics/gpu/ConvolutionShader.cpp b/Source/WebCore/platform/graphics/gpu/ConvolutionShader.cpp
new file mode 100644
index 0000000..f0b6bd9
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gpu/ConvolutionShader.cpp
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(ACCELERATED_2D_CANVAS)
+
+#include "ConvolutionShader.h"
+
+#include "GraphicsContext3D.h"
+#include "StringExtras.h"
+
+namespace WebCore {
+
+ConvolutionShader::ConvolutionShader(GraphicsContext3D* context, unsigned program, int kernelWidth)
+    : Shader(context, program)
+    , m_kernelWidth(kernelWidth)
+    , m_matrixLocation(context->getUniformLocation(program, "matrix"))
+    , m_texMatrixLocation(context->getUniformLocation(program, "texMatrix"))
+    , m_kernelLocation(context->getUniformLocation(program, "kernel"))
+    , m_imageLocation(context->getUniformLocation(program, "image"))
+    , m_imageIncrementLocation(context->getUniformLocation(program, "imageIncrement"))
+    , m_positionLocation(context->getAttribLocation(program, "position"))
+{
+}
+
+PassOwnPtr<ConvolutionShader> ConvolutionShader::create(GraphicsContext3D* context, int kernelWidth)
+{
+    static const char* vertexShaderRaw =
+        "#define KERNEL_WIDTH %d\n"
+        "uniform mat3 matrix;\n"
+        "uniform mat3 texMatrix;\n"
+        "uniform vec2 imageIncrement;\n"
+        "attribute vec3 position;\n"
+        "varying vec2 imageCoord;\n"
+        "void main() {\n"
+        "    // Offset image coords by half of kernel width, in image texels\n"
+        "    gl_Position = vec4(matrix * position, 1.0);\n"
+        "    float scale = (float(KERNEL_WIDTH) - 1.0) / 2.0;\n"
+        "    imageCoord = (texMatrix * position).xy - vec2(scale, scale) * imageIncrement;\n"
+        "}\n";
+    char vertexShaderSource[1024];
+    snprintf(vertexShaderSource, sizeof(vertexShaderSource), vertexShaderRaw, kernelWidth);
+    static const char* fragmentShaderRaw =
+        "#ifdef GL_ES\n"
+        "precision mediump float;\n"
+        "#endif\n"
+        "#define KERNEL_WIDTH %d\n"
+        "uniform sampler2D image;\n"
+        "uniform float kernel[KERNEL_WIDTH];\n"
+        "uniform vec2 imageIncrement;\n"
+        "varying vec2 imageCoord;\n"
+        "void main() {\n"
+        "    vec2 coord = imageCoord;\n"
+        "    vec4 sum = vec4(0, 0, 0, 0);\n"
+        "    for (int i = 0; i < KERNEL_WIDTH; i++) {\n"
+        "      sum += texture2D(image, coord) * kernel[i];\n"
+        "      coord += imageIncrement;\n"
+        "    }\n"
+        "    gl_FragColor = sum;\n"
+        "}\n";
+    char fragmentShaderSource[1024];
+    snprintf(fragmentShaderSource, sizeof(fragmentShaderSource), fragmentShaderRaw, kernelWidth);
+
+    unsigned program = loadProgram(context, vertexShaderSource, fragmentShaderSource);
+    if (!program)
+        return 0;
+    return new ConvolutionShader(context, program, kernelWidth);
+}
+
+void ConvolutionShader::use(const AffineTransform& transform, const AffineTransform& texTransform, const float* kernel, int kernelWidth, float imageIncrement[2])
+{
+    m_context->useProgram(m_program);
+    float matrix[9];
+    affineTo3x3(transform, matrix);
+    m_context->uniformMatrix3fv(m_matrixLocation, false /*transpose*/, matrix, 1 /*count*/);
+
+    float texMatrix[9];
+    affineTo3x3(texTransform, texMatrix);
+    m_context->uniformMatrix3fv(m_texMatrixLocation, false /*transpose*/, texMatrix, 1 /*count*/);
+
+    m_context->uniform2f(m_imageIncrementLocation, imageIncrement[0], imageIncrement[1]);
+
+    // For now, we always use texture unit 0. If that ever changes, we should
+    // expose this parameter to the caller.
+    m_context->uniform1i(m_imageLocation, 0);
+    if (kernelWidth > m_kernelWidth)
+        kernelWidth = m_kernelWidth;
+    m_context->uniform1fv(m_kernelLocation, const_cast<float*>(kernel), kernelWidth);
+
+    m_context->vertexAttribPointer(m_positionLocation, 3, GraphicsContext3D::FLOAT, false, 0, 0);
+
+    m_context->enableVertexAttribArray(m_positionLocation);
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/platform/graphics/gpu/ConvolutionShader.h b/Source/WebCore/platform/graphics/gpu/ConvolutionShader.h
new file mode 100644
index 0000000..533e0f5
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gpu/ConvolutionShader.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ConvolutionShader_h
+#define ConvolutionShader_h
+
+#include "Shader.h"
+
+namespace WebCore {
+
+class ConvolutionShader : public Shader {
+public:
+    static PassOwnPtr<ConvolutionShader> create(GraphicsContext3D*, int kernelWidth);
+
+    void use(const AffineTransform&, const AffineTransform& texTransform, const float* kernel, int kernelWidth, float imageIncrement[2]);
+
+private:
+    ConvolutionShader(GraphicsContext3D*, unsigned program, int kernelWidth);
+
+    int m_kernelWidth;
+    int m_matrixLocation;
+    int m_texMatrixLocation;
+    int m_kernelLocation;
+    int m_imageLocation;
+    int m_imageIncrementLocation;
+    int m_positionLocation;
+};
+
+}
+
+#endif // ConvolutionShader_h
diff --git a/Source/WebCore/platform/graphics/gpu/DrawingBuffer.h b/Source/WebCore/platform/graphics/gpu/DrawingBuffer.h
index 49ae114..606484e 100644
--- a/Source/WebCore/platform/graphics/gpu/DrawingBuffer.h
+++ b/Source/WebCore/platform/graphics/gpu/DrawingBuffer.h
@@ -42,6 +42,10 @@
 #include <wtf/RetainPtr.h>
 #endif
 
+#if ENABLE(SKIA_GPU)
+class GrContext;
+#endif
+
 namespace WebCore {
 
 #if PLATFORM(CHROMIUM)
@@ -59,6 +63,7 @@ public:
     void reset(const IntSize&);
     void bind();
     IntSize size() const { return m_size; }
+    Platform3DObject colorBuffer() const { return m_colorBuffer; }
 
     // Clear all resources from this object, as well as context. Called when context is destroyed
     // to prevent invalid accesses to the resources.
@@ -94,6 +99,10 @@ public:
     void setWillPublishCallback(PassOwnPtr<WillPublishCallback> callback) { m_callback = callback; }
 #endif
 
+#if ENABLE(SKIA_GPU)
+    void setGrContext(GrContext* ctx);
+#endif
+
     PassRefPtr<GraphicsContext3D> graphicsContext3D() const { return m_context; }
 
 private:
@@ -130,6 +139,10 @@ private:
 #if PLATFORM(MAC)
     RetainPtr<WebGLLayer> m_platformLayer;
 #endif
+
+#if ENABLE(SKIA_GPU)
+    GrContext* m_grContext;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.cpp b/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.cpp
index 5439885..a96213c 100644
--- a/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.cpp
+++ b/Source/WebCore/platform/graphics/gpu/LoopBlinnPathProcessor.cpp
@@ -42,6 +42,8 @@
 #include <algorithm>
 #include <wtf/Assertions.h>
 #include <wtf/FastMalloc.h>
+#include <wtf/UnusedParam.h>
+
 
 #if USE(SKIA)
 #include "SkGeometry.h"
@@ -701,6 +703,7 @@ void LoopBlinnPathProcessor::buildContours(const Path& path)
         }
     } while (verb != SkPath::kDone_Verb);
 #else // !USE(SKIA)
+    UNUSED_PARAM(path);
     // Must port to your platform.
     ASSERT_NOT_REACHED();
 #endif
@@ -1145,6 +1148,8 @@ static void combineCallback(GLdouble coords[3], void* vertexData[4],
                             GLfloat weight[4], void** outData,
                             void* polygonData)
 {
+    UNUSED_PARAM(vertexData);
+    UNUSED_PARAM(weight);
     TessellationState* state = static_cast<TessellationState*>(polygonData);
     GLdouble* outVertex = static_cast<GLdouble*>(fastMalloc(3 * sizeof(GLdouble)));
     state->allocatedPointers.append(outVertex);
diff --git a/Source/WebCore/platform/graphics/gpu/PODRedBlackTree.h b/Source/WebCore/platform/graphics/gpu/PODRedBlackTree.h
index bd08988..7dd9ddd 100644
--- a/Source/WebCore/platform/graphics/gpu/PODRedBlackTree.h
+++ b/Source/WebCore/platform/graphics/gpu/PODRedBlackTree.h
@@ -257,7 +257,7 @@ private:
     // properly update such summary information based only on the values
     // in the left and right children. This method should return true if
     // the node's summary information changed.
-    virtual bool updateNode(Node* node) { return false; }
+    virtual bool updateNode(Node*) { return false; }
 
     //----------------------------------------------------------------------
     // Generic binary search tree operations
@@ -713,7 +713,7 @@ private:
     }
 
 #ifdef NDEBUG
-    void logIfVerbose(const char* output) const { }
+    void logIfVerbose(const char*) const { }
 #else
     void logIfVerbose(const char* output) const
     {
diff --git a/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp b/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
index ea8bc71..662d6a8 100644
--- a/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
+++ b/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
@@ -35,7 +35,10 @@
 #include "SharedGraphicsContext3D.h"
 
 #include "AffineTransform.h"
+#include "BicubicShader.h"
 #include "Color.h"
+#include "ConvolutionShader.h"
+#include "DrawingBuffer.h"
 #include "Extensions3D.h"
 #include "FloatRect.h"
 #include "IntSize.h"
@@ -43,6 +46,15 @@
 #include "SolidFillShader.h"
 #include "TexShader.h"
 
+#if ENABLE(SKIA_GPU)
+#include "GrContext.h"
+// Limit the number of textures we hold in the bitmap->texture cache.
+static const int maxTextureCacheCount = 512;
+// Limit the bytes allocated toward textures in the bitmap->texture cache.
+static const size_t maxTextureCacheBytes = 50 * 1024 * 1024;
+#endif
+
+#include <wtf/OwnArrayPtr.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/WTFString.h>
 
@@ -65,16 +77,30 @@ PassRefPtr<SharedGraphicsContext3D> SharedGraphicsContext3D::create(HostWindow*
     OwnPtr<TexShader> texShader = TexShader::create(context.get());
     if (!texShader)
         return 0;
-    return adoptRef(new SharedGraphicsContext3D(context.release(), solidFillShader.release(), texShader.release()));
+    OwnPtr<BicubicShader> bicubicShader = BicubicShader::create(context.get());
+    if (!bicubicShader)
+        return 0;
+    OwnArrayPtr<OwnPtr<ConvolutionShader> > convolutionShaders = adoptArrayPtr(new OwnPtr<ConvolutionShader>[cMaxKernelWidth]);
+    for (int i = 0; i < cMaxKernelWidth; ++i) {
+        convolutionShaders[i] = ConvolutionShader::create(context.get(), i + 1);
+        if (!convolutionShaders[i])
+            return 0;
+    }
+    return adoptRef(new SharedGraphicsContext3D(context.release(), solidFillShader.release(), texShader.release(), bicubicShader.release(), convolutionShaders.release()));
 }
 
-SharedGraphicsContext3D::SharedGraphicsContext3D(PassRefPtr<GraphicsContext3D> context, PassOwnPtr<SolidFillShader> solidFillShader, PassOwnPtr<TexShader> texShader)
+SharedGraphicsContext3D::SharedGraphicsContext3D(PassRefPtr<GraphicsContext3D> context, PassOwnPtr<SolidFillShader> solidFillShader, PassOwnPtr<TexShader> texShader, PassOwnPtr<BicubicShader> bicubicShader, PassOwnArrayPtr<OwnPtr<ConvolutionShader> > convolutionShaders)
     : m_context(context)
     , m_bgraSupported(false)
     , m_quadVertices(0)
     , m_solidFillShader(solidFillShader)
     , m_texShader(texShader)
+    , m_bicubicShader(bicubicShader)
+    , m_convolutionShaders(convolutionShaders)
     , m_oesStandardDerivativesSupported(false)
+#if ENABLE(SKIA_GPU)
+    , m_grContext(0)
+#endif
 {
     allContexts()->add(this);
     Extensions3D* extensions = m_context->getExtensions();
@@ -92,6 +118,9 @@ SharedGraphicsContext3D::~SharedGraphicsContext3D()
 {
     m_context->deleteBuffer(m_quadVertices);
     allContexts()->remove(this);
+#if ENABLE(SKIA_GPU)
+    GrSafeUnref(m_grContext);
+#endif
 }
 
 void SharedGraphicsContext3D::makeContextCurrent()
@@ -369,6 +398,17 @@ void SharedGraphicsContext3D::useTextureProgram(const AffineTransform& transform
     m_texShader->use(transform, texTransform, 0, alpha);
 }
 
+void SharedGraphicsContext3D::useBicubicProgram(const AffineTransform& transform, const AffineTransform& texTransform, const float coefficients[16], const float imageIncrement[2], float alpha)
+{
+    m_bicubicShader->use(transform, texTransform, coefficients, imageIncrement, alpha);
+}
+
+void SharedGraphicsContext3D::useConvolutionProgram(const AffineTransform& transform, const AffineTransform& texTransform, const float* kernel, int kernelWidth, float imageIncrement[2])
+{
+    ASSERT(kernelWidth >= 1 && kernelWidth <= cMaxKernelWidth);
+    m_convolutionShaders[kernelWidth - 1]->use(transform, texTransform, kernel, kernelWidth, imageIncrement);
+}
+
 void SharedGraphicsContext3D::bindFramebuffer(Platform3DObject framebuffer)
 {
     m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, framebuffer);
@@ -411,6 +451,31 @@ void SharedGraphicsContext3D::useLoopBlinnExteriorProgram(unsigned vertexOffset,
     m_loopBlinnExteriorShader->use(vertexOffset, klmOffset, transform, color);
 }
 
+DrawingBuffer* SharedGraphicsContext3D::getOffscreenBuffer(unsigned index, const IntSize& size)
+{
+    if (index >= m_offscreenBuffers.size())
+        m_offscreenBuffers.resize(index + 1);
+
+    if (!m_offscreenBuffers[index])
+        m_offscreenBuffers[index] = m_context->createDrawingBuffer(size);
+
+    if (size.width() != m_offscreenBuffers[index]->size().width()
+        || size.height() != m_offscreenBuffers[index]->size().height())
+        m_offscreenBuffers[index]->reset(size);
+    return m_offscreenBuffers[index].get();
+}
+
+#if ENABLE(SKIA_GPU)
+GrContext* SharedGraphicsContext3D::grContext()
+{
+    if (!m_grContext) {
+        m_grContext = GrContext::CreateGLShaderContext();
+        m_grContext->setTextureCacheLimits(maxTextureCacheCount, maxTextureCacheBytes);
+    }
+    return m_grContext;
+}
+#endif
+
 } // namespace WebCore
 
 #endif
diff --git a/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.h b/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.h
index 707fd24..8fb3d50 100644
--- a/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.h
+++ b/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.h
@@ -38,14 +38,22 @@
 
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/OwnArrayPtr.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
+#if ENABLE(SKIA_GPU)
+class GrContext;
+#endif
+
 namespace WebCore {
 
 class AffineTransform;
+class BicubicShader;
 class Color;
+class ConvolutionShader;
+class DrawingBuffer;
 class FloatRect;
 class HostWindow;
 class IntSize;
@@ -101,6 +109,8 @@ public:
 
     void useFillSolidProgram(const AffineTransform&, const Color&);
     void useTextureProgram(const AffineTransform&, const AffineTransform&, float alpha);
+    void useBicubicProgram(const AffineTransform&, const AffineTransform&, const float coefficients[16], const float imageIncrement[2], float alpha);
+    void useConvolutionProgram(const AffineTransform&, const AffineTransform& texTransform, const float* kernel, int kernelWidth, float imageIncrement[2]);
 
     void setActiveTexture(GC3Denum textureUnit);
     void bindTexture(GC3Denum target, Platform3DObject texture);
@@ -127,9 +137,14 @@ public:
     static bool useLoopBlinnForPathRendering();
     void useLoopBlinnInteriorProgram(unsigned vertexOffset, const AffineTransform&, const Color&);
     void useLoopBlinnExteriorProgram(unsigned vertexOffset, unsigned klmOffset, const AffineTransform&, const Color&);
+    DrawingBuffer* getOffscreenBuffer(unsigned index, const IntSize&);
+
+#if ENABLE(SKIA_GPU)
+    GrContext* grContext();
+#endif
 
 private:
-    SharedGraphicsContext3D(PassRefPtr<GraphicsContext3D>, PassOwnPtr<SolidFillShader>, PassOwnPtr<TexShader>);
+    SharedGraphicsContext3D(PassRefPtr<GraphicsContext3D>, PassOwnPtr<SolidFillShader>, PassOwnPtr<TexShader>, PassOwnPtr<BicubicShader>, PassOwnArrayPtr<OwnPtr<ConvolutionShader> >);
 
     // Used to implement removeTexturesFor(), see the comment above.
     static HashSet<SharedGraphicsContext3D*>* allContexts();
@@ -142,6 +157,8 @@ private:
 
     OwnPtr<SolidFillShader> m_solidFillShader;
     OwnPtr<TexShader> m_texShader;
+    OwnPtr<BicubicShader> m_bicubicShader;
+    OwnArrayPtr<OwnPtr<ConvolutionShader> > m_convolutionShaders;
 
     TextureHashMap m_textures;
 
@@ -150,8 +167,17 @@ private:
     OwnPtr<LoopBlinnSolidFillShader> m_loopBlinnInteriorShader;
     OwnPtr<LoopBlinnSolidFillShader> m_loopBlinnExteriorShader;
     bool m_oesStandardDerivativesSupported;
+
+    WTF::Vector<RefPtr<DrawingBuffer> > m_offscreenBuffers;
+
+#if ENABLE(SKIA_GPU)
+    GrContext* m_grContext;
+#endif
 };
 
+const float cMaxSigma = 4.0f;
+const int cMaxKernelWidth = 25;
+
 } // namespace WebCore
 
 #endif // SharedGraphicsContext3D_h
diff --git a/Source/WebCore/platform/graphics/gpu/TilingData.cpp b/Source/WebCore/platform/graphics/gpu/TilingData.cpp
index dd540b3..1370543 100644
--- a/Source/WebCore/platform/graphics/gpu/TilingData.cpp
+++ b/Source/WebCore/platform/graphics/gpu/TilingData.cpp
@@ -66,7 +66,7 @@ void TilingData::setTotalSize(int totalSizeX, int totalSizeY)
 
 void TilingData::setMaxTextureSize(int maxTextureSize)
 {
-    m_maxTextureSize = m_maxTextureSize;
+    m_maxTextureSize = maxTextureSize;
     recomputeNumTiles();
 }
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
index 3763ef7..2fb4cef 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
@@ -117,6 +117,13 @@ gboolean mediaPlayerPrivateMessageCallback(GstBus* bus, GstMessage* message, gpo
             || err->code == GST_RESOURCE_ERROR_NOT_FOUND)
             error = MediaPlayer::FormatError;
         else if (err->domain == GST_STREAM_ERROR) {
+            // Let the mediaPlayerClient handle the stream error, in
+            // this case the HTMLMediaElement will emit a stalled
+            // event.
+            if (err->code == GST_STREAM_ERROR_TYPE_NOT_FOUND) {
+                LOG_VERBOSE(Media, "Decode error, let the Media element emit a stalled event.");
+                break;
+            }
             error = MediaPlayer::DecodeError;
             attemptNextLocation = true;
         } else if (err->domain == GST_RESOURCE_ERROR)
@@ -495,7 +502,7 @@ float MediaPlayerPrivateGStreamer::currentTime() const
         return 0.0f;
 
     if (m_seeking)
-        return static_cast<float>(m_seekTime);
+        return m_seekTime;
 
     return playbackPosition(m_playBin);
 
@@ -513,17 +520,28 @@ void MediaPlayerPrivateGStreamer::seek(float time)
     if (m_errorOccured)
         return;
 
-    GstClockTime sec = (GstClockTime)(static_cast<float>(time * GST_SECOND));
-    LOG_VERBOSE(Media, "Seek: %" GST_TIME_FORMAT, GST_TIME_ARGS(sec));
+    // Extract the integer part of the time (seconds) and the
+    // fractional part (microseconds). Attempt to round the
+    // microseconds so no floating point precision is lost and we can
+    // perform an accurate seek.
+    float seconds;
+    float microSeconds = modf(time, &seconds) * 1000000;
+    GTimeVal timeValue;
+    timeValue.tv_sec = static_cast<glong>(seconds);
+    timeValue.tv_usec = static_cast<glong>(roundf(microSeconds / 10000) * 10000);
+
+    GstClockTime clockTime = GST_TIMEVAL_TO_TIME(timeValue);
+    LOG_VERBOSE(Media, "Seek: %" GST_TIME_FORMAT, GST_TIME_ARGS(clockTime));
+
     if (!gst_element_seek(m_playBin, m_player->rate(),
             GST_FORMAT_TIME,
-            (GstSeekFlags)(GST_SEEK_FLAG_FLUSH),
-            GST_SEEK_TYPE_SET, sec,
+            (GstSeekFlags)(GST_SEEK_FLAG_FLUSH | GST_SEEK_FLAG_ACCURATE),
+            GST_SEEK_TYPE_SET, clockTime,
             GST_SEEK_TYPE_NONE, GST_CLOCK_TIME_NONE))
         LOG_VERBOSE(Media, "Seek to %f failed", time);
     else {
         m_seeking = true;
-        m_seekTime = sec;
+        m_seekTime = time;
     }
 }
 
@@ -1046,15 +1064,9 @@ void MediaPlayerPrivateGStreamer::updateStates()
         if (!m_isStreaming && !m_buffering)
             return;
 
-        // Resume playback if a seek was performed in a live pipeline
-        // or during progressive download. That second use-case
-        // happens when the seek is performed to a region of the media
-        // that hasn't been downloaded yet.
         if (m_seeking) {
             shouldUpdateAfterSeek = true;
             m_seeking = false;
-            if (m_paused)
-                gst_element_set_state(m_playBin, GST_STATE_PLAYING);
         }
         break;
     case GST_STATE_CHANGE_FAILURE:
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
index 11eb81b..8003887 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
@@ -161,7 +161,7 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             GstElement* m_videoSinkBin;
             GstElement* m_fpsSink;
             GstElement* m_source;
-            GstClockTime m_seekTime;
+            float m_seekTime;
             bool m_changingRate;
             float m_endTime;
             bool m_isEndReached;
diff --git a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
index 86e3e7a..66ea9ba 100644
--- a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
@@ -352,7 +352,7 @@ static void webKitWebSrcStop(WebKitWebSrc* src, bool seeking)
     }
     priv->resourceHandle = 0;
 
-    if (priv->frame)
+    if (priv->frame && !seeking)
         priv->frame.release();
 
     GST_OBJECT_LOCK(src);
diff --git a/Source/WebCore/platform/graphics/gtk/FontGtk.cpp b/Source/WebCore/platform/graphics/gtk/FontGtk.cpp
index 216fb56..d14b052 100644
--- a/Source/WebCore/platform/graphics/gtk/FontGtk.cpp
+++ b/Source/WebCore/platform/graphics/gtk/FontGtk.cpp
@@ -35,6 +35,7 @@
 
 #include "CairoUtilities.h"
 #include "ContextShadow.h"
+#include "PlatformContextCairo.h"
 #include "GraphicsContext.h"
 #include "NotImplemented.h"
 #include "SimpleFontData.h"
@@ -44,7 +45,7 @@
 #include <pango/pango.h>
 #include <pango/pangocairo.h>
 
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
 #include <pango/pangofc-fontmap.h>
 #endif
 
@@ -171,13 +172,13 @@ static gchar* convertUniCharToUTF8(const UChar* characters, gint length, int fro
 
 static void setPangoAttributes(const Font* font, const TextRun& run, PangoLayout* layout)
 {
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
     if (font->primaryFont()->platformData().m_pattern) {
         PangoFontDescription* desc = pango_fc_font_description_from_pattern(font->primaryFont()->platformData().m_pattern.get(), FALSE);
         pango_layout_set_font_description(layout, desc);
         pango_font_description_free(desc);
     }
-#elif defined(USE_PANGO)
+#elif USE(PANGO)
     if (font->primaryFont()->platformData().m_font) {
         PangoFontDescription* desc = pango_font_describe(font->primaryFont()->platformData().m_font);
         pango_layout_set_font_description(layout, desc);
@@ -220,7 +221,7 @@ bool Font::canExpandAroundIdeographsInComplexText()
     return false;
 }
 
-static void drawGlyphsShadow(GraphicsContext* graphicsContext, cairo_t* context, const FloatPoint& point, PangoLayoutLine* layoutLine, PangoRegionType renderRegion)
+static void drawGlyphsShadow(GraphicsContext* graphicsContext, const FloatPoint& point, PangoLayoutLine* layoutLine, PangoRegionType renderRegion)
 {
     ContextShadow* shadow = graphicsContext->contextShadow();
     ASSERT(shadow);
@@ -232,6 +233,7 @@ static void drawGlyphsShadow(GraphicsContext* graphicsContext, cairo_t* context,
 
     // Optimize non-blurry shadows, by just drawing text without the ContextShadow.
     if (!shadow->mustUseContextShadow(graphicsContext)) {
+        cairo_t* context = graphicsContext->platformContext()->cr();
         cairo_save(context);
         cairo_translate(context, totalOffset.x(), totalOffset.y());
 
@@ -255,6 +257,7 @@ static void drawGlyphsShadow(GraphicsContext* graphicsContext, cairo_t* context,
         // because we don't want any bits and pieces of characters out of range to be
         // drawn. Since ContextShadow expects a consistent transform, we have to undo the
         // translation before calling endShadowLayer as well.
+        cairo_t* context = graphicsContext->platformContext()->cr();
         cairo_save(context);
         cairo_translate(context, totalOffset.x(), totalOffset.y());
         gdk_cairo_region(context, renderRegion);
@@ -268,14 +271,14 @@ static void drawGlyphsShadow(GraphicsContext* graphicsContext, cairo_t* context,
 
 void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const FloatPoint& point, int from, int to) const
 {
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
     if (!primaryFont()->platformData().m_pattern) {
         drawSimpleText(context, run, point, from, to);
         return;
     }
 #endif
 
-    cairo_t* cr = context->platformContext();
+    cairo_t* cr = context->platformContext()->cr();
     PangoLayout* layout = pango_cairo_create_layout(cr);
     setPangoAttributes(this, run, layout);
 
@@ -294,7 +297,7 @@ void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const F
     int ranges[] = {start - utf8, end - utf8};
     partialRegion = gdk_pango_layout_line_get_clip_region(layoutLine, 0, 0, ranges, 1);
 
-    drawGlyphsShadow(context, cr, point, layoutLine, partialRegion);
+    drawGlyphsShadow(context, point, layoutLine, partialRegion);
 
     cairo_save(cr);
     cairo_translate(cr, point.x(), point.y());
@@ -348,7 +351,7 @@ static PangoLayout* getDefaultPangoLayout(const TextRun& run)
 
 float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts, GlyphOverflow* overflow) const
 {
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
     if (!primaryFont()->platformData().m_pattern)
         return floatWidthForSimpleText(run, 0, fallbackFonts, overflow);
 #endif
@@ -373,7 +376,7 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
 
 int Font::offsetForPositionForComplexText(const TextRun& run, float xFloat, bool includePartialGlyphs) const
 {
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
     if (!primaryFont()->platformData().m_pattern)
         return offsetForPositionForSimpleText(run, xFloat, includePartialGlyphs);
 #endif
@@ -401,7 +404,7 @@ int Font::offsetForPositionForComplexText(const TextRun& run, float xFloat, bool
 
 FloatRect Font::selectionRectForComplexText(const TextRun& run, const FloatPoint& point, int h, int from, int to) const
 {
-#if defined(USE_FREETYPE)
+#if USE(FREETYPE)
     if (!primaryFont()->platformData().m_pattern)
         return selectionRectForSimpleText(run, point, h, from, to);
 #endif
diff --git a/Source/WebCore/platform/graphics/gtk/IconGtk.cpp b/Source/WebCore/platform/graphics/gtk/IconGtk.cpp
index d56b52d..7fdc1f6 100644
--- a/Source/WebCore/platform/graphics/gtk/IconGtk.cpp
+++ b/Source/WebCore/platform/graphics/gtk/IconGtk.cpp
@@ -33,9 +33,9 @@
 #include "GraphicsContext.h"
 #include "MIMETypeRegistry.h"
 #include "PassRefPtr.h"
-#include <wtf/text/CString.h>
-
+#include "PlatformContextCairo.h"
 #include <gtk/gtk.h>
+#include <wtf/text/CString.h>
 
 namespace WebCore {
 
@@ -117,7 +117,7 @@ void Icon::paint(GraphicsContext* context, const IntRect& rect)
         return;
 
     // TODO: Scale/clip the image if necessary.
-    cairo_t* cr = context->platformContext();
+    cairo_t* cr = context->platformContext()->cr();
     cairo_save(cr);
     gdk_cairo_set_source_pixbuf(cr, m_icon, rect.x(), rect.y());
     cairo_paint(cr);
diff --git a/Source/WebCore/platform/graphics/gtk/ImageBufferGtk.cpp b/Source/WebCore/platform/graphics/gtk/ImageBufferGtk.cpp
index 2aa016e..3da0f9b 100644
--- a/Source/WebCore/platform/graphics/gtk/ImageBufferGtk.cpp
+++ b/Source/WebCore/platform/graphics/gtk/ImageBufferGtk.cpp
@@ -54,7 +54,7 @@ String ImageBuffer::toDataURL(const String& mimeType, const double* quality) con
     GError* error = 0;
     gboolean success = FALSE;
     if (type == "jpeg" && quality && *quality >= 0.0 && *quality <= 1.0) {
-        String qualityString = String::format("%f", *quality);
+        String qualityString = String::format("%f", *quality * 100.0);
         success = gdk_pixbuf_save_to_buffer(pixbuf.get(), &buffer.outPtr(), &bufferSize,
             type.utf8().data(), &error, "quality", qualityString.utf8().data(), NULL);
     } else {
diff --git a/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp b/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp
index 623ace6..9dd82a9 100644
--- a/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp
+++ b/Source/WebCore/platform/graphics/gtk/ImageGtk.cpp
@@ -152,7 +152,10 @@ PassRefPtr<Image> Image::loadPlatformThemeIcon(const char* name, int size)
 
 GdkPixbuf* BitmapImage::getGdkPixbuf()
 {
-    return cairoImageSurfaceToGdkPixbuf(frameAtIndex(currentFrame()));
+    cairo_surface_t* frame = frameAtIndex(currentFrame());
+    if (!frame)
+        return 0;
+    return cairoImageSurfaceToGdkPixbuf(frame);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp
index 017b1e4..352de67 100644
--- a/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp
@@ -31,7 +31,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
 {
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, TextOrientation, FontWidthVariant, FontRenderingMode)
 {
     return FontPlatformData(size, bold, italic);
 }
diff --git a/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.h
index 7ffe89a..a319ce5 100644
--- a/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/haiku/FontCustomPlatformData.h
@@ -24,6 +24,7 @@
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
 #include "FontWidthVariant.h"
+#include "TextOrientation.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
@@ -39,7 +40,7 @@ namespace WebCore {
 
         static bool supportsFormat(const String&);
 
-        FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
+        FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
     };
 
     FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer*);
diff --git a/Source/WebCore/platform/graphics/mac/ComplexTextController.cpp b/Source/WebCore/platform/graphics/mac/ComplexTextController.cpp
index 1a56664..07bc3ec 100644
--- a/Source/WebCore/platform/graphics/mac/ComplexTextController.cpp
+++ b/Source/WebCore/platform/graphics/mac/ComplexTextController.cpp
@@ -63,7 +63,8 @@ ComplexTextController::ComplexTextController(const Font* font, const TextRun& ru
     , m_glyphInCurrentRun(0)
     , m_characterInCurrentGlyph(0)
     , m_expansion(run.expansion())
-    , m_afterExpansion(true)
+    , m_leadingExpansion(0)
+    , m_afterExpansion(!run.allowsLeadingExpansion())
     , m_fallbackFonts(fallbackFonts)
     , m_minGlyphBoundingBoxX(numeric_limits<float>::max())
     , m_maxGlyphBoundingBoxX(numeric_limits<float>::min())
@@ -73,7 +74,7 @@ ComplexTextController::ComplexTextController(const Font* font, const TextRun& ru
     if (!m_expansion)
         m_expansionPerOpportunity = 0;
     else {
-        bool isAfterExpansion = true;
+        bool isAfterExpansion = m_afterExpansion;
         unsigned expansionOpportunityCount = Font::expansionOpportunityCount(m_run.characters(), m_end, m_run.ltr() ? LTR : RTL, isAfterExpansion);
         if (isAfterExpansion && !m_run.allowsTrailingExpansion())
             expansionOpportunityCount--;
@@ -86,12 +87,16 @@ ComplexTextController::ComplexTextController(const Font* font, const TextRun& ru
 
     collectComplexTextRuns();
     adjustGlyphsAndAdvances();
+
+    m_runWidthSoFar = m_leadingExpansion;
 }
 
 int ComplexTextController::offsetForPosition(float h, bool includePartialGlyphs)
 {
     if (h >= m_totalWidth)
         return m_run.ltr() ? m_end : 0;
+
+    h -= m_leadingExpansion;
     if (h < 0)
         return m_run.ltr() ? 0 : m_end;
 
@@ -472,16 +477,21 @@ void ComplexTextController::adjustGlyphsAndAdvances()
                 // Handle justification and word-spacing.
                 if (treatAsSpace || Font::isCJKIdeographOrSymbol(ch)) {
                     // Distribute the run's total expansion evenly over all expansion opportunities in the run.
-                    if (m_expansion && (!lastGlyph || m_run.allowsTrailingExpansion())) {
+                    if (m_expansion) {
                         if (!treatAsSpace && !m_afterExpansion) {
                             // Take the expansion opportunity before this ideograph.
                             m_expansion -= m_expansionPerOpportunity;
                             m_totalWidth += m_expansionPerOpportunity;
-                            m_adjustedAdvances.last().width += m_expansionPerOpportunity;
+                            if (m_adjustedAdvances.isEmpty())
+                                m_leadingExpansion = m_expansionPerOpportunity;
+                            else
+                                m_adjustedAdvances.last().width += m_expansionPerOpportunity;
+                        }
+                        if (!lastGlyph || m_run.allowsTrailingExpansion()) {
+                            m_expansion -= m_expansionPerOpportunity;
+                            advance.width += m_expansionPerOpportunity;
+                            m_afterExpansion = true;
                         }
-                        m_expansion -= m_expansionPerOpportunity;
-                        advance.width += m_expansionPerOpportunity;
-                        m_afterExpansion = true;
                     } else
                         m_afterExpansion = false;
 
diff --git a/Source/WebCore/platform/graphics/mac/ComplexTextController.h b/Source/WebCore/platform/graphics/mac/ComplexTextController.h
index 7373bfe..44a7994 100644
--- a/Source/WebCore/platform/graphics/mac/ComplexTextController.h
+++ b/Source/WebCore/platform/graphics/mac/ComplexTextController.h
@@ -175,6 +175,7 @@ private:
     unsigned m_characterInCurrentGlyph;
     float m_expansion;
     float m_expansionPerOpportunity;
+    float m_leadingExpansion;
     bool m_afterExpansion;
 
     HashSet<const SimpleFontData*>* m_fallbackFonts;
diff --git a/Source/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp b/Source/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp
index b367fdf..d965ada 100644
--- a/Source/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp
+++ b/Source/WebCore/platform/graphics/mac/ComplexTextControllerATSUI.cpp
@@ -264,7 +264,7 @@ static void disableLigatures(const SimpleFontData* fontData, ATSUStyle atsuStyle
     // Don't be too aggressive: if the font doesn't contain 'a', then assume that any ligatures it contains are
     // in characters that always go through ATSUI, and therefore allow them. Geeza Pro is an example.
     // See bugzilla 5166.
-    if ((typesettingFeatures & Ligatures) || (fontData->orientation() == Horizontal && fontData->platformData().allowsLigatures()))
+    if ((typesettingFeatures & Ligatures) || (fontData->platformData().orientation() == Horizontal && fontData->platformData().allowsLigatures()))
         return;
 
     ATSUFontFeatureType featureTypes[] = { kLigaturesType };
diff --git a/Source/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp b/Source/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp
index 239113f..d2fbaf5 100644
--- a/Source/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp
+++ b/Source/WebCore/platform/graphics/mac/ComplexTextControllerCoreText.cpp
@@ -144,17 +144,17 @@ void ComplexTextController::collectComplexTextRunsForCharactersCoreText(const UC
         static CFDictionaryRef rtlTypesetterOptions = CFDictionaryCreate(kCFAllocatorDefault, optionKeys, rtlOptionValues, WTF_ARRAY_LENGTH(optionKeys), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-        ProviderInfo info = { cp, length, fontData->getCFStringAttributes(m_font.typesettingFeatures()) };
+        ProviderInfo info = { cp, length, fontData->getCFStringAttributes(m_font.typesettingFeatures(), fontData->platformData().orientation()) };
         RetainPtr<CTTypesetterRef> typesetter(AdoptCF, wkCreateCTTypesetterWithUniCharProviderAndOptions(&provideStringAndAttributes, 0, &info, m_run.ltr() ? ltrTypesetterOptions : rtlTypesetterOptions));
 #else
         RetainPtr<CFStringRef> string(AdoptCF, CFStringCreateWithCharactersNoCopy(kCFAllocatorDefault, cp, length, kCFAllocatorNull));
-        RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(kCFAllocatorDefault, string.get(), fontData->getCFStringAttributes(m_font.typesettingFeatures())));
+        RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(kCFAllocatorDefault, string.get(), fontData->getCFStringAttributes(m_font.typesettingFeatures(), fontData->platformData().orientation())));
         RetainPtr<CTTypesetterRef> typesetter(AdoptCF, CTTypesetterCreateWithAttributedStringAndOptions(attributedString.get(), m_run.ltr() ? ltrTypesetterOptions : rtlTypesetterOptions));
 #endif
 
         line.adoptCF(CTTypesetterCreateLine(typesetter.get(), CFRangeMake(0, 0)));
     } else {
-        ProviderInfo info = { cp, length, fontData->getCFStringAttributes(m_font.typesettingFeatures()) };
+        ProviderInfo info = { cp, length, fontData->getCFStringAttributes(m_font.typesettingFeatures(), fontData->platformData().orientation()) };
 
         line.adoptCF(wkCreateCTLineWithUniCharProvider(&provideStringAndAttributes, 0, &info));
     }
diff --git a/Source/WebCore/platform/graphics/mac/FontCacheMac.mm b/Source/WebCore/platform/graphics/mac/FontCacheMac.mm
index c254906..f7ae6b7 100644
--- a/Source/WebCore/platform/graphics/mac/FontCacheMac.mm
+++ b/Source/WebCore/platform/graphics/mac/FontCacheMac.mm
@@ -211,7 +211,7 @@ FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontD
     bool syntheticBold = isAppKitFontWeightBold(weight) && !isAppKitFontWeightBold(actualWeight);
     bool syntheticOblique = (traits & NSFontItalicTrait) && !(actualTraits & NSFontItalicTrait);
 
-    return new FontPlatformData(platformFont, size, syntheticBold, syntheticOblique, fontDescription.orientation(), fontDescription.widthVariant());
+    return new FontPlatformData(platformFont, size, syntheticBold, syntheticOblique, fontDescription.orientation(), fontDescription.textOrientation(), fontDescription.widthVariant());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/mac/FontComplexTextMac.cpp b/Source/WebCore/platform/graphics/mac/FontComplexTextMac.cpp
index eed49a5..fe2a22c 100644
--- a/Source/WebCore/platform/graphics/mac/FontComplexTextMac.cpp
+++ b/Source/WebCore/platform/graphics/mac/FontComplexTextMac.cpp
@@ -111,8 +111,8 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
 {
     ComplexTextController controller(this, run, true, fallbackFonts);
     if (glyphOverflow) {
-        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-controller.minGlyphBoundingBoxY()) - fontMetrics().ascent());
-        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(controller.maxGlyphBoundingBoxY()) - fontMetrics().descent());
+        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-controller.minGlyphBoundingBoxY()) - (glyphOverflow->computeBounds ? 0 : fontMetrics().ascent()));
+        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(controller.maxGlyphBoundingBoxY()) - (glyphOverflow->computeBounds ? 0 : fontMetrics().descent()));
         glyphOverflow->left = max<int>(0, ceilf(-controller.minGlyphBoundingBoxX()));
         glyphOverflow->right = max<int>(0, ceilf(controller.maxGlyphBoundingBoxX() - controller.totalWidth()));
     }
diff --git a/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
index f2bc33d..383adef 100644
--- a/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
@@ -38,9 +38,9 @@ FontCustomPlatformData::~FontCustomPlatformData()
     CGFontRelease(m_cgFont);
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation orientation, FontWidthVariant widthVariant, FontRenderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation orientation, TextOrientation textOrientation, FontWidthVariant widthVariant, FontRenderingMode)
 {
-    return FontPlatformData(m_cgFont, size, bold, italic, orientation, widthVariant);
+    return FontPlatformData(m_cgFont, size, bold, italic, orientation, textOrientation, widthVariant);
 }
 
 FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
diff --git a/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.h
index c7ae1ca..c625304 100644
--- a/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/mac/FontCustomPlatformData.h
@@ -24,6 +24,7 @@
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
 #include "FontWidthVariant.h"
+#include "TextOrientation.h"
 #include <CoreFoundation/CFBase.h>
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
@@ -48,7 +49,7 @@ public:
 
     ~FontCustomPlatformData();
 
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
     static bool supportsFormat(const String&);
 
diff --git a/Source/WebCore/platform/graphics/mac/FontMac.mm b/Source/WebCore/platform/graphics/mac/FontMac.mm
index acd7562..4c28ead 100644
--- a/Source/WebCore/platform/graphics/mac/FontMac.mm
+++ b/Source/WebCore/platform/graphics/mac/FontMac.mm
@@ -52,28 +52,72 @@ bool Font::canExpandAroundIdeographsInComplexText()
     return true;
 }
 
-static void showGlyphsWithAdvances(const SimpleFontData* font, CGContextRef context, const CGGlyph* glyphs, const CGSize* advances, size_t count)
+// CTFontGetVerticalTranslationsForGlyphs is different on Snow Leopard.  It returns values for a font-size of 1
+// without unitsPerEm applied.  We have to apply a transform that scales up to the point size and that also 
+// divides by unitsPerEm.
+static bool hasBrokenCTFontGetVerticalTranslationsForGlyphs()
 {
+// Chromium runs the same binary on both Leopard and Snow Leopard, so the check has to happen at runtime.
+#if PLATFORM(CHROMIUM)
+    static bool isCached = false;
+    static bool result;
+    
+    if (!isCached) {
+        SInt32 majorVersion = 0;
+        SInt32 minorVersion = 0;
+        Gestalt(gestaltSystemVersionMajor, &majorVersion);
+        Gestalt(gestaltSystemVersionMinor, &minorVersion);
+        result = majorVersion == 10 && minorVersion == 6;
+        isCached = true;
+    }
+    return result;
+#elif defined(BUILDING_ON_SNOW_LEOPARD)
+    return true;
+#else
+    return false;
+#endif
+}
+
+static void showGlyphsWithAdvances(const FloatPoint& point, const SimpleFontData* font, CGContextRef context, const CGGlyph* glyphs, const CGSize* advances, size_t count)
+{
+    CGContextSetTextPosition(context, point.x(), point.y());
+
     const FontPlatformData& platformData = font->platformData();
     if (!platformData.isColorBitmapFont()) {
         CGAffineTransform savedMatrix;
-        bool isVertical = font->orientation() == Vertical;
-
+        bool isVertical = font->platformData().orientation() == Vertical;
         if (isVertical) {
             CGAffineTransform rotateLeftTransform = CGAffineTransformMake(0, -1, 1, 0, 0, 0);
-
             savedMatrix = CGContextGetTextMatrix(context);
             CGAffineTransform runMatrix = CGAffineTransformConcat(savedMatrix, rotateLeftTransform);
-            // Move start point to put glyphs into original region.
-            runMatrix.tx = savedMatrix.tx + font->fontMetrics().ascent();
-            runMatrix.ty = savedMatrix.ty + font->fontMetrics().descent();
             CGContextSetTextMatrix(context, runMatrix);
-        }
-
-        CGContextShowGlyphsWithAdvances(context, glyphs, advances, count);
-
-        if (isVertical)
+            
+            CGAffineTransform translationsTransform;
+            if (hasBrokenCTFontGetVerticalTranslationsForGlyphs()) {
+                translationsTransform = CGAffineTransformMake(platformData.m_size, 0, 0, platformData.m_size, 0, 0);
+                translationsTransform = CGAffineTransformConcat(translationsTransform, rotateLeftTransform);
+                CGFloat unitsPerEm = CGFontGetUnitsPerEm(platformData.cgFont());
+                translationsTransform = CGAffineTransformConcat(translationsTransform, CGAffineTransformMakeScale(1 / unitsPerEm, 1 / unitsPerEm));
+            } else {
+                translationsTransform = rotateLeftTransform;
+            }
+            Vector<CGSize, 256> translations(count);
+            CTFontGetVerticalTranslationsForGlyphs(platformData.ctFont(), glyphs, translations.data(), count);
+            
+            CGAffineTransform transform = CGAffineTransformInvert(CGContextGetTextMatrix(context));
+
+            CGPoint position = FloatPoint(point.x(), point.y() + font->fontMetrics().floatAscent(IdeographicBaseline) - font->fontMetrics().floatAscent());
+            Vector<CGPoint, 256> positions(count);
+            for (size_t i = 0; i < count; ++i) {
+                CGSize translation = CGSizeApplyAffineTransform(translations[i], translationsTransform);
+                positions[i] = CGPointApplyAffineTransform(CGPointMake(position.x - translation.width, position.y + translation.height), transform);
+                position.x += advances[i].width;
+                position.y += advances[i].height;
+            }
+            CGContextShowGlyphsAtPositions(context, glyphs, positions.data(), count);
             CGContextSetTextMatrix(context, savedMatrix);
+        } else
+            CGContextShowGlyphsWithAdvances(context, glyphs, advances, count);
     }
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
     else {
@@ -188,21 +232,15 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
         float shadowTextX = point.x() + shadowOffset.width();
         // If shadows are ignoring transforms, then we haven't applied the Y coordinate flip yet, so down is negative.
         float shadowTextY = point.y() + shadowOffset.height() * (context->shadowsIgnoreTransforms() ? -1 : 1);
-        CGContextSetTextPosition(cgContext, shadowTextX, shadowTextY);
-        showGlyphsWithAdvances(font, cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
-        if (font->syntheticBoldOffset()) {
-            CGContextSetTextPosition(cgContext, shadowTextX + font->syntheticBoldOffset(), shadowTextY);
-            showGlyphsWithAdvances(font, cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
-        }
+        showGlyphsWithAdvances(FloatPoint(shadowTextX, shadowTextY), font, cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
+        if (font->syntheticBoldOffset())
+            showGlyphsWithAdvances(FloatPoint(shadowTextX + font->syntheticBoldOffset(), shadowTextY), font, cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
         context->setFillColor(fillColor, fillColorSpace);
     }
 
-    CGContextSetTextPosition(cgContext, point.x(), point.y());
-    showGlyphsWithAdvances(font, cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
-    if (font->syntheticBoldOffset()) {
-        CGContextSetTextPosition(cgContext, point.x() + font->syntheticBoldOffset(), point.y());
-        showGlyphsWithAdvances(font, cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
-    }
+    showGlyphsWithAdvances(point, font, cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
+    if (font->syntheticBoldOffset())
+        showGlyphsWithAdvances(FloatPoint(point.x() + font->syntheticBoldOffset(), point.y()), font, cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
 
     if (hasSimpleShadow)
         context->setShadow(shadowOffset, shadowBlur, shadowColor, shadowColorSpace);
diff --git a/Source/WebCore/platform/graphics/mac/GlyphPageTreeNodeMac.cpp b/Source/WebCore/platform/graphics/mac/GlyphPageTreeNodeMac.cpp
index fe2b33a..18d0dc5 100644
--- a/Source/WebCore/platform/graphics/mac/GlyphPageTreeNodeMac.cpp
+++ b/Source/WebCore/platform/graphics/mac/GlyphPageTreeNodeMac.cpp
@@ -39,7 +39,7 @@ namespace WebCore {
 #ifndef BUILDING_ON_TIGER
 static bool shouldUseCoreText(UChar* buffer, unsigned bufferLength, const SimpleFontData* fontData)
 {
-    if (fontData->platformData().widthVariant() != RegularWidth || (fontData->orientation() == Vertical && !fontData->isBrokenIdeographFont())) {
+    if (fontData->platformData().widthVariant() != RegularWidth || fontData->hasVerticalGlyphs()) {
         // Ideographs don't have a vertical variant or width variants.
         for (unsigned i = 0; i < bufferLength; ++i) {
             if (!Font::isCJKIdeograph(buffer[i]))
@@ -70,7 +70,7 @@ bool GlyphPage::fill(unsigned offset, unsigned length, UChar* buffer, unsigned b
     } else {
         // We ask CoreText for possible vertical variant glyphs
         RetainPtr<CFStringRef> string(AdoptCF, CFStringCreateWithCharactersNoCopy(kCFAllocatorDefault, buffer, bufferLength, kCFAllocatorNull));
-        RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(kCFAllocatorDefault, string.get(), fontData->getCFStringAttributes(0)));
+        RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(kCFAllocatorDefault, string.get(), fontData->getCFStringAttributes(0, fontData->hasVerticalGlyphs() ? Vertical : Horizontal)));
         RetainPtr<CTLineRef> line(AdoptCF, CTLineCreateWithAttributedString(attributedString.get()));
 
         CFArrayRef runArray = CTLineGetGlyphRuns(line.get());
diff --git a/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm b/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
index aaa250b..997c976 100644
--- a/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
+++ b/Source/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
@@ -93,9 +93,14 @@ GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWi
     , m_attrs(attrs)
     , m_contextObj(0)
     , m_texture(0)
+    , m_compositorTexture(0)
     , m_fbo(0)
     , m_depthStencilBuffer(0)
+    , m_layerComposited(false)
+    , m_internalColorFormat(0)
     , m_boundFBO(0)
+    , m_activeTexture(0)
+    , m_boundTexture0(0)
     , m_multisampleFBO(0)
     , m_multisampleDepthStencilBuffer(0)
     , m_multisampleColorBuffer(0)
@@ -166,6 +171,12 @@ GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWi
     ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
     ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP);
     ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP);
+    ::glGenTextures(1, &m_compositorTexture);
+    ::glBindTexture(GL_TEXTURE_2D, m_compositorTexture);
+    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP);
+    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP);
     ::glBindTexture(GL_TEXTURE_2D, 0);
     
     // create an FBO
@@ -215,6 +226,7 @@ GraphicsContext3D::~GraphicsContext3D()
     if (m_contextObj) {
         CGLSetCurrentContext(m_contextObj);
         ::glDeleteTextures(1, &m_texture);
+        ::glDeleteTextures(1, &m_compositorTexture);
         if (m_attrs.antialias) {
             ::glDeleteRenderbuffersEXT(1, &m_multisampleColorBuffer);
             if (m_attrs.stencil || m_attrs.depth)
diff --git a/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h b/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
index 80bc94e..7bdc064 100644
--- a/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
+++ b/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
@@ -54,6 +54,8 @@ class WebCoreMovieObserver;
 #endif
 
 namespace WebCore {
+    
+class ApplicationCacheResource;
 
 class MediaPlayerPrivateQTKit : public MediaPlayerPrivateInterface {
 public:
@@ -139,6 +141,7 @@ private:
 
     void createQTMovie(const String& url);
     void createQTMovie(NSURL *, NSDictionary *movieAttributes);
+    void createQTMovie(ApplicationCacheResource*);
 
     enum MediaRenderingMode { MediaRenderingNone, MediaRenderingMovieView, MediaRenderingSoftwareRenderer, MediaRenderingMovieLayer };
     MediaRenderingMode currentRenderingMode() const;
@@ -178,6 +181,8 @@ private:
     virtual double maximumDurationToCacheMediaTime() const { return 5; }
 
     virtual void setPrivateBrowsingMode(bool);
+    
+    NSMutableDictionary* commonMovieAttributes();
 
     MediaPlayer* m_player;
     RetainPtr<QTMovie> m_qtMovie;
@@ -211,6 +216,7 @@ private:
     double m_timeStartedPlaying;
     double m_timeStoppedPlaying;
 #endif
+    mutable FloatSize m_cachedNaturalSize;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm b/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
index ecb7d9f..400fdfb 100644
--- a/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
+++ b/Source/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
@@ -29,11 +29,18 @@
 
 #import "MediaPlayerPrivateQTKit.h"
 
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+#include "ApplicationCacheHost.h"
+#include "ApplicationCacheResource.h"
+#include "DocumentLoader.h"
+#endif
+
 #ifdef BUILDING_ON_TIGER
 #import "AutodrainedPool.h"
 #endif
 
 #import "BlockExceptions.h"
+#import "DocumentLoader.h"
 #import "FrameView.h"
 #import "GraphicsContext.h"
 #import "KURL.h"
@@ -83,6 +90,7 @@ SOFT_LINK_POINTER(QTKit, QTMediaTypeText, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMediaTypeVideo, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieAskUnresolvedDataRefsAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieLoopsAttribute, NSString *)
+SOFT_LINK_POINTER(QTKit, QTMovieDataAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieDataSizeAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieDidEndNotification, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieHasVideoAttribute, NSString *)
@@ -120,6 +128,7 @@ SOFT_LINK_POINTER(QTKit, QTMovieApertureModeAttribute, NSString *)
 #define QTMediaTypeVideo getQTMediaTypeVideo()
 #define QTMovieAskUnresolvedDataRefsAttribute getQTMovieAskUnresolvedDataRefsAttribute()
 #define QTMovieLoopsAttribute getQTMovieLoopsAttribute()
+#define QTMovieDataAttribute getQTMovieDataAttribute()
 #define QTMovieDataSizeAttribute getQTMovieDataSizeAttribute()
 #define QTMovieDidEndNotification getQTMovieDidEndNotification()
 #define QTMovieHasVideoAttribute getQTMovieHasVideoAttribute()
@@ -241,21 +250,26 @@ MediaPlayerPrivateQTKit::~MediaPlayerPrivateQTKit()
     [m_objcObserver.get() disconnect];
 }
 
-void MediaPlayerPrivateQTKit::createQTMovie(const String& url)
+NSMutableDictionary* MediaPlayerPrivateQTKit::commonMovieAttributes() 
 {
-    NSURL *cocoaURL = KURL(ParsedURLString, url);
-    NSMutableDictionary *movieAttributes = [NSMutableDictionary dictionaryWithObjectsAndKeys:
-                       cocoaURL, QTMovieURLAttribute,
-                       [NSNumber numberWithBool:m_player->preservesPitch()], QTMovieRateChangesPreservePitchAttribute,
-                       [NSNumber numberWithBool:YES], QTMoviePreventExternalURLLinksAttribute,
-                       [NSNumber numberWithBool:YES], QTSecurityPolicyNoCrossSiteAttribute,
-                       [NSNumber numberWithBool:NO], QTMovieAskUnresolvedDataRefsAttribute,
-                       [NSNumber numberWithBool:NO], QTMovieLoopsAttribute,
-                       [NSNumber numberWithBool:!m_privateBrowsing], @"QTMovieAllowPersistentCacheAttribute",
+    return [NSMutableDictionary dictionaryWithObjectsAndKeys:
+            [NSNumber numberWithBool:m_player->preservesPitch()], QTMovieRateChangesPreservePitchAttribute,
+            [NSNumber numberWithBool:YES], QTMoviePreventExternalURLLinksAttribute,
+            [NSNumber numberWithBool:YES], QTSecurityPolicyNoCrossSiteAttribute,
+            [NSNumber numberWithBool:NO], QTMovieAskUnresolvedDataRefsAttribute,
+            [NSNumber numberWithBool:NO], QTMovieLoopsAttribute,
+            [NSNumber numberWithBool:!m_privateBrowsing], @"QTMovieAllowPersistentCacheAttribute",
 #ifndef BUILDING_ON_TIGER
-                       QTMovieApertureModeClean, QTMovieApertureModeAttribute,
+            QTMovieApertureModeClean, QTMovieApertureModeAttribute,
 #endif
-                       nil];
+            nil];
+}
+
+void MediaPlayerPrivateQTKit::createQTMovie(const String& url)
+{
+    NSURL *cocoaURL = KURL(ParsedURLString, url);
+    NSMutableDictionary *movieAttributes = commonMovieAttributes();    
+    [movieAttributes setValue:cocoaURL forKey:QTMovieURLAttribute];
 
 #if !defined(BUILDING_ON_LEOPARD)
     CFDictionaryRef proxySettings = CFNetworkCopySystemProxySettings();
@@ -291,6 +305,33 @@ void MediaPlayerPrivateQTKit::createQTMovie(const String& url)
     createQTMovie(cocoaURL, movieAttributes);
 }
 
+void MediaPlayerPrivateQTKit::createQTMovie(ApplicationCacheResource* resource)
+{
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    ASSERT(resource);
+
+    NSMutableDictionary *movieAttributes = commonMovieAttributes();    
+    [movieAttributes setObject:[NSNumber numberWithBool:YES] forKey:@"QTMovieOpenForPlaybackAttribute"];
+    
+    // ApplicationCacheResources can supply either a data pointer, or a path to a locally cached 
+    // flat file.  We would prefer the path over the data, but QTKit can handle either:
+    String localPath = resource->path();
+    NSURL* cocoaURL = !localPath.isEmpty() ? [NSURL fileURLWithPath:localPath isDirectory:NO] : nil;
+    if (cocoaURL)
+        [movieAttributes setValue:cocoaURL forKey:QTMovieURLAttribute];
+    else {
+        NSData* movieData = resource->data()->createNSData();
+        [movieAttributes setValue:movieData forKey:QTMovieDataAttribute];
+        [movieData release];
+    }
+    
+    createQTMovie(cocoaURL, movieAttributes);
+    
+#else
+    ASSERT_NOT_REACHED();
+#endif
+}
+
 static void disableComponentsOnce()
 {
     static bool sComponentsDisabled = false;
@@ -658,6 +699,14 @@ void MediaPlayerPrivateQTKit::loadInternal(const String& url)
     
     [m_objcObserver.get() setDelayCallbacks:YES];
 
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    Frame* frame = m_player->frameView() ? m_player->frameView()->frame() : NULL;
+    ApplicationCacheHost* cacheHost = frame ? frame->loader()->documentLoader()->applicationCacheHost() : NULL;
+    ApplicationCacheResource* resource = NULL;
+    if (cacheHost && cacheHost->shouldLoadResourceFromApplicationCache(ResourceRequest(url), resource) && resource)
+        createQTMovie(resource);
+    else
+#endif    
     createQTMovie(url);
 
     [m_objcObserver.get() loadStateChanged:nil];
@@ -827,8 +876,19 @@ IntSize MediaPlayerPrivateQTKit::naturalSize() const
     //    dimensions, aspect ratio, clean aperture, resolution, and so forth, as defined for the 
     //    format used by the resource
     
-    NSSize naturalSize = [[m_qtMovie.get() attributeForKey:QTMovieNaturalSizeAttribute] sizeValue];
-    return IntSize(naturalSize.width * m_scaleFactor.width(), naturalSize.height * m_scaleFactor.height());
+    FloatSize naturalSize([[m_qtMovie.get() attributeForKey:QTMovieNaturalSizeAttribute] sizeValue]);
+    if (naturalSize.isEmpty() && m_isStreaming) {
+        // HTTP Live Streams will occasionally return {0,0} natural sizes while scrubbing.
+        // Work around this problem (<rdar://problem/9078563>) by returning the last valid 
+        // cached natural size:
+        naturalSize = m_cachedNaturalSize;
+    } else {
+        // Unfortunately, due to another QTKit bug (<rdar://problem/9082071>) we won't get a sizeChanged
+        // event when this happens, so we must cache the last valid naturalSize here:
+        m_cachedNaturalSize = naturalSize;
+    }
+        
+    return IntSize(naturalSize.width() * m_scaleFactor.width(), naturalSize.height() * m_scaleFactor.height());
 }
 
 bool MediaPlayerPrivateQTKit::hasVideo() const
diff --git a/Source/WebCore/platform/graphics/mac/SimpleFontDataCoreText.cpp b/Source/WebCore/platform/graphics/mac/SimpleFontDataCoreText.cpp
index 452bd54..832bb9d 100644
--- a/Source/WebCore/platform/graphics/mac/SimpleFontDataCoreText.cpp
+++ b/Source/WebCore/platform/graphics/mac/SimpleFontDataCoreText.cpp
@@ -39,15 +39,17 @@ using namespace std;
 
 namespace WebCore {
 
-CFDictionaryRef SimpleFontData::getCFStringAttributes(TypesettingFeatures typesettingFeatures) const
+CFDictionaryRef SimpleFontData::getCFStringAttributes(TypesettingFeatures typesettingFeatures, FontOrientation orientation) const
 {
     unsigned key = typesettingFeatures + 1;
     pair<HashMap<unsigned, RetainPtr<CFDictionaryRef> >::iterator, bool> addResult = m_CFStringAttributes.add(key, RetainPtr<CFDictionaryRef>());
     RetainPtr<CFDictionaryRef>& attributesDictionary = addResult.first->second;
     if (!addResult.second)
         return attributesDictionary.get();
+    
+    bool treatLineAsVertical = orientation == Vertical;
 
-    bool allowLigatures = (orientation() == Horizontal && platformData().allowsLigatures()) || (typesettingFeatures & Ligatures);
+    bool allowLigatures = (!treatLineAsVertical && platformData().allowsLigatures()) || (typesettingFeatures & Ligatures);
 
     static const int ligaturesNotAllowedValue = 0;
     static CFNumberRef ligaturesNotAllowed = CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &ligaturesNotAllowedValue);
@@ -60,13 +62,13 @@ CFDictionaryRef SimpleFontData::getCFStringAttributes(TypesettingFeatures typese
         static CFNumberRef kerningAdjustment = CFNumberCreate(kCFAllocatorDefault, kCFNumberFloatType, &kerningAdjustmentValue);
         static const void* keysWithKerningDisabled[] = { kCTFontAttributeName, kCTKernAttributeName, kCTLigatureAttributeName, kCTVerticalFormsAttributeName };
         const void* valuesWithKerningDisabled[] = { platformData().ctFont(), kerningAdjustment, allowLigatures
-            ? ligaturesAllowed : ligaturesNotAllowed, orientation() == Vertical ? kCFBooleanTrue : kCFBooleanFalse };
+            ? ligaturesAllowed : ligaturesNotAllowed, treatLineAsVertical ? kCFBooleanTrue : kCFBooleanFalse };
         attributesDictionary.adoptCF(CFDictionaryCreate(0, keysWithKerningDisabled, valuesWithKerningDisabled,
             WTF_ARRAY_LENGTH(keysWithKerningDisabled), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
     } else {
         // By omitting the kCTKernAttributeName attribute, we get Core Text's standard kerning.
         static const void* keysWithKerningEnabled[] = { kCTFontAttributeName, kCTLigatureAttributeName, kCTVerticalFormsAttributeName };
-        const void* valuesWithKerningEnabled[] = { platformData().ctFont(), allowLigatures ? ligaturesAllowed : ligaturesNotAllowed, orientation() == Vertical ? kCFBooleanTrue : kCFBooleanFalse };
+        const void* valuesWithKerningEnabled[] = { platformData().ctFont(), allowLigatures ? ligaturesAllowed : ligaturesNotAllowed, treatLineAsVertical ? kCFBooleanTrue : kCFBooleanFalse };
         attributesDictionary.adoptCF(CFDictionaryCreate(0, keysWithKerningEnabled, valuesWithKerningEnabled,
             WTF_ARRAY_LENGTH(keysWithKerningEnabled), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
     }
diff --git a/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm b/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
index 3094498..cd34000 100644
--- a/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
+++ b/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
@@ -259,49 +259,32 @@ void SimpleFontData::platformInit()
         descent = 3;
     }
     
-    if (m_orientation == Vertical) {
-        // Ignore vertical orientation when the font doesn't support vertical metrics.
+    if (platformData().orientation() == Vertical && !isTextOrientationFallback()) {
         // The check doesn't look neat but this is what AppKit does for vertical writing...
         RetainPtr<CFArrayRef> tableTags(AdoptCF, CTFontCopyAvailableTables(m_platformData.ctFont(), kCTFontTableOptionExcludeSynthetic));
         CFIndex numTables = CFArrayGetCount(tableTags.get());
-        bool found = false;
         for (CFIndex index = 0; index < numTables; ++index) {
             CTFontTableTag tag = (CTFontTableTag)(uintptr_t)CFArrayGetValueAtIndex(tableTags.get(), index);
             if (tag == kCTFontTableVhea || tag == kCTFontTableVORG) {
-                found = true;
+                m_hasVerticalGlyphs = true;
                 break;
             }
         }
-
-        if (found == false)
-            m_orientation = Horizontal;
     }
 
     float xHeight;
 
-    // Measure the actual character "x", because AppKit synthesizes X height rather than getting it from the font.
-    // Unfortunately, NSFont will round this for us so we don't quite get the right value.
-    GlyphPage* glyphPageZero = GlyphPageTreeNode::getRootChild(this, 0)->page();
-    NSGlyph xGlyph = glyphPageZero ? glyphPageZero->glyphDataForCharacter('x').glyph : 0;
-    if (xGlyph) {
-        CGRect xBox = platformBoundsForGlyph(xGlyph);
-        // Use the maximum of either width or height because "x" is nearly square
-        // and web pages that foolishly use this metric for width will be laid out
-        // poorly if we return an accurate height. Classic case is Times 13 point,
-        // which has an "x" that is 7x6 pixels.
-        xHeight = static_cast<float>(max(CGRectGetMaxX(xBox), -CGRectGetMinY(xBox)));
-    } else {
-#ifndef BUILDING_ON_TIGER
-        xHeight = static_cast<float>(CGFontGetXHeight(m_platformData.cgFont())) / unitsPerEm;
-#else
-        xHeight = m_platformData.font() ? [m_platformData.font() xHeight] : 0;
-#endif
-        // CGFontGetXHeight() returns a wrong value for "Apple Symbols" font (a float close to 0, but not strictly 0).
-        // The following code makes a guess for xHeight in that case.
-        // The int cast is a workaround for the "almost" zero value returned by CGFontGetXHeight().
-        if (!static_cast<int>(xHeight) && ascent)
-            xHeight = 2 * ascent / 3;
-    }
+    if (platformData().orientation() == Horizontal) {
+        // Measure the actual character "x", since it's possible for it to extend below the baseline, and we need the
+        // reported x-height to only include the portion of the glyph that is above the baseline.
+        GlyphPage* glyphPageZero = GlyphPageTreeNode::getRootChild(this, 0)->page();
+        NSGlyph xGlyph = glyphPageZero ? glyphPageZero->glyphDataForCharacter('x').glyph : 0;
+        if (xGlyph)
+            xHeight = -CGRectGetMinY(platformBoundsForGlyph(xGlyph));
+        else
+            xHeight = scaleEmToUnits(CGFontGetXHeight(m_platformData.cgFont()), unitsPerEm) * pointSize;
+    } else
+        xHeight = verticalRightOrientationFontData()->fontMetrics().xHeight();
 
     m_fontMetrics.setUnitsPerEm(unitsPerEm);
     m_fontMetrics.setAscent(ascent);
@@ -474,17 +457,8 @@ void SimpleFontData::determinePitch()
 FloatRect SimpleFontData::platformBoundsForGlyph(Glyph glyph) const
 {
     FloatRect boundingBox;
-#ifndef BUILDING_ON_TIGER
-    boundingBox = CTFontGetBoundingRectsForGlyphs(m_platformData.ctFont(),
-                    orientation() == Vertical ? kCTFontVerticalOrientation : kCTFontHorizontalOrientation, &glyph, 0, 1);
+    boundingBox = CTFontGetBoundingRectsForGlyphs(m_platformData.ctFont(), platformData().orientation() == Vertical ? kCTFontVerticalOrientation : kCTFontHorizontalOrientation, &glyph, 0, 1);
     boundingBox.setY(-boundingBox.maxY());
-#else
-    // FIXME: Custom fonts don't have NSFonts, so this function doesn't compute correct bounds for these on Tiger.
-    if (!m_platformData.font())
-        return boundingBox;
-    boundingBox = [m_platformData.font() boundingRectForGlyph:glyph];
-    boundingBox.setY(-boundingBox.maxY());
-#endif
     if (m_syntheticBoldOffset)
         boundingBox.setWidth(boundingBox.width() + m_syntheticBoldOffset);
 
@@ -494,7 +468,7 @@ FloatRect SimpleFontData::platformBoundsForGlyph(Glyph glyph) const
 float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
 {
     CGSize advance;
-    if (orientation() == Horizontal || m_isBrokenIdeographFont) {
+    if (platformData().orientation() == Horizontal || m_isBrokenIdeographFallback) {
         NSFont* font = platformData().font();
         float pointSize = platformData().m_size;
         CGAffineTransform m = CGAffineTransformMakeScale(pointSize, pointSize);
diff --git a/Source/WebCore/platform/graphics/mac/WebLayer.h b/Source/WebCore/platform/graphics/mac/WebLayer.h
index 30bf55b..2e9bea0 100644
--- a/Source/WebCore/platform/graphics/mac/WebLayer.h
+++ b/Source/WebCore/platform/graphics/mac/WebLayer.h
@@ -32,6 +32,7 @@
 
 namespace WebCore {
     class GraphicsLayer;
+    class PlatformCALayer;
     class PlatformCALayerClient;
 }
 
@@ -48,7 +49,7 @@ namespace WebCore {
 @end
 
 // Functions allows us to share implementation across WebTiledLayer and WebLayer
-void drawLayerContents(CGContextRef, CALayer *, WebCore::PlatformCALayerClient*);
+void drawLayerContents(CGContextRef, CALayer *, WebCore::PlatformCALayer*);
 void setLayerNeedsDisplayInRect(CALayer *, WebCore::PlatformCALayerClient*, CGRect);
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/mac/WebLayer.mm b/Source/WebCore/platform/graphics/mac/WebLayer.mm
index 414a75f..c9705d0 100644
--- a/Source/WebCore/platform/graphics/mac/WebLayer.mm
+++ b/Source/WebCore/platform/graphics/mac/WebLayer.mm
@@ -40,8 +40,9 @@ using namespace WebCore;
 
 @implementation WebLayer
 
-void drawLayerContents(CGContextRef context, CALayer *layer, WebCore::PlatformCALayerClient* layerContents)
+void drawLayerContents(CGContextRef context, CALayer *layer, WebCore::PlatformCALayer* platformLayer)
 {
+    WebCore::PlatformCALayerClient* layerContents = platformLayer->owner();
     if (!layerContents)
         return;
 
@@ -62,6 +63,7 @@ void drawLayerContents(CGContextRef context, CALayer *layer, WebCore::PlatformCA
 
     GraphicsContext graphicsContext(context);
     graphicsContext.setIsCALayerContext(true);
+    graphicsContext.setIsAcceleratedContext(platformLayer->acceleratesDrawing());
 
     if (!layerContents->platformCALayerContentsOpaque()) {
         // Turn off font smoothing to improve the appearance of text rendered onto a transparent background.
@@ -167,7 +169,7 @@ void setLayerNeedsDisplayInRect(CALayer *layer, WebCore::PlatformCALayerClient*
 {
     PlatformCALayer* layer = PlatformCALayer::platformCALayer(self);
     if (layer)
-        drawLayerContents(context, self, layer->owner());
+        drawLayerContents(context, self, layer);
 }
 
 @end // implementation WebLayer
diff --git a/Source/WebCore/platform/graphics/mac/WebTiledLayer.mm b/Source/WebCore/platform/graphics/mac/WebTiledLayer.mm
index e9fa5b7..9bcdd54 100644
--- a/Source/WebCore/platform/graphics/mac/WebTiledLayer.mm
+++ b/Source/WebCore/platform/graphics/mac/WebTiledLayer.mm
@@ -83,7 +83,7 @@ using namespace WebCore;
 {
     PlatformCALayer* layer = PlatformCALayer::platformCALayer(self);
     if (layer)
-        drawLayerContents(context, self, layer->owner());
+        drawLayerContents(context, self, layer);
 }
 
 @end // implementation WebTiledLayer
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
index c224e20..f831550 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
@@ -38,6 +38,7 @@
 #include "GraphicsContext.h"
 #include "HTMLCanvasElement.h"
 #include "ImageBuffer.h"
+#include "ImageData.h"
 #include "Int32Array.h"
 #include "NotImplemented.h"
 #include "Uint8Array.h"
@@ -53,11 +54,12 @@ namespace WebCore {
 
 void GraphicsContext3D::validateAttributes()
 {
-    const char* extensions = reinterpret_cast<const char*>(::glGetString(GL_EXTENSIONS));
+    Extensions3D* extensions = getExtensions();
     if (m_attrs.stencil) {
-        if (std::strstr(extensions, "GL_EXT_packed_depth_stencil")) {
-            if (!m_attrs.depth)
-                m_attrs.depth = true;
+        if (extensions->supports("GL_EXT_packed_depth_stencil")) {
+            extensions->ensureEnabled("GL_EXT_packed_depth_stencil");
+            // Force depth if stencil is true.
+            m_attrs.depth = true;
         } else
             m_attrs.stencil = false;
     }
@@ -67,24 +69,16 @@ void GraphicsContext3D::validateAttributes()
         const char* vendor = reinterpret_cast<const char*>(::glGetString(GL_VENDOR));
         if (!std::strstr(vendor, "NVIDIA"))
             isValidVendor = false;
-        if (!isValidVendor || !std::strstr(extensions, "GL_EXT_framebuffer_multisample"))
+        if (!isValidVendor || !extensions->supports("GL_ANGLE_framebuffer_multisample"))
             m_attrs.antialias = false;
+        else
+            extensions->ensureEnabled("GL_ANGLE_framebuffer_multisample");
     }
-    // FIXME: instead of enforcing premultipliedAlpha = true, implement the
-    // correct behavior when premultipliedAlpha = false is requested.
-    m_attrs.premultipliedAlpha = true;
 }
 
-void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* context)
+void GraphicsContext3D::readRenderingResults(unsigned char *pixels, int pixelsSize)
 {
-    HTMLCanvasElement* canvas = context->canvas();
-    ImageBuffer* imageBuffer = canvas->buffer();
-
-    int rowBytes = m_currentWidth * 4;
-    int totalBytes = rowBytes * m_currentHeight;
-
-    OwnArrayPtr<unsigned char> pixels = adoptArrayPtr(new unsigned char[totalBytes]);
-    if (!pixels)
+    if (pixelsSize < m_currentWidth * m_currentHeight * 4)
         return;
 
     makeContextCurrent();
@@ -111,18 +105,62 @@ void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* co
         mustRestorePackAlignment = true;
     }
 
-    ::glReadPixels(0, 0, m_currentWidth, m_currentHeight, GL_BGRA, GL_UNSIGNED_INT_8_8_8_8_REV, pixels.get());
+    ::glReadPixels(0, 0, m_currentWidth, m_currentHeight, GL_BGRA, GL_UNSIGNED_INT_8_8_8_8_REV, pixels);
 
     if (mustRestorePackAlignment)
         ::glPixelStorei(GL_PACK_ALIGNMENT, packAlignment);
 
     if (mustRestoreFBO)
         ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
+}
+
+void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* context)
+{
+    HTMLCanvasElement* canvas = context->canvas();
+    ImageBuffer* imageBuffer = canvas->buffer();
+
+    int rowBytes = m_currentWidth * 4;
+    int totalBytes = rowBytes * m_currentHeight;
+
+    OwnArrayPtr<unsigned char> pixels = adoptArrayPtr(new unsigned char[totalBytes]);
+    if (!pixels)
+        return;
+
+    readRenderingResults(pixels.get(), totalBytes);
+
+    if (!m_attrs.premultipliedAlpha) {
+        for (int i = 0; i < totalBytes; i += 4) {
+            // Premultiply alpha
+            pixels[i + 0] = std::min(255, pixels[i + 0] * pixels[i + 3] / 255);
+            pixels[i + 1] = std::min(255, pixels[i + 1] * pixels[i + 3] / 255);
+            pixels[i + 2] = std::min(255, pixels[i + 2] * pixels[i + 3] / 255);
+        }
+    }
 
     paintToCanvas(pixels.get(), m_currentWidth, m_currentHeight,
                   canvas->width(), canvas->height(), imageBuffer->context()->platformContext());
 }
 
+PassRefPtr<ImageData> GraphicsContext3D::paintRenderingResultsToImageData()
+{
+    // Reading premultiplied alpha would involve unpremultiplying, which is
+    // lossy
+    if (m_attrs.premultipliedAlpha)
+        return 0;
+
+    RefPtr<ImageData> imageData = ImageData::create(IntSize(m_currentWidth, m_currentHeight));
+    unsigned char* pixels = imageData->data()->data()->data();
+    int totalBytes = 4 * m_currentWidth * m_currentHeight;
+
+    readRenderingResults(pixels, totalBytes);
+
+    // Convert to RGBA
+    for (int i = 0; i < totalBytes; i += 4)
+        std::swap(pixels[i], pixels[i + 2]);
+
+    return imageData.release();
+}
+
 void GraphicsContext3D::reshape(int width, int height)
 {
     if (!m_contextObj)
@@ -135,19 +173,23 @@ void GraphicsContext3D::reshape(int width, int height)
     m_currentHeight = height;
     
     makeContextCurrent();
-    
-    GLuint internalColorFormat, colorFormat, internalDepthStencilFormat = 0;
+    validateAttributes();
+
+    GLuint colorFormat, internalDepthStencilFormat = 0;
     if (m_attrs.alpha) {
-        internalColorFormat = GL_RGBA8;
+        m_internalColorFormat = GL_RGBA8;
         colorFormat = GL_RGBA;
     } else {
-        internalColorFormat = GL_RGB8;
+        m_internalColorFormat = GL_RGB8;
         colorFormat = GL_RGB;
     }
     if (m_attrs.stencil || m_attrs.depth) {
         // We don't allow the logic where stencil is required and depth is not.
-        // See GraphicsContext3D constructor.
-        if (m_attrs.stencil && m_attrs.depth)
+        // See GraphicsContext3D::validateAttributes.
+
+        Extensions3D* extensions = getExtensions();
+        // Use a 24 bit depth buffer where we know we have it
+        if (extensions->supports("GL_EXT_packed_depth_stencil"))
             internalDepthStencilFormat = GL_DEPTH24_STENCIL8_EXT;
         else
             internalDepthStencilFormat = GL_DEPTH_COMPONENT;
@@ -167,7 +209,7 @@ void GraphicsContext3D::reshape(int width, int height)
             mustRestoreFBO = true;
         }
         ::glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, m_multisampleColorBuffer);
-        ::glRenderbufferStorageMultisampleEXT(GL_RENDERBUFFER_EXT, sampleCount, internalColorFormat, width, height);
+        ::glRenderbufferStorageMultisampleEXT(GL_RENDERBUFFER_EXT, sampleCount, m_internalColorFormat, width, height);
         ::glFramebufferRenderbufferEXT(GL_FRAMEBUFFER_EXT, GL_COLOR_ATTACHMENT0_EXT, GL_RENDERBUFFER_EXT, m_multisampleColorBuffer);
         if (m_attrs.stencil || m_attrs.depth) {
             ::glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, m_multisampleDepthStencilBuffer);
@@ -190,8 +232,10 @@ void GraphicsContext3D::reshape(int width, int height)
         ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
     }
     ::glBindTexture(GL_TEXTURE_2D, m_texture);
-    ::glTexImage2D(GL_TEXTURE_2D, 0, internalColorFormat, width, height, 0, colorFormat, GL_UNSIGNED_BYTE, 0);
+    ::glTexImage2D(GL_TEXTURE_2D, 0, m_internalColorFormat, width, height, 0, colorFormat, GL_UNSIGNED_BYTE, 0);
     ::glFramebufferTexture2DEXT(GL_FRAMEBUFFER_EXT, GL_COLOR_ATTACHMENT0_EXT, GL_TEXTURE_2D, m_texture, 0);
+    ::glBindTexture(GL_TEXTURE_2D, m_compositorTexture);
+    ::glTexImage2D(GL_TEXTURE_2D, 0, m_internalColorFormat, width, height, 0, colorFormat, GL_UNSIGNED_BYTE, 0);
     ::glBindTexture(GL_TEXTURE_2D, 0);
     if (!m_attrs.antialias && (m_attrs.stencil || m_attrs.depth)) {
         ::glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, m_depthStencilBuffer);
@@ -278,19 +322,29 @@ IntSize GraphicsContext3D::getInternalFramebufferSize()
 
 void GraphicsContext3D::prepareTexture()
 {
+    if (m_layerComposited)
+        return;
     makeContextCurrent();
     if (m_attrs.antialias) {
         ::glBindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, m_multisampleFBO);
         ::glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, m_fbo);
         ::glBlitFramebufferEXT(0, 0, m_currentWidth, m_currentHeight, 0, 0, m_currentWidth, m_currentHeight, GL_COLOR_BUFFER_BIT, GL_LINEAR);
-        ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
     }
+    ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
+    ::glActiveTexture(0);
+    ::glBindTexture(GL_TEXTURE_2D, m_compositorTexture);
+    ::glCopyTexImage2D(GL_TEXTURE_2D, 0, m_internalColorFormat, 0, 0, m_currentWidth, m_currentHeight, 0);
+    ::glBindTexture(GL_TEXTURE_2D, m_boundTexture0);
+    ::glActiveTexture(m_activeTexture);
+    ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
     ::glFinish();
+    m_layerComposited = true;
 }
 
 void GraphicsContext3D::activeTexture(GC3Denum texture)
 {
     makeContextCurrent();
+    m_activeTexture = texture;
     ::glActiveTexture(texture);
 }
 
@@ -340,6 +394,8 @@ void GraphicsContext3D::bindRenderbuffer(GC3Denum target, Platform3DObject rende
 void GraphicsContext3D::bindTexture(GC3Denum target, Platform3DObject texture)
 {
     makeContextCurrent();
+    if (m_activeTexture && target == GL_TEXTURE_2D)
+        m_boundTexture0 = texture;
     ::glBindTexture(target, texture);
 }
 
@@ -1442,6 +1498,21 @@ void GraphicsContext3D::synthesizeGLError(GC3Denum error)
     m_syntheticErrors.add(error);
 }
 
+void GraphicsContext3D::markContextChanged()
+{
+    m_layerComposited = false;
+}
+
+void GraphicsContext3D::markLayerComposited()
+{
+    m_layerComposited = true;
+}
+
+bool GraphicsContext3D::layerComposited() const
+{
+    return m_layerComposited;
+}
+
 Extensions3D* GraphicsContext3D::getExtensions()
 {
     if (!m_extensions)
diff --git a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp b/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp
index 2e2082d..9765937 100644
--- a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/TextureMapperGL.cpp
@@ -21,11 +21,11 @@
 #include "TextureMapperGL.h"
 
 #include "GraphicsContext.h"
-#include "HashMap.h"
 #include "Image.h"
-#include "PassRefPtr.h"
-#include "RefCounted.h"
 #include "Timer.h"
+#include <wtf/HashMap.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 
 #if defined(TEXMAP_OPENGL_ES_2)
 #include <GLES2/gl2.h>
diff --git a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.h b/Source/WebCore/platform/graphics/opengl/TextureMapperGL.h
index 8035abf..92c5198 100644
--- a/Source/WebCore/platform/graphics/opengl/TextureMapperGL.h
+++ b/Source/WebCore/platform/graphics/opengl/TextureMapperGL.h
@@ -24,8 +24,8 @@
 
 #include "FloatQuad.h"
 #include "IntSize.h"
+#include "TextureMapper.h"
 #include "TransformationMatrix.h"
-#include "texmap/TextureMapper.h"
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/openvg/PathOpenVG.cpp b/Source/WebCore/platform/graphics/openvg/PathOpenVG.cpp
index 39a4b06..95df242 100644
--- a/Source/WebCore/platform/graphics/openvg/PathOpenVG.cpp
+++ b/Source/WebCore/platform/graphics/openvg/PathOpenVG.cpp
@@ -169,7 +169,7 @@ FloatRect Path::boundingRect() const
     return FloatRect(FloatPoint(minX, minY), FloatSize(width, height));
 }
 
-FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 {
     notImplemented();
 
@@ -464,7 +464,7 @@ void Path::transform(const AffineTransform& transformation)
 // functions and Path::apply() doesn't really work as long as we rely on VGPath
 // as primary path storage.
 
-float Path::length()
+float Path::length() const
 {
     m_path->makeCompatibleContextCurrent();
     VGfloat length = vgPathLength(m_path->vgPath(), 0, vgGetParameteri(m_path->vgPath(), VG_PATH_NUM_SEGMENTS));
@@ -472,7 +472,7 @@ float Path::length()
     return length;
 }
 
-FloatPoint Path::pointAtLength(float length, bool& ok)
+FloatPoint Path::pointAtLength(float length, bool& ok) const
 {
     VGfloat x = 0, y = 0;
     m_path->makeCompatibleContextCurrent();
@@ -483,7 +483,7 @@ FloatPoint Path::pointAtLength(float length, bool& ok)
     return FloatPoint(x, y);
 }
 
-float Path::normalAngleAtLength(float length, bool& ok)
+float Path::normalAngleAtLength(float length, bool& ok) const
 {
     VGfloat tangentX, tangentY;
     m_path->makeCompatibleContextCurrent();
diff --git a/Source/WebCore/platform/graphics/pango/FontCustomPlatformDataPango.cpp b/Source/WebCore/platform/graphics/pango/FontCustomPlatformDataPango.cpp
index f9d36d3..deff9f7 100644
--- a/Source/WebCore/platform/graphics/pango/FontCustomPlatformDataPango.cpp
+++ b/Source/WebCore/platform/graphics/pango/FontCustomPlatformDataPango.cpp
@@ -30,7 +30,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
 {
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, TextOrientation, FontWidthVariant, FontRenderingMode)
 {
     return FontPlatformData(m_fontFace, size, bold, italic);
 }
diff --git a/Source/WebCore/platform/graphics/pango/FontPlatformData.h b/Source/WebCore/platform/graphics/pango/FontPlatformData.h
index 2929a3f..180d23b 100644
--- a/Source/WebCore/platform/graphics/pango/FontPlatformData.h
+++ b/Source/WebCore/platform/graphics/pango/FontPlatformData.h
@@ -74,7 +74,7 @@ public:
     unsigned hash() const
     {
         uintptr_t hashCodes[1] = { reinterpret_cast<uintptr_t>(m_scaledFont) };
-        return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+        return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
     }
 
     bool operator==(const FontPlatformData&) const;
diff --git a/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp b/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
index dcea72f..3adc93f 100644
--- a/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/Extensions3DQt.cpp
@@ -30,6 +30,7 @@
 #include "Extensions3DQt.h"
 
 #include "GraphicsContext3D.h"
+#include <QGLContext>
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/qt/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/qt/FontCustomPlatformData.h
index e8441d2..3996d22 100644
--- a/Source/WebCore/platform/graphics/qt/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/qt/FontCustomPlatformData.h
@@ -25,6 +25,7 @@
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
 #include "FontWidthVariant.h"
+#include "TextOrientation.h"
 #include <wtf/FastAllocBase.h>
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
@@ -43,7 +44,8 @@ public:
     // for use with QFontDatabase::addApplicationFont/removeApplicationFont
     int m_handle;
 
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight,
+                                      FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
     static bool supportsFormat(const String&);
 };
diff --git a/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp b/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
index ec8747d..20f161a 100644
--- a/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/FontCustomPlatformDataQt.cpp
@@ -34,7 +34,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
     QFontDatabase::removeApplicationFont(m_handle);
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, TextOrientation, FontWidthVariant, FontRenderingMode)
 {
     QFont font;
     font.setFamily(QFontDatabase::applicationFontFamilies(m_handle)[0]);
diff --git a/Source/WebCore/platform/graphics/qt/FontPlatformData.h b/Source/WebCore/platform/graphics/qt/FontPlatformData.h
index 32e8a2d..4a92acf 100644
--- a/Source/WebCore/platform/graphics/qt/FontPlatformData.h
+++ b/Source/WebCore/platform/graphics/qt/FontPlatformData.h
@@ -141,6 +141,7 @@ public:
     }
     
     FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
+    void setOrientation(FontOrientation) { } // FIXME: Implement.
 
     unsigned hash() const;
 
diff --git a/Source/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp b/Source/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
index 185ae85..95dabd5 100644
--- a/Source/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/FontPlatformDataQt.cpp
@@ -73,9 +73,7 @@ FontPlatformData::FontPlatformData(const FontDescription& description, const Ato
     font.setLetterSpacing(QFont::AbsoluteSpacing, letterSpacing);
     const bool smallCaps = description.smallCaps();
     font.setCapitalization(smallCaps ? QFont::SmallCaps : QFont::MixedCase);
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     font.setStyleStrategy(QFont::ForceIntegerMetrics);
-#endif
 
     m_data->bold = font.bold();
     // WebKit allows font size zero but QFont does not. We will return
diff --git a/Source/WebCore/platform/graphics/qt/FontQt.cpp b/Source/WebCore/platform/graphics/qt/FontQt.cpp
index 646cd0e..3fe90a4 100644
--- a/Source/WebCore/platform/graphics/qt/FontQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/FontQt.cpp
@@ -169,21 +169,16 @@ static void drawTextCommon(GraphicsContext* ctx, const TextRun& run, const Float
             p->restore();
             return;
         }
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
         int skipWidth = QFontMetrics(font).width(string, from, Qt::TextBypassShaping);
         pt.setX(pt.x() + skipWidth);
         string = fromRawDataWithoutRef(sanitized, from, to - from);
-#endif
     }
 
     p->setFont(font);
 
     int flags = run.rtl() ? Qt::TextForceRightToLeft : Qt::TextForceLeftToRight;
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
-    // See QWebPagePrivate::QWebPagePrivate() where the default path is set to Complex for Qt 4.6 and earlier.
     if (!isComplexText && !(ctx->textDrawingMode() & TextModeStroke))
         flags |= Qt::TextBypassShaping;
-#endif
 
     QPainterPath textStrokePath;
     if (ctx->textDrawingMode() & TextModeStroke)
@@ -200,11 +195,7 @@ static void drawTextCommon(GraphicsContext* ctx, const TextRun& run, const Float
                 p->restore();
             } else {
                 QFontMetrics fm(font);
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
                 QRectF boundingRect(pt.x(), point.y() - fm.ascent(), fm.width(string, -1, flags), fm.height());
-#else
-                QRectF boundingRect(pt.x(), point.y() - fm.ascent(), fm.width(string), fm.height());
-#endif
                 QPainter* shadowPainter = ctxShadow->beginShadowLayer(ctx, boundingRect);
                 if (shadowPainter) {
                     // Since it will be blurred anyway, we don't care about render hints.
@@ -221,11 +212,7 @@ static void drawTextCommon(GraphicsContext* ctx, const TextRun& run, const Float
                 p->translate(-ctxShadow->offset());
             } else {
                 QFontMetrics fm(font);
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
                 QRectF boundingRect(pt.x(), point.y() - fm.ascent(), fm.width(string, -1, flags), fm.height());
-#else
-                QRectF boundingRect(pt.x(), point.y() - fm.ascent(), fm.width(string), fm.height());
-#endif
                 QPainter* shadowPainter = ctxShadow->beginShadowLayer(ctx, boundingRect);
                 if (shadowPainter) {
                     // Since it will be blurred anyway, we don't care about render hints.
@@ -250,11 +237,7 @@ static void drawTextCommon(GraphicsContext* ctx, const TextRun& run, const Float
 
 void Font::drawSimpleText(GraphicsContext* ctx, const TextRun& run, const FloatPoint& point, int from, int to) const
 {
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     drawTextCommon(ctx, run, point, from, to, font(), /* isComplexText = */false);
-#else
-    Q_ASSERT(false);
-#endif
 }
 
 void Font::drawComplexText(GraphicsContext* ctx, const TextRun& run, const FloatPoint& point, int from, int to) const
@@ -295,7 +278,6 @@ float Font::floatWidthForSimpleText(const TextRun& run, GlyphBuffer* glyphBuffer
     if (!primaryFont()->platformData().size())
         return 0;
 
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     if (!run.length())
         return 0;
 
@@ -309,10 +291,6 @@ float Font::floatWidthForSimpleText(const TextRun& run, GlyphBuffer* glyphBuffer
         w -= m_wordSpacing;
 
     return w + run.expansion();
-#else
-    Q_ASSERT(false);
-    return 0;
-#endif
 }
 
 float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>*, GlyphOverflow*) const
@@ -339,7 +317,6 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
 
 int Font::offsetForPositionForSimpleText(const TextRun& run, float position, bool includePartialGlyphs) const
 {
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     String sanitized = Font::normalizeSpaces(run.characters(), run.length());
     QString string = fromRawDataWithoutRef(sanitized);
 
@@ -359,10 +336,6 @@ int Font::offsetForPositionForSimpleText(const TextRun& run, float position, boo
     } while (++curPos < string.size());
 
     return curPos;
-#else
-    Q_ASSERT(false);
-    return 0;
-#endif
 }
 
 int Font::offsetForPositionForComplexText(const TextRun& run, float position, bool) const
@@ -377,7 +350,6 @@ int Font::offsetForPositionForComplexText(const TextRun& run, float position, bo
 
 FloatRect Font::selectionRectForSimpleText(const TextRun& run, const FloatPoint& pt, int h, int from, int to) const
 {
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     String sanitized = Font::normalizeSpaces(run.characters(), run.length());
     QString wholeText = fromRawDataWithoutRef(sanitized);
     QString selectedText = fromRawDataWithoutRef(sanitized, from, qMin(to - from, wholeText.length() - from));
@@ -386,10 +358,6 @@ FloatRect Font::selectionRectForSimpleText(const TextRun& run, const FloatPoint&
     int width = QFontMetrics(font()).width(selectedText, -1, Qt::TextBypassShaping);
 
     return FloatRect(pt.x() + startX, pt.y(), width, h);
-#else
-    Q_ASSERT(false);
-    return FloatRect();
-#endif
 }
 
 FloatRect Font::selectionRectForComplexText(const TextRun& run, const FloatPoint& pt, int h, int from, int to) const
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
index b849214..4daa4dc 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
@@ -27,10 +27,14 @@
 #include "HTMLCanvasElement.h"
 #include "HostWindow.h"
 #include "ImageBuffer.h"
+#include "ImageData.h"
 #include "NotImplemented.h"
 #include "QWebPageClient.h"
+#include "qwebpage.h"
 #include <QAbstractScrollArea>
+#include <QGraphicsObject>
 #include <QGLContext>
+#include <QStyleOptionGraphicsItem>
 #include <wtf/UnusedParam.h>
 #include <wtf/text/CString.h>
 
@@ -42,6 +46,10 @@ namespace WebCore {
 typedef char GLchar;
 #endif
 
+#if !defined(GL_DEPTH24_STENCIL8)
+#define GL_DEPTH24_STENCIL8 0x88F0
+#endif
+
 #if !defined(APIENTRY)
 #define APIENTRY
 #endif
@@ -145,13 +153,17 @@ typedef void (APIENTRY* glVertexAttrib4fType) (GLuint, const GLfloat, const GLfl
 typedef void (APIENTRY* glVertexAttrib4fvType) (GLuint, const GLfloat*);
 typedef void (APIENTRY* glVertexAttribPointerType) (GLuint, GLint, GLenum, GLboolean, GLsizei, const GLvoid*);
 
-class GraphicsContext3DInternal {
+class GraphicsContext3DInternal : public QGraphicsObject {
 public:
     GraphicsContext3DInternal(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow);
     ~GraphicsContext3DInternal();
 
-    bool isContextValid() { return m_contextValid; }
-    QGLWidget* getOwnerGLWidget(QWebPageClient* webPageClient);
+    bool isValid() { return m_valid; }
+
+    QGLWidget* getViewportGLWidget();
+    void reshape(int width, int height);
+    void paint(QPainter*, const QStyleOptionGraphicsItem*, QWidget*);
+    QRectF boundingRect() const;
 
     glActiveTextureType activeTexture;
     glAttachShaderType attachShader;
@@ -247,11 +259,13 @@ public:
     GraphicsContext3D::Attributes m_attrs;
     HostWindow* m_hostWindow;
     QGLWidget* m_glWidget;
+    QGLWidget* m_viewportGLWidget;
+    QRectF m_boundingRect;
     GLuint m_texture;
-    GLuint m_mainFbo;
+    GLuint m_canvasFbo;
     GLuint m_currentFbo;
     GLuint m_depthBuffer;
-    QImage m_pixels;
+    bool m_layerComposited;
     ListHashSet<unsigned int> m_syntheticErrors;
 
     OwnPtr<Extensions3DQt> m_extensions;
@@ -259,7 +273,7 @@ public:
 private:
 
     void* getProcAddress(const String& proc);
-    bool m_contextValid;
+    bool m_valid;
 };
 
 #if defined (QT_OPENGL_ES_2) 
@@ -281,39 +295,37 @@ GraphicsContext3DInternal::GraphicsContext3DInternal(GraphicsContext3D::Attribut
     : m_attrs(attrs)
     , m_hostWindow(hostWindow)
     , m_glWidget(0)
+    , m_viewportGLWidget(0)
     , m_texture(0)
-    , m_mainFbo(0)
+    , m_canvasFbo(0)
     , m_currentFbo(0)
     , m_depthBuffer(0)
-    , m_contextValid(true)
+    , m_layerComposited(false)
+    , m_valid(true)
 {
-    QWebPageClient* webPageClient = hostWindow->platformPageClient();
-    QGLWidget* ownerGLWidget  = getOwnerGLWidget(webPageClient);
+    m_viewportGLWidget = getViewportGLWidget();
 
-    if (ownerGLWidget) 
-        m_glWidget = new QGLWidget(0, ownerGLWidget);
-    else {
-        QGLFormat format;
-        format.setDepth(true);
-        format.setSampleBuffers(true);
-        format.setStencil(false);
-
-        m_glWidget = new QGLWidget(format);
-    }
+    if (m_viewportGLWidget)
+        m_glWidget = new QGLWidget(0, m_viewportGLWidget);
+    else
+        m_glWidget = new QGLWidget();
 
     if (!m_glWidget->isValid()) {
-        LOG_ERROR("GraphicsContext3D: QGLWidget does not have a valid context");
-        m_contextValid = false;
+        LOG_ERROR("GraphicsContext3D: QGLWidget initialization failed.");
+        m_valid = false;
         return;
     }
- 
-    QGLFormat format = m_glWidget->format();
 
-    m_attrs.alpha = format.alpha();
-    m_attrs.depth = format.depth();
-    m_attrs.stencil = format.stencil();
+    // Geometry can be set to zero because m_glWidget is used only for its QGLContext.
+    m_glWidget->setGeometry(0, 0, 0, 0);
+
+#if defined(QT_OPENGL_ES_2)
+    m_attrs.stencil = false;
+#else
+    if (m_attrs.stencil)
+        m_attrs.depth = true;
+#endif
     m_attrs.antialias = false;
-    m_attrs.premultipliedAlpha = true;
 
     m_glWidget->makeCurrent();
 
@@ -408,60 +420,165 @@ GraphicsContext3DInternal::GraphicsContext3DInternal(GraphicsContext3D::Attribut
     vertexAttrib4fv = GET_PROC_ADDRESS(glVertexAttrib4fv);
     vertexAttribPointer = GET_PROC_ADDRESS(glVertexAttribPointer);
 
-    if (!m_contextValid) {
+    if (!m_valid) {
         LOG_ERROR("GraphicsContext3D: All needed OpenGL extensions are not available");
-        m_contextValid = false;
         return;
     }
 
+    // Create buffers for the canvas FBO.
+    genFramebuffers(/* count */ 1, &m_canvasFbo);
+
     glGenTextures(1, &m_texture);
     glBindTexture(GraphicsContext3D::TEXTURE_2D, m_texture);
     glTexParameterf(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::LINEAR);
     glTexParameterf(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR);
     glTexParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE);
     glTexParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
-    glTexImage2D(GraphicsContext3D::TEXTURE_2D, 0, GraphicsContext3D::RGBA, 1, 1, 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, 0);
     glBindTexture(GraphicsContext3D::TEXTURE_2D, 0);
 
-    genFramebuffers(/* count */ 1, &m_mainFbo);
-    m_currentFbo = m_mainFbo;
+    if (m_attrs.depth)
+        genRenderbuffers(/* count */ 1, &m_depthBuffer);
+
+    // Bind canvas FBO and set initial clear color to black.
+    m_currentFbo = m_canvasFbo;
+    bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_canvasFbo);
+    glClearColor(0.0, 0.0, 0.0, 0.0);
+}
+
+GraphicsContext3DInternal::~GraphicsContext3DInternal()
+{
+    delete m_glWidget;
+    m_glWidget = 0;
+}
+
+QGLWidget* GraphicsContext3DInternal::getViewportGLWidget()
+{
+    QWebPageClient* webPageClient = m_hostWindow->platformPageClient();
+    if (!webPageClient)
+        return 0;
+
+    QAbstractScrollArea* scrollArea = qobject_cast<QAbstractScrollArea*>(webPageClient->ownerWidget());
+    if (scrollArea)
+        return qobject_cast<QGLWidget*>(scrollArea->viewport());
+
+    return 0;
+}
+
+static inline quint32 swapBgrToRgb(quint32 pixel)
+{
+    return ((pixel << 16) & 0xff0000) | ((pixel >> 16) & 0xff) | (pixel & 0xff00ff00);
+}
+
+void GraphicsContext3DInternal::reshape(int width, int height)
+{
+    if (width == m_boundingRect.width() && height == m_boundingRect.height())
+        return;
+
+    m_boundingRect = QRectF(QPointF(0, 0), QSizeF(width, height));
+
+    m_glWidget->makeCurrent();
 
-    bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_mainFbo);
+    // Create color buffer
+    glBindTexture(GraphicsContext3D::TEXTURE_2D, m_texture);
+    if (m_attrs.alpha)
+        glTexImage2D(GraphicsContext3D::TEXTURE_2D, /* level */ 0, GraphicsContext3D::RGBA, width, height, /* border */ 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, /* data */ 0);
+    else
+        glTexImage2D(GraphicsContext3D::TEXTURE_2D, /* level */ 0, GraphicsContext3D::RGB, width, height, /* border */ 0, GraphicsContext3D::RGB, GraphicsContext3D::UNSIGNED_BYTE, /* data */ 0);
+    glBindTexture(GraphicsContext3D::TEXTURE_2D, 0);
 
-    genRenderbuffers(/* count */ 1, &m_depthBuffer);
-    bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, m_depthBuffer);
+    if (m_attrs.depth) {
+        // Create depth and stencil buffers.
+        bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, m_depthBuffer);
 #if defined(QT_OPENGL_ES_2)
-    renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT16, /* width */ 1, /* height */ 1);
+        renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT16, width, height);
 #else
-    renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT, /* width */ 1, /* height */ 1);
+        if (m_attrs.stencil)
+            renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GL_DEPTH24_STENCIL8, width, height);
+        else
+            renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT, width, height);
 #endif
+        bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, 0);
+    }
 
-    bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, 0);
- 
+    // Construct canvas FBO.
+    bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_canvasFbo);
     framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, m_texture, 0);
-    framebufferRenderbuffer(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::DEPTH_ATTACHMENT, GraphicsContext3D::RENDERBUFFER, m_depthBuffer);
-    glClearColor(/* red */ 0, /* green */ 0, /* blue */ 0, /* alpha */ 0);
+    if (m_attrs.depth)
+        framebufferRenderbuffer(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::DEPTH_ATTACHMENT, GraphicsContext3D::RENDERBUFFER, m_depthBuffer);
+#if !defined(QT_OPENGL_ES_2)
+    if (m_attrs.stencil)
+        framebufferRenderbuffer(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::STENCIL_ATTACHMENT, GraphicsContext3D::RENDERBUFFER, m_depthBuffer);
+#endif
 
-    if (checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER) != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
-        LOG_ERROR("GraphicsContext3D: Wasn't able to create the main framebuffer");
-        m_contextValid = false;
+    GLenum status = checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER);
+    if (status != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
+        LOG_ERROR("GraphicsContext3D: Canvas FBO initialization failed.");
+        return;
     }
-}
 
-GraphicsContext3DInternal::~GraphicsContext3DInternal()
-{
-    delete m_glWidget;
-    m_glWidget = 0;
+    int clearFlags = GraphicsContext3D::COLOR_BUFFER_BIT;
+    if (m_attrs.depth)
+        clearFlags |= GraphicsContext3D::DEPTH_BUFFER_BIT;
+    if (m_attrs.stencil)
+        clearFlags |= GraphicsContext3D::STENCIL_BUFFER_BIT;
+
+    glClear(clearFlags);
+    glFlush();
 }
 
-QGLWidget* GraphicsContext3DInternal::getOwnerGLWidget(QWebPageClient* webPageClient)
+void GraphicsContext3DInternal::paint(QPainter* painter, const QStyleOptionGraphicsItem* option, QWidget* widget)
 {
-    QAbstractScrollArea* scrollArea = qobject_cast<QAbstractScrollArea*>(webPageClient->ownerWidget());
+    Q_UNUSED(widget);
 
-    if (scrollArea) 
-        return qobject_cast<QGLWidget*>(scrollArea->viewport());
+    QRectF rect = option ? option->rect : boundingRect();
 
-    return 0;
+    // Use direct texture mapping if WebGL canvas has a shared OpenGL context
+    // with browsers OpenGL context.
+    QGLWidget* viewportGLWidget = getViewportGLWidget();
+    if (viewportGLWidget && viewportGLWidget == m_viewportGLWidget && viewportGLWidget == painter->device()) {
+        viewportGLWidget->drawTexture(rect, m_texture);
+        return;
+    }
+
+    // Alternatively read pixels to a memory buffer.
+    QImage offscreenImage(rect.width(), rect.height(), QImage::Format_ARGB32);
+    quint32* imagePixels = reinterpret_cast<quint32*>(offscreenImage.bits());
+
+    m_glWidget->makeCurrent();
+    bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_canvasFbo);
+    glReadPixels(/* x */ 0, /* y */ 0, rect.width(), rect.height(), GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, imagePixels);
+
+    bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_currentFbo);
+
+    // OpenGL gives us ABGR on 32 bits, and with the origin at the bottom left
+    // We need RGB32 or ARGB32_PM, with the origin at the top left.
+    quint32* pixelsSrc = imagePixels;
+    const int height = static_cast<int>(rect.height());
+    const int width = static_cast<int>(rect.width());
+    const int halfHeight = height / 2;
+    for (int row = 0; row < halfHeight; ++row) {
+        const int targetIdx = (height - 1 - row) * width;
+        quint32* pixelsDst = imagePixels + targetIdx;
+        for (int column = 0; column < width; ++column) {
+            quint32 tempPixel = *pixelsSrc;
+            *pixelsSrc = swapBgrToRgb(*pixelsDst);
+            *pixelsDst = swapBgrToRgb(tempPixel);
+            ++pixelsSrc;
+            ++pixelsDst;
+        }
+    }
+    if (static_cast<int>(height) % 2) {
+        for (int column = 0; column < width; ++column) {
+            *pixelsSrc = swapBgrToRgb(*pixelsSrc);
+            ++pixelsSrc;
+        }
+    }
+    painter->drawImage(/* x */ 0, /* y */ 0, offscreenImage);
+}
+
+QRectF GraphicsContext3DInternal::boundingRect() const
+{
+    return m_boundingRect;
 }
 
 void* GraphicsContext3DInternal::getProcAddress(const String& proc)
@@ -477,7 +594,7 @@ void* GraphicsContext3DInternal::getProcAddress(const String& proc)
     }
 
     LOG_ERROR("GraphicsContext3D: Did not find GL function %s", proc.utf8().data());
-    m_contextValid = false;
+    m_valid = false;
     return 0;
 }
 
@@ -493,7 +610,7 @@ PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attri
 GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, bool)
     : m_internal(new GraphicsContext3DInternal(attrs, hostWindow))
 {
-    if (!m_internal->isContextValid()) 
+    if (!m_internal->isValid())
         m_internal = 0;
 }
 
@@ -511,6 +628,11 @@ Platform3DObject GraphicsContext3D::platformTexture() const
     return m_internal->m_texture;
 }
 
+PlatformLayer* GraphicsContext3D::platformLayer() const
+{
+    return m_internal.get();
+}
+
 void GraphicsContext3D::makeContextCurrent()
 {
     m_internal->m_glWidget->makeCurrent();
@@ -522,62 +644,25 @@ void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* co
     HTMLCanvasElement* canvas = context->canvas();
     ImageBuffer* imageBuffer = canvas->buffer();
     QPainter* painter = imageBuffer->context()->platformContext();
-    paint(painter, QRect(QPoint(0, 0), QSize(m_currentWidth, m_currentHeight)));
+    m_internal->paint(painter, 0, 0);
 }
 
-void GraphicsContext3D::paint(QPainter* painter, const QRect& rect) const
+PassRefPtr<ImageData> GraphicsContext3D::paintRenderingResultsToImageData()
 {
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
-    QWebPageClient* webPageClient = m_internal->m_hostWindow->platformPageClient();
-    QGLWidget* ownerGLWidget  = m_internal->getOwnerGLWidget(webPageClient);
-    if (ownerGLWidget) {
-        ownerGLWidget->drawTexture(rect, m_internal->m_texture);
-        return;
-    } 
-#endif
-    m_internal->m_glWidget->makeCurrent();
-    m_internal->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_internal->m_mainFbo);
-    glReadPixels(/* x */ 0, /* y */ 0, m_currentWidth, m_currentHeight, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, m_internal->m_pixels.bits());
-    painter->drawImage(/* x */ 0, /* y */ 0, m_internal->m_pixels.rgbSwapped().transformed(QMatrix().rotate(180)));
-    m_internal->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_internal->m_currentFbo); 
+    // FIXME: This needs to be implemented for proper non-premultiplied-alpha
+    // support.
+    return 0;
 }
 
 void GraphicsContext3D::reshape(int width, int height)
 {
-    if (((width == m_currentWidth) && (height == m_currentHeight)) || (!m_internal))
+    if (width == m_currentWidth && height == m_currentHeight || (!m_internal))
         return;
-    
+
     m_currentWidth = width;
     m_currentHeight = height;
 
-    m_internal->m_pixels = QImage(m_currentWidth, m_currentHeight, QImage::Format_ARGB32);
-
-    m_internal->m_glWidget->makeCurrent();
-
-    glBindTexture(GraphicsContext3D::TEXTURE_2D, m_internal->m_texture);
-    glTexImage2D(GraphicsContext3D::TEXTURE_2D, /* level */ 0, GraphicsContext3D::RGBA, width, height, /* border */ 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, /* data */ 0);
-    glBindTexture(GraphicsContext3D::TEXTURE_2D, 0);
-   
-    m_internal->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_internal->m_mainFbo);
-    m_internal->bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, m_internal->m_depthBuffer);
-#if defined(QT_OPENGL_ES_2)
-    renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT16, width, height);
-#else
-    renderbufferStorage(GraphicsContext3D::RENDERBUFFER, GraphicsContext3D::DEPTH_COMPONENT, width, height);
-#endif
-    m_internal->bindRenderbuffer(GraphicsContext3D::RENDERBUFFER, 0);
-    
-    m_internal->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, m_internal->m_texture, 0);
-    m_internal->framebufferRenderbuffer(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::DEPTH_ATTACHMENT, GraphicsContext3D::RENDERBUFFER, m_internal->m_depthBuffer);
-
-    GLenum status = m_internal->checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER);
-    if (status != GraphicsContext3D::FRAMEBUFFER_COMPLETE) {
-        LOG_ERROR("GraphicsContext3D: Wasn't able to reshape the main framebuffer");
-        notImplemented();
-    }
-
-    glClear(GraphicsContext3D::COLOR_BUFFER_BIT);
-    glFlush();
+    m_internal->reshape(width, height);
 }
 
 IntSize GraphicsContext3D::getInternalFramebufferSize()
@@ -626,7 +711,7 @@ void GraphicsContext3D::bindBuffer(GC3Denum target, Platform3DObject buffer)
 void GraphicsContext3D::bindFramebuffer(GC3Denum target, Platform3DObject buffer)
 {
     m_internal->m_glWidget->makeCurrent();
-    m_internal->m_currentFbo = buffer ? buffer : m_internal->m_mainFbo;
+    m_internal->m_currentFbo = buffer ? buffer : m_internal->m_canvasFbo;
     m_internal->bindFramebuffer(target, m_internal->m_currentFbo);
 }
 
@@ -1064,6 +1149,23 @@ void GraphicsContext3D::releaseShaderCompiler()
 void GraphicsContext3D::renderbufferStorage(GC3Denum target, GC3Denum internalformat, GC3Dsizei width, GC3Dsizei height)
 {
     m_internal->m_glWidget->makeCurrent();
+#if !defined(QT_OPENGL_ES_2)
+    switch (internalformat) {
+    case DEPTH_STENCIL:
+        internalformat = GL_DEPTH24_STENCIL8;
+        break;
+    case DEPTH_COMPONENT16:
+        internalformat = DEPTH_COMPONENT;
+        break;
+    case RGBA4:
+    case RGB5_A1:
+        internalformat = RGBA;
+        break;
+    case RGB565:
+        internalformat = RGB;
+        break;
+    }
+#endif
     m_internal->renderbufferStorage(target, internalformat, width, height);
 }
 
@@ -1598,6 +1700,22 @@ void GraphicsContext3D::synthesizeGLError(GC3Denum error)
     m_internal->m_syntheticErrors.add(error);
 }
 
+void GraphicsContext3D::markLayerComposited()
+{
+    m_internal->m_layerComposited = true;
+}
+
+void GraphicsContext3D::markContextChanged()
+{
+    // FIXME: Any accelerated compositor needs to be told to re-read from here.
+    m_internal->m_layerComposited = false;
+}
+
+bool GraphicsContext3D::layerComposited() const
+{
+    return m_internal->m_layerComposited;
+}
+
 Extensions3D* GraphicsContext3D::getExtensions()
 {
     if (!m_internal->m_extensions)
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index 9742755..e3e0fa6 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -9,6 +9,7 @@
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies).
  * Copyright (C) 2008 Dirk Schulze <vbs85@gmx.de>
  * Copyright (C) 2010, 2011 Sencha, Inc.
+ * Copyright (C) 2011 Andreas Kling <kling@webkit.org>
  *
  * All rights reserved.
  *
@@ -672,8 +673,6 @@ void GraphicsContext::fillRect(const FloatRect& rect)
     ContextShadow* shadow = contextShadow();
 
     if (m_state.fillPattern) {
-        AffineTransform affine;
-        QBrush brush(m_state.fillPattern->createPlatformPattern(affine));
         QPixmap* image = m_state.fillPattern->tileImage()->nativeImageForCurrentFrame();
         QPainter* shadowPainter = hasShadow() ? shadow->beginShadowLayer(this, normalizedRect) : 0;
         if (shadowPainter) {
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
index f3cfc47..1f77fc2 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
@@ -310,10 +310,6 @@ public:
         }
     } m_state;
 
-#if ENABLE(WEBGL)
-    const GraphicsContext3D* m_gc3D;
-#endif
-
 #ifndef QT_NO_ANIMATION
     friend class AnimationQtBase;
 #endif
@@ -340,9 +336,6 @@ GraphicsLayerQtImpl::GraphicsLayerQtImpl(GraphicsLayerQt* newLayer)
 #if ENABLE(TILED_BACKING_STORE)
     , m_tiledBackingStore(0)
 #endif
-#if ENABLE(WEBGL)
-    , m_gc3D(0)
-#endif
 {
     // We use graphics-view for compositing-only, not for interactivity.
     setAcceptedMouseButtons(Qt::NoButton);
@@ -665,11 +658,6 @@ void GraphicsLayerQtImpl::paint(QPainter* painter, const QStyleOptionGraphicsIte
     case MediaContentType:
         // we don't need to paint anything: we have a QGraphicsItem from the media element
         break;
-#if ENABLE(WEBGL)
-    case Canvas3DContentType:
-        m_gc3D->paint(painter, option->rect);
-        break;
-#endif
     }
 }
 
@@ -808,16 +796,6 @@ void GraphicsLayerQtImpl::flushChanges(bool recursive, bool forceUpdateTransform
 
             setFlag(ItemHasNoContents, !m_layer->drawsContent());
             break;
-
-#if ENABLE(WEBGL)
-        case Canvas3DContentType:
-            if (m_pendingContent.contentType != m_currentContent.contentType)
-                update();
-
-            setCacheMode(NoCache);
-            setFlag(ItemHasNoContents, false);
-            break;
-#endif
         }
     }
 
@@ -1268,23 +1246,6 @@ void GraphicsLayerQt::setContentsBackgroundColor(const Color& color)
     GraphicsLayer::setContentsBackgroundColor(color);
 }
 
-#if ENABLE(WEBGL)
-void GraphicsLayerQt::setContentsToGraphicsContext3D(const GraphicsContext3D* ctx)
-{
-    if (ctx == m_impl->m_gc3D)
-        return;
-
-    m_impl->m_pendingContent.contentType = GraphicsLayerQtImpl::Canvas3DContentType;
-    m_impl->m_gc3D = ctx;
-    m_impl->notifyChange(GraphicsLayerQtImpl::ContentChange);
-}
-
-void GraphicsLayerQt::setGraphicsContext3DNeedsDisplay()
-{
-    setNeedsDisplay();
-}
-#endif
-
 void GraphicsLayerQt::setContentsToMedia(PlatformLayer* media)
 {
     if (media) {
@@ -1297,6 +1258,11 @@ void GraphicsLayerQt::setContentsToMedia(PlatformLayer* media)
     GraphicsLayer::setContentsToMedia(media);
 }
 
+void GraphicsLayerQt::setContentsToCanvas(PlatformLayer* canvas)
+{
+    setContentsToMedia(canvas);
+}
+
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerQt::setContentsOrientation(CompositingCoordinatesOrientation orientation)
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.h b/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.h
index 569bd8d..2af98fd 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.h
+++ b/Source/WebCore/platform/graphics/qt/GraphicsLayerQt.h
@@ -20,9 +20,6 @@
 #ifndef GraphicsLayerQt_h
 #define GraphicsLayerQt_h
 
-#if ENABLE(WEBGL)
-#include "GraphicsContext3D.h"
-#endif
 #include "GraphicsLayer.h"
 #include "GraphicsLayerClient.h"
 
@@ -78,11 +75,8 @@ public:
     virtual void setContentsToImage(Image*);
     virtual void setContentsNeedsDisplay();
     virtual void setContentsToMedia(PlatformLayer*);
+    virtual void setContentsToCanvas(PlatformLayer*);
     virtual void setContentsBackgroundColor(const Color&);
-#if ENABLE(WEBGL)
-    virtual void setContentsToGraphicsContext3D(const GraphicsContext3D*);
-    virtual void setGraphicsContext3DNeedsDisplay();
-#endif
     virtual void setContentsOrientation(CompositingCoordinatesOrientation orientation);
     virtual void distributeOpacity(float);
     virtual float accumulatedOpacity() const;
diff --git a/Source/WebCore/platform/graphics/qt/ImageBufferData.h b/Source/WebCore/platform/graphics/qt/ImageBufferData.h
index aa32253..602197e 100644
--- a/Source/WebCore/platform/graphics/qt/ImageBufferData.h
+++ b/Source/WebCore/platform/graphics/qt/ImageBufferData.h
@@ -42,6 +42,8 @@ class ImageBufferData {
 public:
     ImageBufferData(const IntSize&);
 
+    QImage toQImage() const;
+
     QPixmap m_pixmap;
     OwnPtr<QPainter> m_painter;
     RefPtr<Image> m_image;
diff --git a/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp b/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
index 62f5c3e..f7d63ca 100644
--- a/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
@@ -80,6 +80,21 @@ ImageBufferData::ImageBufferData(const IntSize& size)
     m_image = StillImage::createForRendering(&m_pixmap);
 }
 
+QImage ImageBufferData::toQImage() const
+{
+    QPaintEngine* paintEngine = m_pixmap.paintEngine();
+    if (!paintEngine || paintEngine->type() != QPaintEngine::Raster)
+        return m_pixmap.toImage();
+
+    // QRasterPixmapData::toImage() will deep-copy the backing QImage if there's an active QPainter on it.
+    // For performance reasons, we don't want that here, so we temporarily redirect the paint engine.
+    QPaintDevice* currentPaintDevice = paintEngine->paintDevice();
+    paintEngine->setPaintDevice(0);
+    QImage image = m_pixmap.toImage();
+    paintEngine->setPaintDevice(currentPaintDevice);
+    return image;
+}
+
 ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace, RenderingMode, bool& success)
     : m_data(size)
     , m_size(size)
@@ -159,7 +174,7 @@ void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
     if (isPainting)
         m_data.m_painter->end();
 
-    QImage image = m_data.m_pixmap.toImage().convertToFormat(QImage::Format_ARGB32);
+    QImage image = m_data.toQImage().convertToFormat(QImage::Format_ARGB32);
     ASSERT(!image.isNull());
 
     uchar* bits = image.bits();
@@ -214,16 +229,12 @@ PassRefPtr<ByteArray> getImageData(const IntRect& rect, const ImageBufferData& i
     int numRows = endy - originy;
 
     // NOTE: For unmultiplied data, we undo the premultiplication below.
-    QImage image = imageData.m_pixmap.toImage().convertToFormat(QImage::Format_ARGB32_Premultiplied);
+    QImage image = imageData.toQImage().convertToFormat(QImage::Format_ARGB32_Premultiplied);
 
     ASSERT(!image.isNull());
 
     const int bytesPerLine = image.bytesPerLine();
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     const uchar* bits = image.constBits();
-#else
-    const uchar* bits = image.bits();
-#endif
 
     quint32* destRows = reinterpret_cast_ptr<quint32*>(&data[desty * rect.width() * 4 + destx * 4]);
 
diff --git a/Source/WebCore/platform/graphics/qt/ImageDecoderQt.cpp b/Source/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
index 3540994..8cda231 100644
--- a/Source/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
@@ -194,15 +194,7 @@ void ImageDecoderQt::internalReadImage(size_t frameIndex)
 
 bool ImageDecoderQt::internalHandleCurrentImage(size_t frameIndex)
 {
-    QPixmap pixmap;
-
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
-    pixmap = QPixmap::fromImageReader(m_reader.get());
-#else
-    QImage img;
-    if (m_reader->read(&img))
-        pixmap = QPixmap::fromImage(img);
-#endif
+    QPixmap pixmap = QPixmap::fromImageReader(m_reader.get());
 
     if (pixmap.isNull()) {
         frameCount();
diff --git a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
index 001d45b..bc43acf 100644
--- a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
@@ -74,7 +74,7 @@ void MediaPlayerPrivateQt::getSupportedTypes(HashSet<String> &supported)
 
     for (int i = 0; i < types.size(); i++) {
         QString mime = types.at(i);
-        if (mime.startsWith("audio/") || mime.startsWith("video/"))
+        if (mime.startsWith(QString::fromLatin1("audio/")) || mime.startsWith(QString::fromLatin1("video/")))
             supported.add(mime);
     }
 }
@@ -103,7 +103,6 @@ MediaPlayerPrivateQt::MediaPlayerPrivateQt(MediaPlayer* player)
     , m_isVisible(false)
     , m_isSeeking(false)
     , m_composited(false)
-    , m_queuedSeek(-1)
     , m_preload(MediaPlayer::Auto)
     , m_suppressNextPlaybackChanged(false)
 {
@@ -195,7 +194,7 @@ void MediaPlayerPrivateQt::commitLoad(const String& url)
     HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
 
     // Construct the media content with a network request if the resource is http[s]
-    if (scheme == "http" || scheme == "https") {
+    if (scheme == QString::fromLatin1("http") || scheme == QString::fromLatin1("https")) {
         QNetworkRequest request = QNetworkRequest(rUrl);
 
         // Grab the current document
@@ -220,7 +219,7 @@ void MediaPlayerPrivateQt::commitLoad(const String& url)
 
             // Set the refferer, but not when requesting insecure content from a secure page
             QUrl documentUrl = QUrl(QString(document->documentURI()));
-            if (documentUrl.scheme().toLower() == "http" || scheme == "https")
+            if (documentUrl.scheme().toLower() == QString::fromLatin1("http") || scheme == QString::fromLatin1("https"))
                 request.setRawHeader("Referer", documentUrl.toEncoded());
 
             // Set the user agent
@@ -296,32 +295,8 @@ void MediaPlayerPrivateQt::seek(float position)
     if (m_mediaPlayerControl && !m_mediaPlayerControl->availablePlaybackRanges().contains(position * 1000))
         return;
 
-    if (m_isSeeking)
-        return;
-
-    if (position > duration())
-        position = duration();
-
-    // Seeking is most reliable when we're paused.
-    // Webkit will try to pause before seeking, but due to the asynchronous nature
-    // of the backend, the player may not actually be paused yet.
-    // In this case, we should queue the seek and wait until pausing has completed
-    // before attempting to seek.
-    if (m_mediaPlayer->state() == QMediaPlayer::PlayingState) {
-        m_mediaPlayer->pause();
-        m_isSeeking = true;
-        m_queuedSeek = static_cast<qint64>(position * 1000);
-
-        // Set a timeout, so that in the event that we don't get a state changed
-        // signal, we still attempt the seek.
-        QTimer::singleShot(1000, this, SLOT(queuedSeekTimeout()));
-    } else {
-        m_isSeeking = true;
-        m_mediaPlayer->setPosition(static_cast<qint64>(position * 1000));
-
-        // Set a timeout, in case we don't get a position changed signal
-        QTimer::singleShot(10000, this, SLOT(seekTimeout()));
-    }
+    m_isSeeking = true;
+    m_mediaPlayer->setPosition(static_cast<qint64>(position * 1000));
 }
 
 bool MediaPlayerPrivateQt::seeking() const
@@ -443,13 +418,8 @@ void MediaPlayerPrivateQt::handleError(QMediaPlayer::Error)
     updateStates();
 }
 
-void MediaPlayerPrivateQt::stateChanged(QMediaPlayer::State state)
+void MediaPlayerPrivateQt::stateChanged(QMediaPlayer::State)
 {
-    if (state != QMediaPlayer::PlayingState && m_isSeeking && m_queuedSeek >= 0) {
-        m_mediaPlayer->setPosition(m_queuedSeek);
-        m_queuedSeek = -1;
-    }
-
     if (!m_suppressNextPlaybackChanged)
         m_webCorePlayer->playbackStateChanged();
     else
@@ -468,34 +438,12 @@ void MediaPlayerPrivateQt::nativeSizeChanged(const QSizeF& size)
     m_webCorePlayer->sizeChanged();
 }
 
-void MediaPlayerPrivateQt::queuedSeekTimeout()
-{
-    // If we haven't heard anything, assume the player is now paused
-    // and we can attempt the seek
-    if (m_isSeeking && m_queuedSeek >= 0) {
-        m_mediaPlayer->setPosition(m_queuedSeek);
-        m_queuedSeek = -1;
-
-        // Set a timeout, in case we don't get a position changed signal
-        QTimer::singleShot(10000, this, SLOT(seekTimeout()));
-    }
-}
-
-void MediaPlayerPrivateQt::seekTimeout()
-{
-    // If we haven't heard anything, assume the seek succeeded
-    if (m_isSeeking) {
-        m_webCorePlayer->timeChanged();
-        m_isSeeking = false;
-    }
-}
-
 void MediaPlayerPrivateQt::positionChanged(qint64)
 {
     // Only propagate this event if we are seeking
-    if (m_isSeeking && m_queuedSeek == -1) {
-        m_webCorePlayer->timeChanged();
+    if (m_isSeeking) {
         m_isSeeking = false;
+        m_webCorePlayer->timeChanged();
     }
 }
 
@@ -649,7 +597,7 @@ void MediaPlayerPrivateQt::repaint()
 
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
 
-class TextureMapperVideoLayerQt : public virtual TextureMapperVideoLayer {
+class TextureMapperVideoLayerQt : public virtual TextureMapperMediaLayer {
 public:
     TextureMapperVideoLayerQt(QGraphicsVideoItem* videoItem)
         : m_videoItem(videoItem)
diff --git a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
index 81cdd79..c6398c9 100644
--- a/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
+++ b/Source/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
@@ -33,7 +33,7 @@ QT_END_NAMESPACE
 
 namespace WebCore {
 
-class TextureMapperVideoLayer;
+class TextureMapperMediaLayer;
 
 class MediaPlayerPrivateQt : public QObject, public MediaPlayerPrivateInterface {
 
@@ -120,8 +120,6 @@ private slots:
     void handleError(QMediaPlayer::Error);
     void stateChanged(QMediaPlayer::State);
     void nativeSizeChanged(const QSizeF&);
-    void queuedSeekTimeout();
-    void seekTimeout();
     void positionChanged(qint64);
     void durationChanged(qint64);
     void bufferStatusChanged(int);
@@ -141,7 +139,7 @@ private:
     QGraphicsVideoItem* m_videoItem;
     QGraphicsScene* m_videoScene;
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
-    OwnPtr<TextureMapperVideoLayer> m_platformLayer;
+    OwnPtr<TextureMapperMediaLayer> m_platformLayer;
 #endif
 
     mutable MediaPlayer::NetworkState m_networkState;
@@ -153,7 +151,6 @@ private:
     bool m_isVisible;
     bool m_isSeeking;
     bool m_composited;
-    qint64 m_queuedSeek;
     MediaPlayer::Preload m_preload;
     bool m_delayingLoad;
     String m_mediaUrl;
diff --git a/Source/WebCore/platform/graphics/qt/PathQt.cpp b/Source/WebCore/platform/graphics/qt/PathQt.cpp
index ad482f7..ccc7f3d 100644
--- a/Source/WebCore/platform/graphics/qt/PathQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/PathQt.cpp
@@ -154,7 +154,7 @@ FloatRect Path::boundingRect() const
     return m_path.boundingRect();
 }
 
-FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 {
     GraphicsContext* context = scratchContext();
     QPainterPathStroker stroke;
@@ -398,23 +398,15 @@ void Path::apply(void* info, PathApplierFunction function) const
 void Path::transform(const AffineTransform& transform)
 {
     QTransform qTransform(transform);
-#if QT_VERSION < QT_VERSION_CHECK(4, 7, 0)
-    // Workaround for http://bugreports.qt.nokia.com/browse/QTBUG-11264
-    // QTransform.map doesn't handle the MoveTo element because of the isEmpty issue
-    if (m_path.isEmpty() && m_path.elementCount()) {
-        QPointF point = qTransform.map(m_path.currentPosition());
-        moveTo(point);
-    } else 
-#endif
-        m_path = qTransform.map(m_path);
-}
-
-float Path::length()
+    m_path = qTransform.map(m_path);
+}
+
+float Path::length() const
 {
     return m_path.length();
 }
 
-FloatPoint Path::pointAtLength(float length, bool& ok)
+FloatPoint Path::pointAtLength(float length, bool& ok) const
 {
     ok = (length >= 0 && length <= m_path.length());
 
@@ -424,7 +416,7 @@ FloatPoint Path::pointAtLength(float length, bool& ok)
     return point;
 }
 
-float Path::normalAngleAtLength(float length, bool& ok)
+float Path::normalAngleAtLength(float length, bool& ok) const
 {
     ok = (length >= 0 && length <= m_path.length());
 
diff --git a/Source/WebCore/platform/graphics/qt/TileQt.cpp b/Source/WebCore/platform/graphics/qt/TileQt.cpp
index 096ce14..8723cd4 100644
--- a/Source/WebCore/platform/graphics/qt/TileQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/TileQt.cpp
@@ -91,10 +91,10 @@ void Tile::invalidate(const IntRect& dirtyRect)
     *m_dirtyRegion += tileDirtyRect;
 }
     
-void Tile::updateBackBuffer()
+Vector<IntRect> Tile::updateBackBuffer()
 {
     if (m_buffer && !isDirty())
-        return;
+        return Vector<IntRect>();
 
     if (!m_backBuffer) {
         if (!m_buffer) {
@@ -115,15 +115,19 @@ void Tile::updateBackBuffer()
     GraphicsContext context(&painter);
     context.translate(-m_rect.x(), -m_rect.y());
 
+    Vector<IntRect> updatedRects;
     int size = dirtyRects.size();
     for (int n = 0; n < size; ++n)  {
         context.save();
         IntRect rect = dirtyRects[n];
+        updatedRects.append(rect);
         context.clip(FloatRect(rect));
         context.scale(FloatSize(m_backingStore->m_contentsScale, m_backingStore->m_contentsScale));
         m_backingStore->m_client->tiledBackingStorePaint(&context, m_backingStore->mapToContents(rect));
         context.restore();
     }
+
+    return updatedRects;
 }
 
 void Tile::swapBackBufferToFront()
diff --git a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
index 0e68c21..cc695a5 100644
--- a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.cpp
@@ -65,7 +65,8 @@ FontCustomPlatformData::~FontCustomPlatformData()
 #endif
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation orientation, FontWidthVariant, FontRenderingMode mode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation orientation,
+                                                          TextOrientation textOrientation, FontWidthVariant, FontRenderingMode mode)
 {
 #if OS(WINDOWS)
     ASSERT(m_fontReference);
@@ -102,7 +103,7 @@ FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, b
     return FontPlatformData(hfont, size);
 #elif OS(LINUX) || OS(FREEBSD) || PLATFORM(BREWMP)
     ASSERT(m_fontReference);
-    return FontPlatformData(m_fontReference, "", size, bold && !m_fontReference->isBold(), italic && !m_fontReference->isItalic(), orientation);
+    return FontPlatformData(m_fontReference, "", size, bold && !m_fontReference->isBold(), italic && !m_fontReference->isItalic(), orientation, textOrientation);
 #else
     notImplemented();
     return FontPlatformData();
diff --git a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.h
index 2dee3ab..b68722b 100644
--- a/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/skia/FontCustomPlatformData.h
@@ -35,6 +35,7 @@
 #include "FontOrientation.h"
 #include "FontRenderingMode.h"
 #include "FontWidthVariant.h"
+#include "TextOrientation.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 
@@ -66,8 +67,8 @@ public:
 
     ~FontCustomPlatformData();
 
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth,
-                                      FontRenderingMode = NormalRenderingMode);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight,
+                                      FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
     static bool supportsFormat(const String&);
 
diff --git a/Source/WebCore/platform/graphics/skia/GlyphPageTreeNodeSkia.cpp b/Source/WebCore/platform/graphics/skia/GlyphPageTreeNodeSkia.cpp
index 66e6839..f362fa3 100644
--- a/Source/WebCore/platform/graphics/skia/GlyphPageTreeNodeSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GlyphPageTreeNodeSkia.cpp
@@ -91,7 +91,7 @@ bool GlyphPage::fill(unsigned offset, unsigned length, UChar* buffer, unsigned b
         return false;
     }
 
-    if ((fontData->orientation() == Vertical) && (!fontData->isBrokenIdeographFont())) {
+    if (fontData->hasVerticalGlyphs()) {
         bool lookVariants = false;
         for (unsigned i = 0; i < bufferLength; ++i) {
             if (!Font::isCJKIdeograph(buffer[i])) {
diff --git a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
index 00afd07..df680eb 100644
--- a/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
@@ -1025,6 +1025,14 @@ void GraphicsContext::setPlatformShadow(const FloatSize& size,
     if (paintingDisabled())
         return;
 
+    if (platformContext()->useGPU()) {
+        GLES2Canvas* canvas = platformContext()->gpuCanvas();
+        canvas->setShadowOffset(size);
+        canvas->setShadowBlur(blurFloat);
+        canvas->setShadowColor(color, colorSpace);
+        canvas->setShadowsIgnoreTransforms(m_state.shadowsIgnoreTransforms);
+    }
+
     // Detect when there's no effective shadow and clear the looper.
     if (!size.width() && !size.height() && !blurFloat) {
         platformContext()->setDrawLooper(0);
@@ -1035,14 +1043,15 @@ void GraphicsContext::setPlatformShadow(const FloatSize& size,
     double height = size.height();
     double blur = blurFloat;
 
-    SkBlurDrawLooper::BlurFlags blurFlags = SkBlurDrawLooper::kNone_BlurFlag;
+    uint32_t blurFlags = SkBlurDrawLooper::kHighQuality_BlurFlag | 
+        SkBlurDrawLooper::kOverrideColor_BlurFlag;
 
     if (m_state.shadowsIgnoreTransforms)  {
         // Currently only the GraphicsContext associated with the
         // CanvasRenderingContext for HTMLCanvasElement have shadows ignore
         // Transforms. So with this flag set, we know this state is associated
         // with a CanvasRenderingContext.
-        blurFlags = SkBlurDrawLooper::kIgnoreTransform_BlurFlag;
+        blurFlags |= SkBlurDrawLooper::kIgnoreTransform_BlurFlag;
         
         // CG uses natural orientation for Y axis, but the HTML5 canvas spec
         // does not.
diff --git a/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp b/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
index 2721523..b89c68d 100644
--- a/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
@@ -341,6 +341,28 @@ void ImageBuffer::putPremultipliedImageData(ByteArray* source, const IntSize& so
     putImageData<Premultiplied>(source, sourceSize, sourceRect, destPoint, context()->platformContext()->canvas()->getDevice(), m_size);
 }
 
+template <typename T>
+static String ImageToDataURL(T& source, const String& mimeType, const double* quality)
+{
+    Vector<unsigned char> encodedImage;
+    if (mimeType == "image/jpeg") {
+        int compressionQuality = JPEGImageEncoder::DefaultCompressionQuality;
+        if (quality && *quality >= 0.0 && *quality <= 1.0)
+            compressionQuality = static_cast<int>(*quality * 100 + 0.5);
+        if (!JPEGImageEncoder::encode(source, compressionQuality, &encodedImage))
+            return "data:,";
+    } else {
+        if (!PNGImageEncoder::encode(source, &encodedImage))
+            return "data:,";
+        ASSERT(mimeType == "image/png");
+    }
+
+    Vector<char> base64Data;
+    base64Encode(*reinterpret_cast<Vector<char>*>(&encodedImage), base64Data);
+
+    return makeString("data:", mimeType, ";base64,", base64Data);
+}
+
 String ImageBuffer::toDataURL(const String& mimeType, const double* quality) const
 {
     ASSERT(MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType));
@@ -358,23 +380,13 @@ String ImageBuffer::toDataURL(const String& mimeType, const double* quality) con
         if (!device->readPixels(bounds, &bitmap))
             return "data:,";
     }
-    
-    if (mimeType == "image/jpeg") {
-        int compressionQuality = JPEGImageEncoder::DefaultCompressionQuality;
-        if (quality && *quality >= 0.0 && *quality <= 1.0)
-            compressionQuality = static_cast<int>(*quality * 100 + 0.5);
-        if (!JPEGImageEncoder::encode(bitmap, compressionQuality, &encodedImage))
-            return "data:,";
-    } else {
-        if (!PNGImageEncoder::encode(bitmap, &encodedImage))
-            return "data:,";
-        ASSERT(mimeType == "image/png");
-    }
 
-    Vector<char> base64Data;
-    base64Encode(*reinterpret_cast<Vector<char>*>(&encodedImage), base64Data);
+    return ImageToDataURL(bitmap, mimeType, quality);
+}
 
-    return makeString("data:", mimeType, ";base64,", base64Data);
+String ImageDataToDataURL(const ImageData& source, const String& mimeType, const double* quality)
+{
+    return ImageToDataURL(source, mimeType, quality);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/skia/ImageSkia.cpp b/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
index 91a4e4f..72bec29 100644
--- a/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/ImageSkia.cpp
@@ -260,6 +260,7 @@ static void paintSkBitmap(PlatformContextSkia* platformContext, const NativeImag
     paint.setXfermodeMode(compOp);
     paint.setFilterBitmap(true);
     paint.setAlpha(platformContext->getNormalizedAlpha());
+    paint.setLooper(platformContext->getDrawLooper());
 
     skia::PlatformCanvas* canvas = platformContext->canvas();
 
diff --git a/Source/WebCore/platform/graphics/skia/PathSkia.cpp b/Source/WebCore/platform/graphics/skia/PathSkia.cpp
index 0344086..b037a0d 100644
--- a/Source/WebCore/platform/graphics/skia/PathSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/PathSkia.cpp
@@ -228,7 +228,7 @@ void Path::transform(const AffineTransform& xform)
     m_path->transform(xform);
 }
 
-FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 {
     GraphicsContext* scratch = scratchContext();
     scratch->save();
diff --git a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index eac5e4a..8e1937f 100644
--- a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -68,18 +68,6 @@
 
 namespace WebCore {
 
-#if ENABLE(SKIA_GPU)
-GrContext* GetGlobalGrContext()
-{
-    static GrContext* gGR;
-    if (!gGR) {
-        gGR = GrContext::CreateGLShaderContext();
-        gGR->setTextureCacheLimits(512, 50 * 1024 * 1024);
-    }
-    return gGR;
-}
-#endif
-
 extern bool isPathSkiaSafe(const SkMatrix& transform, const SkPath& path);
 
 // State -----------------------------------------------------------------------
@@ -241,8 +229,14 @@ PlatformContextSkia::PlatformContextSkia(skia::PlatformCanvas* canvas)
 PlatformContextSkia::~PlatformContextSkia()
 {
 #if ENABLE(ACCELERATED_2D_CANVAS)
-    if (m_gpuCanvas)
+    if (m_gpuCanvas) {
+#if ENABLE(SKIA_GPU)
+        // make sure everything related to this platform context has been flushed
+        if (!m_useGPU)
+            m_gpuCanvas->context()->grContext()->flush(0);
+#endif
         m_gpuCanvas->drawingBuffer()->setWillPublishCallback(0);
+    }
 #endif
 }
 
@@ -697,8 +691,7 @@ void PlatformContextSkia::applyAntiAliasedClipPaths(WTF::Vector<SkPath>& paths)
 
 bool PlatformContextSkia::canAccelerate() const
 {
-    return !m_state->m_fillShader // Can't accelerate with a fill gradient or pattern.
-        && !m_state->m_looper; // Can't accelerate with a shadow.
+    return !m_state->m_fillShader; // Can't accelerate with a fill gradient or pattern.
 }
 
 bool PlatformContextSkia::canvasClipApplied() const
@@ -741,8 +734,10 @@ void PlatformContextSkia::setSharedGraphicsContext3D(SharedGraphicsContext3D* co
         context->makeContextCurrent();
         m_gpuCanvas->bindFramebuffer();
 
-        GrContext* gr = GetGlobalGrContext();
+        GrContext* gr = context->grContext();
         gr->resetContext();
+        drawingBuffer->setGrContext(gr);
+
         SkDeviceFactory* factory = new SkGpuDeviceFactory(gr, SkGpuDevice::Current3DApiRenderTarget());
         SkDevice* device = factory->newDevice(m_canvas, SkBitmap::kARGB_8888_Config, drawingBuffer->size().width(), drawingBuffer->size().height(), false, false);
         m_canvas->setDevice(device)->unref();
diff --git a/Source/WebCore/platform/graphics/skia/SkiaFontWin.cpp b/Source/WebCore/platform/graphics/skia/SkiaFontWin.cpp
index 54aa35e..b0cb0c7 100644
--- a/Source/WebCore/platform/graphics/skia/SkiaFontWin.cpp
+++ b/Source/WebCore/platform/graphics/skia/SkiaFontWin.cpp
@@ -380,6 +380,11 @@ bool paintSkiaText(GraphicsContext* context,
         paint.reset();
         platformContext->setupPaintForStroking(&paint, 0, 0);
         paint.setFlags(SkPaint::kAntiAlias_Flag);
+#if ENABLE(SKIA_TEXT)
+        paint.setTextEncoding(SkPaint::kGlyphID_TextEncoding);
+        setupPaintForFont(hfont, &paint);
+#endif
+
         if (didFill) {
             // If there is a shadow and we filled above, there will already be
             // a shadow. We don't want to draw it again or it will be too dark
@@ -390,7 +395,7 @@ bool paintSkiaText(GraphicsContext* context,
             // thing would be to draw to a new layer and then draw that layer
             // with a shadow. But this is a lot of extra work for something
             // that isn't normally an issue.
-            SkSafeUnref(paint.setLooper(0));
+            paint.setLooper(0);
         }
 
         if (!skiaDrawText(hfont, dc, platformContext->canvas(), *origin, &paint,
diff --git a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
index 4698239..760ba6c 100644
--- a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
+++ b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
@@ -336,7 +336,7 @@ void GraphicsLayerTextureMapper::setContentsToMedia(PlatformLayer* media)
     notifyChange(TextureMapperNode::ContentChange);
     m_pendingContent.contentType = media ? TextureMapperNode::MediaContentType : TextureMapperNode::HTMLContentType;
     if (media)
-        m_pendingContent.media = static_cast<TextureMapperVideoLayer*>(media);
+        m_pendingContent.media = static_cast<TextureMapperMediaLayer*>(media);
     else
         m_pendingContent.media = 0;
 }
@@ -366,13 +366,6 @@ void GraphicsLayerTextureMapper::syncCompositingState()
 }
 
 /* \reimp (GraphicsLayer.h)
- */
-NativeLayer GraphicsLayerTextureMapper::nativeLayer() const
-{
-    return m_node.get();
-}
-
-/* \reimp (GraphicsLayer.h)
 */
 PlatformLayer* GraphicsLayerTextureMapper::platformLayer() const
 {
diff --git a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
index 47a27c6..dcf4938 100644
--- a/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
@@ -81,7 +81,6 @@ public:
     virtual void syncCompositingState();
     virtual void syncCompositingStateForThisLayerOnly();
     virtual void setName(const String& name);
-    virtual NativeLayer nativeLayer() const;
     virtual PlatformLayer* platformLayer() const;
 
     virtual bool addAnimation(const KeyframeValueList&, const IntSize& /*boxSize*/, const Animation*, const String& /*keyframesName*/, double /*timeOffset*/) { return false; }
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapper.h b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
index 589fda1..8e46e3c 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
@@ -31,6 +31,7 @@
 #include "IntRect.h"
 #include "IntSize.h"
 #include "TransformationMatrix.h"
+#include <wtf/UnusedParam.h>
 
 /*
     TextureMapper is a mechanism that enables hardware acceleration of CSS animations (accelerated compositing) without
@@ -68,7 +69,7 @@ public:
         return beginPaint(IntRect(0, 0, size().width(), size().height()));
     }
     virtual void setContentsToImage(Image*) = 0;
-    virtual bool save(const String& filename) { return false; }
+    virtual bool save(const String&) { return false; }
 
     inline void lock() { ++m_lockCount; }
     inline void unlock() { --m_lockCount; }
@@ -101,6 +102,7 @@ public:
     virtual void bindSurface(BitmapTexture* surface) = 0;
     virtual void paintToTarget(const BitmapTexture& texture, const IntSize&, const TransformationMatrix& matrix, float opacity, const IntRect& visibleRect)
     {
+        UNUSED_PARAM(visibleRect);
         drawTexture(texture, IntRect(0, 0, texture.contentSize().width(), texture.contentSize().height()), matrix, opacity, 0);
     }
 
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperNode.h b/Source/WebCore/platform/graphics/texmap/TextureMapperNode.h
index 9694043..c5decc1 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperNode.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperNode.h
@@ -20,19 +20,19 @@
 #ifndef TextureMapperNode_h
 #define TextureMapperNode_h
 
-#include "CurrentTime.h"
 #include "FloatRect.h"
 #include "GraphicsContext.h"
 #include "GraphicsLayer.h"
-#include "HashMap.h"
 #include "Image.h"
-#include "RefCounted.h"
 #include "TextureMapper.h"
 #include "TextureMapperPlatformLayer.h"
 #include "Timer.h"
 #include "TransformOperations.h"
 #include "TranslateTransformOperation.h"
 #include "UnitBezier.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/HashMap.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
@@ -94,7 +94,7 @@ public:
 
         ContentType contentType;
         RefPtr<Image> image;
-        TextureMapperVideoLayer* media;
+        TextureMapperMediaLayer* media;
 
         ContentData()
             : needsDisplay(false)
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h b/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
index 2a38b90..d2d646a 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
@@ -43,7 +43,7 @@ class TextureMapperPlatformLayer {
 public:
     enum Type {
         ContentLayer,
-        VideoLayer
+        MediaLayer
     };
 
     virtual Type layerType() const = 0;
@@ -66,13 +66,11 @@ public:
     virtual Type layerType() const { return ContentLayer; }
 };
 
-#if ENABLE(VIDEO)
-class TextureMapperVideoLayer : public TextureMapperPlatformLayer {
+class TextureMapperMediaLayer : public TextureMapperPlatformLayer {
 public:
     virtual void paint(GraphicsContext*) = 0;
-    virtual Type layerType() const { return VideoLayer; }
+    virtual Type layerType() const { return MediaLayer; }
 };
-#endif
 
 }
 
diff --git a/Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.cpp b/Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.cpp
index a8ad131..b1ea99b 100644
--- a/Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.cpp
+++ b/Source/WebCore/platform/graphics/transforms/TranslateTransformOperation.cpp
@@ -21,6 +21,7 @@
 
 #include "config.h"
 #include "TranslateTransformOperation.h"
+#include "FloatConversion.h"
 
 namespace WebCore {
 
@@ -30,15 +31,15 @@ PassRefPtr<TransformOperation> TranslateTransformOperation::blend(const Transfor
         return this;
     
     if (blendToIdentity)
-        return TranslateTransformOperation::create(Length(m_x.type()).blend(m_x, progress), 
-                                                   Length(m_y.type()).blend(m_y, progress), 
-                                                   Length(m_z.type()).blend(m_z, progress), m_type);
+        return TranslateTransformOperation::create(Length(m_x.type()).blend(m_x, narrowPrecisionToFloat(progress)), 
+                                                   Length(m_y.type()).blend(m_y, narrowPrecisionToFloat(progress)), 
+                                                   Length(m_z.type()).blend(m_z, narrowPrecisionToFloat(progress)), m_type);
 
     const TranslateTransformOperation* fromOp = static_cast<const TranslateTransformOperation*>(from);
     Length fromX = fromOp ? fromOp->m_x : Length(m_x.type());
     Length fromY = fromOp ? fromOp->m_y : Length(m_y.type());
     Length fromZ = fromOp ? fromOp->m_z : Length(m_z.type());
-    return TranslateTransformOperation::create(m_x.blend(fromX, progress), m_y.blend(fromY, progress), m_z.blend(fromZ, progress), m_type);
+    return TranslateTransformOperation::create(m_x.blend(fromX, narrowPrecisionToFloat(progress)), m_y.blend(fromY, narrowPrecisionToFloat(progress)), m_z.blend(fromZ, narrowPrecisionToFloat(progress)), m_type);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/win/FontCacheWin.cpp b/Source/WebCore/platform/graphics/win/FontCacheWin.cpp
index e800245..5382ef7 100644
--- a/Source/WebCore/platform/graphics/win/FontCacheWin.cpp
+++ b/Source/WebCore/platform/graphics/win/FontCacheWin.cpp
@@ -584,7 +584,7 @@ FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontD
 #if PLATFORM(CG)
     bool fontCreationFailed = !result->cgFont();
 #elif PLATFORM(CAIRO)
-    bool fontCreationFailed = !result->fontFace();
+    bool fontCreationFailed = !result->scaledFont();
 #endif
 
     if (fontCreationFailed) {
diff --git a/Source/WebCore/platform/graphics/win/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/win/FontCustomPlatformData.cpp
index 4aee6cd..8348acb 100644
--- a/Source/WebCore/platform/graphics/win/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/win/FontCustomPlatformData.cpp
@@ -59,7 +59,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
     }
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode renderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, TextOrientation, FontWidthVariant, FontRenderingMode renderingMode)
 {
     ASSERT(m_fontReference);
     ASSERT(T2embedLibrary());
diff --git a/Source/WebCore/platform/graphics/win/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/win/FontCustomPlatformData.h
index abdb356..65388d8 100644
--- a/Source/WebCore/platform/graphics/win/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/win/FontCustomPlatformData.h
@@ -25,6 +25,7 @@
 #include "FontRenderingMode.h"
 #include "FontWidthVariant.h"
 #include "PlatformString.h"
+#include "TextOrientation.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 
@@ -46,7 +47,8 @@ public:
 
     ~FontCustomPlatformData();
 
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight,
+                                      FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
     static bool supportsFormat(const String&);
 
diff --git a/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.cpp b/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.cpp
index fd30a6d..6f9bbf0 100644
--- a/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.cpp
+++ b/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.cpp
@@ -23,8 +23,11 @@
 
 #include "SharedBuffer.h"
 #include "FontPlatformData.h"
+
+#include <cairo-win32.h>
 #include <wtf/RetainPtr.h>
 
+
 namespace WebCore {
 
 FontCustomPlatformData::~FontCustomPlatformData()
@@ -32,7 +35,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
    cairo_font_face_destroy(m_fontFace);
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, TextOrientation, FontWidthVariant)
 {
     return FontPlatformData(m_fontFace, size, bold, italic);
 }
diff --git a/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.h b/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.h
index ea3ae38..bd90f18 100644
--- a/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.h
+++ b/Source/WebCore/platform/graphics/win/FontCustomPlatformDataCairo.h
@@ -42,7 +42,7 @@ public:
     }
     ~FontCustomPlatformData();
 
-    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth);
+    FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth);
 
     static bool supportsFormat(const String&);
 
diff --git a/Source/WebCore/platform/graphics/win/FontPlatformDataCGWin.cpp b/Source/WebCore/platform/graphics/win/FontPlatformDataCGWin.cpp
index 9234229..287121b 100644
--- a/Source/WebCore/platform/graphics/win/FontPlatformDataCGWin.cpp
+++ b/Source/WebCore/platform/graphics/win/FontPlatformDataCGWin.cpp
@@ -115,11 +115,15 @@ void FontPlatformData::platformDataInit(HFONT font, float size, HDC hdc, WCHAR*
 }
 
 FontPlatformData::FontPlatformData(HFONT hfont, CGFontRef font, float size, bool bold, bool oblique, bool useGDI)
-    : m_font(RefCountedGDIHandle<HFONT>::create(hfont))
+    : m_syntheticBold(bold)
+    , m_syntheticOblique(oblique)
+    , m_orientation(Horizontal)
+    , m_textOrientation(TextOrientationVerticalRight)
     , m_size(size)
+    , m_widthVariant(RegularWidth)
+    , m_font(RefCountedGDIHandle<HFONT>::create(hfont))
     , m_cgFont(font)
-    , m_syntheticBold(bold)
-    , m_syntheticOblique(oblique)
+    , m_isColorBitmapFont(false)
     , m_useGDI(useGDI)
 {
 }
@@ -128,4 +132,27 @@ FontPlatformData::~FontPlatformData()
 {
 }
 
+void FontPlatformData::platformDataInit(const FontPlatformData& source)
+{
+    m_font = source.m_font;
+    m_cgFont = source.m_cgFont;
+    m_useGDI = source.m_useGDI;
+}
+
+const FontPlatformData& FontPlatformData::platformDataAssign(const FontPlatformData& other)
+{
+    m_font = other.m_font;
+    m_cgFont = other.m_cgFont;
+    m_useGDI = other.m_useGDI;
+
+    return *this;
+}
+
+bool FontPlatformData::platformIsEqual(const FontPlatformData& other) const
+{
+    return m_font == other.m_font
+        && m_cgFont == other.m_cgFont
+        && m_useGDI == other.m_useGDI;
+}
+
 }
diff --git a/Source/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp b/Source/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp
index 0f5c365..e60b69b 100644
--- a/Source/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp
+++ b/Source/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp
@@ -4,7 +4,7 @@
  *
  * Copyright (C) 2006, 2007, 2008 Apple Inc.
  * Copyright (C) 2007 Alp Toker
- * Copyright (C) 2008, 2010 Brent Fulgham
+ * Copyright (C) 2008, 2010, 2011 Brent Fulgham
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -40,7 +40,7 @@ namespace WebCore {
 
 void FontPlatformData::platformDataInit(HFONT font, float size, HDC hdc, WCHAR* faceName)
 {
-    m_fontFace = cairo_win32_font_face_create_for_hfont(font);
+    cairo_font_face_t* fontFace = cairo_win32_font_face_create_for_hfont(font);
 
     cairo_matrix_t sizeMatrix, ctm;
     cairo_matrix_init_identity(&ctm);
@@ -52,14 +52,18 @@ void FontPlatformData::platformDataInit(HFONT font, float size, HDC hdc, WCHAR*
        cairo_font_options_set_antialias(fontOptions, CAIRO_ANTIALIAS_SUBPIXEL);
     }
 
-    m_scaledFont = cairo_scaled_font_create(m_fontFace, &sizeMatrix, &ctm, fontOptions);
+    m_scaledFont = cairo_scaled_font_create(fontFace, &sizeMatrix, &ctm, fontOptions);
+    cairo_font_face_destroy(fontFace);
 }
 
 FontPlatformData::FontPlatformData(cairo_font_face_t* fontFace, float size, bool bold, bool oblique)
     : m_font(0)
     , m_size(size)
-    , m_fontFace(fontFace)
+    , m_orientation(Horizontal)
+    , m_textOrientation(TextOrientationVerticalRight)
+    , m_widthVariant(RegularWidth)
     , m_scaledFont(0)
+    , m_isColorBitmapFont(false)
     , m_syntheticBold(bold)
     , m_syntheticOblique(oblique)
     , m_useGDI(false)
@@ -79,64 +83,39 @@ FontPlatformData::FontPlatformData(cairo_font_face_t* fontFace, float size, bool
    cairo_font_options_destroy(options);
 }
 
-FontPlatformData::FontPlatformData(const FontPlatformData& source)
-    : m_font(source.m_font)
-    , m_size(source.m_size)
-    , m_fontFace(0)
-    , m_scaledFont(0)
-    , m_syntheticBold(source.m_syntheticBold)
-    , m_syntheticOblique(source.m_syntheticOblique)
-    , m_useGDI(source.m_useGDI)
+FontPlatformData::~FontPlatformData()
 {
-    if (source.m_fontFace)
-        m_fontFace = cairo_font_face_reference(source.m_fontFace);
-
-    if (source.m_scaledFont)
-        m_scaledFont = cairo_scaled_font_reference(source.m_scaledFont);
+    if (m_scaledFont && m_scaledFont != hashTableDeletedFontValue())
+        cairo_scaled_font_destroy(m_scaledFont);
 }
 
-
-FontPlatformData::~FontPlatformData()
+void FontPlatformData::platformDataInit(const FontPlatformData& source)
 {
-    cairo_scaled_font_destroy(m_scaledFont);
-    cairo_font_face_destroy(m_fontFace);
+    m_font = source.m_font;
+    m_useGDI = source.m_useGDI;
+    m_scaledFont = 0;
+
+    if (source.m_scaledFont)
+        m_scaledFont = cairo_scaled_font_reference(source.m_scaledFont);
 }
 
-FontPlatformData& FontPlatformData::operator=(const FontPlatformData& other)
+const FontPlatformData& FontPlatformData::platformDataAssign(const FontPlatformData& other)
 {
-    // Check for self-assignment.
-    if (this == &other)
-        return *this;
-
     m_font = other.m_font;
-    m_size = other.m_size;
-    m_syntheticBold = other.m_syntheticBold;
-    m_syntheticOblique = other.m_syntheticOblique;
     m_useGDI = other.m_useGDI;
 
-    if (other.m_fontFace)
-        cairo_font_face_reference(other.m_fontFace);
-    if (m_fontFace)
-        cairo_font_face_destroy(m_fontFace);
-    m_fontFace = other.m_fontFace;
-
-    if (other.m_scaledFont)
-        cairo_scaled_font_reference(other.m_scaledFont);
-    if (m_scaledFont)
+    if (m_scaledFont && m_scaledFont != hashTableDeletedFontValue())
         cairo_scaled_font_destroy(m_scaledFont);
-    m_scaledFont = other.m_scaledFont;
+
+    m_scaledFont = cairo_scaled_font_reference(other.m_scaledFont);
 
     return *this;
 }
 
-bool FontPlatformData::operator==(const FontPlatformData& other) const
-{ 
+bool FontPlatformData::platformIsEqual(const FontPlatformData& other) const
+{
     return m_font == other.m_font
-        && m_fontFace == other.m_fontFace
         && m_scaledFont == other.m_scaledFont
-        && m_size == other.m_size
-        && m_syntheticBold == other.m_syntheticBold
-        && m_syntheticOblique == other.m_syntheticOblique
         && m_useGDI == other.m_useGDI;
 }
 
diff --git a/Source/WebCore/platform/graphics/win/FontPlatformDataWin.cpp b/Source/WebCore/platform/graphics/win/FontPlatformDataWin.cpp
index 09ed4a6..301198d 100644
--- a/Source/WebCore/platform/graphics/win/FontPlatformDataWin.cpp
+++ b/Source/WebCore/platform/graphics/win/FontPlatformDataWin.cpp
@@ -38,12 +38,15 @@ namespace WebCore {
 FontPlatformData::FontPlatformData(HFONT font, float size, bool bold, bool oblique, bool useGDI)
     : m_font(RefCountedGDIHandle<HFONT>::create(font))
     , m_size(size)
+    , m_orientation(Horizontal)
+    , m_textOrientation(TextOrientationVerticalRight)
+    , m_widthVariant(RegularWidth)
 #if PLATFORM(CG)
     , m_cgFont(0)
 #elif PLATFORM(CAIRO)
-    , m_fontFace(0)
     , m_scaledFont(0)
 #endif
+    , m_isColorBitmapFont(false)
     , m_syntheticBold(bold)
     , m_syntheticOblique(oblique)
     , m_useGDI(useGDI)
@@ -71,20 +74,6 @@ FontPlatformData::FontPlatformData(HFONT font, float size, bool bold, bool obliq
     ReleaseDC(0, hdc);
 }
 
-FontPlatformData::FontPlatformData(float size, bool bold, bool oblique)
-    : m_size(size)
-#if PLATFORM(CG)
-    , m_cgFont(0)
-#elif PLATFORM(CAIRO)
-    , m_fontFace(0)
-    , m_scaledFont(0)
-#endif
-    , m_syntheticBold(bold)
-    , m_syntheticOblique(oblique)
-    , m_useGDI(false)
-{
-}
-
 #ifndef NDEBUG
 String FontPlatformData::description() const
 {
diff --git a/Source/WebCore/platform/graphics/win/FontWin.cpp b/Source/WebCore/platform/graphics/win/FontWin.cpp
index 47c44bc..9e31f56 100644
--- a/Source/WebCore/platform/graphics/win/FontWin.cpp
+++ b/Source/WebCore/platform/graphics/win/FontWin.cpp
@@ -127,8 +127,8 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
     UniscribeController controller(this, run, fallbackFonts);
     controller.advance(run.length());
     if (glyphOverflow) {
-        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-controller.minGlyphBoundingBoxY()) - fontMetrics().ascent());
-        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(controller.maxGlyphBoundingBoxY()) - fontMetrics().descent());
+        glyphOverflow->top = max<int>(glyphOverflow->top, ceilf(-controller.minGlyphBoundingBoxY()) - (glyphOverflow->computeBounds ? 0 : fontMetrics().ascent()));
+        glyphOverflow->bottom = max<int>(glyphOverflow->bottom, ceilf(controller.maxGlyphBoundingBoxY()) - (glyphOverflow->computeBounds ? 0  : fontMetrics().descent()));
         glyphOverflow->left = max<int>(0, ceilf(-controller.minGlyphBoundingBoxX()));
         glyphOverflow->right = max<int>(0, ceilf(controller.maxGlyphBoundingBoxX() - controller.runWidthSoFar()));
     }
diff --git a/Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp b/Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
index b2c702f..7ce7ee9 100644
--- a/Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
+++ b/Source/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
@@ -72,18 +72,15 @@ GraphicsContext::GraphicsContext(HDC dc, bool hasAlpha)
 
 void GraphicsContext::platformInit(HDC dc, bool hasAlpha)
 {
-    m_data = new GraphicsContextPlatformPrivate;
-
-    if (dc) {
-        m_data->cr = createCairoContextWithHDC(dc, hasAlpha);
-        m_data->m_hdc = dc;
-    } else {
+    cairo_t* cr = 0;
+    if (dc)
+        cr = createCairoContextWithHDC(dc, hasAlpha);
+    else
         setPaintingDisabled(true);
-        m_data->cr = 0;
-        m_data->m_hdc = 0;
-    }
 
-    if (m_data->cr) {
+    m_data = new GraphicsContextPlatformPrivateTopLevel(new PlatformContextCairo(cr));
+    m_data->m_hdc = dc;
+    if (platformContext()->cr()) {
         // Make sure the context starts in sync with our state.
         setPlatformFillColor(fillColor(), fillColorSpace());
         setPlatformStrokeColor(strokeColor(), strokeColorSpace());
@@ -131,24 +128,25 @@ void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, boo
     // Scale the target surface to the new image size, and flip it
     // so that when we set the srcImage as the surface it will draw
     // right-side-up.
-    cairo_save(m_data->cr);
-    cairo_translate(m_data->cr, dstRect.x(), dstRect.height() + dstRect.y());
-    cairo_scale(m_data->cr, 1.0, -1.0);
-    cairo_set_source_surface(m_data->cr, image, 0, 0);
+    cairo_t* cr = platformContext()->cr();
+    cairo_save(cr);
+    cairo_translate(cr, dstRect.x(), dstRect.height() + dstRect.y());
+    cairo_scale(cr, 1, -1);
+    cairo_set_source_surface(cr, image, 0, 0);
 
     if (m_data->layers.size())
-        cairo_paint_with_alpha(m_data->cr, m_data->layers.last());
+        cairo_paint_with_alpha(cr, m_data->layers.last());
     else
-        cairo_paint(m_data->cr);
+        cairo_paint(cr);
      
     // Delete all our junk.
     cairo_surface_destroy(image);
     ::DeleteDC(hdc);
     ::DeleteObject(bitmap);
-    cairo_restore(m_data->cr);
+    cairo_restore(cr);
 }
 
-void GraphicsContextPlatformPrivate::syncContext(PlatformGraphicsContext* cr)
+void GraphicsContextPlatformPrivate::syncContext(cairo_t* cr)
 {
     if (!cr)
        return;
diff --git a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp
index 40fe1d1..bac85f7 100644
--- a/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp
+++ b/Source/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp
@@ -28,8 +28,11 @@
 #if ENABLE(VIDEO)
 #include "MediaPlayerPrivateQuickTimeVisualContext.h"
 
+#include "ApplicationCacheHost.h"
+#include "ApplicationCacheResource.h"
 #include "Cookie.h"
 #include "CookieJar.h"
+#include "DocumentLoader.h"
 #include "Frame.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
@@ -369,7 +372,16 @@ void MediaPlayerPrivateQuickTimeVisualContext::loadInternal(const String& url)
     setUpCookiesForQuickTime(url);
 
     m_movie = adoptRef(new QTMovie(m_movieClient.get()));
-    m_movie->load(url.characters(), url.length(), m_player->preservesPitch());
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    Frame* frame = m_player->frameView() ? m_player->frameView()->frame() : 0;
+    ApplicationCacheHost* cacheHost = frame ? frame->loader()->documentLoader()->applicationCacheHost() : 0;
+    ApplicationCacheResource* resource = 0;
+    if (cacheHost && cacheHost->shouldLoadResourceFromApplicationCache(ResourceRequest(url), resource) && resource && !resource->path().isEmpty())
+        m_movie->load(resource->path().characters(), resource->path().length(), m_player->preservesPitch());
+    else
+#endif
+        m_movie->load(url.characters(), url.length(), m_player->preservesPitch());
     m_movie->setVolume(m_player->volume());
 }
 
diff --git a/Source/WebCore/platform/graphics/win/QTMovie.cpp b/Source/WebCore/platform/graphics/win/QTMovie.cpp
index 05fbb86..6f9c668 100644
--- a/Source/WebCore/platform/graphics/win/QTMovie.cpp
+++ b/Source/WebCore/platform/graphics/win/QTMovie.cpp
@@ -442,6 +442,17 @@ void QTMovie::getNaturalSize(int& width, int& height)
     height = (rect.bottom - rect.top) * m_private->m_heightScaleFactor;
 }
 
+void QTMovie::loadPath(const UChar* url, int len, bool preservesPitch)
+{
+    CFStringRef urlStringRef = CFStringCreateWithCharacters(kCFAllocatorDefault, reinterpret_cast<const UniChar*>(url), len);
+    CFURLRef cfURL = CFURLCreateWithFileSystemPath(kCFAllocatorDefault, urlStringRef, kCFURLWindowsPathStyle, false);
+
+    load(cfURL, preservesPitch);
+
+    CFRelease(cfURL);
+    CFRelease(urlStringRef);
+}
+
 void QTMovie::load(const UChar* url, int len, bool preservesPitch)
 {
     CFStringRef urlStringRef = CFStringCreateWithCharacters(kCFAllocatorDefault, reinterpret_cast<const UniChar*>(url), len);
diff --git a/Source/WebCore/platform/graphics/win/QTMovie.h b/Source/WebCore/platform/graphics/win/QTMovie.h
index e97d16d..38b3473 100644
--- a/Source/WebCore/platform/graphics/win/QTMovie.h
+++ b/Source/WebCore/platform/graphics/win/QTMovie.h
@@ -70,6 +70,7 @@ public:
     void addClient(QTMovieClient*);
     void removeClient(QTMovieClient*);
 
+    void loadPath(const UChar* url, int len, bool preservesPitch);
     void load(const UChar* url, int len, bool preservesPitch);
     void load(CFURLRef, bool preservesPitch);
 
diff --git a/Source/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp b/Source/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp
index 30a931e..12f1127 100644
--- a/Source/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp
+++ b/Source/WebCore/platform/graphics/win/SimpleFontDataCGWin.cpp
@@ -97,18 +97,14 @@ void SimpleFontData::platformInit()
     m_fontMetrics.setLineGap(fLineGap);
     m_fontMetrics.setLineSpacing(lroundf(fAscent) + lroundf(fDescent) + lroundf(fLineGap));
 
-    // Measure the actual character "x", because AppKit synthesizes X height rather than getting it from the font.
-    // Unfortunately, NSFont will round this for us so we don't quite get the right value.
     GlyphPage* glyphPageZero = GlyphPageTreeNode::getRootChild(this, 0)->page();
     Glyph xGlyph = glyphPageZero ? glyphPageZero->glyphDataForCharacter('x').glyph : 0;
     if (xGlyph) {
+        // Measure the actual character "x", since it's possible for it to extend below the baseline, and we need the
+        // reported x-height to only include the portion of the glyph that is above the baseline.
         CGRect xBox;
         CGFontGetGlyphBBoxes(font, &xGlyph, 1, &xBox);
-        // Use the maximum of either width or height because "x" is nearly square
-        // and web pages that foolishly use this metric for width will be laid out
-        // poorly if we return an accurate height. Classic case is Times 13 point,
-        // which has an "x" that is 7x6 pixels.
-        m_fontMetrics.setXHeight(scaleEmToUnits(max(CGRectGetMaxX(xBox), CGRectGetMaxY(xBox)), unitsPerEm) * pointSize);
+        m_fontMetrics.setXHeight(scaleEmToUnits(CGRectGetMaxY(xBox), unitsPerEm) * pointSize);
     } else {
         int iXHeight = CGFontGetXHeight(font);
         m_fontMetrics.setXHeight(scaleEmToUnits(iXHeight, unitsPerEm) * pointSize);
diff --git a/Source/WebCore/platform/graphics/win/cairo/FontPlatformData.h b/Source/WebCore/platform/graphics/win/cairo/FontPlatformData.h
deleted file mode 100644
index d8f538a..0000000
--- a/Source/WebCore/platform/graphics/win/cairo/FontPlatformData.h
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * Copyright (C) 2006, 2007, 2008 Apple Inc.
- * Copyright (C) 2006 Michael Emmel mike.emmel@gmail.com
- * Copyright (C) 2007 Holger Hans Peter Freyther
- * Copyright (C) 2007 Pioneer Research Center USA, Inc.
- * Copyright (C) 2010 Brent Fulgham <bfulgham@webkit.org>
- * All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef FontPlatformDataCairoWin_h
-#define FontPlatformDataCairoWin_h
-
-#include "FontOrientation.h"
-#include "GlyphBuffer.h"
-#include "RefCountedGDIHandle.h"
-#include "StringImpl.h"
-#include <cairo-win32.h>
-#include <cairo.h>
-#include <wtf/Forward.h>
-
-typedef struct HFONT__* HFONT;
-
-namespace WebCore {
-
-class FontDescription;
-
-class FontPlatformData {
-public:
-    FontPlatformData(WTF::HashTableDeletedValueType)
-        : m_fontFace(0)
-        , m_useGDI(false)
-        , m_font(WTF::HashTableDeletedValue)
-        , m_size(0)
-        , m_syntheticBold(false)
-        , m_syntheticOblique(false)
-        , m_scaledFont(0)
-        { }
-
-    FontPlatformData()
-        : m_fontFace(0)
-        , m_useGDI(false)
-        , m_size(0)
-        , m_syntheticBold(false)
-        , m_syntheticOblique(false)
-        , m_scaledFont(0)
-        { }
-
-    FontPlatformData(HFONT, float size, bool bold, bool oblique, bool useGDI);
-    FontPlatformData(cairo_font_face_t* fontFace, float size, bool bold, bool italic);
-    FontPlatformData(float size, bool bold, bool italic);
-    FontPlatformData(const FontPlatformData&);
-    ~FontPlatformData();
-
-    HFONT hfont() const { return m_font->handle(); }
-    bool useGDI() const { return m_useGDI; }
-    cairo_font_face_t* fontFace() const { return m_fontFace; }
-
-    bool isFixedPitch();
-    float size() const { return m_size; }
-    void setSize(float size) { m_size = size; }
-    bool syntheticBold() const { return m_syntheticBold; }
-    bool syntheticOblique() const { return m_syntheticOblique; }
-
-    FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
-
-    cairo_scaled_font_t* scaledFont() const { return m_scaledFont; }
-
-    unsigned hash() const
-    {
-        return m_font->hash();
-    }
-
-    bool operator==(const FontPlatformData&) const;
-    FontPlatformData& operator=(const FontPlatformData&);
-    bool isHashTableDeletedValue() const
-    {
-        return m_font.isHashTableDeletedValue();
-    }
-
-#ifndef NDEBUG
-    String description() const;
-#endif
-
-private:
-    void platformDataInit(HFONT, float size, HDC, WCHAR* faceName);
-
-    RefPtr<RefCountedGDIHandle<HFONT> > m_font;
-    cairo_font_face_t* m_fontFace;
-    bool m_useGDI;
-    float m_size;
-    bool m_syntheticBold;
-    bool m_syntheticOblique;
-    cairo_scaled_font_t* m_scaledFont;
-};
-
-}
-
-#endif // FontPlatformDataCairoWin_h
diff --git a/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp b/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp
index fb97fe1..07a8756 100644
--- a/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp
@@ -45,7 +45,7 @@ FontCustomPlatformData::~FontCustomPlatformData()
         g_customFontCache->unregisterFont(m_name);
 }
 
-FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, FontWidthVariant, FontRenderingMode renderingMode)
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontOrientation, TextOrientation, FontWidthVariant, FontRenderingMode renderingMode)
 {
     FontDescription fontDesc;
     fontDesc.setComputedSize(size);
diff --git a/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.h b/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.h
index fe7ee94..12a86e9 100644
--- a/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.h
+++ b/Source/WebCore/platform/graphics/wince/FontCustomPlatformData.h
@@ -24,6 +24,7 @@
 #include "FontDescription.h"
 #include "FontRenderingMode.h"
 #include "FontWidthVariant.h"
+#include "TextOrientation.h"
 #include "PlatformString.h"
 #include <wtf/Noncopyable.h>
 
@@ -48,7 +49,7 @@ namespace WebCore {
 
         ~FontCustomPlatformData();
 
-        FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
+        FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontOrientation = Horizontal, TextOrientation = TextOrientationVerticalRight, FontWidthVariant = RegularWidth, FontRenderingMode = NormalRenderingMode);
 
         static bool supportsFormat(const String&);
 
diff --git a/Source/WebCore/platform/graphics/wince/FontPlatformData.cpp b/Source/WebCore/platform/graphics/wince/FontPlatformData.cpp
index d9d8a72..d767ac7 100644
--- a/Source/WebCore/platform/graphics/wince/FontPlatformData.cpp
+++ b/Source/WebCore/platform/graphics/wince/FontPlatformData.cpp
@@ -148,7 +148,7 @@ struct FixedSizeFontDataKeyHash {
             font.m_weight,
             // static_cast<unsigned>(font.m_italic);
         };
-        return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+        return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
     }
 
     static bool equal(const FixedSizeFontDataKey& a, const FixedSizeFontDataKey& b)
diff --git a/Source/WebCore/platform/graphics/wince/FontPlatformData.h b/Source/WebCore/platform/graphics/wince/FontPlatformData.h
index e73a7b2..9c3f733 100644
--- a/Source/WebCore/platform/graphics/wince/FontPlatformData.h
+++ b/Source/WebCore/platform/graphics/wince/FontPlatformData.h
@@ -79,6 +79,7 @@ namespace WebCore {
         static LONG adjustedGDIFontWeight(LONG gdiFontWeight, const String& family);
 
         FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
+        void setOrientation(FontOrientation) { } // FIXME: Implement.
 
 #ifndef NDEBUG
         String description() const;
diff --git a/Source/WebCore/platform/graphics/wince/PathWinCE.cpp b/Source/WebCore/platform/graphics/wince/PathWinCE.cpp
index fa4c8fb..9c9112b 100644
--- a/Source/WebCore/platform/graphics/wince/PathWinCE.cpp
+++ b/Source/WebCore/platform/graphics/wince/PathWinCE.cpp
@@ -133,7 +133,7 @@ void Path::transform(const AffineTransform& t)
     m_path->transform(t);
 }
 
-FloatRect Path::strokeBoundingRect(StrokeStyleApplier *)
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier*) const
 {
     notImplemented();
     return FloatRect();
diff --git a/Source/WebCore/platform/graphics/wx/FontPlatformData.h b/Source/WebCore/platform/graphics/wx/FontPlatformData.h
index 3ef0179..8a2c4a0 100644
--- a/Source/WebCore/platform/graphics/wx/FontPlatformData.h
+++ b/Source/WebCore/platform/graphics/wx/FontPlatformData.h
@@ -150,6 +150,7 @@ public:
     bool allowsLigatures() const { return false; }
     
     FontOrientation orientation() const { return Horizontal; } // FIXME: Implement.
+    void setOrientation(FontOrientation) { } // FIXME: Implement.
 
     // We don't support this yet, so just return the default value for now.
     FontWidthVariant widthVariant() const { return RegularWidth; }
diff --git a/Source/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp b/Source/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
index c125b7c..830cd05 100644
--- a/Source/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
+++ b/Source/WebCore/platform/graphics/wx/FontPlatformDataWx.cpp
@@ -126,10 +126,10 @@ unsigned FontPlatformData::computeHash() const
         thisFont->GetStyle(),
         thisFont->GetWeight(),
         thisFont->GetUnderlined(), 
-        WTF::StringHasher::createHash(thisFont->GetFaceName().utf8_str().data())
+        StringHasher::computeHash(thisFont->GetFaceName().utf8_str().data())
     };
 
-    return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+    return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
 }
 
 FontPlatformData::~FontPlatformData()
diff --git a/Source/WebCore/platform/graphics/wx/PathWx.cpp b/Source/WebCore/platform/graphics/wx/PathWx.cpp
index f5355f2..a95cc1c 100644
--- a/Source/WebCore/platform/graphics/wx/PathWx.cpp
+++ b/Source/WebCore/platform/graphics/wx/PathWx.cpp
@@ -105,7 +105,7 @@ FloatRect Path::boundingRect() const
     return FloatRect();
 }
 
-FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier) const
 {
     notImplemented();
     return FloatRect();
diff --git a/Source/WebCore/platform/gtk/FileSystemGtk.cpp b/Source/WebCore/platform/gtk/FileSystemGtk.cpp
index b3c4c9f..e2b1642 100644
--- a/Source/WebCore/platform/gtk/FileSystemGtk.cpp
+++ b/Source/WebCore/platform/gtk/FileSystemGtk.cpp
@@ -227,16 +227,16 @@ Vector<String> listDirectory(const String& path, const String& filter)
     return entries;
 }
 
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
+String openTemporaryFile(const String& prefix, PlatformFileHandle& handle)
 {
-    GOwnPtr<gchar> filename(g_strdup_printf("%s%s", prefix, createCanonicalUUIDString().utf8().data()));
+    GOwnPtr<gchar> filename(g_strdup_printf("%s%s", prefix.utf8().data(), createCanonicalUUIDString().utf8().data()));
     GOwnPtr<gchar> tempPath(g_build_filename(g_get_tmp_dir(), filename.get(), NULL));
     GRefPtr<GFile> file = adoptGRef(g_file_new_for_path(tempPath.get()));
 
     handle = g_file_create_readwrite(file.get(), G_FILE_CREATE_NONE, 0, 0);
     if (!isHandleValid(handle))
-        return CString();
-    return tempPath.get();
+        return String();
+    return String::fromUTF8(tempPath.get());
 }
 
 PlatformFileHandle openFile(const String& path, FileOpenMode mode)
diff --git a/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp b/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp
index eab0ac6..02f6c47 100644
--- a/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp
+++ b/Source/WebCore/platform/gtk/LocalizedStringsGtk.cpp
@@ -259,7 +259,7 @@ String contextMenuItemTagSearchWeb()
     return String::fromUTF8(_("_Search the Web"));
 }
 
-String contextMenuItemTagLookUpInDictionary()
+String contextMenuItemTagLookUpInDictionary(const String&)
 {
     return String::fromUTF8(_("_Look Up in Dictionary"));
 }
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
index 1e9f159..9b11c27 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.cpp
@@ -34,6 +34,7 @@
 #include "HTMLNames.h"
 #include "MediaControlElements.h"
 #include "PaintInfo.h"
+#include "PlatformContextCairo.h"
 #include "RenderBox.h"
 #include "RenderObject.h"
 #include "TimeRanges.h"
@@ -234,7 +235,7 @@ static void paintGdkPixbuf(GraphicsContext* context, const GdkPixbuf* icon, cons
         icon = scaledIcon.get();
     }
 
-    cairo_t* cr = context->platformContext();
+    cairo_t* cr = context->platformContext()->cr();
     cairo_save(cr);
     gdk_cairo_set_source_pixbuf(cr, icon, iconRect.x(), iconRect.y());
     cairo_paint(cr);
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk.h b/Source/WebCore/platform/gtk/RenderThemeGtk.h
index f5e03a9..191a34b 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk.h
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk.h
@@ -214,6 +214,7 @@ private:
     GtkWidget* gtkComboBoxButton() const;
     GtkWidget* gtkComboBoxArrow() const;
     GtkWidget* gtkComboBoxSeparator() const;
+    GtkWidget* gtkSpinButton() const;
 
     GdkColormap* m_colormap;
     mutable GtkWidget* m_gtkWindow;
@@ -232,6 +233,7 @@ private:
     mutable GtkWidget* m_gtkComboBoxSeparator;
     mutable GtkWidget* m_gtkVScrollbar;
     mutable GtkWidget* m_gtkHScrollbar;
+    mutable GtkWidget* m_gtkSpinButton;
     bool m_themePartsHaveRGBAColormap;
     friend class WidgetRenderingContext;
 #endif
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk2.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk2.cpp
index 534aa97..5149bea 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk2.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk2.cpp
@@ -46,6 +46,9 @@
 
 namespace WebCore {
 
+// This is the default value defined by GTK+, where it was defined as MIN_ARROW_WIDTH in gtkspinbutton.c.
+static const int minSpinButtonArrowSize = 6;
+
 // This is not a static method, because we want to avoid having GTK+ headers in RenderThemeGtk.h.
 extern GtkTextDirection gtkTextDirection(TextDirection);
 
@@ -68,6 +71,7 @@ void RenderThemeGtk::platformInit()
     m_gtkComboBoxSeparator = 0;
     m_gtkVScrollbar = 0;
     m_gtkHScrollbar = 0;
+    m_gtkSpinButton = 0;
 
     m_colormap = gdk_screen_get_rgba_colormap(gdk_screen_get_default());
     if (!m_colormap) {
@@ -117,6 +121,10 @@ void RenderThemeGtk::adjustRepaintRect(const RenderObject* renderObject, IntRect
         adjustRectForFocus(part == CheckboxPart ? gtkCheckButton() : gtkRadioButton(), rect, true);
         return;
     }
+    case InnerSpinButtonPart:
+        // See paintInnerSpinButton for an explanation of why we expand the painting rect.
+        rect.inflateY(2);
+        rect.setWidth(rect.width() + 2);
     default:
         return;
     }
@@ -566,13 +574,84 @@ bool RenderThemeGtk::paintProgressBar(RenderObject* renderObject, const PaintInf
 }
 #endif
 
-void RenderThemeGtk::adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const
+void RenderThemeGtk::adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
+    GtkStyle* gtkStyle = gtk_widget_get_style(gtkSpinButton());
+    const PangoFontDescription* fontDescription = gtkStyle->font_desc;
+    gint fontSize = pango_font_description_get_size(fontDescription);
+
+    // Force an odd arrow size here. GTK+ 3.x forces even in this case, but
+    // Nodoka-based themes look incorrect with an even arrow size.
+    int width = max(PANGO_PIXELS(fontSize), minSpinButtonArrowSize);
+    width += -((width % 2) - 1) + gtkStyle->xthickness;
+
+    style->setWidth(Length(width, Fixed));
+    style->setMinWidth(Length(width, Fixed));
 }
 
-bool RenderThemeGtk::paintInnerSpinButton(RenderObject*, const PaintInfo&, const IntRect&)
+bool RenderThemeGtk::paintInnerSpinButton(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
 {
-    return true;
+    // We expand the painted area by 2 pixels on the top and bottom and 2 pixels on the right. This
+    // is because GTK+ themes want to draw over the text box borders, but WebCore renders the inner
+    // spin button inside the text box.
+    IntRect expandedRect(rect);
+    expandedRect.inflateY(2);
+    expandedRect.setWidth(rect.width() + 2);
+
+    WidgetRenderingContext widgetContext(paintInfo.context, expandedRect);
+    GtkWidget* widget = gtkSpinButton();
+    gtk_widget_set_direction(widget, gtkTextDirection(renderObject->style()->direction()));
+
+    IntRect fullSpinButtonRect(IntPoint(), expandedRect.size());
+    widgetContext.gtkPaintBox(fullSpinButtonRect, widget, GTK_STATE_NORMAL, GTK_SHADOW_IN, "spinbutton");
+
+    bool upPressed = isSpinUpButtonPartPressed(renderObject);
+    bool upHovered = isSpinUpButtonPartHovered(renderObject);
+    bool controlActive = isEnabled(renderObject) && !isReadOnlyControl(renderObject);
+    GtkShadowType shadowType = upPressed ? GTK_SHADOW_IN : GTK_SHADOW_OUT;
+
+    GtkStateType stateType = GTK_STATE_INSENSITIVE;
+    if (controlActive) {
+        if (isPressed(renderObject) && upPressed)
+            stateType = GTK_STATE_ACTIVE;
+        else if (isHovered(renderObject) && upHovered)
+            stateType = GTK_STATE_PRELIGHT;
+        else
+            stateType = GTK_STATE_NORMAL;
+    }
+    IntRect topRect(IntPoint(), expandedRect.size());
+    topRect.setHeight(expandedRect.height() / 2);
+    widgetContext.gtkPaintBox(topRect, widget, stateType, shadowType, "spinbutton_up");
+
+    // The arrow size/position calculation here is based on the arbitrary gymnastics that happen
+    // in gtkspinbutton.c. It isn't pretty there and it isn't pretty here. This manages to make
+    // the button look native for many themes though.
+    IntRect arrowRect;
+    int arrowSize = (expandedRect.width() - 3) / 2;
+    arrowSize -= (arrowSize % 2) - 1; // Force odd.
+    arrowRect.setWidth(arrowSize);
+    arrowRect.setHeight(arrowSize);
+    arrowRect.move((expandedRect.width() - arrowRect.width()) / 2,
+                   (topRect.height() - arrowRect.height()) / 2 + 1);
+    widgetContext.gtkPaintArrow(arrowRect, widget, stateType, shadowType, GTK_ARROW_UP, "spinbutton");
+
+    shadowType = isPressed(renderObject) && !upPressed ? GTK_SHADOW_IN : GTK_SHADOW_OUT;
+    if (controlActive) {
+        if (isPressed(renderObject) && !upPressed)
+            stateType = GTK_STATE_ACTIVE;
+        else if (isHovered(renderObject) && !upHovered)
+            stateType = GTK_STATE_PRELIGHT;
+        else
+            stateType = GTK_STATE_NORMAL;
+    }
+    IntRect bottomRect(IntPoint(0, expandedRect.height() / 2), expandedRect.size());
+    bottomRect.setHeight(expandedRect.height() - bottomRect.y());
+    widgetContext.gtkPaintBox(bottomRect, widget, stateType, shadowType, "spinbutton_down");
+
+    arrowRect.setY(arrowRect.y() + bottomRect.y() - 1);
+    widgetContext.gtkPaintArrow(arrowRect, widget, stateType, shadowType, GTK_ARROW_DOWN, "spinbutton");
+
+    return false;
 }
 
 GRefPtr<GdkPixbuf> RenderThemeGtk::getStockIcon(GType widgetType, const char* iconName, gint direction, gint state, gint iconSize)
@@ -867,6 +946,15 @@ GtkWidget* RenderThemeGtk::gtkVScrollbar() const
     return m_gtkVScrollbar;
 }
 
+GtkWidget* RenderThemeGtk::gtkSpinButton() const
+{
+    if (m_gtkSpinButton)
+        return m_gtkSpinButton;
+    m_gtkSpinButton = gtk_spin_button_new_with_range(0, 10, 1);
+    setupWidgetAndAddToContainer(m_gtkSpinButton, gtkContainer());
+    return m_gtkSpinButton;
+}
+
 } // namespace WebCore
 
 #endif // GTK_API_VERSION_2
diff --git a/Source/WebCore/platform/gtk/RenderThemeGtk3.cpp b/Source/WebCore/platform/gtk/RenderThemeGtk3.cpp
index 7fa0f04..527de1a 100644
--- a/Source/WebCore/platform/gtk/RenderThemeGtk3.cpp
+++ b/Source/WebCore/platform/gtk/RenderThemeGtk3.cpp
@@ -483,14 +483,14 @@ bool RenderThemeGtk::paintMenuList(RenderObject* renderObject, const PaintInfo&
     gtk_style_context_get_style(arrowStyleContext, "arrow-scaling", &arrowScaling, NULL);
 
     IntSize arrowSize(minArrowSize, innerRect.height());
-    IntPoint arrowPosition = innerRect.location();
+    FloatPoint arrowPosition(innerRect.location());
     if (direction == GTK_TEXT_DIR_LTR)
         arrowPosition.move(innerRect.width() - arrowSize.width(), 0);
 
     // GTK+ actually fetches the xalign and valign values from the widget, but since we
     // don't have a widget here, we are just using the default xalign and valign values of 0.5.
     gint extent = std::min(arrowSize.width(), arrowSize.height()) * arrowScaling;
-    arrowPosition.move(std::floor((arrowSize.width() - extent) / 2), std::floor((arrowSize.height() - extent) / 2));
+    arrowPosition.move((arrowSize.width() - extent) / 2, (arrowSize.height() - extent) / 2);
 
     gtk_style_context_set_state(arrowStyleContext, state);
     gtk_render_arrow(arrowStyleContext, cairoContext, G_PI, arrowPosition.x(), arrowPosition.y(), extent);
diff --git a/Source/WebCore/platform/gtk/ScrollViewGtk.cpp b/Source/WebCore/platform/gtk/ScrollViewGtk.cpp
index c5f32f3..53cacf7 100644
--- a/Source/WebCore/platform/gtk/ScrollViewGtk.cpp
+++ b/Source/WebCore/platform/gtk/ScrollViewGtk.cpp
@@ -31,6 +31,8 @@
 #include "config.h"
 #include "ScrollView.h"
 
+#if USE(NATIVE_GTK_MAIN_FRAME_SCROLLBAR)
+
 #include "ChromeClient.h"
 #include "FloatRect.h"
 #include "Frame.h"
@@ -44,7 +46,6 @@
 #include "PlatformMouseEvent.h"
 #include "PlatformWheelEvent.h"
 #include "ScrollbarTheme.h"
-
 #include <gtk/gtk.h>
 
 using namespace std;
@@ -228,3 +229,5 @@ void ScrollView::setScrollbarModes(ScrollbarMode horizontalMode, ScrollbarMode v
 }
 
 }
+
+#endif // USE(NATIVE_GTK_MAIN_FRAME_SCROLLBAR)
diff --git a/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp b/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp
index d000063..b0b5146 100644
--- a/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp
+++ b/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp
@@ -135,40 +135,16 @@ void ScrollbarThemeGtk::paintButton(GraphicsContext* context, Scrollbar* scrollb
         flags |= GTK_STATE_FLAG_INSENSITIVE;
     gtk_style_context_set_state(m_context, static_cast<GtkStateFlags>(flags));
 
-    guint sides = gtk_style_context_get_junction_sides(m_context);
-    if (scrollbar->orientation() == VerticalScrollbar)
-        sides &= ~(GTK_JUNCTION_TOP | GTK_JUNCTION_BOTTOM);
-    else
-        sides &= ~(GTK_JUNCTION_LEFT | GTK_JUNCTION_RIGHT);
-
-    switch (part) {
-    case BackButtonStartPart:
-        sides |= (scrollbar->orientation() == VerticalScrollbar) ? GTK_JUNCTION_BOTTOM : GTK_JUNCTION_RIGHT;
-        break;
-    case BackButtonEndPart:
-    case ForwardButtonEndPart:
-        sides |= (scrollbar->orientation() == VerticalScrollbar) ?
-                GTK_JUNCTION_TOP | GTK_JUNCTION_BOTTOM : GTK_JUNCTION_RIGHT | GTK_JUNCTION_LEFT;
-        break;
-    case ForwardButtonStartPart:
-        sides |= (scrollbar->orientation() == VerticalScrollbar) ? GTK_JUNCTION_TOP : GTK_JUNCTION_LEFT;
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-    }
-    gtk_style_context_set_junction_sides(m_context, static_cast<GtkJunctionSides>(sides));
     gtk_style_context_add_class(m_context, GTK_STYLE_CLASS_BUTTON);
-
     gtk_render_background(m_context, context->platformContext(), rect.x(), rect.y(), rect.width(), rect.height());
     gtk_render_frame(m_context, context->platformContext(), rect.x(), rect.y(), rect.width(), rect.height());
 
     gfloat arrowScaling;
     gtk_style_context_get_style(m_context, "arrow-scaling", &arrowScaling, NULL);
 
-    IntSize arrowSize = rect.size();
-    arrowSize.scale(arrowScaling);
-    IntPoint arrowPoint(rect.x() + (rect.width() - arrowSize.width()) / 2,
-                        rect.y() + (rect.height() - arrowSize.height()) / 2);
+    double arrowSize = std::min(rect.width(), rect.height()) * arrowScaling;
+    FloatPoint arrowPoint(rect.x() + (rect.width() - arrowSize) / 2,
+                          rect.y() + (rect.height() - arrowSize) / 2);
 
     if (flags & GTK_STATE_FLAG_ACTIVE) {
         gint arrowDisplacementX, arrowDisplacementY;
@@ -179,16 +155,14 @@ void ScrollbarThemeGtk::paintButton(GraphicsContext* context, Scrollbar* scrollb
         arrowPoint.move(arrowDisplacementX, arrowDisplacementY);
     }
 
-    gdouble angle, size;
+    gdouble angle;
     if (scrollbar->orientation() == VerticalScrollbar) {
-        size = arrowSize.width();
         angle = (part == ForwardButtonEndPart || part == ForwardButtonStartPart) ? G_PI : 0;
     } else {
-        size = arrowSize.height();
         angle = (part == ForwardButtonEndPart || part == ForwardButtonStartPart) ? G_PI / 2 : 3 * (G_PI / 2);
     }
 
-    gtk_render_arrow(m_context, context->platformContext(), angle, arrowPoint.x(), arrowPoint.y(), size);
+    gtk_render_arrow(m_context, context->platformContext(), angle, arrowPoint.x(), arrowPoint.y(), arrowSize);
 
     gtk_style_context_restore(m_context);
 }
diff --git a/Source/WebCore/platform/gtk/WidgetGtk.cpp b/Source/WebCore/platform/gtk/WidgetGtk.cpp
index f251772..0ab3940 100644
--- a/Source/WebCore/platform/gtk/WidgetGtk.cpp
+++ b/Source/WebCore/platform/gtk/WidgetGtk.cpp
@@ -41,8 +41,6 @@
 
 namespace WebCore {
 
-static GdkCursor* lastSetCursor;
-
 Widget::Widget(PlatformWidget widget)
 {
     init(widget);
@@ -60,11 +58,6 @@ void Widget::setFocus(bool focused)
         gtk_widget_grab_focus(platformWidget() ? platformWidget() : GTK_WIDGET(root()->hostWindow()->platformPageClient()));
 }
 
-static GdkWindow* gdkWindow(PlatformWidget widget)
-{
-    return widget ? gtk_widget_get_window(widget) : 0;
-}
-    
 void Widget::setCursor(const Cursor& cursor)
 {
     ScrollView* view = root();
diff --git a/Source/WebCore/platform/gtk/WidgetRenderingContext.cpp b/Source/WebCore/platform/gtk/WidgetRenderingContext.cpp
index 9e640f6..6f7389d 100644
--- a/Source/WebCore/platform/gtk/WidgetRenderingContext.cpp
+++ b/Source/WebCore/platform/gtk/WidgetRenderingContext.cpp
@@ -33,6 +33,7 @@
 
 #include "GraphicsContext.h"
 #include "GtkVersioning.h"
+#include "PlatformContextCairo.h"
 #include "RefPtrCairo.h"
 #include "RenderThemeGtk.h"
 #include "Timer.h"
@@ -128,7 +129,7 @@ WidgetRenderingContext::~WidgetRenderingContext()
     }
 
     // FIXME: It's unclear if it is necessary to preserve the current source here.
-    cairo_t* cairoContext = m_graphicsContext->platformContext();
+    cairo_t* cairoContext = m_graphicsContext->platformContext()->cr();
     RefPtr<cairo_pattern_t> previousSource(cairo_get_source(cairoContext));
 
     // The blit rectangle is the original target rectangle adjusted for any extra space.
diff --git a/Source/WebCore/platform/haiku/FileSystemHaiku.cpp b/Source/WebCore/platform/haiku/FileSystemHaiku.cpp
index b0d34f2..7985c54 100644
--- a/Source/WebCore/platform/haiku/FileSystemHaiku.cpp
+++ b/Source/WebCore/platform/haiku/FileSystemHaiku.cpp
@@ -56,11 +56,11 @@ String homeDirectoryPath()
     return String(path.Path());
 }
 
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
+String openTemporaryFile(const String&, PlatformFileHandle& handle)
 {
     notImplemented();
     handle = invalidPlatformFileHandle;
-    return CString();
+    return String();
 }
 
 void closeFile(PlatformFileHandle&)
diff --git a/Source/WebCore/platform/haiku/LocalizedStringsHaiku.cpp b/Source/WebCore/platform/haiku/LocalizedStringsHaiku.cpp
index 63b9b91..c1f3641 100644
--- a/Source/WebCore/platform/haiku/LocalizedStringsHaiku.cpp
+++ b/Source/WebCore/platform/haiku/LocalizedStringsHaiku.cpp
@@ -213,7 +213,7 @@ String contextMenuItemTagSearchWeb()
     return "Search web";
 }
 
-String contextMenuItemTagLookUpInDictionary()
+String contextMenuItemTagLookUpInDictionary(const String&)
 {
     return "Lookup in dictionary";
 }
diff --git a/Source/WebCore/platform/image-decoders/ImageDecoder.h b/Source/WebCore/platform/image-decoders/ImageDecoder.h
index 2a307c5..801daf3 100644
--- a/Source/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/Source/WebCore/platform/image-decoders/ImageDecoder.h
@@ -62,7 +62,7 @@ namespace WebCore {
             DisposeNotSpecified,      // Leave frame in framebuffer
             DisposeKeep,              // Leave frame in framebuffer
             DisposeOverwriteBgcolor,  // Clear frame to transparent
-            DisposeOverwritePrevious, // Clear frame to previous framebuffer
+            DisposeOverwritePrevious  // Clear frame to previous framebuffer
                                       // contents
         };
 #if USE(SKIA) || PLATFORM(QT)
diff --git a/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp b/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
index 8edfe36..8419a97 100644
--- a/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
@@ -241,11 +241,11 @@ void PNGImageDecoder::headerAvailable()
 {
     png_structp png = m_reader->pngPtr();
     png_infop info = m_reader->infoPtr();
-    png_uint_32 width = png->width;
-    png_uint_32 height = png->height;
+    png_uint_32 width = png_get_image_width(png, info);
+    png_uint_32 height = png_get_image_height(png, info);
     
     // Protect against large images.
-    if (png->width > cMaxPNGSize || png->height > cMaxPNGSize) {
+    if (width > cMaxPNGSize || height > cMaxPNGSize) {
         longjmp(JMPBUF(png), 1);
         return;
     }
@@ -318,9 +318,14 @@ void PNGImageDecoder::headerAvailable()
     m_reader->setHasAlpha(channels == 4);
 
     if (m_reader->decodingSizeOnly()) {
-        // If we only needed the size, halt the reader.     
+        // If we only needed the size, halt the reader.
+#if defined(PNG_LIBPNG_VER_MAJOR) && defined(PNG_LIBPNG_VER_MINOR) && (PNG_LIBPNG_VER_MAJOR > 1 || (PNG_LIBPNG_VER_MAJOR == 1 && PNG_LIBPNG_VER_MINOR >= 5))
+        // '0' argument to png_process_data_pause means: Do not cache unprocessed data.
+        m_reader->setReadOffset(m_reader->currentBufferSize() - png_process_data_pause(png, 0));
+#else
         m_reader->setReadOffset(m_reader->currentBufferSize() - png->buffer_size);
         png->buffer_size = 0;
+#endif
     }
 }
 
@@ -343,7 +348,7 @@ void PNGImageDecoder::rowAvailable(unsigned char* rowBuffer, unsigned rowIndex,
         // For PNGs, the frame always fills the entire image.
         buffer.setOriginalFrameRect(IntRect(IntPoint(), size()));
 
-        if (m_reader->pngPtr()->interlaced)
+        if (png_get_interlace_type(m_reader->pngPtr(), m_reader->infoPtr()) != PNG_INTERLACE_NONE)
             m_reader->createInterlaceBuffer((m_reader->hasAlpha() ? 4 : 3) * size().width() * size().height());
     }
 
diff --git a/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.cpp b/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.cpp
index be3c92a..f0ac601 100644
--- a/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.cpp
+++ b/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "JPEGImageEncoder.h"
 
+#include "ImageData.h"
 #include "IntSize.h"
 #include "SkBitmap.h"
 #include "SkColorPriv.h"
@@ -79,22 +80,29 @@ static void handleError(j_common_ptr common)
     longjmp(*jumpBufferPtr, -1);
 }
 
-static void preMultipliedBGRAtoRGB(const SkPMColor* input, unsigned int pixels, unsigned char* output)
+static void preMultipliedBGRAtoRGB(const void* pixels, unsigned int pixelCount, unsigned char* output)
 {
-    for (; pixels-- > 0; ++input) {
+    const SkPMColor* input = static_cast<const SkPMColor*>(pixels);
+    for (; pixelCount-- > 0; ++input) {
         *output++ = SkGetPackedR32(*input);
         *output++ = SkGetPackedG32(*input);
         *output++ = SkGetPackedB32(*input);
     }
 }
 
-bool JPEGImageEncoder::encode(const SkBitmap& bitmap, int quality, Vector<unsigned char>* output)
+static void RGBAtoRGB(const unsigned char* input, unsigned int pixels, unsigned char* output)
 {
-    if (bitmap.config() != SkBitmap::kARGB_8888_Config)
-        return false; // Only support ARGB 32 bpp skia bitmaps.
+    for (; pixels-- > 0; input += 4) {
+        *output++ = input[0];
+        *output++ = input[1];
+        *output++ = input[2];
+    }
+}
 
-    SkAutoLockPixels bitmapLock(bitmap);
-    IntSize imageSize(bitmap.width(), bitmap.height());
+static bool encodePixels(const IntSize& inputSize, unsigned char* inputPixels,
+                         bool premultiplied, int quality, Vector<unsigned char>* output)
+{
+    IntSize imageSize(inputSize);
     imageSize.clampNegativeToZero();
     JPEGOutputBuffer destination;
     destination.output = output;
@@ -126,12 +134,15 @@ bool JPEGImageEncoder::encode(const SkBitmap& bitmap, int quality, Vector<unsign
     jpeg_set_quality(&cinfo, quality, TRUE);
     jpeg_start_compress(&cinfo, TRUE);
 
-    const SkPMColor* pixels = static_cast<SkPMColor*>(bitmap.getPixels());
+    unsigned char* pixels = inputPixels;
     row.resize(cinfo.image_width * cinfo.input_components);
     while (cinfo.next_scanline < cinfo.image_height) {
-        preMultipliedBGRAtoRGB(pixels, cinfo.image_width, row.data());
+        if (premultiplied)
+            preMultipliedBGRAtoRGB(pixels, cinfo.image_width, row.data());
+        else 
+            RGBAtoRGB(pixels, cinfo.image_width, row.data());
         jpeg_write_scanlines(&cinfo, row.dataSlot(), 1);
-        pixels += cinfo.image_width;
+        pixels += cinfo.image_width * 4;
     }
 
     jpeg_finish_compress(&cinfo);
@@ -139,4 +150,22 @@ bool JPEGImageEncoder::encode(const SkBitmap& bitmap, int quality, Vector<unsign
     return true;
 }
 
+bool JPEGImageEncoder::encode(const SkBitmap& bitmap, int quality, Vector<unsigned char>* output)
+{
+    if (bitmap.config() != SkBitmap::kARGB_8888_Config)
+        return false; // Only support ARGB 32 bpp skia bitmaps.
+
+    SkAutoLockPixels bitmapLock(bitmap);
+    IntSize imageSize(bitmap.width(), bitmap.height());
+
+    return encodePixels(imageSize, static_cast<unsigned char *>(bitmap.getPixels()),
+                        true, quality, output);
+}
+
+bool JPEGImageEncoder::encode(const ImageData& imageData, int quality, Vector<unsigned char>* output)
+{
+    return encodePixels(imageData.size(), imageData.data()->data()->data(),
+                        false, quality, output);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.h b/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.h
index f2ac52d..122725d 100644
--- a/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.h
+++ b/Source/WebCore/platform/image-encoders/skia/JPEGImageEncoder.h
@@ -31,16 +31,19 @@
 #ifndef JPEGImageEncoder_h
 #define JPEGImageEncoder_h
 
-#include "Vector.h"
+#include <wtf/Vector.h>
 
 class SkBitmap;
 
 namespace WebCore {
 
+class ImageData;
+
 class JPEGImageEncoder {
 public:
-    // Encode the input bitmap with a compression quality in [0-100].
+    // Encode the input data with a compression quality in [0-100].
     static bool encode(const SkBitmap&, int quality, Vector<unsigned char>*);
+    static bool encode(const ImageData&, int quality, Vector<unsigned char>*);
 
     // For callers: provide a reasonable compression quality default.
     enum Quality { DefaultCompressionQuality = 92 };
diff --git a/Source/WebCore/platform/image-encoders/skia/PNGImageEncoder.cpp b/Source/WebCore/platform/image-encoders/skia/PNGImageEncoder.cpp
index 78f737e..2fc758e 100644
--- a/Source/WebCore/platform/image-encoders/skia/PNGImageEncoder.cpp
+++ b/Source/WebCore/platform/image-encoders/skia/PNGImageEncoder.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "PNGImageEncoder.h"
 
+#include "ImageData.h"
 #include "IntSize.h"
 #include "SkBitmap.h"
 #include "SkColorPriv.h"
@@ -46,11 +47,12 @@ static void writeOutput(png_structp png, png_bytep data, png_size_t size)
     static_cast<Vector<unsigned char>*>(png->io_ptr)->append(data, size);
 }
 
-static void preMultipliedBGRAtoRGBA(const SkPMColor* input, int pixels, unsigned char* output)
+static void preMultipliedBGRAtoRGBA(const void* pixels, int pixelCount, unsigned char* output)
 {
     static const SkUnPreMultiply::Scale* scale = SkUnPreMultiply::GetScaleTable();
+    const SkPMColor* input = static_cast<const SkPMColor*>(pixels);
 
-    for (; pixels-- > 0; ++input) {
+    for (; pixelCount-- > 0; ++input) {
         const unsigned alpha = SkGetPackedA32(*input);
         if ((alpha != 0) && (alpha != 255)) {
             *output++ = SkUnPreMultiply::ApplyScale(scale[alpha], SkGetPackedR32(*input));
@@ -66,13 +68,10 @@ static void preMultipliedBGRAtoRGBA(const SkPMColor* input, int pixels, unsigned
     }
 }
 
-bool PNGImageEncoder::encode(const SkBitmap& bitmap, Vector<unsigned char>* output)
+static bool encodePixels(const IntSize& inputSize, unsigned char* inputPixels,
+                         bool premultiplied, Vector<unsigned char>* output)
 {
-    if (bitmap.config() != SkBitmap::kARGB_8888_Config)
-        return false; // Only support ARGB 32 bpp skia bitmaps.
-
-    SkAutoLockPixels bitmapLock(bitmap);
-    IntSize imageSize(bitmap.width(), bitmap.height());
+    IntSize imageSize(inputSize);
     imageSize.clampNegativeToZero();
     Vector<unsigned char> row;
 
@@ -100,12 +99,15 @@ bool PNGImageEncoder::encode(const SkBitmap& bitmap, Vector<unsigned char>* outp
                  8, PNG_COLOR_TYPE_RGB_ALPHA, 0, 0, 0);
     png_write_info(png, info);
 
-    const SkPMColor* pixels = static_cast<SkPMColor*>(bitmap.getPixels());
-    row.resize(imageSize.width() * bitmap.bytesPerPixel());
+    unsigned char* pixels = inputPixels;
+    row.resize(imageSize.width() * sizeof(SkPMColor));
     for (int y = 0; y < imageSize.height(); ++y) {
-        preMultipliedBGRAtoRGBA(pixels, imageSize.width(), row.data());
-        png_write_row(png, row.data());
-        pixels += imageSize.width();
+        if (premultiplied) {
+            preMultipliedBGRAtoRGBA(pixels, imageSize.width(), row.data());
+            png_write_row(png, row.data());
+        } else
+            png_write_row(png, pixels);
+        pixels += imageSize.width() * 4;
     }
 
     png_write_end(png, info);
@@ -113,4 +115,19 @@ bool PNGImageEncoder::encode(const SkBitmap& bitmap, Vector<unsigned char>* outp
     return true;
 }
 
+bool PNGImageEncoder::encode(const SkBitmap& bitmap, Vector<unsigned char>* output)
+{
+    if (bitmap.config() != SkBitmap::kARGB_8888_Config)
+        return false; // Only support ARGB 32 bpp skia bitmaps.
+
+    SkAutoLockPixels bitmapLock(bitmap);
+    IntSize imageSize(bitmap.width(), bitmap.height());
+    return encodePixels(imageSize, static_cast<unsigned char*>(bitmap.getPixels()), true, output);
+}
+
+bool PNGImageEncoder::encode(const ImageData& bitmap, Vector<unsigned char>* output)
+{
+    return encodePixels(bitmap.size(), bitmap.data()->data()->data(), false, output);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/image-encoders/skia/PNGImageEncoder.h b/Source/WebCore/platform/image-encoders/skia/PNGImageEncoder.h
index b8dfec3..31edad3 100644
--- a/Source/WebCore/platform/image-encoders/skia/PNGImageEncoder.h
+++ b/Source/WebCore/platform/image-encoders/skia/PNGImageEncoder.h
@@ -31,16 +31,19 @@
 #ifndef PNGImageEncoder_h
 #define PNGImageEncoder_h
 
-#include "Vector.h"
+#include <wtf/Vector.h>
 
 class SkBitmap;
 
 namespace WebCore {
 
+class ImageData;
+
 // Interface for encoding PNG data. This is a wrapper around libpng.
 class PNGImageEncoder {
 public:
     static bool encode(const SkBitmap&, Vector<unsigned char>* output);
+    static bool encode(const ImageData&, Vector<unsigned char>* output);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/mac/FileSystemMac.mm b/Source/WebCore/platform/mac/FileSystemMac.mm
index 8cdd382..a9cbcf4 100644
--- a/Source/WebCore/platform/mac/FileSystemMac.mm
+++ b/Source/WebCore/platform/mac/FileSystemMac.mm
@@ -41,28 +41,29 @@ String homeDirectoryPath()
     return NSHomeDirectory();
 }
 
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& platformFileHandle)
+String openTemporaryFile(const String& prefix, PlatformFileHandle& platformFileHandle)
 {
     platformFileHandle = invalidPlatformFileHandle;
     
     Vector<char> temporaryFilePath(PATH_MAX);
     if (!confstr(_CS_DARWIN_USER_TEMP_DIR, temporaryFilePath.data(), temporaryFilePath.size()))
-        return CString();
+        return String();
 
     // Shrink the vector.   
     temporaryFilePath.shrink(strlen(temporaryFilePath.data()));
     ASSERT(temporaryFilePath.last() == '/');
 
-    // Append the file name.    
-    temporaryFilePath.append(prefix, strlen(prefix));
+    // Append the file name.
+    CString prefixUtf8 = prefix.utf8();
+    temporaryFilePath.append(prefixUtf8.data(), prefixUtf8.length());
     temporaryFilePath.append("XXXXXX", 6);
     temporaryFilePath.append('\0');
 
     platformFileHandle = mkstemp(temporaryFilePath.data());
     if (platformFileHandle == invalidPlatformFileHandle)
-        return CString();
+        return String();
 
-    return CString(temporaryFilePath.data());
+    return String::fromUTF8(temporaryFilePath.data());
 }
 
 bool canExcludeFromBackup()
diff --git a/Source/WebCore/platform/mac/HTMLConverter.h b/Source/WebCore/platform/mac/HTMLConverter.h
new file mode 100644
index 0000000..645c1d7
--- /dev/null
+++ b/Source/WebCore/platform/mac/HTMLConverter.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "DOM.h"
+#import "DOMDocument.h"
+#import "DOMRange.h"
+
+namespace WebCore {
+class DocumentLoader;
+}
+
+@interface WebHTMLConverter : NSObject {
+    NSMutableAttributedString *_attrStr;
+    NSURL *_baseURL;
+    DOMDocument *_document;
+    DOMRange *_domRange;
+    NSMutableArray *_domStartAncestors;
+    WebCore::DocumentLoader *_dataSource;
+    NSString *_standardFontFamily;
+    CGFloat _textSizeMultiplier;
+    CGFloat _webViewTextSizeMultiplier;
+    CGFloat _defaultTabInterval;
+    CGFloat _defaultFontSize;
+    CGFloat _minimumFontSize;
+    NSMutableArray *_textLists;
+    NSMutableArray *_textBlocks;
+    NSMutableArray *_textTables;
+    NSMutableDictionary *_textTableFooters;
+    NSMutableArray *_textTableSpacings;
+    NSMutableArray *_textTablePaddings;
+    NSMutableArray *_textTableRows;
+    NSMutableArray *_textTableRowArrays;
+    NSMutableArray *_textTableRowBackgroundColors;
+    NSMutableDictionary *_computedStylesForElements;
+    NSMutableDictionary *_specifiedStylesForElements;
+    NSMutableDictionary *_stringsForNodes;
+    NSMutableDictionary *_floatsForNodes;
+    NSMutableDictionary *_colorsForNodes;
+    NSMutableDictionary *_attributesForElements;
+    NSMutableDictionary *_elementIsBlockLevel;
+    NSMutableDictionary *_fontCache;
+    NSMutableArray *_writingDirectionArray;
+    NSUInteger _domRangeStartIndex;
+    NSInteger _indexingLimit;
+    NSUInteger _thumbnailLimit;
+    NSInteger _errorCode;
+    NSInteger _quoteLevel;
+
+    struct {
+        unsigned int isSoft:1;
+        unsigned int reachedStart:1;
+        unsigned int reachedEnd:1;
+        unsigned int isIndexing:1;
+        unsigned int isTesting:1;
+        unsigned int hasTrailingNewline:1;
+        unsigned int pad:26;
+    } _flags;
+}
+
+- (id)init;
+- (id)initWithDOMRange:(DOMRange *)domRange;
+
+- (NSAttributedString *)attributedString;
+
+@end
+
diff --git a/Source/WebCore/platform/mac/HTMLConverter.mm b/Source/WebCore/platform/mac/HTMLConverter.mm
new file mode 100644
index 0000000..a4864c2
--- /dev/null
+++ b/Source/WebCore/platform/mac/HTMLConverter.mm
@@ -0,0 +1,1682 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "HTMLConverter.h"
+
+#import "ArchiveResource.h"
+#import "Document.h"
+#import "DocumentLoader.h"
+#import "DOMDocumentInternal.h"
+#import "DOMElementInternal.h"
+#import "DOMHTMLTableCellElement.h"
+#import "DOMPrivate.h"
+#import "Element.h"
+#import "Frame.h"
+#import "HTMLNames.h"
+#import "HTMLParserIdioms.h"
+#import <wtf/ASCIICType.h>
+
+using namespace WebCore;
+using namespace HTMLNames;
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+// Additional control Unicode characters
+const unichar WebNextLineCharacter = 0x0085;
+
+@interface NSTextList (TextListPrivate)
++ (NSDictionary *)_standardMarkerAttributesForAttributes:(NSDictionary *)attrs;
+@end
+
+@interface NSTextAttachment (NSIgnoreOrientation)
+- (void)setIgnoresOrientation:(BOOL)flag;
+- (BOOL)ignoresOrientation;
+@end
+
+@interface NSURL (WebDataURL)
++ (NSURL *)_web_uniqueWebDataURL;
++ (NSURL *)_web_uniqueWebDataURLWithRelativeString:(NSString *)string;
++ (NSURL *)_web_URLWithString:(NSString *)string relativeToURL:(NSURL *)baseURL;
+- (NSString *)_web_suggestedFilenameWithMIMEType:(NSString *)MIMEType;
+@end
+
+@interface WebHTMLConverter(WebHTMLConverterPrivate)
+
+- (NSString *)_stringForNode:(DOMNode *)node property:(NSString *)key;
+- (NSColor *)_colorForNode:(DOMNode *)node property:(NSString *)key;
+- (BOOL)_getFloat:(CGFloat *)val forNode:(DOMNode *)node property:(NSString *)key;
+- (void)_traverseNode:(DOMNode *)node depth:(NSInteger)depth embedded:(BOOL)embedded;
+- (void)_traverseFooterNode:(DOMNode *)node depth:(NSInteger)depth;
+
+@end
+
+// Returns the font to be used if the NSFontAttributeName doesn't exist
+static NSFont *WebDefaultFont()
+{
+    static NSFont *defaultFont = nil;
+    
+    if (defaultFont)
+        return defaultFont;
+    
+    NSFont *font = [NSFont fontWithName:@"Helvetica" size:12];    
+    if (!font)
+        font = [NSFont systemFontOfSize:12];
+    
+    defaultFont = [font retain];
+    
+    return defaultFont;
+}
+
+@implementation WebHTMLConverter
+
+static NSFont *_fontForNameAndSize(NSString *fontName, CGFloat size, NSMutableDictionary *cache)
+{
+    NSFontManager *fontManager = [NSFontManager sharedFontManager];
+    NSFont *font = [cache objectForKey:fontName];
+
+    if (font) {
+        font = [fontManager convertFont:font toSize:size];
+        return font;
+    }
+    font = [fontManager fontWithFamily:fontName traits:0 weight:0 size:size];
+    if (!font) {
+        NSArray *availableFamilyNames = [fontManager availableFontFamilies];
+        NSRange dividingRange, dividingSpaceRange = [fontName rangeOfString:@" " options:NSBackwardsSearch], dividingDashRange = [fontName rangeOfString:@"-" options:NSBackwardsSearch];
+        dividingRange = (0 < dividingSpaceRange.length && 0 < dividingDashRange.length) ? (dividingSpaceRange.location > dividingDashRange.location ? dividingSpaceRange : dividingDashRange) : (0 < dividingSpaceRange.length ? dividingSpaceRange : dividingDashRange);
+        while (0 < dividingRange.length) {
+            NSString *familyName = [fontName substringToIndex:dividingRange.location];
+            if ([availableFamilyNames containsObject:familyName]) {
+                NSArray *familyMemberArray;
+                NSString *faceName = [fontName substringFromIndex:(dividingRange.location + dividingRange.length)];
+                NSArray *familyMemberArrays = [fontManager availableMembersOfFontFamily:familyName];
+                NSEnumerator *familyMemberArraysEnum = [familyMemberArrays objectEnumerator];
+                while ((familyMemberArray = [familyMemberArraysEnum nextObject])) {
+                    NSString *familyMemberFaceName = [familyMemberArray objectAtIndex:1];
+                    if ([familyMemberFaceName compare:faceName options:NSCaseInsensitiveSearch] == NSOrderedSame) {
+                        NSFontTraitMask traits = [[familyMemberArray objectAtIndex:3] integerValue];
+                        NSInteger weight = [[familyMemberArray objectAtIndex:2] integerValue];
+                        font = [fontManager fontWithFamily:familyName traits:traits weight:weight size:size];
+                        break;
+                    }
+                }
+                if (!font) {
+                    if (0 < [familyMemberArrays count]) {
+                        NSArray *familyMemberArray = [familyMemberArrays objectAtIndex:0];
+                        NSFontTraitMask traits = [[familyMemberArray objectAtIndex:3] integerValue];
+                        NSInteger weight = [[familyMemberArray objectAtIndex:2] integerValue];
+                        font = [fontManager fontWithFamily:familyName traits:traits weight:weight size:size];
+                    }
+                }
+                break;
+            } else {
+                dividingSpaceRange = [familyName rangeOfString:@" " options:NSBackwardsSearch];
+                dividingDashRange = [familyName rangeOfString:@"-" options:NSBackwardsSearch];
+                dividingRange = (0 < dividingSpaceRange.length && 0 < dividingDashRange.length) ? (dividingSpaceRange.location > dividingDashRange.location ? dividingSpaceRange : dividingDashRange) : (0 < dividingSpaceRange.length ? dividingSpaceRange : dividingDashRange);
+            }
+        }
+    }
+    if (!font) font = [NSFont fontWithName:@"Times" size:size];
+    if (!font) font = [NSFont userFontOfSize:size];
+    if (!font) font = [fontManager convertFont:WebDefaultFont() toSize:size];
+    if (!font) font = WebDefaultFont();
+    [cache setObject:font forKey:fontName];
+    return font;
+}
+
++ (NSParagraphStyle *)defaultParagraphStyle
+{
+    static NSMutableParagraphStyle *defaultParagraphStyle = nil;
+    if (!defaultParagraphStyle) {
+        defaultParagraphStyle = [[NSParagraphStyle defaultParagraphStyle] mutableCopy];
+        [defaultParagraphStyle setDefaultTabInterval:36];
+        [defaultParagraphStyle setTabStops:[NSArray array]];
+    }
+    return defaultParagraphStyle;
+}
+
+- (NSArray *)_childrenForNode:(DOMNode *)node
+{
+    NSMutableArray *array = [NSMutableArray array];
+    DOMNode *child = [node firstChild];
+    while (child) {
+        [array addObject:child];
+        child = [child nextSibling];
+    }
+    return array;
+}
+
+- (DOMCSSStyleDeclaration *)_computedStyleForElement:(DOMElement *)element
+{
+    DOMDocument *document = [element ownerDocument];
+    DOMCSSStyleDeclaration *result = nil;
+    result = [_computedStylesForElements objectForKey:element];
+    if (result) {
+        if ([[NSNull null] isEqual:result]) result = nil;
+    } else {
+        result = [document getComputedStyle:element pseudoElement:@""] ;
+        [_computedStylesForElements setObject:(result ? (id)result : (id)[NSNull null]) forKey:element];
+    }
+    return result;
+}
+
+- (DOMCSSStyleDeclaration *)_specifiedStyleForElement:(DOMElement *)element
+{
+    DOMCSSStyleDeclaration *result = [_specifiedStylesForElements objectForKey:element];
+    if (result) {
+        if ([[NSNull null] isEqual:result]) result = nil;
+    } else {
+        result = [element style];
+        [_specifiedStylesForElements setObject:(result ? (id)result : (id)[NSNull null]) forKey:element];
+    }
+    return result;
+}
+
+- (NSString *)_computedStringForNode:(DOMNode *)node property:(NSString *)key
+{
+    NSString *result = nil;
+    BOOL inherit = YES;
+    DOMElement *element = (DOMElement *)node;    
+    if (element && [element nodeType] == DOM_ELEMENT_NODE) {
+        DOMCSSStyleDeclaration *computedStyle, *specifiedStyle;
+        inherit = NO;
+        if (!result && (computedStyle = [self _computedStyleForElement:element])) {
+            DOMCSSPrimitiveValue *computedValue = (DOMCSSPrimitiveValue *)[computedStyle getPropertyCSSValue:key];
+            if (computedValue) {
+                unsigned short valueType = [computedValue cssValueType];
+                if (valueType == DOM_CSS_PRIMITIVE_VALUE) {
+                    unsigned short primitiveType = [computedValue primitiveType];
+                    if (primitiveType == DOM_CSS_STRING || primitiveType == DOM_CSS_URI || primitiveType == DOM_CSS_IDENT || primitiveType == DOM_CSS_ATTR) {
+                        result = [computedValue getStringValue];
+                        if (result && [result length] == 0) result = nil;
+                    }
+                } else if (valueType == DOM_CSS_VALUE_LIST) {
+                    result = [computedStyle getPropertyValue:key];
+                }
+            }
+        }
+        if (!result && (specifiedStyle = [self _specifiedStyleForElement:element])) {
+            DOMCSSPrimitiveValue *specifiedValue = (DOMCSSPrimitiveValue *)[specifiedStyle getPropertyCSSValue:key];
+            if (specifiedValue) {
+                unsigned short valueType = [specifiedValue cssValueType];
+                if (valueType == DOM_CSS_PRIMITIVE_VALUE) {
+                    unsigned short primitiveType = [specifiedValue primitiveType];
+                    if (primitiveType == DOM_CSS_STRING || primitiveType == DOM_CSS_URI || primitiveType == DOM_CSS_IDENT || primitiveType == DOM_CSS_ATTR) {
+                        result = [specifiedValue getStringValue];
+                        if (result && [result length] == 0) result = nil;
+                        // ??? hack alert
+                        if (!result) {
+                            result = [specifiedStyle getPropertyValue:key];
+                        }
+                    }
+                } else if (valueType == DOM_CSS_INHERIT) {
+                    inherit = YES;
+                } else if (valueType == DOM_CSS_VALUE_LIST) {
+                    result = [specifiedStyle getPropertyValue:key];
+                }
+            }
+        }
+        if (!result) {
+            Element* coreElement = core(element);
+            if ([@"display" isEqualToString:key]) {
+                if (coreElement->hasTagName(headTag) || coreElement->hasTagName(scriptTag) || coreElement->hasTagName(appletTag) || coreElement->hasTagName(noframesTag))
+                    result = @"none";
+                else if (coreElement->hasTagName(addressTag) || coreElement->hasTagName(blockquoteTag) || coreElement->hasTagName(bodyTag) || coreElement->hasTagName(centerTag)
+                         || coreElement->hasTagName(ddTag) || coreElement->hasTagName(dirTag) || coreElement->hasTagName(divTag) || coreElement->hasTagName(dlTag)
+                         || coreElement->hasTagName(dtTag) || coreElement->hasTagName(fieldsetTag) || coreElement->hasTagName(formTag) || coreElement->hasTagName(frameTag)
+                         || coreElement->hasTagName(framesetTag) || coreElement->hasTagName(hrTag) || coreElement->hasTagName(htmlTag) || coreElement->hasTagName(h1Tag)
+                         || coreElement->hasTagName(h2Tag) || coreElement->hasTagName(h3Tag) || coreElement->hasTagName(h4Tag) || coreElement->hasTagName(h5Tag)
+                         || coreElement->hasTagName(h6Tag) || coreElement->hasTagName(iframeTag) || coreElement->hasTagName(menuTag) || coreElement->hasTagName(noscriptTag)
+                         || coreElement->hasTagName(olTag) || coreElement->hasTagName(pTag) || coreElement->hasTagName(preTag) || coreElement->hasTagName(ulTag))
+                    result = @"block";
+                else if (coreElement->hasTagName(liTag))
+                    result = @"list-item";
+                else if (coreElement->hasTagName(tableTag))
+                    result = @"table";
+                else if (coreElement->hasTagName(trTag))
+                    result = @"table-row";
+                else if (coreElement->hasTagName(thTag) || coreElement->hasTagName(tdTag))
+                    result = @"table-cell";
+                else if (coreElement->hasTagName(theadTag))
+                    result = @"table-header-group";
+                else if (coreElement->hasTagName(tbodyTag))
+                    result = @"table-row-group";
+                else if (coreElement->hasTagName(tfootTag))
+                    result = @"table-footer-group";
+                else if (coreElement->hasTagName(colTag))
+                    result = @"table-column";
+                else if (coreElement->hasTagName(colgroupTag))
+                    result = @"table-column-group";
+                else if (coreElement->hasTagName(captionTag))
+                    result = @"table-caption";
+            } else if ([@"white-space" isEqualToString:key]) {
+                if (coreElement->hasTagName(preTag))
+                    result = @"pre";
+                else
+                    inherit = YES;
+            } else if ([@"font-style" isEqualToString:key]) {
+                if (coreElement->hasTagName(iTag) || coreElement->hasTagName(citeTag) || coreElement->hasTagName(emTag) || coreElement->hasTagName(varTag) || coreElement->hasTagName(addressTag))
+                    result = @"italic";
+                else
+                    inherit = YES;
+            } else if ([@"font-weight" isEqualToString:key]) {
+                if (coreElement->hasTagName(bTag) || coreElement->hasTagName(strongTag) || coreElement->hasTagName(thTag))
+                    result = @"bolder";
+                else
+                    inherit = YES;
+            } else if ([@"text-decoration" isEqualToString:key]) {
+                if (coreElement->hasTagName(uTag) || coreElement->hasTagName(insTag))
+                    result = @"underline";
+                else if (coreElement->hasTagName(sTag) || coreElement->hasTagName(strikeTag) || coreElement->hasTagName(delTag))
+                    result = @"line-through";
+                else
+                    inherit = YES; // ??? this is not strictly correct
+            } else if ([@"text-align" isEqualToString:key]) {
+                if (coreElement->hasTagName(centerTag) || coreElement->hasTagName(captionTag) || coreElement->hasTagName(thTag))
+                    result = @"center";
+                else
+                    inherit = YES;
+            } else if ([@"vertical-align" isEqualToString:key]) {
+                if (coreElement->hasTagName(supTag))
+                    result = @"super";
+                else if (coreElement->hasTagName(subTag))
+                    result = @"sub";
+                else if (coreElement->hasTagName(theadTag) || coreElement->hasTagName(tbodyTag) || coreElement->hasTagName(tfootTag))
+                    result = @"middle";
+                else if (coreElement->hasTagName(trTag) || coreElement->hasTagName(thTag) || coreElement->hasTagName(tdTag))
+                    inherit = YES;
+            } else if ([@"font-family" isEqualToString:key] || [@"font-variant" isEqualToString:key] || [@"font-effect" isEqualToString:key]
+                       || [@"text-transform" isEqualToString:key] || [@"text-shadow" isEqualToString:key] || [@"visibility" isEqualToString:key]
+                       || [@"border-collapse" isEqualToString:key] || [@"empty-cells" isEqualToString:key] || [@"word-spacing" isEqualToString:key]
+                       || [@"list-style-type" isEqualToString:key] || [@"direction" isEqualToString:key]) {
+                inherit = YES;
+            }
+        }
+    }
+    if (!result && inherit) {
+        DOMNode *parentNode = [node parentNode];
+        if (parentNode) result = [self _stringForNode:parentNode property:key];
+    }
+    return result ? [result lowercaseString] : nil;
+}
+
+- (NSString *)_stringForNode:(DOMNode *)node property:(NSString *)key
+{
+    NSString *result = nil;
+    NSMutableDictionary *attributeDictionary = [_stringsForNodes objectForKey:node];
+    if (!attributeDictionary) {
+        attributeDictionary = [[NSMutableDictionary alloc] init];
+        [_stringsForNodes setObject:attributeDictionary forKey:node];
+        [attributeDictionary release];
+    }
+    result = [attributeDictionary objectForKey:key];
+    if (result) {
+        if ([@"" isEqualToString:result]) result = nil;
+    } else {
+        result = [self _computedStringForNode:node property:key];
+        [attributeDictionary setObject:(result ? result : @"") forKey:key];
+    }
+    return result;
+}
+
+static inline BOOL _getFloat(DOMCSSPrimitiveValue *primitiveValue, CGFloat *val)
+{
+    if (!val)
+        return NO;
+    switch ([primitiveValue primitiveType]) {
+        case DOM_CSS_PX:
+            *val = [primitiveValue getFloatValue:DOM_CSS_PX];
+            return YES;
+        case DOM_CSS_PT:
+            *val = 4 * [primitiveValue getFloatValue:DOM_CSS_PT] / 3;
+            return YES;
+        case DOM_CSS_PC:
+            *val = 16 * [primitiveValue getFloatValue:DOM_CSS_PC];
+            return YES;
+        case DOM_CSS_CM:
+            *val = 96 * [primitiveValue getFloatValue:DOM_CSS_CM] / (CGFloat)2.54;
+            return YES;
+        case DOM_CSS_MM:
+            *val = 96 * [primitiveValue getFloatValue:DOM_CSS_MM] / (CGFloat)25.4;
+            return YES;
+        case DOM_CSS_IN:
+            *val = 96 * [primitiveValue getFloatValue:DOM_CSS_IN];
+            return YES;
+        default:
+            return NO;
+    }
+}
+
+- (BOOL)_getComputedFloat:(CGFloat *)val forNode:(DOMNode *)node property:(NSString *)key
+{
+    BOOL result = NO, inherit = YES;
+    CGFloat floatVal = 0;
+    DOMElement *element = (DOMElement *)node;    
+    if (element && [element nodeType] == DOM_ELEMENT_NODE) {
+        DOMCSSStyleDeclaration *computedStyle, *specifiedStyle;
+        inherit = NO;
+        if (!result && (computedStyle = [self _computedStyleForElement:element])) {
+            DOMCSSPrimitiveValue *computedValue = (DOMCSSPrimitiveValue *)[computedStyle getPropertyCSSValue:key];
+            if (computedValue && [computedValue cssValueType] == DOM_CSS_PRIMITIVE_VALUE) {
+                result = _getFloat(computedValue, &floatVal);
+            }
+        }
+        if (!result && (specifiedStyle = [self _specifiedStyleForElement:element])) {
+            DOMCSSPrimitiveValue *specifiedValue = (DOMCSSPrimitiveValue *)[specifiedStyle getPropertyCSSValue:key];
+            if (specifiedValue) {
+                unsigned short valueType = [specifiedValue cssValueType];
+                if (valueType == DOM_CSS_PRIMITIVE_VALUE) {
+                    result = _getFloat(specifiedValue, &floatVal);
+                } else if (valueType == DOM_CSS_INHERIT) {
+                    inherit = YES;
+                }
+            }
+        }
+        if (!result) {
+            if ([@"text-indent" isEqualToString:key] || [@"letter-spacing" isEqualToString:key] || [@"word-spacing" isEqualToString:key]
+                || [@"line-height" isEqualToString:key] || [@"widows" isEqualToString:key] || [@"orphans" isEqualToString:key])
+                inherit = YES;
+        }
+    }
+    if (!result && inherit) {
+        DOMNode *parentNode = [node parentNode];
+        if (parentNode) result = [self _getFloat:&floatVal forNode:parentNode property:key];
+    }
+    if (result && val)
+        *val = floatVal;
+    return result;
+}
+
+- (BOOL)_getFloat:(CGFloat *)val forNode:(DOMNode *)node property:(NSString *)key
+{
+    BOOL result = NO;
+    CGFloat floatVal = 0;
+    NSNumber *floatNumber;
+    NSMutableDictionary *attributeDictionary = [_floatsForNodes objectForKey:node];
+    if (!attributeDictionary) {
+        attributeDictionary = [[NSMutableDictionary alloc] init];
+        [_floatsForNodes setObject:attributeDictionary forKey:node];
+        [attributeDictionary release];
+    }
+    floatNumber = [attributeDictionary objectForKey:key];
+    if (floatNumber) {
+        if (![[NSNull null] isEqual:floatNumber]) {
+            result = YES;
+            floatVal = [floatNumber floatValue];
+        }
+    } else {
+        result = [self _getComputedFloat:&floatVal forNode:node property:key];
+        [attributeDictionary setObject:(result ? (id)[NSNumber numberWithDouble:floatVal] : (id)[NSNull null]) forKey:key];
+    }
+    if (result && val) *val = floatVal;
+    return result;
+}
+
+static inline NSColor *_colorForRGBColor(DOMRGBColor *domRGBColor, BOOL ignoreBlack)
+{
+    NSColor *color = [domRGBColor _color];
+    NSColorSpace *colorSpace = [color colorSpace];
+    const CGFloat ColorEpsilon = 1 / (2 * (CGFloat)255.0);
+    
+    if (color) {
+        if ([colorSpace isEqual:[NSColorSpace genericGrayColorSpace]] || [colorSpace isEqual:[NSColorSpace deviceGrayColorSpace]]) {
+            CGFloat white, alpha;
+            [color getWhite:&white alpha:&alpha];
+            if (white < ColorEpsilon && (ignoreBlack || alpha < ColorEpsilon)) color = nil;
+        } else {
+            NSColor *rgbColor = nil;
+            if ([colorSpace isEqual:[NSColorSpace genericRGBColorSpace]] || [colorSpace isEqual:[NSColorSpace deviceRGBColorSpace]]) rgbColor = color;
+            if (!rgbColor) rgbColor = [color colorUsingColorSpaceName:NSDeviceRGBColorSpace];
+            if (rgbColor) {
+                CGFloat red, green, blue, alpha;
+                [rgbColor getRed:&red green:&green blue:&blue alpha:&alpha];
+                if (red < ColorEpsilon && green < ColorEpsilon && blue < ColorEpsilon && (ignoreBlack || alpha < ColorEpsilon)) color = nil;
+            }
+        }
+    }
+    return color;
+}
+
+static inline NSShadow *_shadowForShadowStyle(NSString *shadowStyle)
+{
+    NSShadow *shadow = nil;
+    NSUInteger shadowStyleLength = [shadowStyle length];
+    NSRange openParenRange = [shadowStyle rangeOfString:@"("], closeParenRange = [shadowStyle rangeOfString:@")"], firstRange = NSMakeRange(NSNotFound, 0), secondRange = NSMakeRange(NSNotFound, 0), thirdRange = NSMakeRange(NSNotFound, 0), spaceRange;
+    if (openParenRange.length > 0 && closeParenRange.length > 0 && NSMaxRange(openParenRange) < closeParenRange.location) {
+        NSArray *components = [[shadowStyle substringWithRange:NSMakeRange(NSMaxRange(openParenRange), closeParenRange.location - NSMaxRange(openParenRange))] componentsSeparatedByString:@","];
+        if ([components count] >= 3) {
+            CGFloat red = [[components objectAtIndex:0] floatValue] / 255, green = [[components objectAtIndex:1] floatValue] / 255, blue = [[components objectAtIndex:2] floatValue] / 255, alpha = ([components count] >= 4) ? [[components objectAtIndex:3] floatValue] / 255 : 1;
+            NSColor *shadowColor = [NSColor colorWithCalibratedRed:red green:green blue:blue alpha:alpha];
+            NSSize shadowOffset;
+            CGFloat shadowBlurRadius;
+            firstRange = [shadowStyle rangeOfString:@"px"];
+            if (firstRange.length > 0 && NSMaxRange(firstRange) < shadowStyleLength) secondRange = [shadowStyle rangeOfString:@"px" options:0 range:NSMakeRange(NSMaxRange(firstRange), shadowStyleLength - NSMaxRange(firstRange))];
+            if (secondRange.length > 0 && NSMaxRange(secondRange) < shadowStyleLength) thirdRange = [shadowStyle rangeOfString:@"px" options:0 range:NSMakeRange(NSMaxRange(secondRange), shadowStyleLength - NSMaxRange(secondRange))];
+            if (firstRange.location > 0 && firstRange.length > 0 && secondRange.length > 0 && thirdRange.length > 0) {
+                spaceRange = [shadowStyle rangeOfString:@" " options:NSBackwardsSearch range:NSMakeRange(0, firstRange.location)];
+                if (spaceRange.length == 0) spaceRange = NSMakeRange(0, 0);
+                shadowOffset.width = [[shadowStyle substringWithRange:NSMakeRange(NSMaxRange(spaceRange), firstRange.location - NSMaxRange(spaceRange))] floatValue];
+                spaceRange = [shadowStyle rangeOfString:@" " options:NSBackwardsSearch range:NSMakeRange(0, secondRange.location)];
+                if (spaceRange.length == 0) spaceRange = NSMakeRange(0, 0);
+                shadowOffset.height = -[[shadowStyle substringWithRange:NSMakeRange(NSMaxRange(spaceRange), secondRange.location - NSMaxRange(spaceRange))] floatValue];
+                spaceRange = [shadowStyle rangeOfString:@" " options:NSBackwardsSearch range:NSMakeRange(0, thirdRange.location)];
+                if (spaceRange.length == 0) spaceRange = NSMakeRange(0, 0);
+                shadowBlurRadius = [[shadowStyle substringWithRange:NSMakeRange(NSMaxRange(spaceRange), thirdRange.location - NSMaxRange(spaceRange))] floatValue];
+                shadow = [[[NSShadow alloc] init] autorelease];
+                [shadow setShadowColor:shadowColor];
+                [shadow setShadowOffset:shadowOffset];
+                [shadow setShadowBlurRadius:shadowBlurRadius];
+            }
+        }
+    }
+    return shadow;
+}
+
+- (BOOL)_elementIsBlockLevel:(DOMElement *)element
+{
+    BOOL isBlockLevel = NO;
+    NSNumber *val = nil;
+    val = [_elementIsBlockLevel objectForKey:element];
+    if (val) {
+        isBlockLevel = [val boolValue];
+    } else {
+        NSString *displayVal = [self _stringForNode:element property:@"display"], *floatVal = [self _stringForNode:element property:@"float"];
+        if (floatVal && ([@"left" isEqualToString:floatVal] || [@"right" isEqualToString:floatVal])) {
+            isBlockLevel = YES;
+        } else if (displayVal) {
+            isBlockLevel = ([@"block" isEqualToString:displayVal] || [@"list-item" isEqualToString:displayVal] || [displayVal hasPrefix:@"table"]);
+        }
+        [_elementIsBlockLevel setObject:[NSNumber numberWithBool:isBlockLevel] forKey:element];
+    }
+    return isBlockLevel;
+}
+
+- (BOOL)_elementHasOwnBackgroundColor:(DOMElement *)element
+{
+    // In the text system, text blocks (table elements) and documents (body elements) have their own background colors, which should not be inherited
+    if ([self _elementIsBlockLevel:element]) {
+        Element* coreElement = core(element);
+        NSString *displayVal = [self _stringForNode:element property:@"display"];
+        if (coreElement->hasTagName(htmlTag) || coreElement->hasTagName(bodyTag) || [displayVal hasPrefix:@"table"])
+            return YES;
+    }
+    return NO;
+}
+    
+- (DOMElement *)_blockLevelElementForNode:(DOMNode *)node
+{
+    DOMElement *element = (DOMElement *)node;
+    while (element && [element nodeType] != DOM_ELEMENT_NODE)
+        element = (DOMElement *)[element parentNode];
+    if (element && ![self _elementIsBlockLevel:element])
+        element = [self _blockLevelElementForNode:[element parentNode]];
+    return element;
+}
+
+- (NSColor *)_computedColorForNode:(DOMNode *)node property:(NSString *)key
+{
+    NSColor *result = nil;
+    BOOL inherit = YES, haveResult = NO, isColor = [@"color" isEqualToString:key], isBackgroundColor = [@"background-color" isEqualToString:key];
+    DOMElement *element = (DOMElement *)node;    
+    if (element && [element nodeType] == DOM_ELEMENT_NODE) {
+        DOMCSSStyleDeclaration *computedStyle, *specifiedStyle;
+        inherit = NO;
+        if (!haveResult && (computedStyle = [self _computedStyleForElement:element])) {
+            DOMCSSPrimitiveValue *computedValue = (DOMCSSPrimitiveValue *)[computedStyle getPropertyCSSValue:key];
+            if (computedValue && [computedValue cssValueType] == DOM_CSS_PRIMITIVE_VALUE && [computedValue primitiveType] == DOM_CSS_RGBCOLOR) {
+                result = _colorForRGBColor([computedValue getRGBColorValue], isColor);
+                haveResult = YES;
+            }
+        }
+        if (!haveResult && (specifiedStyle = [self _specifiedStyleForElement:element])) {
+            DOMCSSPrimitiveValue *specifiedValue = (DOMCSSPrimitiveValue *)[specifiedStyle getPropertyCSSValue:key];
+            if (specifiedValue) {
+                unsigned short valueType = [specifiedValue cssValueType];
+                if (valueType == DOM_CSS_PRIMITIVE_VALUE && [specifiedValue primitiveType] == DOM_CSS_RGBCOLOR) {
+                    result = _colorForRGBColor([specifiedValue getRGBColorValue], isColor);
+                    haveResult = YES;
+                } else if (valueType == DOM_CSS_INHERIT) {
+                    inherit = YES;
+                }
+            }
+        }
+        if (!result) {
+            if ((isColor && !haveResult) || (isBackgroundColor && ![self _elementHasOwnBackgroundColor:element])) inherit = YES;
+        }
+    }
+    if (!result && inherit) {
+        DOMNode *parentNode = [node parentNode];
+        if (parentNode && !(isBackgroundColor && [parentNode nodeType] == DOM_ELEMENT_NODE && [self _elementHasOwnBackgroundColor:(DOMElement *)parentNode])) {
+            result = [self _colorForNode:parentNode property:key];
+        }
+    }
+    return result;
+}
+
+- (NSColor *)_colorForNode:(DOMNode *)node property:(NSString *)key
+{
+    NSColor *result = nil;
+    NSMutableDictionary *attributeDictionary = [_colorsForNodes objectForKey:node];
+    if (!attributeDictionary) {
+        attributeDictionary = [[NSMutableDictionary alloc] init];
+        [_colorsForNodes setObject:attributeDictionary forKey:node];
+        [attributeDictionary release];
+    }
+    result = [attributeDictionary objectForKey:key];
+    if (result) {
+        if ([[NSColor clearColor] isEqual:result]) result = nil;
+    } else {
+        result = [self _computedColorForNode:node property:key];
+        [attributeDictionary setObject:(result ? result : [NSColor clearColor]) forKey:key];
+    }
+    return result;
+}
+
+- (NSDictionary *)_computedAttributesForElement:(DOMElement *)element
+{
+    DOMElement *blockElement = [self _blockLevelElementForNode:element];
+    NSMutableDictionary *attrs = [NSMutableDictionary dictionary];
+    NSFontManager *fontManager = [NSFontManager sharedFontManager];
+    NSString *fontEffect = [self _stringForNode:element property:@"font-effect"], *textDecoration = [self _stringForNode:element property:@"text-decoration"], *verticalAlign = [self _stringForNode:element property:@"vertical-align"], *textShadow = [self _stringForNode:element property:@"text-shadow"];
+    CGFloat fontSize = 0, baselineOffset = 0, kerning = 0;
+    NSFont *font = nil, *actualFont = [element _font];
+    NSColor *foregroundColor = [self _colorForNode:element property:@"color"], *backgroundColor = [self _colorForNode:element property:@"background-color"];
+
+    if (![self _getFloat:&fontSize forNode:element property:@"font-size"] || fontSize <= 0.0) fontSize = _defaultFontSize;
+    fontSize *= _textSizeMultiplier;
+    if (fontSize < _minimumFontSize) fontSize = _minimumFontSize;
+    if (fabs(floor(2.0 * fontSize + 0.5) / 2.0 - fontSize) < 0.05) {
+        fontSize = (CGFloat)floor(2.0 * fontSize + 0.5) / 2;
+    } else if (fabs(floor(10.0 * fontSize + 0.5) / 10.0 - fontSize) < 0.005) {
+        fontSize = (CGFloat)floor(10.0 * fontSize + 0.5) / 10;
+    }
+    if (fontSize <= 0.0) fontSize = 12;
+    
+    if (actualFont) font = [fontManager convertFont:actualFont toSize:fontSize];
+    if (!font) {
+        NSString *fontName = [[self _stringForNode:element property:@"font-family"] capitalizedString], *fontStyle = [self _stringForNode:element property:@"font-style"], *fontWeight = [self _stringForNode:element property:@"font-weight"], *fontVariant = [self _stringForNode:element property:@"font-variant"];
+        
+        if (!fontName) fontName = _standardFontFamily;
+        if (fontName) font = _fontForNameAndSize(fontName, fontSize, _fontCache);
+        if (!font) font = [NSFont fontWithName:@"Times" size:fontSize];
+        if ([@"italic" isEqualToString:fontStyle] || [@"oblique" isEqualToString:fontStyle]) {
+            NSFont *originalFont = font;
+            font = [fontManager convertFont:font toHaveTrait:NSItalicFontMask];
+            if (!font) font = originalFont;
+        }
+        if ([fontWeight hasPrefix:@"bold"] || [fontWeight integerValue] >= 700) {
+            // ??? handle weight properly using NSFontManager
+            NSFont *originalFont = font;
+            font = [fontManager convertFont:font toHaveTrait:NSBoldFontMask];
+            if (!font) font = originalFont;
+        }
+        if ([@"small-caps" isEqualToString:fontVariant]) {
+            // ??? synthesize small-caps if [font isEqual:originalFont]
+            NSFont *originalFont = font;
+            font = [fontManager convertFont:font toHaveTrait:NSSmallCapsFontMask];
+            if (!font) font = originalFont;
+        }
+    }
+    if (font) [attrs setObject:font forKey:NSFontAttributeName];
+    if (foregroundColor) [attrs setObject:foregroundColor forKey:NSForegroundColorAttributeName];
+    if (backgroundColor && ![self _elementHasOwnBackgroundColor:element]) [attrs setObject:backgroundColor forKey:NSBackgroundColorAttributeName];
+    if (fontEffect) {
+        if ([fontEffect rangeOfString:@"outline"].location != NSNotFound) [attrs setObject:[NSNumber numberWithDouble:3.0] forKey:NSStrokeWidthAttributeName];
+        if ([fontEffect rangeOfString:@"emboss"].location != NSNotFound) [attrs setObject:[[[NSShadow alloc] init] autorelease] forKey:NSShadowAttributeName];
+    }
+    if (textDecoration && [textDecoration length] > 4) {
+        if ([textDecoration rangeOfString:@"underline"].location != NSNotFound) [attrs setObject:[NSNumber numberWithInteger:NSUnderlineStyleSingle] forKey:NSUnderlineStyleAttributeName];
+        if ([textDecoration rangeOfString:@"line-through"].location != NSNotFound) [attrs setObject:[NSNumber numberWithInteger:NSUnderlineStyleSingle] forKey:NSStrikethroughStyleAttributeName];
+    }
+    if (verticalAlign) {
+        if ([verticalAlign rangeOfString:@"super"].location != NSNotFound) [attrs setObject:[NSNumber numberWithInteger:1] forKey:NSSuperscriptAttributeName];
+        if ([verticalAlign rangeOfString:@"sub"].location != NSNotFound) [attrs setObject:[NSNumber numberWithInteger:-1] forKey:NSSuperscriptAttributeName];
+    }
+    if ([self _getFloat:&baselineOffset forNode:element property:@"vertical-align"]) [attrs setObject:[NSNumber numberWithDouble:baselineOffset] forKey:NSBaselineOffsetAttributeName];
+    if ([self _getFloat:&kerning forNode:element property:@"letter-spacing"]) [attrs setObject:[NSNumber numberWithDouble:kerning] forKey:NSKernAttributeName];
+    if (textShadow && [textShadow length] > 4) {
+        NSShadow *shadow = _shadowForShadowStyle(textShadow);
+        if (shadow) [attrs setObject:shadow forKey:NSShadowAttributeName];
+    }
+    if (element != blockElement && [_writingDirectionArray count] > 0) [attrs setObject:[NSArray arrayWithArray:_writingDirectionArray] forKey:NSWritingDirectionAttributeName];
+    
+    if (blockElement) {
+        NSMutableParagraphStyle *paragraphStyle = [[[self class] defaultParagraphStyle] mutableCopy];
+        NSString *blockTag = [blockElement tagName];
+        BOOL isParagraph = ([@"P" isEqualToString:blockTag] || [@"LI" isEqualToString:blockTag] || ([blockTag hasPrefix:@"H"] && 2 == [blockTag length]));
+        NSString *textAlign = [self _stringForNode:blockElement property:@"text-align"], *direction = [self _stringForNode:blockElement property:@"direction"];
+        CGFloat leftMargin = 0, rightMargin = 0, bottomMargin = 0, textIndent = 0, lineHeight = 0;
+        if (textAlign) {
+            // WebKit can return -khtml-left, -khtml-right, -khtml-center
+            if ([textAlign hasSuffix:@"left"]) [paragraphStyle setAlignment:NSLeftTextAlignment];
+            else if ([textAlign hasSuffix:@"right"]) [paragraphStyle setAlignment:NSRightTextAlignment];
+            else if ([textAlign hasSuffix:@"center"]) [paragraphStyle setAlignment:NSCenterTextAlignment];
+            else if ([textAlign hasSuffix:@"justify"]) [paragraphStyle setAlignment:NSJustifiedTextAlignment];
+        }
+        if (direction) {
+            if ([direction isEqualToString:@"ltr"]) [paragraphStyle setBaseWritingDirection:NSWritingDirectionLeftToRight];
+            else if ([direction isEqualToString:@"rtl"]) [paragraphStyle setBaseWritingDirection:NSWritingDirectionRightToLeft];
+        }
+        if ([blockTag hasPrefix:@"H"] && 2 == [blockTag length]) {
+            NSInteger headerLevel = [blockTag characterAtIndex:1] - '0';
+            if (1 <= headerLevel && headerLevel <= 6) [paragraphStyle setHeaderLevel:headerLevel];            
+        }
+        if (isParagraph) {
+            //if ([self _getFloat:&topMargin forNode:blockElement property:@"margin-top"] && topMargin > 0.0) [paragraphStyle setParagraphSpacingBefore:topMargin];
+            if ([self _getFloat:&leftMargin forNode:blockElement property:@"margin-left"] && leftMargin > 0.0) [paragraphStyle setHeadIndent:leftMargin];
+            if ([self _getFloat:&textIndent forNode:blockElement property:@"text-indent"]) [paragraphStyle setFirstLineHeadIndent:[paragraphStyle headIndent] + textIndent];
+            if ([self _getFloat:&rightMargin forNode:blockElement property:@"margin-right"] && rightMargin > 0.0) [paragraphStyle setTailIndent:-rightMargin];
+            if ([self _getFloat:&bottomMargin forNode:blockElement property:@"margin-bottom"] && bottomMargin > 0.0) [paragraphStyle setParagraphSpacing:bottomMargin];
+        }
+        if (_webViewTextSizeMultiplier > 0.0 && [self _getFloat:&lineHeight forNode:element property:@"line-height"] && lineHeight > 0.0) {
+            [paragraphStyle setMinimumLineHeight:lineHeight / _webViewTextSizeMultiplier];
+        }
+        if ([_textLists count] > 0) [paragraphStyle setTextLists:_textLists];
+        if ([_textBlocks count] > 0) [paragraphStyle setTextBlocks:_textBlocks];
+        [attrs setObject:paragraphStyle forKey:NSParagraphStyleAttributeName];
+        [paragraphStyle release];
+    }
+    return attrs;
+}
+
+- (NSDictionary *)_attributesForElement:(DOMElement *)element
+{
+    NSDictionary *result;
+    if (element) {
+        result = [_attributesForElements objectForKey:element];
+        if (!result) {
+            result = [self _computedAttributesForElement:element];
+            [_attributesForElements setObject:result forKey:element];
+        }
+    } else {
+        result = [NSDictionary dictionary];
+    }
+    return result;
+
+}
+
+- (void)_newParagraphForElement:(DOMElement *)element tag:(NSString *)tag allowEmpty:(BOOL)flag suppressTrailingSpace:(BOOL)suppress
+{
+    NSUInteger textLength = [_attrStr length];
+    unichar lastChar = (textLength > 0) ? [[_attrStr string] characterAtIndex:textLength - 1] : '\n';
+    NSRange rangeToReplace = (suppress && _flags.isSoft && (lastChar == ' ' || lastChar == NSLineSeparatorCharacter)) ? NSMakeRange(textLength - 1, 1) : NSMakeRange(textLength, 0);
+    BOOL needBreak = (flag || lastChar != '\n');
+    if (needBreak) {
+        NSString *string = (([@"BODY" isEqualToString:tag] || [@"HTML" isEqualToString:tag]) ? @"" : @"\n");
+        [_writingDirectionArray removeAllObjects];
+        [_attrStr replaceCharactersInRange:rangeToReplace withString:string];
+        if (rangeToReplace.location < _domRangeStartIndex) _domRangeStartIndex += [string length] - rangeToReplace.length;
+        rangeToReplace.length = [string length];
+        if (!_flags.isIndexing) {
+            NSDictionary *attrs = [self _attributesForElement:element];
+            if (!_flags.isTesting && rangeToReplace.length > 0) [_attrStr setAttributes:attrs range:rangeToReplace];
+        }
+        _flags.isSoft = YES;
+    }
+}
+
+- (void)_newLineForElement:(DOMElement *)element
+{
+    unichar c = NSLineSeparatorCharacter;
+    NSString *string = [[NSString alloc] initWithCharacters:&c length:1];
+    NSUInteger textLength = [_attrStr length];
+    NSRange rangeToReplace = NSMakeRange(textLength, 0);
+    [_attrStr replaceCharactersInRange:rangeToReplace withString:string];
+    rangeToReplace.length = [string length];
+    if (rangeToReplace.location < _domRangeStartIndex) _domRangeStartIndex += rangeToReplace.length;
+    if (!_flags.isIndexing) {
+        NSDictionary *attrs = [self _attributesForElement:element];
+        if (!_flags.isTesting && rangeToReplace.length > 0) [_attrStr setAttributes:attrs range:rangeToReplace];
+    }
+    [string release];
+    _flags.isSoft = YES;
+}
+
+- (void)_newTabForElement:(DOMElement *)element
+{
+    NSString *string = @"\t";
+    NSUInteger textLength = [_attrStr length];
+    unichar lastChar = (textLength > 0) ? [[_attrStr string] characterAtIndex:textLength - 1] : '\n';
+    NSRange rangeToReplace = (_flags.isSoft && lastChar == ' ') ? NSMakeRange(textLength - 1, 1) : NSMakeRange(textLength, 0);
+    [_attrStr replaceCharactersInRange:rangeToReplace withString:string];
+    rangeToReplace.length = [string length];
+    if (rangeToReplace.location < _domRangeStartIndex) _domRangeStartIndex += rangeToReplace.length;
+    if (!_flags.isIndexing) {
+        NSDictionary *attrs = [self _attributesForElement:element];
+        if (!_flags.isTesting && rangeToReplace.length > 0) [_attrStr setAttributes:attrs range:rangeToReplace];
+    }
+    [string release];
+    _flags.isSoft = YES;
+}
+
+static NSFileWrapper *fileWrapperForURL(DocumentLoader *dataSource, NSURL *URL)
+{
+    if ([URL isFileURL]) {
+        NSString *path = [[URL path] stringByResolvingSymlinksInPath];
+        return [[[NSFileWrapper alloc] initWithPath:path] autorelease];
+    }
+    
+    RefPtr<ArchiveResource> resource = dataSource->subresource(URL);
+    if (resource) {
+        NSFileWrapper *wrapper = [[[NSFileWrapper alloc] initRegularFileWithContents:[resource->data()->createNSData() autorelease]] autorelease];
+        NSString *filename = resource->response().suggestedFilename();
+        if (!filename || ![filename length]) {
+            NSURL *URL = resource->url();
+            filename = [URL _web_suggestedFilenameWithMIMEType:resource->mimeType()];
+        }
+        [wrapper setPreferredFilename:filename];
+        return wrapper;
+    }
+    
+    NSMutableURLRequest *request = [[NSMutableURLRequest alloc] initWithURL:URL];
+
+    NSCachedURLResponse *cachedResponse = [[NSURLCache sharedURLCache] cachedResponseForRequest:request];
+    [request release];
+    
+    if (cachedResponse) {
+        NSFileWrapper *wrapper = [[[NSFileWrapper alloc] initRegularFileWithContents:[cachedResponse data]] autorelease];
+        [wrapper setPreferredFilename:[[cachedResponse response] suggestedFilename]];
+        return wrapper;
+    }
+    
+    return nil;
+}
+    
+- (BOOL)_addAttachmentForElement:(DOMElement *)element URL:(NSURL *)url needsParagraph:(BOOL)needsParagraph usePlaceholder:(BOOL)flag
+{
+    BOOL retval = NO, notFound = NO;
+    NSFileWrapper *fileWrapper = nil;
+    static NSImage *missingImage = nil;
+    Frame* frame = core([element ownerDocument])->frame();
+    DocumentLoader *dataSource = frame->loader()->frameHasLoaded() ? frame->loader()->documentLoader() : 0;
+    BOOL ignoreOrientation = YES;
+
+    if (_flags.isIndexing) return NO;
+    if ([url isFileURL]) {
+        NSString *path = [[url path] stringByStandardizingPath];
+        if (path) fileWrapper = [[[NSFileWrapper alloc] initWithPath:path] autorelease];
+    }
+    if (!fileWrapper) {
+        RefPtr<ArchiveResource> resource = dataSource->subresource(url);
+        if (!resource) resource = dataSource->subresource(url);
+        if (flag && resource && [@"text/html" isEqual:resource->mimeType()]) notFound = YES;
+        if (resource && !notFound) {
+            fileWrapper = [[[NSFileWrapper alloc] initRegularFileWithContents:[resource->data()->createNSData() autorelease]] autorelease];
+            [fileWrapper setPreferredFilename:[url _web_suggestedFilenameWithMIMEType:resource->mimeType()]];
+        }
+    }
+    if (!fileWrapper && !notFound) {
+        fileWrapper = fileWrapperForURL(dataSource, url);
+        if (flag && fileWrapper && [[[[fileWrapper preferredFilename] pathExtension] lowercaseString] hasPrefix:@"htm"]) notFound = YES;
+        if (notFound) fileWrapper = nil;
+    }
+    if (!fileWrapper && !notFound) {
+        fileWrapper = fileWrapperForURL(_dataSource, url);
+        if (flag && fileWrapper && [[[[fileWrapper preferredFilename] pathExtension] lowercaseString] hasPrefix:@"htm"]) notFound = YES;
+        if (notFound) fileWrapper = nil;
+    }
+    if (fileWrapper || flag) {
+        NSUInteger textLength = [_attrStr length];
+        NSTextAttachment *attachment = [[NSTextAttachment alloc] initWithFileWrapper:fileWrapper];
+        NSTextAttachmentCell *cell;
+        NSString *string = [[NSString alloc] initWithFormat:(needsParagraph ? @"%C\n" : @"%C"), NSAttachmentCharacter];
+        NSRange rangeToReplace = NSMakeRange(textLength, 0);
+        NSDictionary *attrs;
+        if (fileWrapper) {
+            if (ignoreOrientation) [attachment setIgnoresOrientation:YES];
+        } else {
+            cell = [[NSTextAttachmentCell alloc] initImageCell:missingImage];
+            [attachment setAttachmentCell:cell];
+            [cell release];
+        }
+        [_attrStr replaceCharactersInRange:rangeToReplace withString:string];
+        rangeToReplace.length = [string length];
+        if (rangeToReplace.location < _domRangeStartIndex) _domRangeStartIndex += rangeToReplace.length;
+        attrs = [self _attributesForElement:element];
+        if (!_flags.isTesting && rangeToReplace.length > 0) {
+            [_attrStr setAttributes:attrs range:rangeToReplace];
+            rangeToReplace.length = 1;
+            [_attrStr addAttribute:NSAttachmentAttributeName value:attachment range:rangeToReplace];
+        }
+        [string release];
+        [attachment release];
+        _flags.isSoft = NO;
+        retval = YES;
+    }
+    return retval;
+}
+
+- (void)_addQuoteForElement:(DOMElement *)element opening:(BOOL)opening level:(NSInteger)level
+{
+    unichar c = ((level % 2) == 0) ? (opening ? 0x201c : 0x201d) : (opening ? 0x2018 : 0x2019);
+    NSString *string = [[NSString alloc] initWithCharacters:&c length:1];
+    NSUInteger textLength = [_attrStr length];
+    NSRange rangeToReplace = NSMakeRange(textLength, 0);
+    [_attrStr replaceCharactersInRange:rangeToReplace withString:string];
+    rangeToReplace.length = [string length];
+    if (rangeToReplace.location < _domRangeStartIndex) _domRangeStartIndex += rangeToReplace.length;
+    if (!_flags.isIndexing) {
+        NSDictionary *attrs = [self _attributesForElement:element];
+        if (!_flags.isTesting && rangeToReplace.length > 0) [_attrStr setAttributes:attrs range:rangeToReplace];
+    }
+    [string release];
+    _flags.isSoft = NO;
+}
+
+- (void)_addValue:(NSString *)value forElement:(DOMElement *)element
+{
+    NSUInteger textLength = [_attrStr length], valueLength = [value length];
+    NSRange rangeToReplace = NSMakeRange(textLength, 0);
+    if (valueLength > 0) {
+        [_attrStr replaceCharactersInRange:rangeToReplace withString:value];
+        rangeToReplace.length = valueLength;
+        if (rangeToReplace.location < _domRangeStartIndex) _domRangeStartIndex += rangeToReplace.length;
+        if (!_flags.isIndexing) {
+            NSDictionary *attrs = [self _attributesForElement:element];
+            if (!_flags.isTesting && rangeToReplace.length > 0) [_attrStr setAttributes:attrs range:rangeToReplace];
+        }
+        _flags.isSoft = NO;
+    }
+}
+
+- (void)_fillInBlock:(NSTextBlock *)block forElement:(DOMElement *)element backgroundColor:(NSColor *)backgroundColor extraMargin:(CGFloat)extraMargin extraPadding:(CGFloat)extraPadding isTable:(BOOL)isTable
+{
+    CGFloat val = 0;
+    NSColor *color = nil;
+    BOOL isTableCellElement = [element isKindOfClass:[DOMHTMLTableCellElement class]];
+    NSString *width = isTableCellElement ? [(DOMHTMLTableCellElement *)element width] : [element getAttribute:@"width"];
+
+    if ((width && [width length] > 0) || !isTable) {
+        if ([self _getFloat:&val forNode:element property:@"width"]) [block setValue:val type:NSTextBlockAbsoluteValueType forDimension:NSTextBlockWidth];
+    }
+    
+    if ([self _getFloat:&val forNode:element property:@"min-width"]) [block setValue:val type:NSTextBlockAbsoluteValueType forDimension:NSTextBlockMinimumWidth];
+    if ([self _getFloat:&val forNode:element property:@"max-width"]) [block setValue:val type:NSTextBlockAbsoluteValueType forDimension:NSTextBlockMaximumWidth];
+    if ([self _getFloat:&val forNode:element property:@"min-height"]) [block setValue:val type:NSTextBlockAbsoluteValueType forDimension:NSTextBlockMinimumHeight];
+    if ([self _getFloat:&val forNode:element property:@"max-height"]) [block setValue:val type:NSTextBlockAbsoluteValueType forDimension:NSTextBlockMaximumHeight];
+
+    if ([self _getFloat:&val forNode:element property:@"padding-left"]) [block setWidth:val + extraPadding type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockPadding edge:NSMinXEdge]; else [block setWidth:extraPadding type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockPadding edge:NSMinXEdge];
+    if ([self _getFloat:&val forNode:element property:@"padding-top"]) [block setWidth:val + extraPadding type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockPadding edge:NSMinYEdge]; else [block setWidth:extraPadding type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockPadding edge:NSMinYEdge];
+    if ([self _getFloat:&val forNode:element property:@"padding-right"]) [block setWidth:val + extraPadding type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockPadding edge:NSMaxXEdge]; else [block setWidth:extraPadding type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockPadding edge:NSMaxXEdge];
+    if ([self _getFloat:&val forNode:element property:@"padding-bottom"]) [block setWidth:val + extraPadding type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockPadding edge:NSMaxYEdge]; else [block setWidth:extraPadding type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockPadding edge:NSMaxYEdge];
+    
+    if ([self _getFloat:&val forNode:element property:@"border-left-width"]) [block setWidth:val type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockBorder edge:NSMinXEdge];
+    if ([self _getFloat:&val forNode:element property:@"border-top-width"]) [block setWidth:val type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockBorder edge:NSMinYEdge];
+    if ([self _getFloat:&val forNode:element property:@"border-right-width"]) [block setWidth:val type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockBorder edge:NSMaxXEdge];
+    if ([self _getFloat:&val forNode:element property:@"border-bottom-width"]) [block setWidth:val type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockBorder edge:NSMaxYEdge];
+
+    if ([self _getFloat:&val forNode:element property:@"margin-left"]) [block setWidth:val + extraMargin type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockMargin edge:NSMinXEdge]; else [block setWidth:extraMargin type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockMargin edge:NSMinXEdge];
+    if ([self _getFloat:&val forNode:element property:@"margin-top"]) [block setWidth:val + extraMargin type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockMargin edge:NSMinYEdge]; else [block setWidth:extraMargin type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockMargin edge:NSMinYEdge];
+    if ([self _getFloat:&val forNode:element property:@"margin-right"]) [block setWidth:val + extraMargin type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockMargin edge:NSMaxXEdge]; else [block setWidth:extraMargin type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockMargin edge:NSMaxXEdge];
+    if ([self _getFloat:&val forNode:element property:@"margin-bottom"]) [block setWidth:val + extraMargin type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockMargin edge:NSMaxYEdge]; else [block setWidth:extraMargin type:NSTextBlockAbsoluteValueType forLayer:NSTextBlockMargin edge:NSMaxYEdge];
+
+    if ((color = [self _colorForNode:element property:@"background-color"])) [block setBackgroundColor:color];
+    if (!color && backgroundColor) [block setBackgroundColor:backgroundColor];
+    if ((color = [self _colorForNode:element property:@"border-left-color"])) [block setBorderColor:color forEdge:NSMinXEdge];
+    if ((color = [self _colorForNode:element property:@"border-top-color"])) [block setBorderColor:color forEdge:NSMinYEdge];
+    if ((color = [self _colorForNode:element property:@"border-right-color"])) [block setBorderColor:color forEdge:NSMaxXEdge];
+    if ((color = [self _colorForNode:element property:@"border-bottom-color"])) [block setBorderColor:color forEdge:NSMaxYEdge];
+}
+
+static inline BOOL read2DigitNumber(const char **pp, int8_t *outval)
+{
+    BOOL result = NO;
+    char c1 = *(*pp)++, c2;
+    if (isASCIIDigit(c1)) {
+        c2 = *(*pp)++;
+        if (isASCIIDigit(c2)) {
+            *outval = 10 * (c1 - '0') + (c2 - '0');
+            result = YES;
+        }
+    }
+    return result;
+}
+
+static inline NSDate *_dateForString(NSString *string)
+{
+    CFGregorianDate date;
+    const char *p = [string UTF8String];
+    int8_t secval = 0;
+    BOOL wellFormed = YES;
+
+    date.year = 0;
+    while (*p && isASCIIDigit(*p)) date.year = 10 * date.year + *p++ - '0';
+    if (*p++ != '-') wellFormed = NO;
+    if (!wellFormed || !read2DigitNumber(&p, &date.month) || *p++ != '-') wellFormed = NO;
+    if (!wellFormed || !read2DigitNumber(&p, &date.day) || *p++ != 'T') wellFormed = NO;
+    if (!wellFormed || !read2DigitNumber(&p, &date.hour) || *p++ != ':') wellFormed = NO;
+    if (!wellFormed || !read2DigitNumber(&p, &date.minute) || *p++ != ':') wellFormed = NO;
+    if (!wellFormed || !read2DigitNumber(&p, &secval) || *p++ != 'Z') wellFormed = NO;
+    if (wellFormed) date.second = secval;
+    return wellFormed ? [(NSDate *)CFDateCreate(NULL, CFGregorianDateGetAbsoluteTime(date, NULL)) autorelease] : nil;
+}
+
+static NSInteger _colCompare(id block1, id block2, void *)
+{
+    NSInteger col1 = [(NSTextTableBlock *)block1 startingColumn], col2 = [(NSTextTableBlock *)block2 startingColumn];
+    return ((col1 < col2) ? NSOrderedAscending : ((col1 == col2) ? NSOrderedSame : NSOrderedDescending));
+}
+
+- (BOOL)_enterElement:(DOMElement *)element tag:(NSString *)tag display:(NSString *)displayVal
+{
+    if (!displayVal || !([@"none" isEqualToString:displayVal] || [@"table-column" isEqualToString:displayVal] || [@"table-column-group" isEqualToString:displayVal])) {
+        if ([self _elementIsBlockLevel:element] && ![@"BR" isEqualToString:tag] && !([@"table-cell" isEqualToString:displayVal] && [_textTables count] == 0) 
+            && !([_textLists count] > 0 && [@"block" isEqualToString:displayVal] && ![@"LI" isEqualToString:tag] && ![@"UL" isEqualToString:tag] && ![@"OL" isEqualToString:tag]))
+            [self _newParagraphForElement:element tag:tag allowEmpty:NO suppressTrailingSpace:YES];
+        return YES;
+    }
+    return NO;
+}
+
+- (void)_addTableForElement:(DOMElement *)tableElement
+{
+    NSTextTable *table = [[NSTextTable alloc] init];
+    CGFloat cellSpacingVal = 1, cellPaddingVal = 1;
+    [table setNumberOfColumns:1];
+    [table setLayoutAlgorithm:NSTextTableAutomaticLayoutAlgorithm];
+    [table setCollapsesBorders:NO];
+    [table setHidesEmptyCells:NO];
+    if (tableElement) {
+        NSString *borderCollapse = [self _stringForNode:tableElement property:@"border-collapse"], *emptyCells = [self _stringForNode:tableElement property:@"empty-cells"], *tableLayout = [self _stringForNode:tableElement property:@"table-layout"];
+        if ([tableElement respondsToSelector:@selector(cellSpacing)]) {
+            NSString *cellSpacing = [(DOMHTMLTableElement *)tableElement cellSpacing];
+            if (cellSpacing && [cellSpacing length] > 0 && ![cellSpacing hasSuffix:@"%"]) cellSpacingVal = [cellSpacing floatValue];
+        }
+        if ([tableElement respondsToSelector:@selector(cellPadding)]) {
+            NSString *cellPadding = [(DOMHTMLTableElement *)tableElement cellPadding];
+            if (cellPadding && [cellPadding length] > 0 && ![cellPadding hasSuffix:@"%"]) cellPaddingVal = [cellPadding floatValue];
+        }
+        [self _fillInBlock:table forElement:tableElement backgroundColor:nil extraMargin:0 extraPadding:0 isTable:YES];
+        if ([@"collapse" isEqualToString:borderCollapse]) {
+            [table setCollapsesBorders:YES];
+            cellSpacingVal = 0;
+        }
+        if ([@"hide" isEqualToString:emptyCells]) [table setHidesEmptyCells:YES];
+        if ([@"fixed" isEqualToString:tableLayout]) [table setLayoutAlgorithm:NSTextTableFixedLayoutAlgorithm];
+    }
+    [_textTables addObject:table];
+    [_textTableSpacings addObject:[NSNumber numberWithDouble:cellSpacingVal]];
+    [_textTablePaddings addObject:[NSNumber numberWithDouble:cellPaddingVal]];
+    [_textTableRows addObject:[NSNumber numberWithInteger:0]];
+    [_textTableRowArrays addObject:[NSMutableArray array]];
+    [table release];
+}
+
+- (void)_addTableCellForElement:(DOMElement *)tableCellElement
+{
+    NSTextTable *table = [_textTables lastObject];
+    NSInteger rowNumber = [[_textTableRows lastObject] integerValue], columnNumber = 0, rowSpan = 1, colSpan = 1;
+    NSMutableArray *rowArray = [_textTableRowArrays lastObject];
+    NSUInteger i, count = [rowArray count];
+    NSColor *color = ([_textTableRowBackgroundColors count] > 0) ? [_textTableRowBackgroundColors lastObject] : nil;
+    NSTextTableBlock *block, *previousBlock;
+    CGFloat cellSpacingVal = [[_textTableSpacings lastObject] floatValue];
+    if ([color isEqual:[NSColor clearColor]]) color = nil;
+    for (i = 0; i < count; i++) {
+        previousBlock = [rowArray objectAtIndex:i];
+        if (columnNumber >= [previousBlock startingColumn] && columnNumber < [previousBlock startingColumn] + [previousBlock columnSpan]) columnNumber = [previousBlock startingColumn] + [previousBlock columnSpan];
+    }
+    if (tableCellElement) {
+        if ([tableCellElement respondsToSelector:@selector(rowSpan)]) {
+            rowSpan = [(DOMHTMLTableCellElement *)tableCellElement rowSpan];
+            if (rowSpan < 1) rowSpan = 1;
+        }
+        if ([tableCellElement respondsToSelector:@selector(colSpan)]) {
+            colSpan = [(DOMHTMLTableCellElement *)tableCellElement colSpan];
+            if (colSpan < 1) colSpan = 1;
+        }
+    }
+    block = [[NSTextTableBlock alloc] initWithTable:table startingRow:rowNumber rowSpan:rowSpan startingColumn:columnNumber columnSpan:colSpan];
+    if (tableCellElement) {
+        NSString *verticalAlign = [self _stringForNode:tableCellElement property:@"vertical-align"];
+        [self _fillInBlock:block forElement:tableCellElement backgroundColor:color extraMargin:cellSpacingVal / 2 extraPadding:0 isTable:NO];
+        if ([@"middle" isEqualToString:verticalAlign]) [block setVerticalAlignment:NSTextBlockMiddleAlignment];
+        else if ([@"bottom" isEqualToString:verticalAlign]) [block setVerticalAlignment:NSTextBlockBottomAlignment];
+        else if ([@"baseline" isEqualToString:verticalAlign]) [block setVerticalAlignment:NSTextBlockBaselineAlignment];
+        else if ([@"top" isEqualToString:verticalAlign]) [block setVerticalAlignment:NSTextBlockTopAlignment];
+    }
+    [_textBlocks addObject:block];
+    [rowArray addObject:block];
+    [rowArray sortUsingFunction:_colCompare context:NULL];
+    [block release];
+}
+
+- (BOOL)_processElement:(DOMElement *)element tag:(NSString *)tag display:(NSString *)displayVal depth:(NSInteger)depth
+{
+    BOOL retval = YES, isBlockLevel = [self _elementIsBlockLevel:element];
+    if (isBlockLevel) {
+        [_writingDirectionArray removeAllObjects];
+    } else {
+        NSString *bidi = [self _stringForNode:element property:@"unicode-bidi"];
+        if (bidi && [bidi isEqualToString:@"embed"]) {
+            NSUInteger val = NSTextWritingDirectionEmbedding;
+            NSString *direction = [self _stringForNode:element property:@"direction"];
+            if ([direction isEqualToString:@"rtl"]) val |= NSWritingDirectionRightToLeft;
+            [_writingDirectionArray addObject:[NSNumber numberWithUnsignedInteger:val]];
+        } else if (bidi && [bidi isEqualToString:@"bidi-override"]) {
+            NSUInteger val = NSTextWritingDirectionOverride;
+            NSString *direction = [self _stringForNode:element property:@"direction"];
+            if ([direction isEqualToString:@"rtl"]) val |= NSWritingDirectionRightToLeft;
+            [_writingDirectionArray addObject:[NSNumber numberWithUnsignedInteger:val]];
+        }
+    }
+    if ([@"table" isEqualToString:displayVal] || ([_textTables count] == 0 && [@"table-row-group" isEqualToString:displayVal])) {
+        DOMElement *tableElement = element;
+        if ([@"table-row-group" isEqualToString:displayVal]) {
+            // If we are starting in medias res, the first thing we see may be the tbody, so go up to the table
+            tableElement = [self _blockLevelElementForNode:[element parentNode]];
+            if (![@"table" isEqualToString:[self _stringForNode:tableElement property:@"display"]]) tableElement = element;
+        }
+        while ([_textTables count] > [_textBlocks count]) {
+            [self _addTableCellForElement:nil];
+        }
+        [self _addTableForElement:tableElement];
+    } else if ([@"table-footer-group" isEqualToString:displayVal] && [_textTables count] > 0) {
+        [_textTableFooters setObject:element forKey:[NSValue valueWithNonretainedObject:[_textTables lastObject]]];
+        retval = NO;
+    } else if ([@"table-row" isEqualToString:displayVal] && [_textTables count] > 0) {
+        NSColor *color = [self _colorForNode:element property:@"background-color"];
+        if (!color) color = [NSColor clearColor];
+        [_textTableRowBackgroundColors addObject:color];
+    } else if ([@"table-cell" isEqualToString:displayVal]) {
+        while ([_textTables count] < [_textBlocks count] + 1) {
+            [self _addTableForElement:nil];
+        }
+        [self _addTableCellForElement:element];
+    } else if ([@"IMG" isEqualToString:tag]) {
+        NSString *urlString = [element getAttribute:@"src"];
+        if (urlString && [urlString length] > 0) {
+            NSURL *url = core([element ownerDocument])->completeURL(stripLeadingAndTrailingHTMLSpaces(urlString));
+            if (!url) url = [NSURL _web_URLWithString:[urlString stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]] relativeToURL:_baseURL];
+            if (url) [self _addAttachmentForElement:element URL:url needsParagraph:isBlockLevel usePlaceholder:YES];
+        }
+        retval = NO;
+    } else if ([@"OBJECT" isEqualToString:tag]) {
+        NSString *baseString = [element getAttribute:@"codebase"], *urlString = [element getAttribute:@"data"], *declareString = [element getAttribute:@"declare"];
+        if (urlString && [urlString length] > 0 && ![@"true" isEqualToString:declareString]) {
+            NSURL *baseURL = nil, *url = nil;
+            if (baseString && [baseString length] > 0) {
+                baseURL = core([element ownerDocument])->completeURL(stripLeadingAndTrailingHTMLSpaces(baseString));
+                if (!baseURL) baseURL = [NSURL _web_URLWithString:[baseString stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]] relativeToURL:_baseURL];
+            }
+            if (baseURL) url = [NSURL _web_URLWithString:[urlString stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]] relativeToURL:baseURL];
+            if (!url) url =core([element ownerDocument])->completeURL(stripLeadingAndTrailingHTMLSpaces(urlString));
+            if (!url) url = [NSURL _web_URLWithString:[urlString stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]] relativeToURL:_baseURL];
+            if (url) retval = ![self _addAttachmentForElement:element URL:url needsParagraph:isBlockLevel usePlaceholder:NO];
+        }
+    } else if ([@"FRAME" isEqualToString:tag]) {
+        if ([element respondsToSelector:@selector(contentDocument)]) {
+            DOMDocument *contentDocument = [(DOMHTMLFrameElement *)element contentDocument];
+            if (contentDocument) [self _traverseNode:contentDocument depth:depth + 1 embedded:YES];
+        }
+        retval = NO;
+    } else if ([@"IFRAME" isEqualToString:tag]) {
+        if ([element respondsToSelector:@selector(contentDocument)]) {
+            DOMDocument *contentDocument = [(DOMHTMLIFrameElement *)element contentDocument];
+            if (contentDocument) {
+                [self _traverseNode:contentDocument depth:depth + 1 embedded:YES];
+                retval = NO;
+            }
+        }
+    } else if ([@"BR" isEqualToString:tag]) {
+        DOMElement *blockElement = [self _blockLevelElementForNode:[element parentNode]];
+        NSString *breakClass = [element getAttribute:@"class"], *blockTag = [blockElement tagName];
+        BOOL isExtraBreak = [@"Apple-interchange-newline" isEqualToString:breakClass], blockElementIsParagraph = ([@"P" isEqualToString:blockTag] || [@"LI" isEqualToString:blockTag] || ([blockTag hasPrefix:@"H"] && 2 == [blockTag length]));
+        if (isExtraBreak) {
+            _flags.hasTrailingNewline = YES;
+        } else {
+            if (blockElement && blockElementIsParagraph) {
+                [self _newLineForElement:element];
+            } else {
+                [self _newParagraphForElement:element tag:tag allowEmpty:YES suppressTrailingSpace:NO];
+            }
+        }
+    } else if ([@"UL" isEqualToString:tag]) {
+        NSTextList *list;
+        NSString *listStyleType = [self _stringForNode:element property:@"list-style-type"];
+        if (!listStyleType || [listStyleType length] == 0) listStyleType = @"disc";
+        list = [[NSTextList alloc] initWithMarkerFormat:[NSString stringWithFormat:@"{%@}", listStyleType] options:0];
+        [_textLists addObject:list];
+        [list release];
+    } else if ([@"OL" isEqualToString:tag]) {
+        NSTextList *list;
+        NSString *listStyleType = [self _stringForNode:element property:@"list-style-type"];
+        if (!listStyleType || [listStyleType length] == 0) listStyleType = @"decimal";
+        list = [[NSTextList alloc] initWithMarkerFormat:[NSString stringWithFormat:@"{%@}.", listStyleType] options:0];
+        if ([element respondsToSelector:@selector(start)]) {
+            NSInteger startingItemNumber = [(DOMHTMLOListElement *)element start];
+            [list setStartingItemNumber:startingItemNumber];
+        }
+        [_textLists addObject:list];
+        [list release];
+    } else if ([@"Q" isEqualToString:tag]) {
+        [self _addQuoteForElement:element opening:YES level:_quoteLevel++];
+    } else if ([@"INPUT" isEqualToString:tag]) {
+        if ([element respondsToSelector:@selector(type)] && [element respondsToSelector:@selector(value)] && [@"text" compare:[(DOMHTMLInputElement *)element type] options:NSCaseInsensitiveSearch] == NSOrderedSame) {
+            NSString *value = [(DOMHTMLInputElement *)element value];
+            if (value && [value length] > 0) [self _addValue:value forElement:element];
+        }
+    } else if ([@"TEXTAREA" isEqualToString:tag]) {
+        if ([element respondsToSelector:@selector(value)]) {
+            NSString *value = [(DOMHTMLTextAreaElement *)element value];
+            if (value && [value length] > 0) [self _addValue:value forElement:element];
+        }
+        retval = NO;
+    }
+    return retval;
+}
+
+- (void)_addMarkersToList:(NSTextList *)list range:(NSRange)range
+{
+    NSInteger itemNum = [list startingItemNumber];
+    NSString *string = [_attrStr string], *stringToInsert;
+    NSDictionary *attrsToInsert = nil;
+    NSFont *font;
+    NSParagraphStyle *paragraphStyle;
+    NSMutableParagraphStyle *newStyle;
+    NSTextTab *tab = nil, *tabToRemove;
+    NSRange paragraphRange, styleRange;
+    NSUInteger textLength = [_attrStr length], listIndex, idx, insertLength, i, count;
+    NSArray *textLists;
+    CGFloat markerLocation, listLocation, pointSize;
+    
+    if (range.length == 0 || range.location >= textLength) return;
+    if (NSMaxRange(range) > textLength) range.length = textLength - range.location;
+    paragraphStyle = [_attrStr attribute:NSParagraphStyleAttributeName atIndex:range.location effectiveRange:NULL];
+    if (paragraphStyle) {
+        textLists = [paragraphStyle textLists];
+        listIndex = [textLists indexOfObject:list];
+        if (textLists && listIndex != NSNotFound) {
+            for (idx = range.location; idx < NSMaxRange(range);) {
+                paragraphRange = [string paragraphRangeForRange:NSMakeRange(idx, 0)];
+                paragraphStyle = [_attrStr attribute:NSParagraphStyleAttributeName atIndex:idx effectiveRange:&styleRange];
+                font = [_attrStr attribute:NSFontAttributeName atIndex:idx effectiveRange:NULL];
+                pointSize = font ? [font pointSize] : 12;
+                if ([[paragraphStyle textLists] count] == listIndex + 1) {
+                    stringToInsert = [NSString stringWithFormat:@"\t%@\t", [list markerForItemNumber:itemNum++]];
+                    insertLength = [stringToInsert length];
+                    if (!_flags.isIndexing && !_flags.isTesting) attrsToInsert = [NSTextList _standardMarkerAttributesForAttributes:[_attrStr attributesAtIndex:paragraphRange.location effectiveRange:NULL]];
+                    [_attrStr replaceCharactersInRange:NSMakeRange(paragraphRange.location, 0) withString:stringToInsert];
+                    if (!_flags.isIndexing && !_flags.isTesting) [_attrStr setAttributes:attrsToInsert range:NSMakeRange(paragraphRange.location, insertLength)];
+                    range.length += insertLength;
+                    paragraphRange.length += insertLength;
+                    if (paragraphRange.location < _domRangeStartIndex) _domRangeStartIndex += insertLength;
+                    
+                    newStyle = [paragraphStyle mutableCopy];
+                    listLocation = (listIndex + 1) * 36;
+                    markerLocation = listLocation - 25;
+                    [newStyle setFirstLineHeadIndent:0];
+                    [newStyle setHeadIndent:listLocation];
+                    while ((count = [[newStyle tabStops] count]) > 0) {
+                        for (i = 0, tabToRemove = nil; !tabToRemove && i < count; i++) {
+                            tab = [[newStyle tabStops] objectAtIndex:i];
+                            if ([tab location] <= listLocation) tabToRemove = tab;
+                        }
+                        if (tabToRemove) [newStyle removeTabStop:tab]; else break;
+                    }
+                    tab = [[NSTextTab alloc] initWithType:NSLeftTabStopType location:markerLocation];
+                    [newStyle addTabStop:tab];
+                    [tab release];
+                    tab = [[NSTextTab alloc] initWithTextAlignment:NSNaturalTextAlignment location:listLocation options:nil];
+                    [newStyle addTabStop:tab];
+                    [tab release];
+                    if (!_flags.isIndexing && !_flags.isTesting) [_attrStr addAttribute:NSParagraphStyleAttributeName value:newStyle range:paragraphRange];
+                    [newStyle release];
+                    
+                    idx = NSMaxRange(paragraphRange);
+                } else {
+                    // skip any deeper-nested lists
+                    idx = NSMaxRange(styleRange);
+                }
+            }
+        }
+    }
+}
+
+- (void)_exitElement:(DOMElement *)element tag:(NSString *)tag display:(NSString *)displayVal depth:(NSInteger)depth startIndex:(NSUInteger)startIndex
+{
+    NSRange range = NSMakeRange(startIndex, [_attrStr length] - startIndex);
+    if (range.length > 0 && [@"A" isEqualToString:tag]) {
+        NSString *urlString = [element getAttribute:@"href"], *strippedString = [urlString stringByTrimmingCharactersInSet:[NSCharacterSet whitespaceAndNewlineCharacterSet]];
+        if (urlString && [urlString length] > 0 && strippedString && [strippedString length] > 0 && ![strippedString hasPrefix:@"#"]) {
+            NSURL *url = core([element ownerDocument])->completeURL(stripLeadingAndTrailingHTMLSpaces(urlString));
+            if (!url) url = core([element ownerDocument])->completeURL(stripLeadingAndTrailingHTMLSpaces(strippedString));
+            if (!url) url = [NSURL _web_URLWithString:strippedString relativeToURL:_baseURL];
+            if (!_flags.isIndexing && !_flags.isTesting) [_attrStr addAttribute:NSLinkAttributeName value:url ? (id)url : (id)urlString range:range];
+        }
+    }
+    if (!_flags.reachedEnd && [self _elementIsBlockLevel:element]) {
+        [_writingDirectionArray removeAllObjects];
+        if ([@"table-cell" isEqualToString:displayVal] && [_textBlocks count] == 0) {
+            [self _newTabForElement:element];
+        } else if ([_textLists count] > 0 && [@"block" isEqualToString:displayVal] && ![@"LI" isEqualToString:tag] && ![@"UL" isEqualToString:tag] && ![@"OL" isEqualToString:tag]) {
+            [self _newLineForElement:element];
+        } else {
+            [self _newParagraphForElement:element tag:tag allowEmpty:(range.length == 0) suppressTrailingSpace:YES];
+        }
+    } else if ([_writingDirectionArray count] > 0) {
+        NSString *bidi = [self _stringForNode:element property:@"unicode-bidi"];
+        if (bidi && ([bidi isEqualToString:@"embed"] || [bidi isEqualToString:@"bidi-override"])) {
+            [_writingDirectionArray removeLastObject];
+        }
+    }
+    range = NSMakeRange(startIndex, [_attrStr length] - startIndex);
+    if ([@"table" isEqualToString:displayVal] && [_textTables count] > 0) {
+        NSValue *key = [NSValue valueWithNonretainedObject:[_textTables lastObject]];
+        DOMNode *footer = [_textTableFooters objectForKey:key];
+        while ([_textTables count] < [_textBlocks count] + 1) {
+            [_textBlocks removeLastObject];
+        }
+        if (footer) {
+            [self _traverseFooterNode:footer depth:depth + 1];
+            [_textTableFooters removeObjectForKey:key];
+        }
+        [_textTables removeLastObject];
+        [_textTableSpacings removeLastObject];
+        [_textTablePaddings removeLastObject];
+        [_textTableRows removeLastObject];
+        [_textTableRowArrays removeLastObject];
+    } else if ([@"table-row" isEqualToString:displayVal] && [_textTables count] > 0) {
+        NSTextTable *table = [_textTables lastObject];
+        NSTextTableBlock *block;
+        NSMutableArray *rowArray = [_textTableRowArrays lastObject], *previousRowArray;
+        NSUInteger i, count;
+        NSInteger numberOfColumns = [table numberOfColumns];
+        NSInteger openColumn;
+        NSInteger rowNumber = [[_textTableRows lastObject] integerValue];
+        do {
+            rowNumber++;
+            previousRowArray = rowArray;
+            rowArray = [NSMutableArray array];
+            count = [previousRowArray count];
+            for (i = 0; i < count; i++) {
+                block = [previousRowArray objectAtIndex:i];
+                if ([block startingColumn] + [block columnSpan] > numberOfColumns) numberOfColumns = [block startingColumn] + [block columnSpan];
+                if ([block startingRow] + [block rowSpan] > rowNumber) [rowArray addObject:block];
+            }
+            count = [rowArray count];
+            openColumn = 0;
+            for (i = 0; i < count; i++) {
+                block = [rowArray objectAtIndex:i];
+                if (openColumn >= [block startingColumn] && openColumn < [block startingColumn] + [block columnSpan]) openColumn = [block startingColumn] + [block columnSpan];
+            }
+        } while (openColumn >= numberOfColumns);
+        if ((NSUInteger)numberOfColumns > [table numberOfColumns]) [table setNumberOfColumns:numberOfColumns];
+        [_textTableRows removeLastObject];
+        [_textTableRows addObject:[NSNumber numberWithInteger:rowNumber]];
+        [_textTableRowArrays removeLastObject];
+        [_textTableRowArrays addObject:rowArray];
+        if ([_textTableRowBackgroundColors count] > 0) [_textTableRowBackgroundColors removeLastObject];
+    } else if ([@"table-cell" isEqualToString:displayVal] && [_textBlocks count] > 0) {
+        while ([_textTables count] > [_textBlocks count]) {
+            [_textTables removeLastObject];
+            [_textTableSpacings removeLastObject];
+            [_textTablePaddings removeLastObject];
+            [_textTableRows removeLastObject];
+            [_textTableRowArrays removeLastObject];
+        }
+        [_textBlocks removeLastObject];
+    } else if (([@"UL" isEqualToString:tag] || [@"OL" isEqualToString:tag]) && [_textLists count] > 0) {
+        NSTextList *list = [_textLists lastObject];
+        [self _addMarkersToList:list range:range];
+        [_textLists removeLastObject];
+    } else if ([@"Q" isEqualToString:tag]) {
+        [self _addQuoteForElement:element opening:NO level:--_quoteLevel];
+    } else if ([@"SPAN" isEqualToString:tag]) {
+        NSString *className = [element getAttribute:@"class"];
+        NSMutableString *mutableString;
+        NSUInteger i, count = 0;
+        unichar c;
+        if ([@"Apple-converted-space" isEqualToString:className]) {
+            mutableString = [_attrStr mutableString];
+            for (i = range.location; i < NSMaxRange(range); i++) {
+                c = [mutableString characterAtIndex:i];
+                if (0xa0 == c) [mutableString replaceCharactersInRange:NSMakeRange(i, 1) withString:@" "];
+            }
+        } else if ([@"Apple-converted-tab" isEqualToString:className]) {
+            mutableString = [_attrStr mutableString];
+            for (i = range.location; i < NSMaxRange(range); i++) {
+                NSRange rangeToReplace = NSMakeRange(NSNotFound, 0);
+                c = [mutableString characterAtIndex:i];
+                if (' ' == c || 0xa0 == c) {
+                    count++;
+                    if (count >= 4 || i + 1 >= NSMaxRange(range)) rangeToReplace = NSMakeRange(i + 1 - count, count);
+                } else {
+                    if (count > 0) rangeToReplace = NSMakeRange(i - count, count);
+                }
+                if (rangeToReplace.length > 0) {
+                    [mutableString replaceCharactersInRange:rangeToReplace withString:@"\t"];
+                    range.length -= (rangeToReplace.length - 1);
+                    i -= (rangeToReplace.length - 1);
+                    if (NSMaxRange(rangeToReplace) <= _domRangeStartIndex) {
+                        _domRangeStartIndex -= (rangeToReplace.length - 1);
+                    } else if (rangeToReplace.location < _domRangeStartIndex) {
+                        _domRangeStartIndex = rangeToReplace.location;
+                    }
+                    count = 0;
+                }
+            }
+        }
+    }
+}
+
+- (void)_processText:(DOMCharacterData *)text
+{
+    NSString *instr = [text data], *outstr = instr, *whitespaceVal, *transformVal;
+    NSUInteger textLength = [_attrStr length], startOffset = 0, endOffset = [instr length];
+    unichar lastChar = (textLength > 0) ? [[_attrStr string] characterAtIndex:textLength - 1] : '\n';
+    BOOL wasSpace = NO, wasLeading = YES, suppressLeadingSpace = ((_flags.isSoft && lastChar == ' ') || lastChar == '\n' || lastChar == '\r' || lastChar == '\t' || lastChar == NSParagraphSeparatorCharacter || lastChar == NSLineSeparatorCharacter || lastChar == NSFormFeedCharacter || lastChar == WebNextLineCharacter);
+    NSRange rangeToReplace = NSMakeRange(textLength, 0);
+    CFMutableStringRef mutstr = NULL;
+    whitespaceVal = [self _stringForNode:text property:@"white-space"];
+    transformVal = [self _stringForNode:text property:@"text-transform"];
+    
+    if (_domRange) {
+        if (text == [_domRange startContainer]) {
+            startOffset = (NSUInteger)[_domRange startOffset];
+            _domRangeStartIndex = [_attrStr length];
+            _flags.reachedStart = YES;
+        }
+        if (text == [_domRange endContainer]) {
+            endOffset = (NSUInteger)[_domRange endOffset];
+            _flags.reachedEnd = YES;
+        }
+        if ((startOffset > 0 || endOffset < [instr length]) && endOffset >= startOffset) {
+            instr = [instr substringWithRange:NSMakeRange(startOffset, endOffset - startOffset)];
+            outstr = instr;
+        }
+    }
+    if ([whitespaceVal hasPrefix:@"pre"]) {
+        if (textLength > 0 && [instr length] > 0 && _flags.isSoft) {
+            unichar c = [instr characterAtIndex:0];
+            if (c == '\n' || c == '\r' || c == NSParagraphSeparatorCharacter || c == NSLineSeparatorCharacter || c == NSFormFeedCharacter || c == WebNextLineCharacter) rangeToReplace = NSMakeRange(textLength - 1, 1);
+        }
+    } else {
+        CFStringInlineBuffer inlineBuffer;
+        const unsigned int TextBufferSize = 255;
+
+        unichar buffer[TextBufferSize + 1];
+        NSUInteger i, count = [instr length], idx = 0;
+
+        mutstr = CFStringCreateMutable(NULL, 0);
+        CFStringInitInlineBuffer((CFStringRef)instr, &inlineBuffer, CFRangeMake(0, count));
+        for (i = 0; i < count; i++) {
+            unichar c = CFStringGetCharacterFromInlineBuffer(&inlineBuffer, i);
+            if (c == ' ' || c == '\n' || c == '\r' || c == '\t' || c == 0xc || c == 0x200b) {
+                wasSpace = (!wasLeading || !suppressLeadingSpace);
+            } else {
+                if (wasSpace) buffer[idx++] = ' ';
+                buffer[idx++] = c;
+                if (idx >= TextBufferSize) {
+                    CFStringAppendCharacters(mutstr, buffer, idx);
+                    idx = 0;
+                }
+                wasSpace = wasLeading = NO;
+            }
+        }
+        if (wasSpace) buffer[idx++] = ' ';
+        if (idx > 0) CFStringAppendCharacters(mutstr, buffer, idx);
+        outstr = (NSString *)mutstr;
+    }
+    if ([outstr length] > 0) {
+        if ([@"capitalize" isEqualToString:transformVal]) {
+            outstr = [outstr capitalizedString];
+        } else if ([@"uppercase" isEqualToString:transformVal]) {
+            outstr = [outstr uppercaseString];
+        } else if ([@"lowercase" isEqualToString:transformVal]) {
+            outstr = [outstr lowercaseString];
+        }
+        [_attrStr replaceCharactersInRange:rangeToReplace withString:outstr];
+        rangeToReplace.length = [outstr length];
+        if (!_flags.isIndexing) {
+            NSDictionary *attrs;
+            DOMElement *element = (DOMElement *)text;
+            while (element && [element nodeType] != DOM_ELEMENT_NODE) element = (DOMElement *)[element parentNode];
+            attrs = [self _attributesForElement:element];
+            if (!_flags.isTesting && rangeToReplace.length > 0) [_attrStr setAttributes:attrs range:rangeToReplace];
+        }
+        _flags.isSoft = wasSpace;
+    }
+    if (mutstr) CFRelease(mutstr);
+}
+
+- (void)_traverseNode:(DOMNode *)node depth:(NSInteger)depth embedded:(BOOL)embedded
+{
+    unsigned short nodeType;
+    NSArray *childNodes;
+    NSUInteger i, count, startOffset, endOffset;
+    BOOL isStart = NO, isEnd = NO;
+
+    if (_flags.reachedEnd) return;
+    if (_domRange && !_flags.reachedStart && _domStartAncestors && ![_domStartAncestors containsObject:node]) return;
+    
+    nodeType = [node nodeType];
+    childNodes = [self _childrenForNode:node];
+    count = [childNodes count];
+    startOffset = 0;
+    endOffset = count;
+
+    if (_domRange) {
+        if (node == [_domRange startContainer]) {
+            startOffset = (NSUInteger)[_domRange startOffset];
+            isStart = YES;
+            _flags.reachedStart = YES;
+        }
+        if (node == [_domRange endContainer]) {
+            endOffset = (NSUInteger)[_domRange endOffset];
+            isEnd = YES;
+        }
+    }
+    
+    if (nodeType == DOM_DOCUMENT_NODE || nodeType == DOM_DOCUMENT_FRAGMENT_NODE) {
+        for (i = 0; i < count; i++) {
+            if (isStart && i == startOffset) _domRangeStartIndex = [_attrStr length];
+            if ((!isStart || startOffset <= i) && (!isEnd || endOffset > i)) [self _traverseNode:[childNodes objectAtIndex:i] depth:depth + 1 embedded:embedded];
+            if (isEnd && i + 1 >= endOffset) _flags.reachedEnd = YES;
+            if (_thumbnailLimit > 0 && [_attrStr length] >= _thumbnailLimit) _flags.reachedEnd = YES;
+            if (_flags.reachedEnd) break;
+        }
+    } else if (nodeType == DOM_ELEMENT_NODE) {
+        DOMElement *element = (DOMElement *)node;
+        NSString *tag = [element tagName], *displayVal = [self _stringForNode:element property:@"display"], *floatVal = [self _stringForNode:element property:@"float"];
+        BOOL isBlockLevel = NO;
+        if (floatVal && ([@"left" isEqualToString:floatVal] || [@"right" isEqualToString:floatVal])) {
+            isBlockLevel = YES;
+        } else if (displayVal) {
+            isBlockLevel = ([@"block" isEqualToString:displayVal] || [@"list-item" isEqualToString:displayVal] || [displayVal hasPrefix:@"table"]);
+        }
+        [_elementIsBlockLevel setObject:[NSNumber numberWithBool:isBlockLevel] forKey:element];
+        if ([self _enterElement:element tag:tag display:displayVal]) {
+            NSUInteger startIndex = [_attrStr length];
+            if ([self _processElement:element tag:tag display:displayVal depth:depth]) {
+                for (i = 0; i < count; i++) {
+                    if (isStart && i == startOffset) _domRangeStartIndex = [_attrStr length];
+                    if ((!isStart || startOffset <= i) && (!isEnd || endOffset > i)) [self _traverseNode:[childNodes objectAtIndex:i] depth:depth + 1 embedded:embedded];
+                    if (isEnd && i + 1 >= endOffset) _flags.reachedEnd = YES;
+                    if (_flags.reachedEnd) break;
+                }
+                [self _exitElement:element tag:tag display:displayVal depth:depth startIndex:startIndex];
+            }
+        }
+    } else if (nodeType == DOM_TEXT_NODE || nodeType == DOM_CDATA_SECTION_NODE) {
+        [self _processText:(DOMCharacterData *)node];
+    }
+    
+    if (isEnd) _flags.reachedEnd = YES;
+}
+
+- (void)_traverseFooterNode:(DOMNode *)node depth:(NSInteger)depth
+{
+    DOMElement *element = (DOMElement *)node;
+    NSArray *childNodes = [self _childrenForNode:node];
+    NSString *tag = @"TBODY", *displayVal = @"table-row-group";
+    NSUInteger i, count = [childNodes count], startOffset = 0, endOffset = count;
+    BOOL isStart = NO, isEnd = NO;
+
+    if (_flags.reachedEnd) return;
+    if (_domRange && !_flags.reachedStart && _domStartAncestors && ![_domStartAncestors containsObject:node]) return;
+    if (_domRange) {
+        if (node == [_domRange startContainer]) {
+            startOffset = (NSUInteger)[_domRange startOffset];
+            isStart = YES;
+            _flags.reachedStart = YES;
+        }
+        if (node == [_domRange endContainer]) {
+            endOffset = (NSUInteger)[_domRange endOffset];
+            isEnd = YES;
+        }
+    }
+    if ([self _enterElement:element tag:tag display:displayVal]) {
+        NSUInteger startIndex = [_attrStr length];
+        if ([self _processElement:element tag:tag display:displayVal depth:depth]) {
+            for (i = 0; i < count; i++) {
+                if (isStart && i == startOffset) _domRangeStartIndex = [_attrStr length];
+                if ((!isStart || startOffset <= i) && (!isEnd || endOffset > i)) [self _traverseNode:[childNodes objectAtIndex:i] depth:depth + 1 embedded:YES];
+                if (isEnd && i + 1 >= endOffset) _flags.reachedEnd = YES;
+                if (_flags.reachedEnd) break;
+            }
+            [self _exitElement:element tag:tag display:displayVal depth:depth startIndex:startIndex];
+        }
+    }
+    if (isEnd) _flags.reachedEnd = YES;
+}
+
+- (void)_adjustTrailingNewline
+{
+    NSUInteger textLength = [_attrStr length];
+    unichar lastChar = (textLength > 0) ? [[_attrStr string] characterAtIndex:textLength - 1] : 0;
+    BOOL alreadyHasTrailingNewline = (lastChar == '\n' || lastChar == '\r' || lastChar == NSParagraphSeparatorCharacter || lastChar == NSLineSeparatorCharacter || lastChar == WebNextLineCharacter);
+    if (_flags.hasTrailingNewline && !alreadyHasTrailingNewline)
+        [_attrStr replaceCharactersInRange:NSMakeRange(textLength, 0) withString:@"\n"];
+}
+
+- (void)_loadFromDOMRange
+{
+    if (-1 == _errorCode) {
+        DOMNode *commonAncestorContainer = [_domRange commonAncestorContainer], *ancestorContainer = [_domRange startContainer];
+        
+        _domStartAncestors = [[NSMutableArray alloc] init];
+        while (ancestorContainer) {
+            [_domStartAncestors addObject:ancestorContainer];
+            if (ancestorContainer == commonAncestorContainer) break;
+            ancestorContainer = [ancestorContainer parentNode];
+        }
+        _document = [commonAncestorContainer ownerDocument];
+        _dataSource = (DocumentLoader *)core(_document)->frame()->loader()->documentLoader();
+        if (_textSizeMultiplier <= 0.0) _textSizeMultiplier = 1;
+        if (_defaultFontSize <= 0.0) _defaultFontSize = 12;
+        if (_minimumFontSize < 1.0) _minimumFontSize = 1;
+        if (_document && _dataSource) {
+            _domRangeStartIndex = 0;
+            _errorCode = 0;
+            [self _traverseNode:commonAncestorContainer depth:0 embedded:NO];
+            if (_domRangeStartIndex > 0 && _domRangeStartIndex <= [_attrStr length]) [_attrStr deleteCharactersInRange:NSMakeRange(0, _domRangeStartIndex)];
+        }
+    }
+}
+
+- (void)dealloc
+{
+    [_attrStr release];
+    [_domRange release];
+    [_domStartAncestors release];
+    [_standardFontFamily release];
+    [_textLists release];
+    [_textBlocks release];
+    [_textTables release];
+    [_textTableFooters release];
+    [_textTableSpacings release];
+    [_textTablePaddings release];
+    [_textTableRows release];
+    [_textTableRowArrays release];
+    [_textTableRowBackgroundColors release];
+    [_computedStylesForElements release];
+    [_specifiedStylesForElements release];
+    [_stringsForNodes release];
+    [_floatsForNodes release];
+    [_colorsForNodes release];
+    [_attributesForElements release];
+    [_elementIsBlockLevel release];
+    [_fontCache release];
+    [_writingDirectionArray release];
+    [super dealloc];
+}
+
+- (id)init
+{
+    self = [super init];
+    if (!self) return nil;
+    
+    _attrStr = [[NSMutableAttributedString alloc] init];
+
+    _textLists = [[NSMutableArray alloc] init];
+    _textBlocks = [[NSMutableArray alloc] init];
+    _textTables = [[NSMutableArray alloc] init];
+    _textTableFooters = [[NSMutableDictionary alloc] init];
+    _textTableSpacings = [[NSMutableArray alloc] init];
+    _textTablePaddings = [[NSMutableArray alloc] init];
+    _textTableRows = [[NSMutableArray alloc] init];
+    _textTableRowArrays = [[NSMutableArray alloc] init];
+    _textTableRowBackgroundColors = [[NSMutableArray alloc] init];
+    _computedStylesForElements = [[NSMutableDictionary alloc] init];
+    _specifiedStylesForElements = [[NSMutableDictionary alloc] init];
+    _stringsForNodes = [[NSMutableDictionary alloc] init];
+    _floatsForNodes = [[NSMutableDictionary alloc] init];
+    _colorsForNodes = [[NSMutableDictionary alloc] init];
+    _attributesForElements = [[NSMutableDictionary alloc] init];
+    _elementIsBlockLevel = [[NSMutableDictionary alloc] init];
+    _fontCache = [[NSMutableDictionary alloc] init];
+    _writingDirectionArray = [[NSMutableArray alloc] init];
+
+    _textSizeMultiplier = 1;
+    _webViewTextSizeMultiplier = 0;
+    _defaultTabInterval = 36;
+    _defaultFontSize = 12;
+    _minimumFontSize = 1;
+    _errorCode = -1;
+    _indexingLimit = 0;
+    _thumbnailLimit = 0;
+
+    _flags.isIndexing = (_indexingLimit > 0);
+    _flags.isTesting = 0;
+    
+    return self;
+}
+
+- (id)initWithDOMRange:(DOMRange *)domRange
+{
+    self = [self init];
+    if (!self) return nil;
+    _domRange = [domRange retain];
+    return self;
+}
+
+- (NSAttributedString *)attributedString
+{
+    [self _loadFromDOMRange];
+    return (0 == _errorCode) ? [[_attrStr retain] autorelease] : nil;
+}
+
+@end
+#endif
diff --git a/Source/WebCore/platform/mac/LoggingMac.mm b/Source/WebCore/platform/mac/LoggingMac.mm
index ee2f39e..168d0cc 100644
--- a/Source/WebCore/platform/mac/LoggingMac.mm
+++ b/Source/WebCore/platform/mac/LoggingMac.mm
@@ -23,6 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#include "config.h"
+
 #include "Logging.h"
 
 namespace WebCore {
diff --git a/Source/WebCore/platform/mac/PasteboardMac.mm b/Source/WebCore/platform/mac/PasteboardMac.mm
index 8c6610a..da06606 100644
--- a/Source/WebCore/platform/mac/PasteboardMac.mm
+++ b/Source/WebCore/platform/mac/PasteboardMac.mm
@@ -38,6 +38,10 @@
 #import "FrameLoaderClient.h"
 #import "HitTestResult.h"
 #import "HTMLAnchorElement.h"
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#import "HTMLConverter.h"
+#endif
+#import "htmlediting.h"
 #import "HTMLNames.h"
 #import "Image.h"
 #import "KURL.h"
@@ -144,9 +148,30 @@ void Pasteboard::writeSelection(NSPasteboard* pasteboard, NSArray* pasteboardTyp
         Pasteboard::generalPasteboard(); // Initializes pasteboard types.
     ASSERT(selectedRange);
     
+    // If the selection is at the beginning of content inside an anchor tag
+    // we move the selection start to include the anchor.
+    // This way the attributed string will contain the url attribute as well.
+    // See <rdar://problem/9084267>.
+    ExceptionCode ec;
+    Node* commonAncestor = selectedRange->commonAncestorContainer(ec);
+    ASSERT(commonAncestor);
+    Node* enclosingAnchor = enclosingNodeWithTag(firstPositionInNode(commonAncestor), HTMLNames::aTag);
+    if (enclosingAnchor && comparePositions(firstPositionInOrBeforeNode(selectedRange->startPosition().anchorNode()), selectedRange->startPosition()) >= 0)
+        selectedRange->setStart(enclosingAnchor, 0, ec);
+
     // Using different API for WebKit and WebKit2.
-    // FIXME - We need to have a way to create the NSAttributedString for WebKit2 that doesn't require accessing the WebFrame.
-    NSAttributedString *attributedString = (frame->view()->platformWidget()) ? [[[NSAttributedString alloc] _initWithDOMRange:kit(selectedRange)] autorelease] : [[[NSAttributedString alloc] initWithString:selectedRange->text()] autorelease];
+    NSAttributedString *attributedString = nil;
+    if (frame->view()->platformWidget())
+        attributedString = [[[NSAttributedString alloc] _initWithDOMRange:kit(selectedRange)] autorelease];
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    else {
+        // In WebKit2 we are using a different way to create the NSAttributedString from the DOMrange that doesn't require access to the WebView.
+        RetainPtr<WebHTMLConverter> converter = [[WebHTMLConverter alloc] initWithDOMRange:kit(selectedRange)];
+        if (converter)
+            attributedString = [converter.get() attributedString];
+    }
+#endif
+
 #ifdef BUILDING_ON_TIGER
     // 4930197: Mail overrides [WebHTMLView pasteboardTypesForSelection] in order to add another type to the pasteboard
     // after WebKit does.  On Tiger we must call this function so that Mail code will be executed, meaning that 
diff --git a/Source/WebCore/platform/mac/PlatformScreenMac.mm b/Source/WebCore/platform/mac/PlatformScreenMac.mm
index 5dbfcf4..916fc9f 100644
--- a/Source/WebCore/platform/mac/PlatformScreenMac.mm
+++ b/Source/WebCore/platform/mac/PlatformScreenMac.mm
@@ -76,12 +76,21 @@ NSScreen *screenForWindow(NSWindow *window)
     return nil;
 }
 
+static CGFloat windowScaleFactor(NSWindow *window)
+{
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    return [window backingScaleFactor];
+#else
+    return [window userSpaceScaleFactor];
+#endif
+}
+
 FloatRect toUserSpace(const NSRect& rect, NSWindow *destination)
 {
     FloatRect userRect = rect;
     userRect.setY(NSMaxY([screenForWindow(destination) frame]) - (userRect.y() + userRect.height())); // flip
     if (destination)
-        userRect.scale(1 / [destination userSpaceScaleFactor]); // scale down
+        userRect.scale(1 / windowScaleFactor(destination)); // scale down
     return userRect;
 }
 
@@ -89,7 +98,7 @@ NSRect toDeviceSpace(const FloatRect& rect, NSWindow *source)
 {
     FloatRect deviceRect = rect;
     if (source)
-        deviceRect.scale([source userSpaceScaleFactor]); // scale up
+        deviceRect.scale(windowScaleFactor(source)); // scale up
     deviceRect.setY(NSMaxY([screenForWindow(source) frame]) - (deviceRect.y() + deviceRect.height())); // flip
     return deviceRect;
 }
diff --git a/Source/WebCore/platform/mac/SSLKeyGeneratorMac.cpp b/Source/WebCore/platform/mac/SSLKeyGeneratorMac.cpp
new file mode 100644
index 0000000..0a1a4d8
--- /dev/null
+++ b/Source/WebCore/platform/mac/SSLKeyGeneratorMac.cpp
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2003, 2005, 2008, 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SSLKeyGenerator.h"
+
+#include "KURL.h"
+#include "LocalizedStrings.h"
+#include "WebCoreSystemInterface.h"
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+void getSupportedKeySizes(Vector<String>& supportedKeySizes)
+{
+    ASSERT(supportedKeySizes.isEmpty());
+    supportedKeySizes.append(keygenMenuItem2048());
+    supportedKeySizes.append(keygenMenuItem1024());
+    supportedKeySizes.append(keygenMenuItem512());
+}
+
+String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String& challengeString, const KURL& url)
+{   
+    // This switch statement must always be synced with the UI strings returned by getSupportedKeySizes.
+    UInt32 keySize;
+    switch (keySizeIndex) {
+    case 0:
+        keySize = 2048;
+        break;
+    case 1:
+        keySize = 1024;
+        break;
+    case 2:
+        keySize = 512;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        return String();
+    }
+
+    RetainPtr<CFStringRef> challengeStringCF(AdoptCF, challengeString.createCFString());
+    RetainPtr<CFStringRef> keyDescription(AdoptCF, keygenKeychainItemName(url.host()).createCFString());
+    RetainPtr<CFStringRef> result(AdoptCF, wkSignedPublicKeyAndChallengeString(keySize, challengeStringCF.get(), keyDescription.get()));
+
+    return result.get();
+}
+
+}
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.h b/Source/WebCore/platform/mac/ScrollAnimatorMac.h
index 2bafbf5..f7b6332 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.h
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.h
@@ -30,7 +30,6 @@
 
 #include "FloatPoint.h"
 #include "FloatSize.h"
-#include "HeaderDetection.h"
 #include "ScrollAnimator.h"
 #include "Timer.h"
 #include "WebCoreSystemInterface.h"
@@ -67,6 +66,8 @@ public:
 #endif
 #endif
 
+    virtual void cancelAnimations();
+
     void immediateScrollToPoint(const FloatPoint& newPosition);
     void immediateScrollByDeltaX(float deltaX);
     void immediateScrollByDeltaY(float deltaY);
@@ -74,14 +75,25 @@ public:
     void setIsDrawingIntoLayer(bool b) { m_drawingIntoLayer = b; }
     bool isDrawingIntoLayer() const { return m_drawingIntoLayer; }
 
+    bool haveScrolledSincePageLoad() const { return m_haveScrolledSincePageLoad; }
+
+#if USE(WK_SCROLLBAR_PAINTER)
+    bool scrollbarPaintTimerIsActive() const;
+    void startScrollbarPaintTimer();
+    void stopScrollbarPaintTimer();
+#endif
+
 private:
     RetainPtr<id> m_scrollAnimationHelper;
     RetainPtr<ScrollAnimationHelperDelegate> m_scrollAnimationHelperDelegate;
 
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     RetainPtr<WKScrollbarPainterControllerRef> m_scrollbarPainterController;
     RetainPtr<ScrollbarPainterControllerDelegate> m_scrollbarPainterControllerDelegate;
     RetainPtr<id> m_scrollbarPainterDelegate;
+
+    void initialScrollbarPaintTimerFired(Timer<ScrollAnimatorMac>*);
+    Timer<ScrollAnimatorMac> m_initialScrollbarPaintTimer;
 #endif
     
     virtual void notityPositionChanged();
@@ -131,6 +143,7 @@ private:
     Timer<ScrollAnimatorMac> m_snapRubberBandTimer;
 #endif
     bool m_drawingIntoLayer;
+    bool m_haveScrolledSincePageLoad;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
index 67c0904..5725880 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
@@ -141,7 +141,7 @@ static NSSize abs(NSSize size)
 
 @end
 
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
 
 @interface ScrollbarPainterControllerDelegate : NSObject
 {
@@ -240,6 +240,13 @@ static NSSize abs(NSSize size)
                                                                                      verticalScrollbar->controlSize(),
                                                                                      false);
         macTheme->setNewPainterForScrollbar(verticalScrollbar, newVerticalPainter);
+        wkSetPainterForPainterController(painterController, newVerticalPainter, false);
+
+        // The different scrollbar styles have different thicknesses, so we must re-set the 
+        // frameRect to the new thickness, and the re-layout below will ensure the position
+        // and length are properly updated.
+        int thickness = macTheme->scrollbarThickness(verticalScrollbar->controlSize());
+        verticalScrollbar->setFrameRect(WebCore::IntRect(0, 0, thickness, thickness));
     }
 
     WKScrollbarPainterRef oldHorizontalPainter = wkHorizontalScrollbarPainterForController(painterController);
@@ -250,9 +257,19 @@ static NSSize abs(NSSize size)
                                                                                        horizontalScrollbar->controlSize(),
                                                                                        true);
         macTheme->setNewPainterForScrollbar(horizontalScrollbar, newHorizontalPainter);
+        wkSetPainterForPainterController(painterController, newHorizontalPainter, true);
+
+        // The different scrollbar styles have different thicknesses, so we must re-set the 
+        // frameRect to the new thickness, and the re-layout below will ensure the position
+        // and length are properly updated.
+        int thickness = macTheme->scrollbarThickness(horizontalScrollbar->controlSize());
+        horizontalScrollbar->setFrameRect(WebCore::IntRect(0, 0, thickness, thickness));
     }
 
     wkSetScrollbarPainterControllerStyle(painterController, newRecommendedScrollerStyle);
+
+    // The different scrollbar styles affect layout, so we must re-layout everything.
+    _animator->scrollableArea()->scrollbarStyleChanged();
 }
 
 @end
@@ -329,6 +346,7 @@ static NSSize abs(NSSize size)
     RetainPtr<ScrollbarPartAnimation> _horizontalTrackAnimation;
 }
 - (id)initWithScrollAnimator:(WebCore::ScrollAnimatorMac*)scrollAnimator;
+- (void)cancelAnimations;
 @end
 
 @implementation ScrollbarPainterDelegate
@@ -343,6 +361,14 @@ static NSSize abs(NSSize size)
     return self;
 }
 
+- (void)cancelAnimations
+{
+    [_verticalKnobAnimation.get() stopAnimation];
+    [_horizontalKnobAnimation.get() stopAnimation];
+    [_verticalTrackAnimation.get() stopAnimation];
+    [_horizontalTrackAnimation.get() stopAnimation];
+}
+
 - (NSRect)convertRectToBacking:(NSRect)aRect
 {
     return aRect;
@@ -367,12 +393,29 @@ static NSSize abs(NSSize size)
 
 - (void)setUpAnimation:(RetainPtr<ScrollbarPartAnimation>&)scrollbarPartAnimation scrollerPainter:(WKScrollbarPainterRef)scrollerPainter part:(WebCore::ScrollbarPart)part animateAlphaTo:(CGFloat)newAlpha duration:(NSTimeInterval)duration
 {
+    // If the user has scrolled the page, then the scrollbars must be animated here. 
+    // This overrides the early returns.
+    bool mustAnimate = _animator->haveScrolledSincePageLoad();
+
+    if (_animator->scrollbarPaintTimerIsActive() && !mustAnimate)
+        return;
+
+    if (_animator->scrollableArea()->shouldSuspendScrollAnimations() && !mustAnimate) {
+        _animator->startScrollbarPaintTimer();
+        return;
+    }
+
+    // At this point, we are definitely going to animate now, so stop the timer.
+    _animator->stopScrollbarPaintTimer();
+
     // If we are currently animating, stop
     if (scrollbarPartAnimation) {
         [scrollbarPartAnimation.get() stopAnimation];
         scrollbarPartAnimation = nil;
     }
-    
+
+    [NSAnimationContext beginGrouping];
+    [[NSAnimationContext currentContext] setDuration:duration];
     scrollbarPartAnimation.adoptNS([[ScrollbarPartAnimation alloc] initWithScrollbarPainter:scrollerPainter 
                                                                     part:part
                                                                     scrollAnimator:_animator 
@@ -380,6 +423,7 @@ static NSSize abs(NSSize size)
                                                                     duration:duration]);
     [scrollbarPartAnimation.get() setAnimationBlockingMode:NSAnimationNonblocking];
     [scrollbarPartAnimation.get() startAnimation];
+    [NSAnimationContext endGrouping];
 }
 
 - (void)scrollerImp:(id)scrollerImp animateKnobAlphaTo:(CGFloat)newKnobAlpha duration:(NSTimeInterval)duration
@@ -388,9 +432,6 @@ static NSSize abs(NSSize size)
         return;
 
     WKScrollbarPainterRef scrollerPainter = (WKScrollbarPainterRef)scrollerImp;
-    if (newKnobAlpha == wkScrollbarPainterKnobAlpha(scrollerPainter))
-        return;
-
     if (wkScrollbarPainterIsHorizontal(scrollerPainter))
         [self setUpAnimation:_horizontalKnobAnimation scrollerPainter:scrollerPainter part:WebCore::ThumbPart animateAlphaTo:newKnobAlpha duration:duration];
     else
@@ -403,9 +444,6 @@ static NSSize abs(NSSize size)
         return;
 
     WKScrollbarPainterRef scrollerPainter = (WKScrollbarPainterRef)scrollerImp;
-    if (newTrackAlpha == wkScrollbarPainterTrackAlpha(scrollerPainter))
-        return;
-
     if (wkScrollbarPainterIsHorizontal(scrollerPainter))
         [self setUpAnimation:_horizontalTrackAnimation scrollerPainter:scrollerPainter part:WebCore::BackTrackPart animateAlphaTo:newTrackAlpha duration:duration];
     else
@@ -414,20 +452,8 @@ static NSSize abs(NSSize size)
 
 - (void)scrollerImp:(id)scrollerImp overlayScrollerStateChangedTo:(NSUInteger)newOverlayScrollerState
 {
-    if (!_animator)
-        return;
-
-    WKScrollbarPainterRef scrollbarPainter = (WKScrollbarPainterRef)scrollerImp;
-    wkScrollbarPainterSetOverlayState(scrollbarPainter, newOverlayScrollerState);
-
-    if (wkScrollbarPainterIsHorizontal(scrollbarPainter)) {
-        WebCore::Scrollbar* horizontalScrollbar = _animator->scrollableArea()->horizontalScrollbar();
-        _animator->scrollableArea()->invalidateScrollbarRect(horizontalScrollbar, WebCore::IntRect(0, 0, horizontalScrollbar->width(), horizontalScrollbar->height()));
-    } else {
-        WebCore::Scrollbar* verticalScrollbar = _animator->scrollableArea()->verticalScrollbar();
-        _animator->scrollableArea()->invalidateScrollbarRect(verticalScrollbar, WebCore::IntRect(0, 0, verticalScrollbar->width(), verticalScrollbar->height()));
-
-    }
+    UNUSED_PARAM(scrollerImp);
+    UNUSED_PARAM(newOverlayScrollerState);
 }
 
 - (void)scrollAnimatorDestroyed
@@ -440,7 +466,8 @@ static NSSize abs(NSSize size)
 }
 
 @end
-#endif // #if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+
+#endif // USE(WK_SCROLLBAR_PAINTER)
 
 namespace WebCore {
 
@@ -451,6 +478,9 @@ PassOwnPtr<ScrollAnimator> ScrollAnimator::create(ScrollableArea* scrollableArea
 
 ScrollAnimatorMac::ScrollAnimatorMac(ScrollableArea* scrollableArea)
     : ScrollAnimator(scrollableArea)
+#if USE(WK_SCROLLBAR_PAINTER)
+    , m_initialScrollbarPaintTimer(this, &ScrollAnimatorMac::initialScrollbarPaintTimerFired)
+#endif
 #if ENABLE(RUBBER_BANDING)
     , m_inScrollGesture(false)
     , m_momentumScrollInProgress(false)
@@ -460,11 +490,12 @@ ScrollAnimatorMac::ScrollAnimatorMac(ScrollableArea* scrollableArea)
     , m_snapRubberBandTimer(this, &ScrollAnimatorMac::snapRubberBandTimerFired)
 #endif
     , m_drawingIntoLayer(false)
+    , m_haveScrolledSincePageLoad(false)
 {
     m_scrollAnimationHelperDelegate.adoptNS([[ScrollAnimationHelperDelegate alloc] initWithScrollAnimator:this]);
     m_scrollAnimationHelper.adoptNS([[NSClassFromString(@"NSScrollAnimationHelper") alloc] initWithDelegate:m_scrollAnimationHelperDelegate.get()]);
 
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     m_scrollbarPainterControllerDelegate.adoptNS([[ScrollbarPainterControllerDelegate alloc] initWithScrollAnimator:this]);
     m_scrollbarPainterController = wkMakeScrollbarPainterController(m_scrollbarPainterControllerDelegate.get());
     m_scrollbarPainterDelegate.adoptNS([[ScrollbarPainterDelegate alloc] initWithScrollAnimator:this]);
@@ -473,7 +504,7 @@ ScrollAnimatorMac::ScrollAnimatorMac(ScrollableArea* scrollableArea)
 
 ScrollAnimatorMac::~ScrollAnimatorMac()
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     [m_scrollbarPainterControllerDelegate.get() scrollAnimatorDestroyed];
     [(id)m_scrollbarPainterController.get() setDelegate:nil];
     [m_scrollbarPainterDelegate.get() scrollAnimatorDestroyed];
@@ -483,6 +514,8 @@ ScrollAnimatorMac::~ScrollAnimatorMac()
 
 bool ScrollAnimatorMac::scroll(ScrollbarOrientation orientation, ScrollGranularity granularity, float step, float multiplier)
 {
+    m_haveScrolledSincePageLoad = true;
+
     if (![[NSUserDefaults standardUserDefaults] boolForKey:@"AppleScrollAnimationEnabled"])
         return ScrollAnimator::scroll(orientation, granularity, step, multiplier);
 
@@ -561,7 +594,7 @@ void ScrollAnimatorMac::immediateScrollByDeltaY(float deltaY)
 
 void ScrollAnimatorMac::notityPositionChanged()
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkContentAreaScrolled(m_scrollbarPainterController.get());
 #endif
     ScrollAnimator::notityPositionChanged();
@@ -569,70 +602,70 @@ void ScrollAnimatorMac::notityPositionChanged()
 
 void ScrollAnimatorMac::contentAreaWillPaint() const
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkContentAreaWillPaint(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::mouseEnteredContentArea() const
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkMouseEnteredContentArea(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::mouseExitedContentArea() const
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkMouseExitedContentArea(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::mouseMovedInContentArea() const
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkMouseMovedInContentArea(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::willStartLiveResize()
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkWillStartLiveResize(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::contentsResized() const
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkContentAreaResized(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::willEndLiveResize()
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkWillEndLiveResize(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::contentAreaDidShow() const
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkContentAreaDidShow(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::contentAreaDidHide() const
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     wkContentAreaDidHide(m_scrollbarPainterController.get());
 #endif
 }
 
 void ScrollAnimatorMac::didAddVerticalScrollbar(Scrollbar* scrollbar)
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     WKScrollbarPainterRef painter = static_cast<WebCore::ScrollbarThemeMac*>(WebCore::ScrollbarTheme::nativeTheme())->painterForScrollbar(scrollbar);
     wkScrollbarPainterSetDelegate(painter, m_scrollbarPainterDelegate.get());
     wkSetPainterForPainterController(m_scrollbarPainterController.get(), painter, false);
@@ -645,7 +678,7 @@ void ScrollAnimatorMac::didAddVerticalScrollbar(Scrollbar* scrollbar)
 
 void ScrollAnimatorMac::willRemoveVerticalScrollbar(Scrollbar* scrollbar)
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     WKScrollbarPainterRef painter = static_cast<WebCore::ScrollbarThemeMac*>(WebCore::ScrollbarTheme::nativeTheme())->painterForScrollbar(scrollbar);
     wkScrollbarPainterSetDelegate(painter, nil);
     wkSetPainterForPainterController(m_scrollbarPainterController.get(), nil, false);
@@ -656,7 +689,7 @@ void ScrollAnimatorMac::willRemoveVerticalScrollbar(Scrollbar* scrollbar)
 
 void ScrollAnimatorMac::didAddHorizontalScrollbar(Scrollbar* scrollbar)
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     WKScrollbarPainterRef painter = static_cast<WebCore::ScrollbarThemeMac*>(WebCore::ScrollbarTheme::nativeTheme())->painterForScrollbar(scrollbar);
     wkScrollbarPainterSetDelegate(painter, m_scrollbarPainterDelegate.get());
     wkSetPainterForPainterController(m_scrollbarPainterController.get(), painter, true);
@@ -669,7 +702,7 @@ void ScrollAnimatorMac::didAddHorizontalScrollbar(Scrollbar* scrollbar)
 
 void ScrollAnimatorMac::willRemoveHorizontalScrollbar(Scrollbar* scrollbar)
 {
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     WKScrollbarPainterRef painter = static_cast<WebCore::ScrollbarThemeMac*>(WebCore::ScrollbarTheme::nativeTheme())->painterForScrollbar(scrollbar);
     wkScrollbarPainterSetDelegate(painter, nil);
     wkSetPainterForPainterController(m_scrollbarPainterController.get(), nil, true);
@@ -678,6 +711,17 @@ void ScrollAnimatorMac::willRemoveHorizontalScrollbar(Scrollbar* scrollbar)
 #endif
 }
 
+void ScrollAnimatorMac::cancelAnimations()
+{
+    m_haveScrolledSincePageLoad = false;
+
+#if USE(WK_SCROLLBAR_PAINTER)
+    if (scrollbarPaintTimerIsActive())
+        stopScrollbarPaintTimer();
+    [m_scrollbarPainterDelegate.get() cancelAnimations];
+#endif
+}
+
 #if ENABLE(RUBBER_BANDING)
 
 static const float scrollVelocityZeroingTimeout = 0.10f;
@@ -720,6 +764,8 @@ static float scrollWheelMultiplier()
 
 void ScrollAnimatorMac::handleWheelEvent(PlatformWheelEvent& wheelEvent)
 {
+    m_haveScrolledSincePageLoad = true;
+
     if (!wheelEvent.hasPreciseScrollingDeltas()) {
         ScrollAnimator::handleWheelEvent(wheelEvent);
         return;
@@ -751,18 +797,18 @@ bool ScrollAnimatorMac::pinnedInDirection(float deltaX, float deltaY)
     if (fabsf(deltaY) >= fabsf(deltaX)) {
         if (deltaY < 0) {
             // We are trying to scroll up.  Make sure we are not pinned to the top
-            limitDelta.setHeight(m_scrollableArea->visibleContentRect().y());
+            limitDelta.setHeight(m_scrollableArea->visibleContentRect().y() + + m_scrollableArea->scrollOrigin().y());
         } else {
             // We are trying to scroll down.  Make sure we are not pinned to the bottom
-            limitDelta.setHeight(m_scrollableArea->contentsSize().height() - m_scrollableArea->visibleContentRect().maxY());
+            limitDelta.setHeight(m_scrollableArea->contentsSize().height() - (m_scrollableArea->visibleContentRect().maxY() + m_scrollableArea->scrollOrigin().y()));
         }
     } else if (deltaX != 0) {
         if (deltaX < 0) {
             // We are trying to scroll left.  Make sure we are not pinned to the left
-            limitDelta.setWidth(m_scrollableArea->visibleContentRect().x());
+            limitDelta.setWidth(m_scrollableArea->visibleContentRect().x() + m_scrollableArea->scrollOrigin().x());
         } else {
             // We are trying to scroll right.  Make sure we are not pinned to the right
-            limitDelta.setWidth(m_scrollableArea->contentsSize().width() - m_scrollableArea->visibleContentRect().maxX());
+            limitDelta.setWidth(m_scrollableArea->contentsSize().width() - (m_scrollableArea->visibleContentRect().maxX() + m_scrollableArea->scrollOrigin().x()));
         }
     }
     
@@ -793,6 +839,8 @@ bool ScrollAnimatorMac::allowsHorizontalStretching() const
 
 void ScrollAnimatorMac::smoothScrollWithEvent(PlatformWheelEvent& wheelEvent)
 {
+    m_haveScrolledSincePageLoad = true;
+
     float deltaX = m_overflowScrollDelta.width();
     float deltaY = m_overflowScrollDelta.height();
 
@@ -925,7 +973,7 @@ void ScrollAnimatorMac::smoothScrollWithEvent(PlatformWheelEvent& wheelEvent)
             m_stretchScrollForce.setHeight(m_stretchScrollForce.height() + deltaY);
 
             FloatSize dampedDelta(ceilf(elasticDeltaForReboundDelta(m_stretchScrollForce.width())), ceilf(elasticDeltaForReboundDelta(m_stretchScrollForce.height())));
-            FloatPoint origOrigin = m_scrollableArea->visibleContentRect().location() - stretchAmount;
+            FloatPoint origOrigin = (m_scrollableArea->visibleContentRect().location() + m_scrollableArea->scrollOrigin()) - stretchAmount;
             FloatPoint newOrigin = origOrigin + dampedDelta;
 
             if (origOrigin != newOrigin) {
@@ -945,6 +993,7 @@ void ScrollAnimatorMac::smoothScrollWithEvent(PlatformWheelEvent& wheelEvent)
 
 void ScrollAnimatorMac::beginScrollGesture()
 {
+    m_haveScrolledSincePageLoad = true;
     m_inScrollGesture = true;
     m_momentumScrollInProgress = false;
     m_ignoreMomentumScrolls = false;
@@ -1017,7 +1066,7 @@ void ScrollAnimatorMac::snapRubberBandTimerFired(Timer<ScrollAnimatorMac>*)
                 return;
             }
 
-            m_origOrigin = m_scrollableArea->visibleContentRect().location() - m_startStretch;
+            m_origOrigin = (m_scrollableArea->visibleContentRect().location() + m_scrollableArea->scrollOrigin()) - m_startStretch;
             m_origVelocity = m_momentumVelocity;
 
             // Just like normal scrolling, prefer vertical rubberbanding
@@ -1069,6 +1118,28 @@ void ScrollAnimatorMac::snapRubberBandTimerFired(Timer<ScrollAnimatorMac>*)
 }
 #endif
 
+#if USE(WK_SCROLLBAR_PAINTER)
+void ScrollAnimatorMac::startScrollbarPaintTimer()
+{
+    m_initialScrollbarPaintTimer.startOneShot(0.1);
+}
+
+bool ScrollAnimatorMac::scrollbarPaintTimerIsActive() const
+{
+    return m_initialScrollbarPaintTimer.isActive();
+}
+
+void ScrollAnimatorMac::stopScrollbarPaintTimer()
+{
+    m_initialScrollbarPaintTimer.stop();
+}
+
+void ScrollAnimatorMac::initialScrollbarPaintTimerFired(Timer<ScrollAnimatorMac>*)
+{
+    wkScrollbarPainterForceFlashScrollers(m_scrollbarPainterController.get());
+}
+#endif
+
 } // namespace WebCore
 
 #endif // ENABLE(SMOOTH_SCROLLING)
diff --git a/Source/WebCore/platform/mac/ScrollbarThemeMac.h b/Source/WebCore/platform/mac/ScrollbarThemeMac.h
index 844a088..bd56808 100644
--- a/Source/WebCore/platform/mac/ScrollbarThemeMac.h
+++ b/Source/WebCore/platform/mac/ScrollbarThemeMac.h
@@ -26,7 +26,6 @@
 #ifndef ScrollbarThemeMac_h
 #define ScrollbarThemeMac_h
 
-#include "HeaderDetection.h"
 #include "ScrollbarThemeComposite.h"
 #include "WebCoreSystemInterface.h"
 
@@ -52,7 +51,7 @@ public:
     virtual void registerScrollbar(Scrollbar*);
     virtual void unregisterScrollbar(Scrollbar*);
 
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
     void setNewPainterForScrollbar(Scrollbar*, WKScrollbarPainterRef);
     WKScrollbarPainterRef painterForScrollbar(Scrollbar*);
 #endif
diff --git a/Source/WebCore/platform/mac/ScrollbarThemeMac.mm b/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
index 5a3796d..5504f5c 100644
--- a/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
+++ b/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
@@ -169,7 +169,7 @@ void ScrollbarThemeMac::unregisterScrollbar(Scrollbar* scrollbar)
     scrollbarMap()->remove(scrollbar);
 }
 
-#if defined(USE_WK_SCROLLBAR_PAINTER_AND_CONTROLLER)
+#if USE(WK_SCROLLBAR_PAINTER)
 void ScrollbarThemeMac::setNewPainterForScrollbar(Scrollbar* scrollbar, WKScrollbarPainterRef newPainter)
 {
     scrollbarMap()->set(scrollbar, newPainter);
@@ -440,7 +440,11 @@ bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, co
         overhang = scrollbar->currentPos() + scrollbar->visibleSize() - scrollbar->totalSize();
     } else {
         // Within the bounds of the scrollable area.
-        value = scrollbar->currentPos() / scrollbar->maximum();
+        int maximum = scrollbar->maximum();
+        if (maximum > 0)
+            value = scrollbar->currentPos() / maximum;
+        else
+            value = 0;
     }
 
     ScrollAnimatorMac* scrollAnimator = static_cast<ScrollAnimatorMac*>(scrollbar->scrollableArea()->scrollAnimator());
diff --git a/Source/WebCore/platform/mac/ThemeMac.mm b/Source/WebCore/platform/mac/ThemeMac.mm
index e510ea7..918bc07 100644
--- a/Source/WebCore/platform/mac/ThemeMac.mm
+++ b/Source/WebCore/platform/mac/ThemeMac.mm
@@ -52,6 +52,11 @@ using namespace std;
     return nil;
 }
 
+- (BOOL)_automaticFocusRingDisabled
+{
+    return YES;
+}
+
 - (NSRect)_focusRingVisibleRect
 {
     return [self visibleRect];
diff --git a/Source/WebCore/platform/mac/WebCoreObjCExtras.mm b/Source/WebCore/platform/mac/WebCoreObjCExtras.mm
index 05d3e01..5a2d564 100644
--- a/Source/WebCore/platform/mac/WebCoreObjCExtras.mm
+++ b/Source/WebCore/platform/mac/WebCoreObjCExtras.mm
@@ -26,6 +26,11 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+// This file intentionally calls objc_finalizeOnMainThread, which is deprecated.
+// According to http://gcc.gnu.org/onlinedocs/gcc-4.2.1/gcc/Diagnostic-Pragmas.html#Diagnostic-Pragmas
+// we need to place this directive before any data or functions are defined.
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+
 #include "config.h"
 #include "WebCoreObjCExtras.h"
 
diff --git a/Source/WebCore/platform/mac/WebCoreSystemInterface.h b/Source/WebCore/platform/mac/WebCoreSystemInterface.h
index df65ff2..308a551 100644
--- a/Source/WebCore/platform/mac/WebCoreSystemInterface.h
+++ b/Source/WebCore/platform/mac/WebCoreSystemInterface.h
@@ -86,6 +86,8 @@ class QTMovie;
 class QTMovieView;
 #endif
 
+typedef struct _CFURLResponse *CFURLResponseRef;
+
 extern "C" {
 
 // In alphabetical order.
@@ -115,6 +117,7 @@ extern BOOL (*wkGetGlyphTransformedAdvances)(CGFontRef, NSFont*, CGAffineTransfo
 extern void (*wkDrawMediaSliderTrack)(int themeStyle, CGContextRef context, CGRect rect, float timeLoaded, float currentTime, 
     float duration, unsigned state);
 extern void (*wkDrawMediaUIPart)(int part, int themeStyle, CGContextRef context, CGRect rect, unsigned state);
+extern CFStringRef (*wkSignedPublicKeyAndChallengeString)(unsigned keySize, CFStringRef challenge, CFStringRef keyDescription);
 extern NSString* (*wkGetPreferredExtensionForMIMEType)(NSString*);
 extern NSArray* (*wkGetExtensionsForMIMEType)(NSString*);
 extern NSString* (*wkGetMIMETypeForExtension)(NSString*);
@@ -194,10 +197,13 @@ extern CGContextRef (*wkIOSurfaceContextCreate)(IOSurfaceRef surface, unsigned w
 extern CGImageRef (*wkIOSurfaceContextCreateImage)(CGContextRef context);
 
 typedef struct __WKScrollbarPainter *WKScrollbarPainterRef;
+typedef struct __WKScrollbarPainterController *WKScrollbarPainterControllerRef;
+
 extern WKScrollbarPainterRef (*wkMakeScrollbarPainter)(int controlSize, bool isHorizontal);
 extern WKScrollbarPainterRef (*wkMakeScrollbarReplacementPainter)(WKScrollbarPainterRef oldPainter, int newStyle, int controlSize, bool isHorizontal);
 extern void (*wkScrollbarPainterSetDelegate)(WKScrollbarPainterRef, id scrollbarPainterDelegate);
 extern void (*wkScrollbarPainterPaint)(WKScrollbarPainterRef, bool enabled, double value, CGFloat proportion, CGRect frameRect);
+extern void (*wkScrollbarPainterForceFlashScrollers)(WKScrollbarPainterControllerRef);
 extern int (*wkScrollbarThickness)(int controlSize);
 extern int (*wkScrollbarMinimumThumbLength)(WKScrollbarPainterRef);
 extern int (*wkScrollbarMinimumTotalLengthNeededForThumb)(WKScrollbarPainterRef);
@@ -208,7 +214,6 @@ extern void (*wkSetScrollbarPainterTrackAlpha)(WKScrollbarPainterRef, CGFloat);
 extern bool (*wkScrollbarPainterIsHorizontal)(WKScrollbarPainterRef);
 extern void (*wkScrollbarPainterSetOverlayState)(WKScrollbarPainterRef, int overlayScrollerState);
 
-typedef struct __WKScrollbarPainterController *WKScrollbarPainterControllerRef;
 extern WKScrollbarPainterControllerRef (*wkMakeScrollbarPainterController)(id painterControllerDelegate);
 extern void (*wkSetPainterForPainterController)(WKScrollbarPainterControllerRef, WKScrollbarPainterRef, bool isHorizontal);
 extern WKScrollbarPainterRef (*wkVerticalScrollbarPainterForController)(WKScrollbarPainterControllerRef);
@@ -244,12 +249,18 @@ extern CFURLStorageSessionRef (*wkCreatePrivateStorageSession)(CFStringRef);
 extern NSURLRequest* (*wkCopyRequestWithStorageSession)(CFURLStorageSessionRef, NSURLRequest*);
 
 typedef struct OpaqueCFHTTPCookieStorage* CFHTTPCookieStorageRef;
-extern CFHTTPCookieStorageRef (*wkCreatePrivateInMemoryHTTPCookieStorage)(CFURLStorageSessionRef);
+extern CFHTTPCookieStorageRef (*wkCopyHTTPCookieStorage)(CFURLStorageSessionRef);
 extern unsigned (*wkGetHTTPCookieAcceptPolicy)(CFHTTPCookieStorageRef);
 extern NSArray *(*wkHTTPCookiesForURL)(CFHTTPCookieStorageRef, NSURL *);
 extern void (*wkSetHTTPCookiesForURL)(CFHTTPCookieStorageRef, NSArray *, NSURL *, NSURL *);
 extern void (*wkDeleteHTTPCookie)(CFHTTPCookieStorageRef, NSHTTPCookie *);
 
+extern CFStringRef (*wkGetCFURLResponseMIMEType)(CFURLResponseRef);
+extern CFURLRef (*wkGetCFURLResponseURL)(CFURLResponseRef);
+extern CFHTTPMessageRef (*wkGetCFURLResponseHTTPResponse)(CFURLResponseRef);
+extern CFStringRef (*wkCopyCFURLResponseSuggestedFilename)(CFURLResponseRef);
+extern void (*wkSetCFURLResponseMIMEType)(CFURLResponseRef, CFStringRef mimeType);
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/mac/WebCoreSystemInterface.mm b/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
index 50ac236..ab059bd 100644
--- a/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
+++ b/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
@@ -48,6 +48,7 @@ void (*wkDrawMediaUIPart)(int part, int themeStyle, CGContextRef context, CGRect
 void (*wkMeasureMediaUIPart)(int part, int themeStyle, CGRect *bounds, CGSize *naturalSize);
 BOOL (*wkMediaControllerThemeAvailable)(int themeStyle);
 NSString* (*wkGetPreferredExtensionForMIMEType)(NSString*);
+CFStringRef (*wkSignedPublicKeyAndChallengeString)(unsigned keySize, CFStringRef challenge, CFStringRef keyDescription);
 NSArray* (*wkGetExtensionsForMIMEType)(NSString*);
 NSString* (*wkGetMIMETypeForExtension)(NSString*);
 NSTimeInterval (*wkGetNSURLResponseCalculatedExpiration)(NSURLResponse *response);
@@ -132,6 +133,7 @@ WKScrollbarPainterRef (*wkMakeScrollbarPainter)(int controlSize, bool isHorizont
 WKScrollbarPainterRef (*wkMakeScrollbarReplacementPainter)(WKScrollbarPainterRef oldPainter, int newStyle, int controlSize, bool isHorizontal);
 void (*wkScrollbarPainterSetDelegate)(WKScrollbarPainterRef, id scrollbarPainterDelegate);
 void (*wkScrollbarPainterPaint)(WKScrollbarPainterRef, bool enabled, double value, CGFloat proportion, CGRect frameRect);
+void (*wkScrollbarPainterForceFlashScrollers)(WKScrollbarPainterControllerRef);
 int (*wkScrollbarThickness)(int controlSize);
 int (*wkScrollbarMinimumThumbLength)(WKScrollbarPainterRef);
 int (*wkScrollbarMinimumTotalLengthNeededForThumb)(WKScrollbarPainterRef);
@@ -174,8 +176,14 @@ AXUIElementRef (*wkCreateAXUIElementRef)(id element);
 
 CFURLStorageSessionRef (*wkCreatePrivateStorageSession)(CFStringRef);
 NSURLRequest* (*wkCopyRequestWithStorageSession)(CFURLStorageSessionRef, NSURLRequest*);
-CFHTTPCookieStorageRef (*wkCreatePrivateInMemoryHTTPCookieStorage)(CFURLStorageSessionRef);
+CFHTTPCookieStorageRef (*wkCopyHTTPCookieStorage)(CFURLStorageSessionRef);
 unsigned (*wkGetHTTPCookieAcceptPolicy)(CFHTTPCookieStorageRef);
 NSArray *(*wkHTTPCookiesForURL)(CFHTTPCookieStorageRef, NSURL *);
 void (*wkSetHTTPCookiesForURL)(CFHTTPCookieStorageRef, NSArray *, NSURL *, NSURL *);
 void (*wkDeleteHTTPCookie)(CFHTTPCookieStorageRef, NSHTTPCookie *);
+
+CFStringRef (*wkGetCFURLResponseMIMEType)(CFURLResponseRef);
+CFURLRef (*wkGetCFURLResponseURL)(CFURLResponseRef);
+CFHTTPMessageRef (*wkGetCFURLResponseHTTPResponse)(CFURLResponseRef);
+CFStringRef (*wkCopyCFURLResponseSuggestedFilename)(CFURLResponseRef);
+void (*wkSetCFURLResponseMIMEType)(CFURLResponseRef, CFStringRef mimeType);
diff --git a/Source/WebCore/platform/mac/WidgetMac.mm b/Source/WebCore/platform/mac/WidgetMac.mm
index 96bcde2..f75faaa 100644
--- a/Source/WebCore/platform/mac/WidgetMac.mm
+++ b/Source/WebCore/platform/mac/WidgetMac.mm
@@ -115,10 +115,15 @@ void Widget::setFocus(bool focused)
 
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
  
+    // If there's no platformWidget, WK2 is running. The focus() method needs to be used
+    // to bring focus to the right view on the UIProcess side.
     NSView *view = [platformWidget() _webcore_effectiveFirstResponder];
-    if (Page* page = frame->page())
-        page->chrome()->focusNSView(view);
-    
+    if (Page* page = frame->page()) {
+        if (!platformWidget())
+            page->chrome()->focus();
+        else
+            page->chrome()->focusNSView(view);
+    }
     END_BLOCK_OBJC_EXCEPTIONS;
 }
 
diff --git a/Source/WebCore/platform/mock/GeolocationClientMock.cpp b/Source/WebCore/platform/mock/GeolocationClientMock.cpp
index 5255b34..d067c8a 100644
--- a/Source/WebCore/platform/mock/GeolocationClientMock.cpp
+++ b/Source/WebCore/platform/mock/GeolocationClientMock.cpp
@@ -79,6 +79,11 @@ void GeolocationClientMock::setPermission(bool allowed)
     asyncUpdatePermission();
 }
 
+int GeolocationClientMock::numberOfPendingPermissionRequests() const
+{
+    return m_pendingPermission.size();
+}
+
 void GeolocationClientMock::requestPermission(Geolocation* geolocation)
 {
     m_pendingPermission.add(geolocation);
diff --git a/Source/WebCore/platform/mock/GeolocationClientMock.h b/Source/WebCore/platform/mock/GeolocationClientMock.h
index df35316..b400166 100644
--- a/Source/WebCore/platform/mock/GeolocationClientMock.h
+++ b/Source/WebCore/platform/mock/GeolocationClientMock.h
@@ -59,6 +59,7 @@ public:
     void setError(PassRefPtr<GeolocationError>);
     void setPosition(PassRefPtr<GeolocationPosition>);
     void setPermission(bool allowed);
+    int numberOfPendingPermissionRequests() const;
 
     // GeolocationClient
     virtual void geolocationDestroyed();
diff --git a/Source/WebCore/platform/network/BlobData.h b/Source/WebCore/platform/network/BlobData.h
index c1f5522..f919d64 100644
--- a/Source/WebCore/platform/network/BlobData.h
+++ b/Source/WebCore/platform/network/BlobData.h
@@ -34,11 +34,11 @@
 #include "KURL.h"
 #include "PlatformString.h"
 #include <wtf/Forward.h>
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
-class RawData : public ThreadSafeShared<RawData> {
+class RawData : public ThreadSafeRefCounted<RawData> {
 public:
     static PassRefPtr<RawData> create()
     {
diff --git a/Source/WebCore/platform/network/FormDataBuilder.cpp b/Source/WebCore/platform/network/FormDataBuilder.cpp
index e973f99..3174614 100644
--- a/Source/WebCore/platform/network/FormDataBuilder.cpp
+++ b/Source/WebCore/platform/network/FormDataBuilder.cpp
@@ -32,6 +32,7 @@
 
 #include <limits>
 #include <wtf/Assertions.h>
+#include <wtf/HexNumber.h>
 #include <wtf/text/CString.h>
 #include <wtf/RandomNumber.h>
 
@@ -192,8 +193,6 @@ void FormDataBuilder::addKeyValuePairAsFormData(Vector<char>& buffer, const CStr
 
 void FormDataBuilder::encodeStringAsFormData(Vector<char>& buffer, const CString& string)
 {
-    static const char hexDigits[17] = "0123456789ABCDEF";
-
     // Same safe characters as Netscape for compatibility.
     static const char safeCharacters[] = "-._*";
 
@@ -210,8 +209,7 @@ void FormDataBuilder::encodeStringAsFormData(Vector<char>& buffer, const CString
             append(buffer, "%0D%0A");
         else if (c != '\r') {
             append(buffer, '%');
-            append(buffer, hexDigits[c >> 4]);
-            append(buffer, hexDigits[c & 0xF]);
+            appendByteAsHex(c, buffer);
         }
     }
 }
diff --git a/Source/WebCore/platform/network/ProtectionSpace.h b/Source/WebCore/platform/network/ProtectionSpace.h
index deb59d2..87758e1 100644
--- a/Source/WebCore/platform/network/ProtectionSpace.h
+++ b/Source/WebCore/platform/network/ProtectionSpace.h
@@ -49,7 +49,7 @@ enum ProtectionSpaceAuthenticationScheme {
     ProtectionSpaceAuthenticationSchemeNegotiate = 6,
     ProtectionSpaceAuthenticationSchemeClientCertificateRequested = 7,
     ProtectionSpaceAuthenticationSchemeServerTrustEvaluationRequested = 8,
-    ProtectionSpaceAuthenticationSchemeUnknown = 100,
+    ProtectionSpaceAuthenticationSchemeUnknown = 100
 };
   
 class ProtectionSpace {
diff --git a/Source/WebCore/platform/network/ProtectionSpaceHash.h b/Source/WebCore/platform/network/ProtectionSpaceHash.h
index 9934321..40eb9b6 100644
--- a/Source/WebCore/platform/network/ProtectionSpaceHash.h
+++ b/Source/WebCore/platform/network/ProtectionSpaceHash.h
@@ -46,7 +46,7 @@ struct ProtectionSpaceHash {
         // Ignore realm for proxies.
         if (protectionSpace.isProxy())
             codeCount -= sizeof(hashCodes[0]);
-        return WTF::StringHasher::createBlobHash(hashCodes, codeCount);
+        return StringHasher::hashMemory(hashCodes, codeCount);
     }
     
     static bool equal(const ProtectionSpace& a, const ProtectionSpace& b) { return a == b; }
diff --git a/Source/WebCore/platform/network/ResourceErrorBase.cpp b/Source/WebCore/platform/network/ResourceErrorBase.cpp
index 42bc0de..e1d29e0 100644
--- a/Source/WebCore/platform/network/ResourceErrorBase.cpp
+++ b/Source/WebCore/platform/network/ResourceErrorBase.cpp
@@ -42,6 +42,7 @@ ResourceError ResourceErrorBase::copy() const
     errorCopy.m_localizedDescription = m_localizedDescription.crossThreadString();
     errorCopy.m_isNull = m_isNull;
     errorCopy.m_isCancellation = m_isCancellation;
+    platformCopy(errorCopy);
     return errorCopy;
 }
 
diff --git a/Source/WebCore/platform/network/ResourceErrorBase.h b/Source/WebCore/platform/network/ResourceErrorBase.h
index a6b7c69..2d7be70 100644
--- a/Source/WebCore/platform/network/ResourceErrorBase.h
+++ b/Source/WebCore/platform/network/ResourceErrorBase.h
@@ -74,6 +74,9 @@ protected:
     // The ResourceError subclass may "shadow" this method to lazily initialize platform specific fields
     void platformLazyInit() {}
 
+    // The ResourceError subclass may "shadow" this method to copy platform specific fields
+    void platformCopy(ResourceError&) const {}
+
     // The ResourceError subclass may "shadow" this method to compare platform specific fields
     static bool platformCompare(const ResourceError&, const ResourceError&) { return true; }
 
diff --git a/Source/WebCore/platform/network/ResourceHandleClient.h b/Source/WebCore/platform/network/ResourceHandleClient.h
index d9350ee..e92b376 100644
--- a/Source/WebCore/platform/network/ResourceHandleClient.h
+++ b/Source/WebCore/platform/network/ResourceHandleClient.h
@@ -59,7 +59,7 @@ namespace WebCore {
     enum CacheStoragePolicy {
         StorageAllowed,
         StorageAllowedInMemoryOnly,
-        StorageNotAllowed,
+        StorageNotAllowed
     };
     
     class ResourceHandleClient {
@@ -78,6 +78,11 @@ namespace WebCore {
         virtual void wasBlocked(ResourceHandle*) { }
         virtual void cannotShowURL(ResourceHandle*) { }
 
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+        virtual bool supportsDataArray() { return false; }
+        virtual void didReceiveDataArray(ResourceHandle*, CFArrayRef) { }
+#endif
+
         virtual void willCacheResponse(ResourceHandle*, CacheStoragePolicy&) { }
 
         virtual bool shouldUseCredentialStorage(ResourceHandle*) { return false; }
diff --git a/Source/WebCore/platform/network/ResourceRequestBase.h b/Source/WebCore/platform/network/ResourceRequestBase.h
index ec7e32a..31a1e69 100644
--- a/Source/WebCore/platform/network/ResourceRequestBase.h
+++ b/Source/WebCore/platform/network/ResourceRequestBase.h
@@ -41,7 +41,7 @@ namespace WebCore {
         UseProtocolCachePolicy, // normal load
         ReloadIgnoringCacheData, // reload
         ReturnCacheDataElseLoad, // back/forward or encoding change - allow stale data
-        ReturnCacheDataDontLoad, // results of a post - allow stale data and only use cache
+        ReturnCacheDataDontLoad  // results of a post - allow stale data and only use cache
     };
 
     class ResourceRequest;
diff --git a/Source/WebCore/platform/network/cf/CookieStorageCFNet.cpp b/Source/WebCore/platform/network/cf/CookieStorageCFNet.cpp
index c2a5691..2eac3f6 100644
--- a/Source/WebCore/platform/network/cf/CookieStorageCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/CookieStorageCFNet.cpp
@@ -42,7 +42,7 @@
 
 namespace WebCore {
 
-static RetainPtr<CFHTTPCookieStorageRef>& privateBrowsingCookieStorage()
+static RetainPtr<CFHTTPCookieStorageRef>& privateCookieStorage()
 {
     DEFINE_STATIC_LOCAL(RetainPtr<CFHTTPCookieStorageRef>, cookieStorage, ());
     return cookieStorage;
@@ -52,16 +52,21 @@ CFHTTPCookieStorageRef currentCookieStorage()
 {
     ASSERT(isMainThread());
 
-    if (CFHTTPCookieStorageRef privateCookieStorage = privateBrowsingCookieStorage().get())
-        return privateCookieStorage;
+    if (CFHTTPCookieStorageRef cookieStorage = privateCookieStorage().get())
+        return cookieStorage;
     return wkGetDefaultHTTPCookieStorage();
 }
 
+CFHTTPCookieStorageRef privateBrowsingCookieStorage()
+{
+    return privateCookieStorage().get();
+}
+
 void setCurrentCookieStorage(CFHTTPCookieStorageRef cookieStorage)
 {
     ASSERT(isMainThread());
 
-    privateBrowsingCookieStorage().adoptCF(cookieStorage);
+    privateCookieStorage().adoptCF(cookieStorage);
 }
 
 void setCookieStoragePrivateBrowsingEnabled(bool enabled)
@@ -69,15 +74,21 @@ void setCookieStoragePrivateBrowsingEnabled(bool enabled)
     ASSERT(isMainThread());
 
     if (!enabled) {
-        privateBrowsingCookieStorage() = nullptr;
+        privateCookieStorage() = nullptr;
         return;
     }
 
 #if USE(CFURLSTORAGESESSIONS)
-    privateBrowsingCookieStorage().adoptCF(wkCreatePrivateInMemoryHTTPCookieStorage(ResourceHandle::privateBrowsingStorageSession()));
-#else
-    privateBrowsingCookieStorage().adoptCF(wkCreatePrivateInMemoryHTTPCookieStorage(0));
+    if (CFURLStorageSessionRef privateStorageSession = ResourceHandle::privateBrowsingStorageSession())
+        privateCookieStorage().adoptCF(wkCopyHTTPCookieStorage(privateStorageSession));
+    else
 #endif
+        privateCookieStorage().adoptCF(wkCreateInMemoryHTTPCookieStorage());
+}
+
+CFHTTPCookieStorageRef defaultCookieStorage()
+{
+    return wkGetDefaultHTTPCookieStorage();
 }
 
 static void notifyCookiesChangedOnMainThread(void* context)
diff --git a/Source/WebCore/platform/network/cf/CookieStorageCFNet.h b/Source/WebCore/platform/network/cf/CookieStorageCFNet.h
index 0167587..d33c76e 100644
--- a/Source/WebCore/platform/network/cf/CookieStorageCFNet.h
+++ b/Source/WebCore/platform/network/cf/CookieStorageCFNet.h
@@ -33,6 +33,8 @@ typedef struct OpaqueCFHTTPCookieStorage*  CFHTTPCookieStorageRef;
 namespace WebCore {
 
     CFHTTPCookieStorageRef currentCookieStorage();
+    CFHTTPCookieStorageRef defaultCookieStorage();
+    CFHTTPCookieStorageRef privateBrowsingCookieStorage();
 
     // Needed for WebKit1 API only.
     void setCurrentCookieStorage(CFHTTPCookieStorageRef cookieStorage);
diff --git a/Source/WebCore/platform/network/cf/LoaderRunLoopCF.h b/Source/WebCore/platform/network/cf/LoaderRunLoopCF.h
index e0d3ba4..272acf9 100644
--- a/Source/WebCore/platform/network/cf/LoaderRunLoopCF.h
+++ b/Source/WebCore/platform/network/cf/LoaderRunLoopCF.h
@@ -29,7 +29,7 @@
 #if USE(CFNETWORK)
 
 #if !PLATFORM(WIN)
-#error This code is not needed on platforms other than Windows, because main thread's CFRunLoop can be used.
+#error This code is not needed on platforms other than Windows, because the CFRunLoop from the main thread can be used.
 #endif
 
 typedef struct __CFRunLoop* CFRunLoopRef;
diff --git a/Source/WebCore/platform/network/cf/ResourceError.h b/Source/WebCore/platform/network/cf/ResourceError.h
index aae9a4a..d36903f 100644
--- a/Source/WebCore/platform/network/cf/ResourceError.h
+++ b/Source/WebCore/platform/network/cf/ResourceError.h
@@ -32,6 +32,7 @@
 #if USE(CFNETWORK)
 #include <CoreFoundation/CFStream.h>
 #else
+
 #ifdef __OBJC__
 @class NSError;
 #else
@@ -54,38 +55,38 @@ public:
     {
     }
 
-#if USE(CFNETWORK)
-    ResourceError(CFStreamError error);
-
-    ResourceError(CFErrorRef error)
-        : m_dataIsUpToDate(false)
-        , m_platformError(error)
-    {
-        m_isNull = !error;
-    }
+    ResourceError(CFErrorRef error);
 
+    CFErrorRef cfError() const;
     operator CFErrorRef() const;
+
+#if USE(CFNETWORK)
+#if PLATFORM(WIN)
+    ResourceError(const String& domain, int errorCode, const String& failingURL, const String& localizedDescription, CFDataRef certificate);
+    PCCERT_CONTEXT certificate() const;
+#endif
+    ResourceError(CFStreamError error);
+    CFStreamError cfStreamError() const;
     operator CFStreamError() const;
 #else
-    ResourceError(NSError* error)
-        : m_dataIsUpToDate(false)
-        , m_platformError(error)
-    {
-        m_isNull = !error;
-    }
-
-    operator NSError*() const;
+    ResourceError(NSError *);
+    NSError *nsError() const;
+    operator NSError *() const;
 #endif
 
 private:
     friend class ResourceErrorBase;
 
     void platformLazyInit();
+    void platformCopy(ResourceError&) const;
     static bool platformCompare(const ResourceError& a, const ResourceError& b);
 
     bool m_dataIsUpToDate;
 #if USE(CFNETWORK)
     mutable RetainPtr<CFErrorRef> m_platformError;
+#if PLATFORM(WIN)
+    RetainPtr<CFDataRef> m_certificate;
+#endif
 #else
     mutable RetainPtr<NSError> m_platformError;
 #endif
diff --git a/Source/WebCore/platform/network/cf/ResourceErrorCF.cpp b/Source/WebCore/platform/network/cf/ResourceErrorCF.cpp
index 1eba97e..556ad6e 100644
--- a/Source/WebCore/platform/network/cf/ResourceErrorCF.cpp
+++ b/Source/WebCore/platform/network/cf/ResourceErrorCF.cpp
@@ -24,44 +24,46 @@
  */
 
 #include "config.h"
-#include "KURL.h"
 #include "ResourceError.h"
 
 #if USE(CFNETWORK)
 
-// FIXME: Once <rdar://problem/5050881> is fixed in open source we
-// can remove this extern "C"
-extern "C" { 
-#include <CFNetwork/CFNetworkErrors.h>
-}
-
+#include "KURL.h"
 #include <CoreFoundation/CFError.h>
+#include <CFNetwork/CFNetworkErrors.h>
+#if PLATFORM(WIN)
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
+#endif
 #include <WTF/RetainPtr.h>
 
 namespace WebCore {
 
-const CFStringRef failingURLStringKey = CFSTR("NSErrorFailingURLStringKey");
-const CFStringRef failingURLKey = CFSTR("NSErrorFailingURLKey");
+ResourceError::ResourceError(CFErrorRef cfError)
+    : m_dataIsUpToDate(false)
+    , m_platformError(cfError)
+{
+    m_isNull = !cfError;
+}
 
-// FIXME: Once <rdar://problem/5050841> is fixed we can remove this constructor.
-ResourceError::ResourceError(CFStreamError error)
-    : m_dataIsUpToDate(true)
+#if PLATFORM(WIN)
+ResourceError::ResourceError(const String& domain, int errorCode, const String& failingURL, const String& localizedDescription, CFDataRef certificate)
+    : ResourceErrorBase(domain, errorCode, failingURL, localizedDescription)
+    , m_dataIsUpToDate(true)
+    , m_certificate(certificate)
 {
-    m_isNull = false;
-    m_errorCode = error.error;
+}
 
-    switch(error.domain) {
-    case kCFStreamErrorDomainCustom:
-        m_domain ="NSCustomErrorDomain";
-        break;
-    case kCFStreamErrorDomainPOSIX:
-        m_domain = "NSPOSIXErrorDomain";
-        break;
-    case kCFStreamErrorDomainMacOSStatus:
-        m_domain = "NSOSStatusErrorDomain";
-        break;
-    }
+PCCERT_CONTEXT ResourceError::certificate() const
+{
+    if (!m_certificate)
+        return 0;
+    
+    return reinterpret_cast<PCCERT_CONTEXT>(CFDataGetBytePtr(m_certificate.get()));
 }
+#endif // PLATFORM(WIN)
+
+const CFStringRef failingURLStringKey = CFSTR("NSErrorFailingURLStringKey");
+const CFStringRef failingURLKey = CFSTR("NSErrorFailingURLKey");
 
 void ResourceError::platformLazyInit()
 {
@@ -101,23 +103,34 @@ void ResourceError::platformLazyInit()
             }
         }
         m_localizedDescription = (CFStringRef) CFDictionaryGetValue(userInfo.get(), kCFErrorLocalizedDescriptionKey);
+        
+#if PLATFORM(WIN)
+        m_certificate = wkGetSSLPeerCertificateData(userInfo.get());
+#endif
     }
 
     m_dataIsUpToDate = true;
 }
 
+void ResourceError::platformCopy(ResourceError& errorCopy) const
+{
+#if PLATFORM(WIN)
+    errorCopy.m_certificate = m_certificate;
+#endif
+}
+
 bool ResourceError::platformCompare(const ResourceError& a, const ResourceError& b)
 {
-    return (CFErrorRef)a == (CFErrorRef)b;
+    return a.cfError() == b.cfError();
 }
 
-ResourceError::operator CFErrorRef() const
+CFErrorRef ResourceError::cfError() const
 {
     if (m_isNull) {
         ASSERT(!m_platformError);
         return 0;
     }
-    
+
     if (!m_platformError) {
         RetainPtr<CFMutableDictionaryRef> userInfo(AdoptCF, CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
 
@@ -133,6 +146,11 @@ ResourceError::operator CFErrorRef() const
             CFDictionarySetValue(userInfo.get(), failingURLKey, url.get());
         }
 
+#if PLATFORM(WIN)
+        if (m_certificate)
+            wkSetSSLPeerCertificateData(userInfo.get(), m_certificate.get());
+#endif
+        
         RetainPtr<CFStringRef> domainString(AdoptCF, m_domain.createCFString());
         m_platformError.adoptCF(CFErrorCreate(0, domainString.get(), m_errorCode, userInfo.get()));
     }
@@ -140,7 +158,32 @@ ResourceError::operator CFErrorRef() const
     return m_platformError.get();
 }
 
-ResourceError::operator CFStreamError() const
+ResourceError::operator CFErrorRef() const
+{
+    return cfError();
+}
+
+// FIXME: Once <rdar://problem/5050841> is fixed we can remove this constructor.
+ResourceError::ResourceError(CFStreamError error)
+    : m_dataIsUpToDate(true)
+{
+    m_isNull = false;
+    m_errorCode = error.error;
+
+    switch(error.domain) {
+    case kCFStreamErrorDomainCustom:
+        m_domain ="NSCustomErrorDomain";
+        break;
+    case kCFStreamErrorDomainPOSIX:
+        m_domain = "NSPOSIXErrorDomain";
+        break;
+    case kCFStreamErrorDomainMacOSStatus:
+        m_domain = "NSOSStatusErrorDomain";
+        break;
+    }
+}
+
+CFStreamError ResourceError::cfStreamError() const
 {
     lazyInit();
 
@@ -159,6 +202,11 @@ ResourceError::operator CFStreamError() const
     return result;
 }
 
+ResourceError::operator CFStreamError() const
+{
+    return cfStreamError();
+}
+
 } // namespace WebCore
 
 #endif // USE(CFNETWORK)
diff --git a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h
index 09f4cea..271dcd2 100644
--- a/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h
+++ b/Source/WebCore/platform/network/cf/ResourceRequestCFNet.h
@@ -50,6 +50,8 @@ inline ResourceLoadPriority mapHTTPPipeliningPriorityToResourceLoadPriority(int
         return ResourceLoadPriorityMedium;
     case 2:
         return ResourceLoadPriorityHigh;
+    case 3:
+        return ResourceLoadPriorityUnresolved;
     default:
         ASSERT_NOT_REACHED();
         return ResourceLoadPriorityLowest;
@@ -67,8 +69,7 @@ inline int mapResourceLoadPriorityToHTTPPipeliningPriority(ResourceLoadPriority
     case ResourceLoadPriorityHigh:
         return 2;
     case ResourceLoadPriorityUnresolved:
-        ASSERT_NOT_REACHED();
-        return 0;
+        return 3;
     }
 
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/platform/network/cf/ResourceResponse.h b/Source/WebCore/platform/network/cf/ResourceResponse.h
index 33b6ddc..0551ede 100644
--- a/Source/WebCore/platform/network/cf/ResourceResponse.h
+++ b/Source/WebCore/platform/network/cf/ResourceResponse.h
@@ -98,9 +98,9 @@ private:
     static bool platformCompare(const ResourceResponse& a, const ResourceResponse& b);
 
 #if USE(CFNETWORK)
-    RetainPtr<CFURLResponseRef> m_cfResponse;
+    mutable RetainPtr<CFURLResponseRef> m_cfResponse;
 #else
-    RetainPtr<NSURLResponse> m_nsResponse;
+    mutable RetainPtr<NSURLResponse> m_nsResponse;
 #endif
     bool m_isUpToDate;
 };
diff --git a/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp b/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp
index 167b079..d4a0b31 100644
--- a/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/ResourceResponseCFNet.cpp
@@ -43,7 +43,14 @@ using namespace std;
 namespace WebCore {
 
 CFURLResponseRef ResourceResponse::cfURLResponse() const
-{  
+{
+    if (!m_cfResponse && !m_isNull) {
+        RetainPtr<CFURLRef> url(AdoptCF, m_url.createCFURL());
+        RetainPtr<CFStringRef> mimeType(AdoptCF, m_mimeType.createCFString());
+        RetainPtr<CFStringRef> textEncodingName(AdoptCF, m_textEncodingName.createCFString());
+        m_cfResponse.adoptCF(CFURLResponseCreate(0, url.get(), mimeType.get(), m_expectedContentLength, textEncodingName.get(), kCFURLCacheStorageAllowed));
+    }
+
     return m_cfResponse.get();
 }
 
diff --git a/Source/WebCore/platform/network/cf/SocketStreamHandle.h b/Source/WebCore/platform/network/cf/SocketStreamHandle.h
index 5c1c6ff..4adee70 100644
--- a/Source/WebCore/platform/network/cf/SocketStreamHandle.h
+++ b/Source/WebCore/platform/network/cf/SocketStreamHandle.h
@@ -44,14 +44,14 @@ class AuthenticationChallenge;
 class Credential;
 class SocketStreamHandleClient;
 
-class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase, public AuthenticationClient {
+class SocketStreamHandle : public ThreadSafeRefCounted<SocketStreamHandle>, public SocketStreamHandleBase, public AuthenticationClient {
 public:
     static PassRefPtr<SocketStreamHandle> create(const KURL& url, SocketStreamHandleClient* client) { return adoptRef(new SocketStreamHandle(url, client)); }
 
     virtual ~SocketStreamHandle();
 
-    using RefCounted<SocketStreamHandle>::ref;
-    using RefCounted<SocketStreamHandle>::deref;
+    using ThreadSafeRefCounted<SocketStreamHandle>::ref;
+    using ThreadSafeRefCounted<SocketStreamHandle>::deref;
 
 private:
     virtual int platformSend(const char* data, int length);
diff --git a/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp b/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
index d5b1743..ee06c68 100644
--- a/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
@@ -117,7 +117,7 @@ CFStringRef SocketStreamHandle::copyPACExecutionDescription(void*)
 
 struct MainThreadPACCallbackInfo {
     MainThreadPACCallbackInfo(SocketStreamHandle* handle, CFArrayRef proxyList) : handle(handle), proxyList(proxyList) { }
-    SocketStreamHandle* handle;
+    RefPtr<SocketStreamHandle> handle;
     CFArrayRef proxyList;
 };
 
@@ -436,7 +436,7 @@ CFStringRef SocketStreamHandle::copyCFStreamDescription(void* info)
 struct MainThreadEventCallbackInfo {
     MainThreadEventCallbackInfo(CFStreamEventType type, SocketStreamHandle* handle) : type(type), handle(handle) { }
     CFStreamEventType type;
-    SocketStreamHandle* handle;
+    RefPtr<SocketStreamHandle> handle;
 };
 
 void SocketStreamHandle::readStreamCallback(CFReadStreamRef stream, CFStreamEventType type, void* clientCallBackInfo)
diff --git a/Source/WebCore/platform/network/mac/CookieStorageMac.mm b/Source/WebCore/platform/network/mac/CookieStorageMac.mm
index db64aae..2696188 100644
--- a/Source/WebCore/platform/network/mac/CookieStorageMac.mm
+++ b/Source/WebCore/platform/network/mac/CookieStorageMac.mm
@@ -92,7 +92,7 @@ void setCookieStoragePrivateBrowsingEnabled(bool enabled)
         return;
 
     if (enabled && ResourceHandle::privateBrowsingStorageSession()) {
-        privateBrowsingCookieStorage().adoptCF(wkCreatePrivateInMemoryHTTPCookieStorage(ResourceHandle::privateBrowsingStorageSession()));
+        privateBrowsingCookieStorage().adoptCF(wkCopyHTTPCookieStorage(ResourceHandle::privateBrowsingStorageSession()));
 
         // FIXME: When Private Browsing is enabled, the Private Browsing Cookie Storage should be
         // observed for changes, not the default Cookie Storage.
@@ -116,7 +116,10 @@ void startObservingCookieChanges()
 
 void stopObservingCookieChanges()
 {
-    ASSERT(cookieStorageAdapter);
+    // cookieStorageAdapter can be nil here, if the WebProcess crashed and was restarted between
+    // when startObservingCookieChanges was called, and stopObservingCookieChanges is currently being called.
+    if (!cookieStorageAdapter)
+        return;
     [cookieStorageAdapter stopListeningForCookieChangeNotifications];
 }
 
diff --git a/Source/WebCore/platform/network/mac/FormDataStreamMac.mm b/Source/WebCore/platform/network/mac/FormDataStreamMac.mm
index eb6f601..f094842 100644
--- a/Source/WebCore/platform/network/mac/FormDataStreamMac.mm
+++ b/Source/WebCore/platform/network/mac/FormDataStreamMac.mm
@@ -192,8 +192,8 @@ static bool advanceCurrentStream(FormStreamFields* form)
         }
 #if ENABLE(BLOB)
         if (nextInput.m_fileStart > 0) {
-            CFNumberRef position = CFNumberCreate(0, kCFNumberLongLongType, &nextInput.m_fileStart);
-            CFReadStreamSetProperty(form->currentStream, kCFStreamPropertyFileCurrentOffset, position);
+            RetainPtr<CFNumberRef> position(AdoptCF, CFNumberCreate(0, kCFNumberLongLongType, &nextInput.m_fileStart));
+            CFReadStreamSetProperty(form->currentStream, kCFStreamPropertyFileCurrentOffset, position.get());
         }
         form->currentStreamRangeLength = nextInput.m_fileLength;
 #endif
diff --git a/Source/WebCore/platform/network/mac/ResourceErrorMac.mm b/Source/WebCore/platform/network/mac/ResourceErrorMac.mm
index 275ca41..0bada1f 100644
--- a/Source/WebCore/platform/network/mac/ResourceErrorMac.mm
+++ b/Source/WebCore/platform/network/mac/ResourceErrorMac.mm
@@ -28,6 +28,7 @@
 
 #import "BlockExceptions.h"
 #import "KURL.h"
+#import <CoreFoundation/CFError.h>
 #import <Foundation/Foundation.h>
 
 @interface NSError (WebExtras)
@@ -36,6 +37,20 @@
 
 namespace WebCore {
 
+ResourceError::ResourceError(NSError *nsError)
+    : m_dataIsUpToDate(false)
+    , m_platformError(nsError)
+{
+    m_isNull = !nsError;
+}
+
+ResourceError::ResourceError(CFErrorRef cfError)
+    : m_dataIsUpToDate(false)
+    , m_platformError((NSError *)cfError)
+{
+    m_isNull = !cfError;
+}
+
 void ResourceError::platformLazyInit()
 {
     if (m_dataIsUpToDate)
@@ -59,10 +74,10 @@ void ResourceError::platformLazyInit()
 
 bool ResourceError::platformCompare(const ResourceError& a, const ResourceError& b)
 {
-    return (NSError*)a == (NSError*)b;
+    return a.nsError() == b.nsError();
 }
 
-ResourceError::operator NSError*() const
+NSError *ResourceError::nsError() const
 {
     if (m_isNull) {
         ASSERT(!m_platformError);
@@ -87,4 +102,19 @@ ResourceError::operator NSError*() const
     return m_platformError.get();
 }
 
+ResourceError::operator NSError *() const
+{
+    return nsError();
+}
+
+CFErrorRef ResourceError::cfError() const
+{
+    return (CFErrorRef)nsError();
+}
+
+ResourceError::operator CFErrorRef() const
+{
+    return cfError();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/mac/ResourceHandleMac.mm b/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
index 96d561d..b2a89f0 100644
--- a/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
+++ b/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
@@ -886,7 +886,7 @@ String ResourceHandle::privateBrowsingStorageSessionIdentifierDefaultBase()
     // Avoid MIME type sniffing if the response comes back as 304 Not Modified.
     int statusCode = [r respondsToSelector:@selector(statusCode)] ? [(id)r statusCode] : 0;
     if (statusCode != 304)
-        [r adjustMIMETypeIfNecessary];
+        adjustMIMETypeIfNecessary([r _CFURLResponse]);
 
     if ([m_handle->firstRequest().nsURLRequest() _propertyForKey:@"ForceHTMLMIMEType"])
         [r _setMIMEType:@"text/html"];
@@ -910,9 +910,32 @@ String ResourceHandle::privateBrowsingStorageSessionIdentifierDefaultBase()
     m_handle->client()->didReceiveResponse(m_handle, r);
 }
 
+#if HAVE(CFNETWORK_DATA_ARRAY_CALLBACK)
+- (void)connection:(NSURLConnection *)connection didReceiveDataArray:(NSArray *)dataArray
+{
+    UNUSED_PARAM(connection);
+    LOG(Network, "Handle %p delegate connection:%p didReceiveDataArray:%p arraySize:%d", m_handle, connection, dataArray, [dataArray count]);
+
+    if (!dataArray)
+        return;
+
+    if (!m_handle || !m_handle->client())
+        return;
+
+    if (m_handle->client()->supportsDataArray())
+        m_handle->client()->didReceiveDataArray(m_handle, reinterpret_cast<CFArrayRef>(dataArray));
+    else {
+        for (NSData *data in dataArray)
+            m_handle->client()->didReceiveData(m_handle, static_cast<const char*>([data bytes]), [data length], static_cast<int>([data length]));
+    }
+    return;
+}
+#endif
+
 - (void)connection:(NSURLConnection *)connection didReceiveData:(NSData *)data lengthReceived:(long long)lengthReceived
 {
     UNUSED_PARAM(connection);
+    UNUSED_PARAM(lengthReceived);
 
     LOG(Network, "Handle %p delegate connection:%p didReceiveData:%p lengthReceived:%lld", m_handle, connection, data, lengthReceived);
 
@@ -922,7 +945,10 @@ String ResourceHandle::privateBrowsingStorageSessionIdentifierDefaultBase()
     // However, with today's computers and networking speeds, this won't happen in practice.
     // Could be an issue with a giant local file.
     CallbackGuard guard;
-    m_handle->client()->didReceiveData(m_handle, (const char*)[data bytes], [data length], static_cast<int>(lengthReceived));
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=19793
+    // -1 means we do not provide any data about transfer size to inspector so it would use
+    // Content-Length headers or content size to show transfer size.
+    m_handle->client()->didReceiveData(m_handle, (const char*)[data bytes], [data length], -1);
 }
 
 - (void)connection:(NSURLConnection *)connection willStopBufferingData:(NSData *)data
diff --git a/Source/WebCore/platform/network/mac/WebCoreURLResponse.h b/Source/WebCore/platform/network/mac/WebCoreURLResponse.h
index 8d43a21..d766b96 100644
--- a/Source/WebCore/platform/network/mac/WebCoreURLResponse.h
+++ b/Source/WebCore/platform/network/mac/WebCoreURLResponse.h
@@ -26,10 +26,15 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-@interface NSURLResponse (WebCoreURLResponse)
--(void)adjustMIMETypeIfNecessary;
-@end
+typedef struct _CFURLResponse* CFURLResponseRef;
 
+#ifdef __OBJC__
 @interface NSURLResponse (Details)
+- (CFURLResponseRef)_CFURLResponse;
 - (void)_setMIMEType:(NSString *)type;
 @end
+#endif
+
+namespace WebCore {
+void adjustMIMETypeIfNecessary(CFURLResponseRef);
+}
diff --git a/Source/WebCore/platform/network/mac/WebCoreURLResponse.mm b/Source/WebCore/platform/network/mac/WebCoreURLResponse.mm
index e287e5f..0960492 100644
--- a/Source/WebCore/platform/network/mac/WebCoreURLResponse.mm
+++ b/Source/WebCore/platform/network/mac/WebCoreURLResponse.mm
@@ -30,308 +30,429 @@
 #import "WebCoreURLResponse.h"
 
 #import "MIMETypeRegistry.h"
-#import <objc/objc-class.h>
+#import "WebCoreSystemInterface.h"
 #import <wtf/Assertions.h>
 #import <wtf/RetainPtr.h>
 
-#ifndef BUILDING_ON_TIGER
+namespace WebCore {
+
 // <rdar://problem/5321972> Plain text document from HTTP server detected as application/octet-stream
 // When we sniff a resource as application/octet-stream but the http response headers had "text/plain",
 // we have a hard decision to make about which of the two generic MIME types to go with.
 // When the URL's extension is a known binary type, we'll go with application/octet-stream.
 // Otherwise, we'll trust the server.
-static NSSet *createBinaryExtensionsSet()
+static CFSetRef createBinaryExtensionsSet()
 {
-    return [[NSSet alloc] initWithObjects:
-        @"3g2",
-        @"3gp",
-        @"ai",
-        @"aif",
-        @"aifc",
-        @"aiff",
-        @"au",
-        @"avi",
-        @"bcpio",
-        @"bin",
-        @"bmp",
-        @"boz",
-        @"bpk",
-        @"bz",
-        @"bz2",
-        @"chm",
-        @"class",
-        @"com",
-        @"cpio",
-        @"dcr",
-        @"dir",
-        @"dist",
-        @"distz",
-        @"dll",
-        @"dmg",
-        @"dms",
-        @"doc",
-        @"dot",
-        @"dump",
-        @"dv",
-        @"dvi",
-        @"dxr",
-        @"elc",
-        @"eot",
-        @"eps",
-        @"exe",
-        @"fgd",
-        @"gif",
-        @"gtar",
-        @"h261",
-        @"h263",
-        @"h264",
-        @"ico",
-        @"ims",
-        @"indd",
-        @"iso",
-        @"jp2",
-        @"jpe",
-        @"jpeg",
-        @"jpg",
-        @"jpgm",
-        @"jpgv",
-        @"jpm",
-        @"kar",
-        @"kmz",
-        @"lha",
-        @"lrm",
-        @"lzh",
-        @"m1v",
-        @"m2a",
-        @"m2v",
-        @"m3a",
-        @"m3u",
-        @"m4a",
-        @"m4p",
-        @"m4v",
-        @"mdb",
-        @"mid",
-        @"midi",
-        @"mj2",
-        @"mjp2",
-        @"mov",
-        @"movie",
-        @"mp2",
-        @"mp2a",
-        @"mp3",
-        @"mp4",
-        @"mp4a",
-        @"mp4s",
-        @"mp4v",
-        @"mpe",
-        @"mpeg",
-        @"mpg",
-        @"mpg4",
-        @"mpga",
-        @"mpp",
-        @"mpt",
-        @"msi",
-        @"ogg",
-        @"otf",
-        @"pct",
-        @"pdf",
-        @"pfa",
-        @"pfb",
-        @"pic",
-        @"pict",
-        @"pkg",
-        @"png",
-        @"pot",
-        @"pps",
-        @"ppt",
-        @"ps",
-        @"psd",
-        @"qt",
-        @"qti",
-        @"qtif",
-        @"qwd",
-        @"qwt",
-        @"qxb",
-        @"qxd",
-        @"qxl",
-        @"qxp",
-        @"qxt",
-        @"ra",
-        @"ram",
-        @"rm",
-        @"rmi",
-        @"rmp",
-        @"scpt",
-        @"sit",
-        @"sitx",
-        @"snd",
-        @"so",
-        @"swf",
-        @"tar",
-        @"tif",
-        @"tiff",
-        @"ttf",
-        @"wav",
-        @"wcm",
-        @"wdb",
-        @"wks",
-        @"wm",
-        @"wma",
-        @"wmd",
-        @"wmf",
-        @"wmv",
-        @"wmx",
-        @"wmz",
-        @"wpd",
-        @"wpl",
-        @"wps",
-        @"wvx",
-        @"xla",
-        @"xlc",
-        @"xlm",
-        @"xls",
-        @"xlt",
-        @"xlw",
-        @"xps",
-        @"zip",
-        nil
-    ];
+    CFStringRef extensions[] = {
+        CFSTR("3g2"),
+        CFSTR("3gp"),
+        CFSTR("ai"),
+        CFSTR("aif"),
+        CFSTR("aifc"),
+        CFSTR("aiff"),
+        CFSTR("au"),
+        CFSTR("avi"),
+        CFSTR("bcpio"),
+        CFSTR("bin"),
+        CFSTR("bmp"),
+        CFSTR("boz"),
+        CFSTR("bpk"),
+        CFSTR("bz"),
+        CFSTR("bz2"),
+        CFSTR("chm"),
+        CFSTR("class"),
+        CFSTR("com"),
+        CFSTR("cpio"),
+        CFSTR("dcr"),
+        CFSTR("dir"),
+        CFSTR("dist"),
+        CFSTR("distz"),
+        CFSTR("dll"),
+        CFSTR("dmg"),
+        CFSTR("dms"),
+        CFSTR("doc"),
+        CFSTR("dot"),
+        CFSTR("dump"),
+        CFSTR("dv"),
+        CFSTR("dvi"),
+        CFSTR("dxr"),
+        CFSTR("elc"),
+        CFSTR("eot"),
+        CFSTR("eps"),
+        CFSTR("exe"),
+        CFSTR("fgd"),
+        CFSTR("gif"),
+        CFSTR("gtar"),
+        CFSTR("h261"),
+        CFSTR("h263"),
+        CFSTR("h264"),
+        CFSTR("ico"),
+        CFSTR("ims"),
+        CFSTR("indd"),
+        CFSTR("iso"),
+        CFSTR("jp2"),
+        CFSTR("jpe"),
+        CFSTR("jpeg"),
+        CFSTR("jpg"),
+        CFSTR("jpgm"),
+        CFSTR("jpgv"),
+        CFSTR("jpm"),
+        CFSTR("kar"),
+        CFSTR("kmz"),
+        CFSTR("lha"),
+        CFSTR("lrm"),
+        CFSTR("lzh"),
+        CFSTR("m1v"),
+        CFSTR("m2a"),
+        CFSTR("m2v"),
+        CFSTR("m3a"),
+        CFSTR("m3u"),
+        CFSTR("m4a"),
+        CFSTR("m4p"),
+        CFSTR("m4v"),
+        CFSTR("mdb"),
+        CFSTR("mid"),
+        CFSTR("midi"),
+        CFSTR("mj2"),
+        CFSTR("mjp2"),
+        CFSTR("mov"),
+        CFSTR("movie"),
+        CFSTR("mp2"),
+        CFSTR("mp2a"),
+        CFSTR("mp3"),
+        CFSTR("mp4"),
+        CFSTR("mp4a"),
+        CFSTR("mp4s"),
+        CFSTR("mp4v"),
+        CFSTR("mpe"),
+        CFSTR("mpeg"),
+        CFSTR("mpg"),
+        CFSTR("mpg4"),
+        CFSTR("mpga"),
+        CFSTR("mpp"),
+        CFSTR("mpt"),
+        CFSTR("msi"),
+        CFSTR("ogg"),
+        CFSTR("otf"),
+        CFSTR("pct"),
+        CFSTR("pdf"),
+        CFSTR("pfa"),
+        CFSTR("pfb"),
+        CFSTR("pic"),
+        CFSTR("pict"),
+        CFSTR("pkg"),
+        CFSTR("png"),
+        CFSTR("pot"),
+        CFSTR("pps"),
+        CFSTR("ppt"),
+        CFSTR("ps"),
+        CFSTR("psd"),
+        CFSTR("qt"),
+        CFSTR("qti"),
+        CFSTR("qtif"),
+        CFSTR("qwd"),
+        CFSTR("qwt"),
+        CFSTR("qxb"),
+        CFSTR("qxd"),
+        CFSTR("qxl"),
+        CFSTR("qxp"),
+        CFSTR("qxt"),
+        CFSTR("ra"),
+        CFSTR("ram"),
+        CFSTR("rm"),
+        CFSTR("rmi"),
+        CFSTR("rmp"),
+        CFSTR("scpt"),
+        CFSTR("sit"),
+        CFSTR("sitx"),
+        CFSTR("snd"),
+        CFSTR("so"),
+        CFSTR("swf"),
+        CFSTR("tar"),
+        CFSTR("tif"),
+        CFSTR("tiff"),
+        CFSTR("ttf"),
+        CFSTR("wav"),
+        CFSTR("wcm"),
+        CFSTR("wdb"),
+        CFSTR("wks"),
+        CFSTR("wm"),
+        CFSTR("wma"),
+        CFSTR("wmd"),
+        CFSTR("wmf"),
+        CFSTR("wmv"),
+        CFSTR("wmx"),
+        CFSTR("wmz"),
+        CFSTR("wpd"),
+        CFSTR("wpl"),
+        CFSTR("wps"),
+        CFSTR("wvx"),
+        CFSTR("xla"),
+        CFSTR("xlc"),
+        CFSTR("xlm"),
+        CFSTR("xls"),
+        CFSTR("xlt"),
+        CFSTR("xlw"),
+        CFSTR("xps"),
+        CFSTR("zip")
+    };
+    return CFSetCreate(kCFAllocatorDefault, (const void **)&extensions, sizeof(extensions)/sizeof(CFStringRef), &kCFTypeSetCallBacks);
 }
-#endif
 
 // <rdar://problem/7007389> CoreTypes UTI map is missing 100+ file extensions that GateKeeper knew about
 // When we disabled content sniffing for file URLs we caused problems with these 100+ extensions that CoreTypes
 // doesn't know about.
 // If CoreTypes is ever brought up to speed we can remove this table and associated code.
-static NSDictionary *createExtensionToMIMETypeMap()
+static CFDictionaryRef createExtensionToMIMETypeMap()
 {
-    return [[NSDictionary alloc] initWithObjectsAndKeys:
-        @"application/postscript", @"ai",
-        @"text/plain", @"asc",
-        @"application/x-bcpio", @"bcpio",
-        @"image/bmp", @"bmp",
-        @"application/x-netcdf", @"cdf",
-        @"application/octet-stream", @"class",
-        @"application/x-gzip", @"cpgz",
-        @"application/x-cpio", @"cpio",
-        @"application/mac-compactpro", @"cpt",
-        @"application/x-csh", @"csh",
-        @"text/css", @"css",
-        @"application/x-director", @"dcr",
-        @"application/x-director", @"dir",
-        @"application/x-diskcopy", @"dmg",
-        @"application/octet-stream", @"dms",
-        @"application/x-dvi", @"dvi",
-        @"application/x-director", @"dxr",
-        @"application/postscript", @"eps",
-        @"text/x-setext", @"etx",
-        @"application/andrew-inset", @"ez",
-        @"application/vnd.fdf", @"fdf",
-        @"application/octet-stream", @"fla",
-        @"application/x-filemaker", @"fp",
-        @"application/x-filemaker", @"fp2",
-        @"application/x-filemaker", @"fp3",
-        @"application/x-filemaker", @"fp4",
-        @"application/x-filemaker", @"fp5",
-        @"application/x-filemaker", @"fp6",
-        @"application/x-hdf", @"hdf",
-        @"x-conference/x-cooltalk", @"ice",
-        @"image/x-icon", @"ico",
-        @"text/calendar", @"ics",
-        @"image/ief", @"ief",
-        @"model/iges", @"iges",
-        @"model/iges", @"igs",
-        @"application/octet-stream", @"iso",
-        @"text/html", @"jhtml",
-        @"application/x-latex", @"latex",
-        @"application/octet-stream", @"lha",
-        @"application/octet-stream", @"lzh",
-        @"audio/x-mpegurl", @"m3u",
-        @"audio/x-m4p", @"m4p",
-        @"image/x-macpaint", @"mac",
-        @"application/x-troff-man", @"man",
-        @"application/x-troff-me", @"me",
-        @"model/mesh", @"mesh",
-        @"application/vnd.mif", @"mif",
-        @"video/x-sgi-movie", @"movie",
-        @"audio/mpeg", @"mp2",
-        @"audio/mpeg", @"mpga",
-        @"application/x-troff-ms", @"ms",
-        @"model/mesh", @"msh",
-        @"video/vnd.mpegurl", @"mxu",
-        @"application/x-netcdf", @"nc",
-        @"application/oda", @"oda",
-        @"image/x-portable-bitmap", @"pbm",
-        @"image/x-pcx", @"pcx",
-        @"chemical/x-pdb", @"pdb",
-        @"image/x-portable-graymap", @"pgm",
-        @"application/x-chess-pgn", @"pgn",
-        @"audio/scpls", @"pls",
-        @"image/x-portable-anymap", @"pnm",
-        @"image/x-macpaint", @"pnt",
-        @"image/x-macpaint", @"pntg",
-        @"image/x-portable-pixmap", @"ppm",
-        @"image/x-cmu-raster", @"ras",
-        @"image/x-rgb", @"rgb",
-        @"application/x-troff", @"roff",
-        @"audio/x-pn-realaudio-plugin", @"rpm",
-        @"text/richtext", @"rtx",
-        @"text/sgml", @"sgm",
-        @"text/sgml", @"sgml",
-        @"application/x-sh", @"sh",
-        @"application/x-shar", @"shar",
-        @"model/mesh", @"silo",
-        @"application/x-koan", @"skd",
-        @"application/x-koan", @"skm",
-        @"application/x-koan", @"skp",
-        @"application/x-koan", @"skt",
-        @"application/x-diskcopy", @"smi",
-        @"application/octet-stream", @"so",
-        @"application/x-futuresplash", @"spl",
-        @"application/x-wais-source", @"src",
-        @"application/x-sv4cpio", @"sv4cpio",
-        @"application/x-sv4crc", @"sv4crc",
-        @"application/x-shockwave-flash", @"swf",
-        @"application/x-troff", @"t",
-        @"image/x-targa", @"targa",
-        @"application/x-tcl", @"tcl",
-        @"application/x-tex", @"tex",
-        @"application/x-texinfo", @"texi",
-        @"application/x-texinfo", @"texinfo",
-        @"application/x-gzip", @"tgz",
-        @"application/x-bittorrent", @"torrent",
-        @"application/x-troff", @"tr",
-        @"text/tab-separated-values", @"tsv",
-        @"application/x-ustar", @"ustar",
-        @"application/x-cdlink", @"vcd",
-        @"model/vrml", @"vrml",
-        @"image/vnd.wap.wbmp", @"wbmp",
-        @"application/vnd.wap.wbxml", @"wbxml",
-        @"application/x-webarchive", @"webarchive",
-        @"application/x-ms-wmd", @"wmd",
-        @"text/vnd.wap.wml", @"wml",
-        @"application/vnd.wap.wmlc", @"wmlc",
-        @"text/vnd.wap.wmlscript", @"wmls",
-        @"application/vnd.wap.wmlscriptc", @"wmlsc",
-        @"model/vrml", @"wrl",
-        @"application/vnd.adobe.xdp+xml", @"xdp",
-        @"application/vnd.adobe.xfd+xml", @"xfd",
-        @"application/vnd.adobe.xfdf", @"xfdf",
-        @"image/x-xpixmap", @"xpm",
-        @"text/xml", @"xsl",
-        @"image/x-xwindowdump", @"xwd",
-        @"chemical/x-xyz", @"xyz",
-        @"application/x-compress", @"z",
-        nil
-    ];
+    CFStringRef keys[] = {
+        CFSTR("ai"),
+        CFSTR("asc"),
+        CFSTR("bcpio"),
+        CFSTR("bmp"),
+        CFSTR("cdf"),
+        CFSTR("class"),
+        CFSTR("cpgz"),
+        CFSTR("cpio"),
+        CFSTR("cpt"),
+        CFSTR("csh"),
+        CFSTR("css"),
+        CFSTR("dcr"),
+        CFSTR("dir"),
+        CFSTR("dmg"),
+        CFSTR("dms"),
+        CFSTR("dvi"),
+        CFSTR("dxr"),
+        CFSTR("eps"),
+        CFSTR("etx"),
+        CFSTR("ez"),
+        CFSTR("fdf"),
+        CFSTR("fla"),
+        CFSTR("fp"),
+        CFSTR("fp2"),
+        CFSTR("fp3"),
+        CFSTR("fp4"),
+        CFSTR("fp5"),
+        CFSTR("fp6"),
+        CFSTR("hdf"),
+        CFSTR("ice"),
+        CFSTR("ico"),
+        CFSTR("ics"),
+        CFSTR("ief"),
+        CFSTR("iges"),
+        CFSTR("igs"),
+        CFSTR("iso"),
+        CFSTR("jhtml"),
+        CFSTR("latex"),
+        CFSTR("lha"),
+        CFSTR("lzh"),
+        CFSTR("m3u"),
+        CFSTR("m4p"),
+        CFSTR("mac"),
+        CFSTR("man"),
+        CFSTR("me"),
+        CFSTR("mesh"),
+        CFSTR("mif"),
+        CFSTR("movie"),
+        CFSTR("mp2"),
+        CFSTR("mpga"),
+        CFSTR("ms"),
+        CFSTR("msh"),
+        CFSTR("mxu"),
+        CFSTR("nc"),
+        CFSTR("oda"),
+        CFSTR("pbm"),
+        CFSTR("pcx"),
+        CFSTR("pdb"),
+        CFSTR("pgm"),
+        CFSTR("pgn"),
+        CFSTR("pls"),
+        CFSTR("pnm"),
+        CFSTR("pnt"),
+        CFSTR("pntg"),
+        CFSTR("ppm"),
+        CFSTR("ras"),
+        CFSTR("rgb"),
+        CFSTR("roff"),
+        CFSTR("rpm"),
+        CFSTR("rtx"),
+        CFSTR("sgm"),
+        CFSTR("sgml"),
+        CFSTR("sh"),
+        CFSTR("shar"),
+        CFSTR("silo"),
+        CFSTR("skd"),
+        CFSTR("skm"),
+        CFSTR("skp"),
+        CFSTR("skt"),
+        CFSTR("smi"),
+        CFSTR("so"),
+        CFSTR("spl"),
+        CFSTR("src"),
+        CFSTR("sv4cpio"),
+        CFSTR("sv4crc"),
+        CFSTR("swf"),
+        CFSTR("t"),
+        CFSTR("targa"),
+        CFSTR("tcl"),
+        CFSTR("tex"),
+        CFSTR("texi"),
+        CFSTR("texinfo"),
+        CFSTR("tgz"),
+        CFSTR("torrent"),
+        CFSTR("tr"),
+        CFSTR("tsv"),
+        CFSTR("ustar"),
+        CFSTR("vcd"),
+        CFSTR("vrml"),
+        CFSTR("wbmp"),
+        CFSTR("wbxml"),
+        CFSTR("webarchive"),
+        CFSTR("wmd"),
+        CFSTR("wml"),
+        CFSTR("wmlc"),
+        CFSTR("wmls"),
+        CFSTR("wmlsc"),
+        CFSTR("wrl"),
+        CFSTR("xdp"),
+        CFSTR("xfd"),
+        CFSTR("xfdf"),
+        CFSTR("xpm"),
+        CFSTR("xsl"),
+        CFSTR("xwd"),
+        CFSTR("xyz"),
+        CFSTR("z")
+    };
+
+    CFStringRef values[] = {
+        CFSTR("application/postscript"),
+        CFSTR("text/plain"),
+        CFSTR("application/x-bcpio"),
+        CFSTR("image/bmp"),
+        CFSTR("application/x-netcdf"),
+        CFSTR("application/octet-stream"),
+        CFSTR("application/x-gzip"),
+        CFSTR("application/x-cpio"),
+        CFSTR("application/mac-compactpro"),
+        CFSTR("application/x-csh"),
+        CFSTR("text/css"),
+        CFSTR("application/x-director"),
+        CFSTR("application/x-director"),
+        CFSTR("application/x-diskcopy"),
+        CFSTR("application/octet-stream"),
+        CFSTR("application/x-dvi"),
+        CFSTR("application/x-director"),
+        CFSTR("application/postscript"),
+        CFSTR("text/x-setext"),
+        CFSTR("application/andrew-inset"),
+        CFSTR("application/vnd.fdf"),
+        CFSTR("application/octet-stream"),
+        CFSTR("application/x-filemaker"),
+        CFSTR("application/x-filemaker"),
+        CFSTR("application/x-filemaker"),
+        CFSTR("application/x-filemaker"),
+        CFSTR("application/x-filemaker"),
+        CFSTR("application/x-filemaker"),
+        CFSTR("application/x-hdf"),
+        CFSTR("x-conference/x-cooltalk"),
+        CFSTR("image/x-icon"),
+        CFSTR("text/calendar"),
+        CFSTR("image/ief"),
+        CFSTR("model/iges"),
+        CFSTR("model/iges"),
+        CFSTR("application/octet-stream"),
+        CFSTR("text/html"),
+        CFSTR("application/x-latex"),
+        CFSTR("application/octet-stream"),
+        CFSTR("application/octet-stream"),
+        CFSTR("audio/x-mpegurl"),
+        CFSTR("audio/x-m4p"),
+        CFSTR("image/x-macpaint"),
+        CFSTR("application/x-troff-man"),
+        CFSTR("application/x-troff-me"),
+        CFSTR("model/mesh"),
+        CFSTR("application/vnd.mif"),
+        CFSTR("video/x-sgi-movie"),
+        CFSTR("audio/mpeg"),
+        CFSTR("audio/mpeg"),
+        CFSTR("application/x-troff-ms"),
+        CFSTR("model/mesh"),
+        CFSTR("video/vnd.mpegurl"),
+        CFSTR("application/x-netcdf"),
+        CFSTR("application/oda"),
+        CFSTR("image/x-portable-bitmap"),
+        CFSTR("image/x-pcx"),
+        CFSTR("chemical/x-pdb"),
+        CFSTR("image/x-portable-graymap"),
+        CFSTR("application/x-chess-pgn"),
+        CFSTR("audio/scpls"),
+        CFSTR("image/x-portable-anymap"),
+        CFSTR("image/x-macpaint"),
+        CFSTR("image/x-macpaint"),
+        CFSTR("image/x-portable-pixmap"),
+        CFSTR("image/x-cmu-raster"),
+        CFSTR("image/x-rgb"),
+        CFSTR("application/x-troff"),
+        CFSTR("audio/x-pn-realaudio-plugin"),
+        CFSTR("text/richtext"),
+        CFSTR("text/sgml"),
+        CFSTR("text/sgml"),
+        CFSTR("application/x-sh"),
+        CFSTR("application/x-shar"),
+        CFSTR("model/mesh"),
+        CFSTR("application/x-koan"),
+        CFSTR("application/x-koan"),
+        CFSTR("application/x-koan"),
+        CFSTR("application/x-koan"),
+        CFSTR("application/x-diskcopy"),
+        CFSTR("application/octet-stream"),
+        CFSTR("application/x-futuresplash"),
+        CFSTR("application/x-wais-source"),
+        CFSTR("application/x-sv4cpio"),
+        CFSTR("application/x-sv4crc"),
+        CFSTR("application/x-shockwave-flash"),
+        CFSTR("application/x-troff"),
+        CFSTR("image/x-targa"),
+        CFSTR("application/x-tcl"),
+        CFSTR("application/x-tex"),
+        CFSTR("application/x-texinfo"),
+        CFSTR("application/x-texinfo"),
+        CFSTR("application/x-gzip"),
+        CFSTR("application/x-bittorrent"),
+        CFSTR("application/x-troff"),
+        CFSTR("text/tab-separated-values"),
+        CFSTR("application/x-ustar"),
+        CFSTR("application/x-cdlink"),
+        CFSTR("model/vrml"),
+        CFSTR("image/vnd.wap.wbmp"),
+        CFSTR("application/vnd.wap.wbxml"),
+        CFSTR("application/x-webarchive"),
+        CFSTR("application/x-ms-wmd"),
+        CFSTR("text/vnd.wap.wml"),
+        CFSTR("application/vnd.wap.wmlc"),
+        CFSTR("text/vnd.wap.wmlscript"),
+        CFSTR("application/vnd.wap.wmlscriptc"),
+        CFSTR("model/vrml"),
+        CFSTR("application/vnd.adobe.xdp+xml"),
+        CFSTR("application/vnd.adobe.xfd+xml"),
+        CFSTR("application/vnd.adobe.xfdf"),
+        CFSTR("image/x-xpixmap"),
+        CFSTR("text/xml"),
+        CFSTR("image/x-xwindowdump"),
+        CFSTR("chemical/x-xyz"),
+        CFSTR("application/x-compress")
+    };
+
+    ASSERT(sizeof(keys) == sizeof(values));
+    return CFDictionaryCreate(kCFAllocatorDefault, (const void**)&keys, (const void**)&values, sizeof(keys)/sizeof(CFStringRef), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 }
 
-static RetainPtr<NSString> mimeTypeFromUTITree(CFStringRef uti)
+static RetainPtr<CFStringRef> mimeTypeFromUTITree(CFStringRef uti)
 {
     // Check if this UTI has a MIME type.
     RetainPtr<CFStringRef> mimeType(AdoptCF, UTTypeCopyPreferredTagWithClass(uti, kUTTagClassMIMEType));
     if (mimeType)
-        return (NSString *)mimeType.get();
+        return mimeType.get();
     
     // If not, walk the ancestory of this UTI via its "ConformsTo" tags and return the first MIME type we find.
     RetainPtr<CFDictionaryRef> decl(AdoptCF, UTTypeCopyDeclaration(uti));
@@ -353,7 +474,7 @@ static RetainPtr<NSString> mimeTypeFromUTITree(CFStringRef uti)
             if (CFGetTypeID(object) != CFStringGetTypeID())
                 continue;
 
-            if (RetainPtr<NSString> mimeType = mimeTypeFromUTITree((CFStringRef)object))
+            if (RetainPtr<CFStringRef> mimeType = mimeTypeFromUTITree((CFStringRef)object))
                 return mimeType;
         }
     }
@@ -361,33 +482,29 @@ static RetainPtr<NSString> mimeTypeFromUTITree(CFStringRef uti)
     return nil;
 }
 
-@implementation NSURLResponse (WebCoreURLResponse)
-
--(void)adjustMIMETypeIfNecessary
+void adjustMIMETypeIfNecessary(CFURLResponseRef cfResponse)
 {
-    RetainPtr<NSString> result = [self MIMEType];
-    RetainPtr<NSString> originalResult = result;
-
-#ifdef BUILDING_ON_TIGER
-    // When content sniffing is disabled, Tiger's CFNetwork automatically returns application/octet-stream for certain
-    // extensions even when scouring the UTI maps would end up with a better result, so we'll give a chance for that to happen.
-    if ([[self URL] isFileURL] && [result.get() caseInsensitiveCompare:@"application/octet-stream"] == NSOrderedSame)
-        result = nil;
-#endif
+    RetainPtr<CFStringRef> result = wkGetCFURLResponseMIMEType(cfResponse);
+    RetainPtr<CFStringRef> originalResult = result;
 
     if (!result) {
-        NSURL *url = [self URL];
-        if ([url isFileURL]) {
-            if (NSString *extension = [[url path] pathExtension]) {
+        CFURLRef url = wkGetCFURLResponseURL(cfResponse);
+        NSURL *nsURL = (NSURL *)url;
+        if ([nsURL isFileURL]) {
+            RetainPtr<CFStringRef> extension(AdoptCF, CFURLCopyPathExtension(url));
+            if (extension) {
                 // <rdar://problem/7007389> CoreTypes UTI map is missing 100+ file extensions that GateKeeper knew about
                 // When this radar is resolved, we can remove this file:// url specific code.
-                static NSDictionary *extensionMap = createExtensionToMIMETypeMap();
-                result = [extensionMap objectForKey:[extension lowercaseString]];
+                static CFDictionaryRef extensionMap = createExtensionToMIMETypeMap();
+                CFMutableStringRef mutableExtension = CFStringCreateMutableCopy(kCFAllocatorDefault, 0, extension.get());
+                CFStringLowercase(mutableExtension, NULL);
+                extension.adoptCF(mutableExtension);
+                result = (CFStringRef) CFDictionaryGetValue(extensionMap, extension.get());
                 
                 if (!result) {
                     // If the Gatekeeper-based map doesn't have a MIME type, we'll try to figure out what it should be by
                     // looking up the file extension in the UTI maps.
-                    RetainPtr<CFStringRef> uti(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassFilenameExtension, (CFStringRef)extension, 0));
+                    RetainPtr<CFStringRef> uti(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassFilenameExtension, extension.get(), 0));
                     result = mimeTypeFromUTITree(uti.get());
                 }
             }
@@ -395,29 +512,33 @@ static RetainPtr<NSString> mimeTypeFromUTITree(CFStringRef uti)
     }
     
     if (!result) {
-        static NSString *defaultMIMETypeString = [(NSString *)WebCore::defaultMIMEType() retain];
+        static CFStringRef defaultMIMETypeString = WebCore::defaultMIMEType().createCFString();
         result = defaultMIMETypeString;
     }
 
-#ifndef BUILDING_ON_TIGER
     // <rdar://problem/5321972> Plain text document from HTTP server detected as application/octet-stream
     // Make the best guess when deciding between "generic binary" and "generic text" using a table of known binary MIME types.
-    if ([result.get() isEqualToString:@"application/octet-stream"] && [self respondsToSelector:@selector(allHeaderFields)] && [[[self performSelector:@selector(allHeaderFields)] objectForKey:@"Content-Type"] hasPrefix:@"text/plain"]) {
-        static NSSet *binaryExtensions = createBinaryExtensionsSet();
-        if (![binaryExtensions containsObject:[[[self suggestedFilename] pathExtension] lowercaseString]])
-            result = @"text/plain";
+    if (CFStringCompare(result.get(), CFSTR("application/octet-stream"), 0) == kCFCompareEqualTo) {
+        CFHTTPMessageRef message = wkGetCFURLResponseHTTPResponse(cfResponse);
+        if (message) {
+            RetainPtr<CFStringRef> contentType(AdoptCF, CFHTTPMessageCopyHeaderFieldValue(message, CFSTR("Content-Type")));
+            if (contentType && CFStringHasPrefix(contentType.get(), CFSTR("text/plain"))) {
+                static CFSetRef binaryExtensions = createBinaryExtensionsSet();
+                RetainPtr<NSString> suggestedFilename(AdoptNS, (NSString *)wkCopyCFURLResponseSuggestedFilename(cfResponse));
+                if (!CFSetContainsValue(binaryExtensions, (CFStringRef) [[suggestedFilename.get() pathExtension] lowercaseString]))
+                    result = CFSTR("text/plain");
+            }
+        }
     }
 
-#endif
-
 #ifdef BUILDING_ON_LEOPARD
     // Workaround for <rdar://problem/5539824>
-    if ([result.get() isEqualToString:@"text/xml"])
-        result = @"application/xml";
+    if (CFStringCompare(result.get(), CFSTR("text/xml"), 0) == kCFCompareEqualTo)
+        result = CFSTR("application/xml");
 #endif
 
     if (result != originalResult)
-        [self _setMIMEType:result.get()];
+        wkSetCFURLResponseMIMEType(cfResponse, result.get());
 }
 
-@end
+}
diff --git a/Source/WebCore/platform/network/qt/DnsPrefetchHelper.h b/Source/WebCore/platform/network/qt/DnsPrefetchHelper.h
index 892a3fb..4fcd19c 100644
--- a/Source/WebCore/platform/network/qt/DnsPrefetchHelper.h
+++ b/Source/WebCore/platform/network/qt/DnsPrefetchHelper.h
@@ -32,7 +32,7 @@ namespace WebCore {
     class DnsPrefetchHelper : public QObject {
         Q_OBJECT
     public:
-        DnsPrefetchHelper() : QObject(), currentLookups(0) {};
+        DnsPrefetchHelper() : QObject(), currentLookups(0) { }
 
     public slots:
         void lookup(QString hostname)
@@ -42,26 +42,8 @@ namespace WebCore {
             if (currentLookups >= 10)
                 return; // do not launch more than 10 lookups at the same time
 
-#if QT_VERSION >= QT_VERSION_CHECK(4, 6, 3)
             currentLookups++;
             QHostInfo::lookupHost(hostname, this, SLOT(lookedUp(QHostInfo)));
-#else
-            // This code is only needed for Qt versions that do not have
-            // the small Qt DNS cache yet.
-
-            QTime* entryTime = lookupCache.object(hostname);
-            if (entryTime && entryTime->elapsed() > 300*1000) {
-                // delete knowledge about lookup if it is already 300 seconds old
-                lookupCache.remove(hostname);
-            } else if (!entryTime) {
-                // not in cache yet, can look it up
-                QTime *tmpTime = new QTime();
-                *tmpTime = QTime::currentTime();
-                lookupCache.insert(hostname, tmpTime);
-                currentLookups++;
-                QHostInfo::lookupHost(hostname, this, SLOT(lookedUp(QHostInfo)));
-            }
-#endif
         }
 
         void lookedUp(const QHostInfo&)
@@ -74,9 +56,6 @@ namespace WebCore {
         }
 
     protected:
-#if QT_VERSION < QT_VERSION_CHECK(4, 6, 3)
-        QCache<QString, QTime> lookupCache; // 100 entries
-#endif
         int currentLookups;
     };
 
diff --git a/Source/WebCore/platform/network/qt/NetworkStateNotifierPrivate.h b/Source/WebCore/platform/network/qt/NetworkStateNotifierPrivate.h
index 766dc90..4b8252c 100644
--- a/Source/WebCore/platform/network/qt/NetworkStateNotifierPrivate.h
+++ b/Source/WebCore/platform/network/qt/NetworkStateNotifierPrivate.h
@@ -22,15 +22,9 @@
 
 #include <QObject>
 
-#if QT_VERSION < QT_VERSION_CHECK(4, 7, 0)
-namespace QtMobility {
-class QNetworkConfigurationManager;
-}
-#else
 QT_BEGIN_NAMESPACE
 class QNetworkConfigurationManager;
 QT_END_NAMESPACE
-#endif
 
 namespace WebCore {
 
@@ -46,11 +40,7 @@ public slots:
     void networkAccessPermissionChanged(bool);
 
 public:
-#if QT_VERSION < QT_VERSION_CHECK(4, 7, 0)
-    QtMobility::QNetworkConfigurationManager* m_configurationManager;
-#else
     QNetworkConfigurationManager* m_configurationManager;
-#endif
     bool m_online;
     bool m_networkAccessAllowed;
     NetworkStateNotifier* m_notifier;
diff --git a/Source/WebCore/platform/network/qt/NetworkStateNotifierQt.cpp b/Source/WebCore/platform/network/qt/NetworkStateNotifierQt.cpp
index f3e7023..ced52eb 100644
--- a/Source/WebCore/platform/network/qt/NetworkStateNotifierQt.cpp
+++ b/Source/WebCore/platform/network/qt/NetworkStateNotifierQt.cpp
@@ -25,10 +25,6 @@
 #include "NetworkStateNotifierPrivate.h"
 #include "qnetworkconfigmanager.h"
 
-#if QT_VERSION < QT_VERSION_CHECK(4, 7, 0)
-using namespace QtMobility;
-#endif
-
 namespace WebCore {
 
 NetworkStateNotifierPrivate::NetworkStateNotifierPrivate(NetworkStateNotifier* notifier)
diff --git a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 61fe96c..6e63145 100644
--- a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -41,21 +41,11 @@
 #include <QDebug>
 #include <QCoreApplication>
 
-// What type of connection should be used for the signals of the
-// QNetworkReply? This depends on if Qt has a bugfix for this or not.
-// It is fixed in Qt 4.6.3. See https://bugs.webkit.org/show_bug.cgi?id=32113
-// and https://bugs.webkit.org/show_bug.cgi?id=36755
-#if QT_VERSION > QT_VERSION_CHECK(4, 6, 2)
-#define SIGNAL_CONN Qt::DirectConnection
-#else
-#define SIGNAL_CONN Qt::QueuedConnection
-#endif
-
 // In Qt 4.8, the attribute for sending a request synchronously will be made public,
 // for now, use this hackish solution for setting the internal attribute.
 const QNetworkRequest::Attribute gSynchronousNetworkRequestAttribute = static_cast<QNetworkRequest::Attribute>(QNetworkRequest::HttpPipeliningWasUsedAttribute + 7);
 
-static const int gMaxRecursionLimit = 10;
+static const int gMaxRedirections = 10;
 
 namespace WebCore {
 
@@ -159,6 +149,86 @@ bool FormDataIODevice::isSequential() const
     return true;
 }
 
+QNetworkReplyWrapper::QNetworkReplyWrapper(QNetworkReply* reply, QObject* parent)
+    : QObject(parent)
+    , m_reply(reply)
+{
+    Q_ASSERT(m_reply);
+
+    connect(m_reply, SIGNAL(metaDataChanged()), this, SLOT(receiveMetaData()));
+    connect(m_reply, SIGNAL(readyRead()), this, SLOT(receiveMetaData()));
+    connect(m_reply, SIGNAL(finished()), this, SLOT(receiveMetaData()));
+}
+
+QNetworkReplyWrapper::~QNetworkReplyWrapper()
+{
+    if (m_reply)
+        m_reply->deleteLater();
+}
+
+QNetworkReply* QNetworkReplyWrapper::release()
+{
+    if (!m_reply)
+        return 0;
+
+    resetConnections();
+    QNetworkReply* reply = m_reply;
+    m_reply = 0;
+    reply->setParent(0);
+    return reply;
+}
+
+void QNetworkReplyWrapper::resetConnections()
+{
+    if (m_reply)
+        m_reply->disconnect(this);
+    QCoreApplication::removePostedEvents(this, QEvent::MetaCall);
+}
+
+void QNetworkReplyWrapper::receiveMetaData()
+{
+    // This slot is only used to receive the first signal from the QNetworkReply object.
+    resetConnections();
+
+    m_redirectionTargetUrl = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
+    if (m_redirectionTargetUrl.isValid()) {
+        emit metaDataChanged();
+        emit finished();
+        return;
+    }
+
+    WTF::String contentType = m_reply->header(QNetworkRequest::ContentTypeHeader).toString();
+    m_encoding = extractCharsetFromMediaType(contentType);
+    m_advertisedMimeType = extractMIMETypeFromMediaType(contentType);
+
+    bool hasData = m_reply->bytesAvailable();
+    bool isFinished = m_reply->isFinished();
+
+    if (!isFinished) {
+        // If not finished, connect to the slots that will be used from this point on.
+        connect(m_reply, SIGNAL(readyRead()), this, SIGNAL(readyRead()));
+        connect(m_reply, SIGNAL(finished()), this, SLOT(didReceiveFinished()));
+    }
+
+    emit metaDataChanged();
+
+    if (hasData)
+        emit readyRead();
+
+    if (isFinished) {
+        emit finished();
+        return;
+    }
+
+}
+
+void QNetworkReplyWrapper::didReceiveFinished()
+{
+    // Disconnecting will make sure that nothing will happen after emitting the finished signal.
+    resetConnections();
+    emit finished();
+}
+
 String QNetworkReplyHandler::httpMethod() const
 {
     switch (m_method) {
@@ -172,30 +242,24 @@ String QNetworkReplyHandler::httpMethod() const
         return "PUT";
     case QNetworkAccessManager::DeleteOperation:
         return "DELETE";
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     case QNetworkAccessManager::CustomOperation:
         return m_resourceHandle->firstRequest().httpMethod();
-#endif
     default:
         ASSERT_NOT_REACHED();
         return "GET";
     }
 }
 
-QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode loadMode)
+QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadType loadType, bool deferred)
     : QObject(0)
-    , m_reply(0)
+    , m_replyWrapper(0)
     , m_resourceHandle(handle)
-    , m_redirected(false)
-    , m_responseSent(false)
-    , m_responseContainsData(false)
-    , m_loadMode(loadMode)
-    , m_shouldStart(true)
-    , m_shouldFinish(false)
-    , m_shouldSendResponse(false)
-    , m_shouldForwardData(false)
-    , m_redirectionTries(gMaxRecursionLimit)
+    , m_loadType(loadType)
+    , m_deferred(deferred)
+    , m_redirectionTries(gMaxRedirections)
 {
+    resetState();
+
     const ResourceRequest &r = m_resourceHandle->firstRequest();
 
     if (r.httpMethod() == "GET")
@@ -208,13 +272,8 @@ QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode load
         m_method = QNetworkAccessManager::PutOperation;
     else if (r.httpMethod() == "DELETE")
         m_method = QNetworkAccessManager::DeleteOperation;
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     else
         m_method = QNetworkAccessManager::CustomOperation;
-#else
-    else
-        m_method = QNetworkAccessManager::UnknownOperation;
-#endif
 
     QObject* originatingObject = 0;
     if (m_resourceHandle->getInternal()->m_context)
@@ -222,40 +281,58 @@ QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode load
 
     m_request = r.toNetworkRequest(originatingObject);
 
-    if (m_loadMode == LoadSynchronously)
-        m_request.setAttribute(gSynchronousNetworkRequestAttribute, true);
-
-    if (m_loadMode == LoadNormal || m_loadMode == LoadSynchronously)
+    if (!m_deferred)
         start();
+}
+
+void QNetworkReplyHandler::resetState()
+{
+    m_redirected = false;
+    m_responseSent = false;
+    m_responseContainsData = false;
+    m_hasStarted = false;
+    m_callFinishOnResume = false;
+    m_callSendResponseIfNeededOnResume = false;
+    m_callForwardDataOnResume = false;
+
+    if (m_replyWrapper) {
+        m_replyWrapper->deleteLater();
+        m_replyWrapper = 0;
+    }
+}
 
-    if (m_loadMode == LoadSynchronously)
-        m_loadMode = LoadNormal;
+void QNetworkReplyHandler::setLoadingDeferred(bool deferred)
+{
+    m_deferred = deferred;
+
+    if (!deferred)
+        resumeDeferredLoad();
 }
 
-void QNetworkReplyHandler::setLoadMode(LoadMode mode)
+void QNetworkReplyHandler::resumeDeferredLoad()
 {
-    // https://bugs.webkit.org/show_bug.cgi?id=26556
-    // We cannot call sendQueuedItems() from here, because the signal that 
-    // caused us to get into deferred mode, might not be processed yet.
-    switch (mode) {
-    case LoadNormal:
-        m_loadMode = LoadResuming;
-        emit processQueuedItems();
-        break;
-    case LoadDeferred:
-        m_loadMode = LoadDeferred;
-        break;
-    case LoadResuming:
-        Q_ASSERT(0); // should never happen
-        break;
-    };
+    if (!m_hasStarted) {
+        ASSERT(!m_callSendResponseIfNeededOnResume);
+        ASSERT(!m_callForwardDataOnResume);
+        ASSERT(!m_callFinishOnResume);
+        start();
+        return;
+    }
+
+    if (m_callSendResponseIfNeededOnResume)
+        sendResponseIfNeeded();
+
+    if (m_callForwardDataOnResume)
+        forwardData();
+
+    if (m_callFinishOnResume)
+        finish();
 }
 
 void QNetworkReplyHandler::abort()
 {
     m_resourceHandle = 0;
-    if (m_reply) {
-        QNetworkReply* reply = release();
+    if (QNetworkReply* reply = release()) {
         reply->abort();
         reply->deleteLater();
     }
@@ -264,20 +341,16 @@ void QNetworkReplyHandler::abort()
 
 QNetworkReply* QNetworkReplyHandler::release()
 {
-    QNetworkReply* reply = m_reply;
-    if (m_reply) {
-        disconnect(m_reply, 0, this, 0);
-        // We have queued connections to the QNetworkReply. Make sure any
-        // posted meta call events that were the result of a signal emission
-        // don't reach the slots in our instance.
-        QCoreApplication::removePostedEvents(this, QEvent::MetaCall);
-        m_reply->setParent(0);
-        m_reply = 0;
-    }
+    if (!m_replyWrapper)
+        return 0;
+
+    QNetworkReply* reply = m_replyWrapper->release();
+    m_replyWrapper->deleteLater();
+    m_replyWrapper = 0;
     return reply;
 }
 
-static bool ignoreHttpError(QNetworkReply* reply, bool receivedData)
+static bool shouldIgnoreHttpError(QNetworkReply* reply, bool receivedData)
 {
     int httpStatusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
 
@@ -292,66 +365,73 @@ static bool ignoreHttpError(QNetworkReply* reply, bool receivedData)
 
 void QNetworkReplyHandler::finish()
 {
-    m_shouldFinish = (m_loadMode != LoadNormal);
-    if (m_shouldFinish)
+    ASSERT(m_hasStarted);
+
+    m_callFinishOnResume = m_deferred;
+    if (m_deferred)
         return;
 
-    if (!m_reply)
+    if (!m_replyWrapper || !m_replyWrapper->reply())
         return;
 
+
     sendResponseIfNeeded();
 
-    if (!m_resourceHandle)
+    if (wasAborted())
         return;
+
     ResourceHandleClient* client = m_resourceHandle->client();
     if (!client) {
-        m_reply->deleteLater();
-        m_reply = 0;
+        m_replyWrapper->deleteLater();
+        m_replyWrapper = 0;
         return;
     }
 
-    if (!m_redirected) {
-        if (!m_reply->error() || ignoreHttpError(m_reply, m_responseContainsData))
-            client->didFinishLoading(m_resourceHandle, 0);
-        else {
-            QUrl url = m_reply->url();
-            int httpStatusCode = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
-
-            if (httpStatusCode) {
-                ResourceError error("HTTP", httpStatusCode, url.toString(), m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toString());
-                client->didFail(m_resourceHandle, error);
-            } else {
-                ResourceError error("QtNetwork", m_reply->error(), url.toString(), m_reply->errorString());
-                client->didFail(m_resourceHandle, error);
-            }
-        }
-        if (m_reply) {
-            m_reply->deleteLater();
-            m_reply = 0;
-        }
-    } else {
-        if (m_reply) {
-            m_reply->deleteLater();
-            m_reply = 0;
-        }
+    if (m_redirected) {
         resetState();
         start();
+        return;
+    }
+
+    if (!m_replyWrapper->reply()->error() || shouldIgnoreHttpError(m_replyWrapper->reply(), m_responseContainsData))
+        client->didFinishLoading(m_resourceHandle, 0);
+    else {
+        QUrl url = m_replyWrapper->reply()->url();
+        int httpStatusCode = m_replyWrapper->reply()->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
+
+        if (httpStatusCode) {
+            ResourceError error("HTTP", httpStatusCode, url.toString(), m_replyWrapper->reply()->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toString());
+            client->didFail(m_resourceHandle, error);
+        } else {
+            ResourceError error("QtNetwork", m_replyWrapper->reply()->error(), url.toString(), m_replyWrapper->reply()->errorString());
+            client->didFail(m_resourceHandle, error);
+        }
+    }
+
+    if (m_replyWrapper) {
+        m_replyWrapper->deleteLater();
+        m_replyWrapper = 0;
     }
 }
 
 void QNetworkReplyHandler::sendResponseIfNeeded()
 {
-    m_shouldSendResponse = (m_loadMode != LoadNormal);
-    if (m_shouldSendResponse)
+    ASSERT(m_hasStarted);
+
+    m_callSendResponseIfNeededOnResume = m_deferred;
+    if (m_deferred)
         return;
 
-    if (!m_reply)
+    if (!m_replyWrapper || !m_replyWrapper->reply())
         return;
 
-    if (m_reply->error() && !ignoreHttpError(m_reply, m_responseContainsData))
+    if (m_replyWrapper->reply()->error() && !shouldIgnoreHttpError(m_replyWrapper->reply(), m_responseContainsData))
         return;
 
-    if (m_responseSent || !m_resourceHandle)
+    if (wasAborted())
+        return;
+
+    if (m_responseSent)
         return;
     m_responseSent = true;
 
@@ -359,18 +439,18 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     if (!client)
         return;
 
-    WTF::String contentType = m_reply->header(QNetworkRequest::ContentTypeHeader).toString();
+    WTF::String contentType = m_replyWrapper->reply()->header(QNetworkRequest::ContentTypeHeader).toString();
     WTF::String encoding = extractCharsetFromMediaType(contentType);
     WTF::String mimeType = extractMIMETypeFromMediaType(contentType);
 
     if (mimeType.isEmpty()) {
         // let's try to guess from the extension
-        mimeType = MIMETypeRegistry::getMIMETypeForPath(m_reply->url().path());
+        mimeType = MIMETypeRegistry::getMIMETypeForPath(m_replyWrapper->reply()->url().path());
     }
 
-    KURL url(m_reply->url());
+    KURL url(m_replyWrapper->reply()->url());
     ResourceResponse response(url, mimeType.lower(),
-                              m_reply->header(QNetworkRequest::ContentLengthHeader).toLongLong(),
+                              m_replyWrapper->reply()->header(QNetworkRequest::ContentLengthHeader).toLongLong(),
                               encoding, String());
 
     if (url.isLocalFile()) {
@@ -379,10 +459,10 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     }
 
     // The status code is equal to 0 for protocols not in the HTTP family.
-    int statusCode = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
+    int statusCode = m_replyWrapper->reply()->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
 
     if (url.protocolInHTTPFamily()) {
-        String suggestedFilename = filenameFromHTTPContentDisposition(QString::fromAscii(m_reply->rawHeader("Content-Disposition")));
+        String suggestedFilename = filenameFromHTTPContentDisposition(QString::fromLatin1(m_replyWrapper->reply()->rawHeader("Content-Disposition")));
 
         if (!suggestedFilename.isEmpty())
             response.setSuggestedFilename(suggestedFilename);
@@ -390,70 +470,79 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
             response.setSuggestedFilename(url.lastPathComponent());
 
         response.setHTTPStatusCode(statusCode);
-        response.setHTTPStatusText(m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toByteArray().constData());
+        response.setHTTPStatusText(m_replyWrapper->reply()->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toByteArray().constData());
 
         // Add remaining headers.
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
-        foreach (const QNetworkReply::RawHeaderPair& pair, m_reply->rawHeaderPairs())
-            response.setHTTPHeaderField(QString::fromAscii(pair.first), QString::fromAscii(pair.second));
-#else
-        foreach (const QByteArray& headerName, m_reply->rawHeaderList())
-            response.setHTTPHeaderField(QString::fromAscii(headerName), QString::fromAscii(m_reply->rawHeader(headerName)));
-#endif
+        foreach (const QNetworkReply::RawHeaderPair& pair, m_replyWrapper->reply()->rawHeaderPairs())
+            response.setHTTPHeaderField(QString::fromLatin1(pair.first), QString::fromLatin1(pair.second));
     }
 
-    QUrl redirection = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
+    QUrl redirection = m_replyWrapper->reply()->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
     if (redirection.isValid()) {
-        QUrl newUrl = m_reply->url().resolved(redirection);
+        redirect(response, redirection);
+        return;
+    }
 
-        m_redirectionTries--;
-        if (m_redirectionTries == 0) { // 10 or more redirections to the same url is considered infinite recursion
-            ResourceError error(newUrl.host(), 400 /*bad request*/,
-                                newUrl.toString(),
-                                QCoreApplication::translate("QWebPage", "Redirection limit reached"));
-            client->didFail(m_resourceHandle, error);
-            return;
-        }
-        m_redirected = true;
+    client->didReceiveResponse(m_resourceHandle, response);
+}
 
+void QNetworkReplyHandler::redirect(ResourceResponse& response, const QUrl& redirection)
+{
+    QUrl newUrl = m_replyWrapper->reply()->url().resolved(redirection);
 
-        //  Status Code 301 (Moved Permanently), 302 (Moved Temporarily), 303 (See Other):
-        //    - If original request is POST convert to GET and redirect automatically
-        //  Status Code 307 (Temporary Redirect) and all other redirect status codes:
-        //    - Use the HTTP method from the previous request
-        if ((statusCode >= 301 && statusCode <= 303) && m_resourceHandle->firstRequest().httpMethod() == "POST")
-            m_method = QNetworkAccessManager::GetOperation;
+    ResourceHandleClient* client = m_resourceHandle->client();
+    ASSERT(client);
+
+    int statusCode = m_replyWrapper->reply()->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
 
-        ResourceRequest newRequest = m_resourceHandle->firstRequest();
-        newRequest.setHTTPMethod(httpMethod());
-        newRequest.setURL(newUrl);
+    m_redirectionTries--;
+    if (!m_redirectionTries) {
+        ResourceError error(newUrl.host(), 400 /*bad request*/,
+                            newUrl.toString(),
+                            QCoreApplication::translate("QWebPage", "Redirection limit reached"));
+        client->didFail(m_resourceHandle, error);
+        return;
+    }
+    m_redirected = true;
 
-        // Should not set Referer after a redirect from a secure resource to non-secure one.
-        if (!newRequest.url().protocolIs("https") && protocolIs(newRequest.httpReferrer(), "https"))
-            newRequest.clearHTTPReferrer();
+    //  Status Code 301 (Moved Permanently), 302 (Moved Temporarily), 303 (See Other):
+    //    - If original request is POST convert to GET and redirect automatically
+    //  Status Code 307 (Temporary Redirect) and all other redirect status codes:
+    //    - Use the HTTP method from the previous request
+    if ((statusCode >= 301 && statusCode <= 303) && m_resourceHandle->firstRequest().httpMethod() == "POST")
+        m_method = QNetworkAccessManager::GetOperation;
 
-        client->willSendRequest(m_resourceHandle, newRequest, response);
-        if (!m_resourceHandle) // network error did cancel the request
-            return;
+    ResourceRequest newRequest = m_resourceHandle->firstRequest();
+    newRequest.setHTTPMethod(httpMethod());
+    newRequest.setURL(newUrl);
 
-        QObject* originatingObject = 0;
-        if (m_resourceHandle->getInternal()->m_context)
-            originatingObject = m_resourceHandle->getInternal()->m_context->originatingObject();
+    // Should not set Referer after a redirect from a secure resource to non-secure one.
+    if (!newRequest.url().protocolIs("https") && protocolIs(newRequest.httpReferrer(), "https"))
+        newRequest.clearHTTPReferrer();
 
-        m_request = newRequest.toNetworkRequest(originatingObject);
+    client->willSendRequest(m_resourceHandle, newRequest, response);
+    if (wasAborted()) // Network error cancelled the request.
         return;
-    }
 
-    client->didReceiveResponse(m_resourceHandle, response);
+    QObject* originatingObject = 0;
+    if (m_resourceHandle->getInternal()->m_context)
+        originatingObject = m_resourceHandle->getInternal()->m_context->originatingObject();
+
+    m_request = newRequest.toNetworkRequest(originatingObject);
 }
 
 void QNetworkReplyHandler::forwardData()
 {
-    m_shouldForwardData = (m_loadMode != LoadNormal);
-    if (m_shouldForwardData)
+    ASSERT(m_hasStarted);
+
+    m_callForwardDataOnResume = m_deferred;
+    if (m_deferred)
         return;
 
-    if (m_reply->bytesAvailable())
+    if (!m_replyWrapper || !m_replyWrapper->reply())
+        return;
+
+    if (m_replyWrapper->reply()->bytesAvailable())
         m_responseContainsData = true;
 
     sendResponseIfNeeded();
@@ -462,22 +551,25 @@ void QNetworkReplyHandler::forwardData()
     if (m_redirected)
         return;
 
-    if (!m_resourceHandle)
+    if (wasAborted())
         return;
 
-    QByteArray data = m_reply->read(m_reply->bytesAvailable());
+    QByteArray data = m_replyWrapper->reply()->read(m_replyWrapper->reply()->bytesAvailable());
 
     ResourceHandleClient* client = m_resourceHandle->client();
     if (!client)
         return;
 
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=19793
+    // -1 means we do not provide any data about transfer size to inspector so it would use
+    // Content-Length headers or content size to show transfer size.
     if (!data.isEmpty())
-        client->didReceiveData(m_resourceHandle, data.constData(), data.length(), data.length() /*FixMe*/);
+        client->didReceiveData(m_resourceHandle, data.constData(), data.length(), -1);
 }
 
 void QNetworkReplyHandler::uploadProgress(qint64 bytesSent, qint64 bytesTotal)
 {
-    if (!m_resourceHandle)
+    if (wasAborted())
         return;
 
     ResourceHandleClient* client = m_resourceHandle->client();
@@ -487,9 +579,10 @@ void QNetworkReplyHandler::uploadProgress(qint64 bytesSent, qint64 bytesTotal)
     client->didSendData(m_resourceHandle, bytesSent, bytesTotal);
 }
 
-void QNetworkReplyHandler::start()
+QNetworkReply* QNetworkReplyHandler::sendNetworkRequest()
 {
-    m_shouldStart = false;
+    if (m_loadType == SynchronousLoad)
+        m_request.setAttribute(gSynchronousNetworkRequestAttribute, true);
 
     ResourceHandleInternal* d = m_resourceHandle->getInternal();
 
@@ -498,7 +591,7 @@ void QNetworkReplyHandler::start()
         manager = d->m_context->networkAccessManager();
 
     if (!manager)
-        return;
+        return 0;
 
     const QUrl url = m_request.url();
     const QString scheme = url.scheme();
@@ -511,108 +604,61 @@ void QNetworkReplyHandler::start()
 
     switch (m_method) {
         case QNetworkAccessManager::GetOperation:
-            m_reply = manager->get(m_request);
-            break;
+            return manager->get(m_request);
         case QNetworkAccessManager::PostOperation: {
-            FormDataIODevice* postDevice = new FormDataIODevice(d->m_firstRequest.httpBody()); 
+            FormDataIODevice* postDevice = new FormDataIODevice(d->m_firstRequest.httpBody());
             // We may be uploading files so prevent QNR from buffering data
             m_request.setHeader(QNetworkRequest::ContentLengthHeader, postDevice->getFormDataSize());
             m_request.setAttribute(QNetworkRequest::DoNotBufferUploadDataAttribute, QVariant(true));
-            m_reply = manager->post(m_request, postDevice);
-            postDevice->setParent(m_reply);
-            break;
+            QNetworkReply* result = manager->post(m_request, postDevice);
+            postDevice->setParent(result);
+            return result;
         }
         case QNetworkAccessManager::HeadOperation:
-            m_reply = manager->head(m_request);
-            break;
+            return manager->head(m_request);
         case QNetworkAccessManager::PutOperation: {
-            FormDataIODevice* putDevice = new FormDataIODevice(d->m_firstRequest.httpBody()); 
+            FormDataIODevice* putDevice = new FormDataIODevice(d->m_firstRequest.httpBody());
             // We may be uploading files so prevent QNR from buffering data
             m_request.setHeader(QNetworkRequest::ContentLengthHeader, putDevice->getFormDataSize());
             m_request.setAttribute(QNetworkRequest::DoNotBufferUploadDataAttribute, QVariant(true));
-            m_reply = manager->put(m_request, putDevice);
-            putDevice->setParent(m_reply);
-            break;
+            QNetworkReply* result = manager->put(m_request, putDevice);
+            putDevice->setParent(result);
+            return result;
         }
         case QNetworkAccessManager::DeleteOperation: {
-            m_reply = manager->deleteResource(m_request);
-            break;
+            return manager->deleteResource(m_request);
         }
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
         case QNetworkAccessManager::CustomOperation:
-            m_reply = manager->sendCustomRequest(m_request, m_resourceHandle->firstRequest().httpMethod().latin1().data());
-            break;
-#endif
-        case QNetworkAccessManager::UnknownOperation: {
-            m_reply = 0;
-            ResourceHandleClient* client = m_resourceHandle->client();
-            if (client) {
-                ResourceError error(url.host(), 400 /*bad request*/,
-                                    url.toString(),
-                                    QCoreApplication::translate("QWebPage", "Bad HTTP request"));
-                client->didFail(m_resourceHandle, error);
-            }
-            return;
-        }
-    }
-
-    m_reply->setParent(this);
-
-    if (m_loadMode == LoadSynchronously && m_reply->isFinished()) {
-        // If supported, a synchronous request will be finished at this point, no need to hook up the signals.
-        return;
-    }
-
-    connect(m_reply, SIGNAL(finished()),
-            this, SLOT(finish()), SIGNAL_CONN);
-
-    // For http(s) we know that the headers are complete upon metaDataChanged() emission, so we
-    // can send the response as early as possible
-    if (scheme == QLatin1String("http") || scheme == QLatin1String("https"))
-        connect(m_reply, SIGNAL(metaDataChanged()),
-                this, SLOT(sendResponseIfNeeded()), SIGNAL_CONN);
-
-    connect(m_reply, SIGNAL(readyRead()),
-            this, SLOT(forwardData()), SIGNAL_CONN);
-
-    if (m_resourceHandle->firstRequest().reportUploadProgress()) {
-        connect(m_reply, SIGNAL(uploadProgress(qint64, qint64)),
-                this, SLOT(uploadProgress(qint64, qint64)), SIGNAL_CONN);
+            return manager->sendCustomRequest(m_request, m_resourceHandle->firstRequest().httpMethod().latin1().data());
+        case QNetworkAccessManager::UnknownOperation:
+            ASSERT_NOT_REACHED();
+            return 0;
     }
-
-    // Make this a direct function call once we require 4.6.1+.
-    connect(this, SIGNAL(processQueuedItems()),
-            this, SLOT(sendQueuedItems()), SIGNAL_CONN);
+    return 0;
 }
 
-void QNetworkReplyHandler::resetState()
+void QNetworkReplyHandler::start()
 {
-    m_redirected = false;
-    m_responseSent = false;
-    m_responseContainsData = false;
-    m_shouldStart = true;
-    m_shouldFinish = false;
-    m_shouldSendResponse = false;
-    m_shouldForwardData = false;
-}
+    ASSERT(!m_hasStarted);
+    m_hasStarted = true;
 
-void QNetworkReplyHandler::sendQueuedItems()
-{
-    if (m_loadMode != LoadResuming)
+    QNetworkReply* reply = sendNetworkRequest();
+    if (!reply)
         return;
-    m_loadMode = LoadNormal;
 
-    if (m_shouldStart)
-        start();
+    m_replyWrapper = new QNetworkReplyWrapper(reply, this);
 
-    if (m_shouldSendResponse)
-        sendResponseIfNeeded();
+    if (m_loadType == SynchronousLoad && m_replyWrapper->reply()->isFinished()) {
+        // If supported, a synchronous request will be finished at this point, no need to hook up the signals.
+        return;
+    }
 
-    if (m_shouldForwardData)
-        forwardData();
+    connect(m_replyWrapper, SIGNAL(finished()), this, SLOT(finish()));
+    connect(m_replyWrapper, SIGNAL(metaDataChanged()), this, SLOT(sendResponseIfNeeded()));
+    connect(m_replyWrapper, SIGNAL(readyRead()), this, SLOT(forwardData()));
 
-    if (m_shouldFinish)
-        finish(); 
+    if (m_resourceHandle->firstRequest().reportUploadProgress())
+        connect(m_replyWrapper->reply(), SIGNAL(uploadProgress(qint64, qint64)), this, SLOT(uploadProgress(qint64, qint64)));
 }
 
 }
diff --git a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.h b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.h
index 8c9bd08..61694d6 100644
--- a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -34,56 +34,90 @@ QT_END_NAMESPACE
 namespace WebCore {
 
 class ResourceHandle;
+class ResourceResponse;
+
+class QNetworkReplyWrapper : public QObject {
+    Q_OBJECT
+public:
+    QNetworkReplyWrapper(QNetworkReply*, QObject* parent = 0);
+    ~QNetworkReplyWrapper();
+
+    QNetworkReply* reply() const { return m_reply; }
+    QNetworkReply* release();
+
+    QUrl redirectionTargetUrl() const { return m_redirectionTargetUrl; }
+    QString encoding() const { return m_encoding; }
+    QString advertisedMimeType() const { return m_advertisedMimeType; }
+
+Q_SIGNALS:
+    void finished();
+    void metaDataChanged();
+    void readyRead();
+    void uploadProgress(qint64 bytesSent, qint64 bytesTotal);
+
+private Q_SLOTS:
+    void receiveMetaData();
+    void didReceiveFinished();
+
+private:
+    void resetConnections();
+
+    QNetworkReply* m_reply;
+    QUrl m_redirectionTargetUrl;
+
+    QString m_encoding;
+    QString m_advertisedMimeType;
+};
 
 class QNetworkReplyHandler : public QObject
 {
     Q_OBJECT
 public:
-    enum LoadMode {
-        LoadNormal,
-        LoadDeferred,
-        LoadResuming,
-        LoadSynchronously
+    enum LoadType {
+        AsynchronousLoad,
+        SynchronousLoad
     };
 
-    QNetworkReplyHandler(ResourceHandle *handle, LoadMode);
-    void setLoadMode(LoadMode);
+    QNetworkReplyHandler(ResourceHandle*, LoadType, bool deferred = false);
+    void setLoadingDeferred(bool);
 
-    QNetworkReply* reply() const { return m_reply; }
+    QNetworkReply* reply() const { return m_replyWrapper ? m_replyWrapper->reply() : 0; }
 
     void abort();
 
     QNetworkReply* release();
 
-signals:
-    void processQueuedItems();
-
 public slots:
     void finish();
     void sendResponseIfNeeded();
     void forwardData();
-    void sendQueuedItems();
     void uploadProgress(qint64 bytesSent, qint64 bytesTotal);
 
 private:
     void start();
     void resetState();
     String httpMethod() const;
+    void resumeDeferredLoad();
+    void redirect(ResourceResponse&, const QUrl&);
+    bool wasAborted() const { return !m_resourceHandle; }
+    QNetworkReply* sendNetworkRequest();
 
-    QNetworkReply* m_reply;
+    QNetworkReplyWrapper* m_replyWrapper;
     ResourceHandle* m_resourceHandle;
     bool m_redirected;
     bool m_responseSent;
     bool m_responseContainsData;
-    LoadMode m_loadMode;
+    LoadType m_loadType;
     QNetworkAccessManager::Operation m_method;
     QNetworkRequest m_request;
 
+    bool m_deferred;
+
     // defer state holding
-    bool m_shouldStart;
-    bool m_shouldFinish;
-    bool m_shouldSendResponse;
-    bool m_shouldForwardData;
+    bool m_hasStarted;
+    bool m_callFinishOnResume;
+    bool m_callSendResponseIfNeededOnResume;
+    bool m_callForwardDataOnResume;
     int m_redirectionTries;
 };
 
diff --git a/Source/WebCore/platform/network/qt/ResourceHandleQt.cpp b/Source/WebCore/platform/network/qt/ResourceHandleQt.cpp
index cd17660..a6da432 100644
--- a/Source/WebCore/platform/network/qt/ResourceHandleQt.cpp
+++ b/Source/WebCore/platform/network/qt/ResourceHandleQt.cpp
@@ -42,9 +42,6 @@
 #include "ResourceHandleInternal.h"
 #include "SharedBuffer.h"
 
-// FIXME: WebCore including these headers from WebKit is a massive layering violation.
-#include "qwebframe_p.h"
-
 #include <QAbstractNetworkCache>
 #include <QCoreApplication>
 #include <QUrl>
@@ -140,7 +137,7 @@ bool ResourceHandle::start(NetworkingContext* context)
 
     getInternal()->m_context = context;
     ResourceHandleInternal *d = getInternal();
-    d->m_job = new QNetworkReplyHandler(this, QNetworkReplyHandler::LoadMode(d->m_defersLoading));
+    d->m_job = new QNetworkReplyHandler(this, QNetworkReplyHandler::AsynchronousLoad, d->m_defersLoading);
     return true;
 }
 
@@ -207,7 +204,7 @@ void ResourceHandle::loadResourceSynchronously(NetworkingContext* context, const
         d->m_firstRequest.setURL(urlWithCredentials);
     }
     d->m_context = context;
-    d->m_job = new QNetworkReplyHandler(handle.get(), QNetworkReplyHandler::LoadSynchronously);
+    d->m_job = new QNetworkReplyHandler(handle.get(), QNetworkReplyHandler::SynchronousLoad);
 
     QNetworkReply* reply = d->m_job->reply();
     // When using synchronous calls, we are finished when reaching this point.
@@ -225,8 +222,9 @@ void ResourceHandle::loadResourceSynchronously(NetworkingContext* context, const
 
 void ResourceHandle::platformSetDefersLoading(bool defers)
 {
-    if (d->m_job)
-        d->m_job->setLoadMode(QNetworkReplyHandler::LoadMode(defers));
+    if (!d->m_job)
+        return;
+    d->m_job->setLoadingDeferred(defers);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/qt/ResourceRequestQt.cpp b/Source/WebCore/platform/network/qt/ResourceRequestQt.cpp
index 7e162ed..498c90a 100644
--- a/Source/WebCore/platform/network/qt/ResourceRequestQt.cpp
+++ b/Source/WebCore/platform/network/qt/ResourceRequestQt.cpp
@@ -83,13 +83,11 @@ QNetworkRequest ResourceRequest::toNetworkRequest(QObject* originatingFrame) con
         break;
     }
 
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     if (!allowCookies()) {
         request.setAttribute(QNetworkRequest::CookieLoadControlAttribute, QNetworkRequest::Manual);
         request.setAttribute(QNetworkRequest::CookieSaveControlAttribute, QNetworkRequest::Manual);
         request.setAttribute(QNetworkRequest::AuthenticationReuseAttribute, QNetworkRequest::Manual);
     }
-#endif
 
     return request;
 }
diff --git a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index d410fa3..e5da0e3 100644
--- a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -364,7 +364,10 @@ static void gotChunkCallback(SoupMessage* msg, SoupBuffer* chunk, gpointer data)
 
     ASSERT(!d->m_response.isNull());
 
-    client->didReceiveData(handle.get(), chunk->data, chunk->length, chunk->length);
+    // FIXME: https://bugs.webkit.org/show_bug.cgi?id=19793
+    // -1 means we do not provide any data about transfer size to inspector so it would use
+    // Content-Length headers or content size to show transfer size.
+    client->didReceiveData(handle.get(), chunk->data, chunk->length, -1);
 }
 
 static SoupSession* createSoupSession()
diff --git a/Source/WebCore/platform/network/win/ResourceHandleWin.cpp b/Source/WebCore/platform/network/win/ResourceHandleWin.cpp
index f50540c..dc5adc8 100644
--- a/Source/WebCore/platform/network/win/ResourceHandleWin.cpp
+++ b/Source/WebCore/platform/network/win/ResourceHandleWin.cpp
@@ -242,8 +242,11 @@ bool ResourceHandle::onRequestComplete()
                 resourceHandleClient->didReceiveResponse(this, response);
         }
 
+        // FIXME: https://bugs.webkit.org/show_bug.cgi?id=19793
+        // -1 means we do not provide any data about transfer size to inspector so it would use
+        // Content-Length headers or content size to show transfer size.
         if (ResourceHandleClient* resourceHandleClient = client())
-            resourceHandleClient->didReceiveData(this, buffer, buffers.dwBufferLength, 0);
+            resourceHandleClient->didReceiveData(this, buffer, buffers.dwBufferLength, -1);
         buffers.dwBufferLength = bufferSize;
     }
 
@@ -385,8 +388,11 @@ void ResourceHandle::fileLoadTimer(Timer<ResourceHandle>*)
         const int bufferSize = 8192;
         char buffer[bufferSize];
         result = ReadFile(fileHandle, &buffer, bufferSize, &bytesRead, 0);
+        // FIXME: https://bugs.webkit.org/show_bug.cgi?id=19793
+        // -1 means we do not provide any data about transfer size to inspector so it would use
+        // Content-Length headers or content size to show transfer size.
         if (result && bytesRead)
-            client()->didReceiveData(this, buffer, bytesRead, 0);
+            client()->didReceiveData(this, buffer, bytesRead, -1);
         // Check for end of file.
     } while (result && bytesRead);
 
diff --git a/Source/WebCore/platform/posix/FileSystemPOSIX.cpp b/Source/WebCore/platform/posix/FileSystemPOSIX.cpp
index c035310..9ad5f3a 100644
--- a/Source/WebCore/platform/posix/FileSystemPOSIX.cpp
+++ b/Source/WebCore/platform/posix/FileSystemPOSIX.cpp
@@ -30,6 +30,7 @@
 #include "FileSystem.h"
 
 #include "PlatformString.h"
+<<<<<<< HEAD
 #ifdef ANDROID_PLUGINS
 #include <dirent.h>
 #endif
@@ -38,6 +39,12 @@
 #ifdef ANDROID_PLUGINS
 #include <fnmatch.h>
 #endif
+=======
+#include <dirent.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <fnmatch.h>
+>>>>>>> webkit.org at r82507
 #include <libgen.h>
 #include <sys/stat.h>
 #include <sys/types.h>
@@ -235,10 +242,30 @@ String directoryName(const String& path)
     return dirname(fsRep.mutableData());
 }
 
-// OK to not implement listDirectory at the moment, because it's only used for plug-ins, and
-// all platforms that use the shared plug-in implementation have implementations. We'd need
-// to implement it if we wanted to use PluginDatabase.cpp on the Mac. Better to not implement
-// at all and get a link error in case this arises, rather than having a stub here, because
-// with a stub you learn about the problem at runtime instead of link time.
+#if !PLATFORM(EFL)
+Vector<String> listDirectory(const String& path, const String& filter)
+{
+    Vector<String> entries;
+    CString cpath = path.utf8();
+    CString cfilter = filter.utf8();
+    DIR* dir = opendir(cpath.data());
+    if (dir) {
+        struct dirent* dp;
+        while ((dp = readdir(dir))) {
+            const char* name = dp->d_name;
+            if (!strcmp(name, ".") || !strcmp(name, ".."))
+                continue;
+            if (fnmatch(cfilter.data(), name, 0))
+                continue;
+            char filePath[1024];
+            if (static_cast<int>(sizeof(filePath) - 1) < snprintf(filePath, sizeof(filePath), "%s/%s", cpath.data(), name))
+                continue; // buffer overflow
+            entries.append(filePath);
+        }
+        closedir(dir);
+    }
+    return entries;
+}
+#endif
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/qt/CookieJarQt.cpp b/Source/WebCore/platform/qt/CookieJarQt.cpp
index db4a42a..3c4cd42 100644
--- a/Source/WebCore/platform/qt/CookieJarQt.cpp
+++ b/Source/WebCore/platform/qt/CookieJarQt.cpp
@@ -91,8 +91,7 @@ String cookies(const Document* document, const KURL& url)
     foreach (QNetworkCookie networkCookie, cookies) {
         if (networkCookie.isHttpOnly())
             continue;
-        resultCookies.append(QString::fromAscii(
-                             networkCookie.toRawForm(QNetworkCookie::NameAndValueOnly).constData()));
+        resultCookies.append(QString::fromLatin1(networkCookie.toRawForm(QNetworkCookie::NameAndValueOnly).constData()));
     }
 
     return resultCookies.join(QLatin1String("; "));
@@ -110,10 +109,8 @@ String cookieRequestHeaderFieldValue(const Document* document, const KURL &url)
         return String();
 
     QStringList resultCookies;
-    foreach (QNetworkCookie networkCookie, cookies) {
-        resultCookies.append(QString::fromAscii(
-                             networkCookie.toRawForm(QNetworkCookie::NameAndValueOnly).constData()));
-    }
+    foreach (QNetworkCookie networkCookie, cookies)
+        resultCookies.append(QString::fromLatin1(networkCookie.toRawForm(QNetworkCookie::NameAndValueOnly).constData()));
 
     return resultCookies.join(QLatin1String("; "));
 }
diff --git a/Source/WebCore/platform/qt/FileSystemQt.cpp b/Source/WebCore/platform/qt/FileSystemQt.cpp
index d88a967..32644d1 100644
--- a/Source/WebCore/platform/qt/FileSystemQt.cpp
+++ b/Source/WebCore/platform/qt/FileSystemQt.cpp
@@ -114,19 +114,19 @@ Vector<String> listDirectory(const String& path, const String& filter)
     return entries;
 }
 
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
+String openTemporaryFile(const String& prefix, PlatformFileHandle& handle)
 {
 #ifndef QT_NO_TEMPORARYFILE
-    QTemporaryFile* tempFile = new QTemporaryFile(QDir::tempPath() + QLatin1Char('/') + QLatin1String(prefix));
+    QTemporaryFile* tempFile = new QTemporaryFile(QDir::tempPath() + QLatin1Char('/') + QString(prefix));
     tempFile->setAutoRemove(false);
     QFile* temp = tempFile;
     if (temp->open(QIODevice::ReadWrite)) {
         handle = temp;
-        return String(temp->fileName()).utf8();
+        return temp->fileName();
     }
 #endif
     handle = invalidPlatformFileHandle;
-    return CString();
+    return String();
 }
 
 PlatformFileHandle openFile(const String& path, FileOpenMode mode)
diff --git a/Source/WebCore/platform/qt/LanguageQt.cpp b/Source/WebCore/platform/qt/LanguageQt.cpp
index 71e554f..5a1d707 100644
--- a/Source/WebCore/platform/qt/LanguageQt.cpp
+++ b/Source/WebCore/platform/qt/LanguageQt.cpp
@@ -35,7 +35,7 @@ namespace WebCore {
 String platformDefaultLanguage()
 {
     QLocale locale;
-    return locale.name().replace("_", "-");
+    return locale.name().replace(QLatin1Char('_'), QLatin1Char('-'));
 }
 
 }
diff --git a/Source/WebCore/platform/qt/PasteboardQt.cpp b/Source/WebCore/platform/qt/PasteboardQt.cpp
index 6865fd7..850d68a 100644
--- a/Source/WebCore/platform/qt/PasteboardQt.cpp
+++ b/Source/WebCore/platform/qt/PasteboardQt.cpp
@@ -77,7 +77,7 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     QApplication::clipboard()->setMimeData(md, m_selectionMode ? QClipboard::Selection : QClipboard::Clipboard);
 #endif
     if (canSmartCopyOrDelete)
-        md->setData("application/vnd.qtwebkit.smartpaste", QByteArray());
+        md->setData(QLatin1String("application/vnd.qtwebkit.smartpaste"), QByteArray());
 }
 
 bool Pasteboard::canSmartReplace()
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.cpp b/Source/WebCore/platform/qt/RenderThemeQt.cpp
index ca8c6dd..cc654d5 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQt.cpp
@@ -1368,7 +1368,6 @@ bool RenderThemeQt::paintMediaSliderTrack(RenderObject* o, const PaintInfo& pain
 
     paintMediaBackground(p.painter, r);
 
-#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
     if (MediaPlayer* player = mediaElement->player()) {
         // Get the buffered parts of the media
         PassRefPtr<TimeRanges> buffered = player->buffered();
@@ -1386,7 +1385,6 @@ bool RenderThemeQt::paintMediaSliderTrack(RenderObject* o, const PaintInfo& pain
             }
         }
     }
-#endif
 
     return false;
 }
diff --git a/Source/WebCore/platform/text/BidiContext.cpp b/Source/WebCore/platform/text/BidiContext.cpp
index fb6b8cf..f507514 100644
--- a/Source/WebCore/platform/text/BidiContext.cpp
+++ b/Source/WebCore/platform/text/BidiContext.cpp
@@ -21,48 +21,80 @@
 
 #include "config.h"
 #include "BidiContext.h"
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
 using namespace WTF::Unicode;
 
-inline PassRefPtr<BidiContext> BidiContext::createUncached(unsigned char level, Direction direction, bool override, BidiContext* parent)
+inline PassRefPtr<BidiContext> BidiContext::createUncached(unsigned char level, Direction direction, bool override, BidiEmbeddingSource source, BidiContext* parent)
 {
-    return adoptRef(new BidiContext(level, direction, override, parent));
+    return adoptRef(new BidiContext(level, direction, override, source, parent));
 }
 
-PassRefPtr<BidiContext> BidiContext::create(unsigned char level, Direction direction, bool override, BidiContext* parent)
+PassRefPtr<BidiContext> BidiContext::create(unsigned char level, Direction direction, bool override, BidiEmbeddingSource source, BidiContext* parent)
 {
     ASSERT(direction == (level % 2 ? RightToLeft : LeftToRight));
 
     if (parent)
-        return createUncached(level, direction, override, parent);
+        return createUncached(level, direction, override, source, parent);
 
     ASSERT(level <= 1);
     if (!level) {
         if (!override) {
-            static BidiContext* ltrContext = createUncached(0, LeftToRight, false, 0).releaseRef();
+            static BidiContext* ltrContext = createUncached(0, LeftToRight, false, FromStyleOrDOM, 0).releaseRef();
             return ltrContext;
         }
 
-        static BidiContext* ltrOverrideContext = createUncached(0, LeftToRight, true, 0).releaseRef();
+        static BidiContext* ltrOverrideContext = createUncached(0, LeftToRight, true, FromStyleOrDOM, 0).releaseRef();
         return ltrOverrideContext;
     }
 
     if (!override) {
-        static BidiContext* rtlContext = createUncached(1, RightToLeft, false, 0).releaseRef();
+        static BidiContext* rtlContext = createUncached(1, RightToLeft, false, FromStyleOrDOM, 0).releaseRef();
         return rtlContext;
     }
 
-    static BidiContext* rtlOverrideContext = createUncached(1, RightToLeft, true, 0).releaseRef();
+    static BidiContext* rtlOverrideContext = createUncached(1, RightToLeft, true, FromStyleOrDOM, 0).releaseRef();
     return rtlOverrideContext;
 }
 
+static inline PassRefPtr<BidiContext> copyContextAndRebaselineLevel(BidiContext* context, BidiContext* parent)
+{
+    ASSERT(context);
+    unsigned char newLevel = parent ? parent->level() : 0;
+    if (context->dir() == RightToLeft)
+        newLevel = nextGreaterOddLevel(newLevel);
+    else if (parent)
+        newLevel = nextGreaterEvenLevel(newLevel);
+
+    return BidiContext::create(newLevel, context->dir(), context->override(), context->source(), parent);
+}
+
+// The BidiContext stack must be immutable -- they're re-used for re-layout after
+// DOM modification/editing -- so we copy all the non-unicode contexts, and
+// recalculate their levels.
+PassRefPtr<BidiContext> BidiContext::copyStackRemovingUnicodeEmbeddingContexts()
+{
+    Vector<BidiContext*, 64> contexts;
+    for (BidiContext* iter = this; iter; iter = iter->parent()) {
+        if (iter->source() != FromUnicode)
+            contexts.append(iter);
+    }
+    ASSERT(contexts.size());
+ 
+    RefPtr<BidiContext> topContext = copyContextAndRebaselineLevel(contexts.last(), 0);
+    for (int i = contexts.size() - 1; i > 0; --i)
+        topContext = copyContextAndRebaselineLevel(contexts[i - 1], topContext.get());
+
+    return topContext.release();
+}
+
 bool operator==(const BidiContext& c1, const BidiContext& c2)
 {
     if (&c1 == &c2)
         return true;
-    if (c1.level() != c2.level() || c1.override() != c2.override() || c1.dir() != c2.dir())
+    if (c1.level() != c2.level() || c1.override() != c2.override() || c1.dir() != c2.dir() || c1.source() != c2.source())
         return false;
     if (!c1.parent())
         return !c2.parent();
diff --git a/Source/WebCore/platform/text/BidiContext.h b/Source/WebCore/platform/text/BidiContext.h
index b52815f..9f45d65 100644
--- a/Source/WebCore/platform/text/BidiContext.h
+++ b/Source/WebCore/platform/text/BidiContext.h
@@ -30,33 +30,52 @@
 
 namespace WebCore {
 
+enum BidiEmbeddingSource {
+    FromStyleOrDOM,
+    FromUnicode
+};
+
 // Used to keep track of explicit embeddings.
 class BidiContext : public RefCounted<BidiContext> {
 public:
-    static PassRefPtr<BidiContext> create(unsigned char level, WTF::Unicode::Direction direction, bool override = false, BidiContext* parent = 0);
+    static PassRefPtr<BidiContext> create(unsigned char level, WTF::Unicode::Direction, bool override = false, BidiEmbeddingSource = FromStyleOrDOM, BidiContext* parent = 0);
 
     BidiContext* parent() const { return m_parent.get(); }
     unsigned char level() const { return m_level; }
     WTF::Unicode::Direction dir() const { return static_cast<WTF::Unicode::Direction>(m_direction); }
     bool override() const { return m_override; }
+    BidiEmbeddingSource source() const { return static_cast<BidiEmbeddingSource>(m_source); }
 
+    PassRefPtr<BidiContext> copyStackRemovingUnicodeEmbeddingContexts();
 private:
-    BidiContext(unsigned char level, WTF::Unicode::Direction direction, bool override, BidiContext* parent)
+    BidiContext(unsigned char level, WTF::Unicode::Direction direction, bool override, BidiEmbeddingSource source, BidiContext* parent)
         : m_level(level)
         , m_direction(direction)
         , m_override(override)
+        , m_source(source)
         , m_parent(parent)
     {
     }
 
-    static PassRefPtr<BidiContext> createUncached(unsigned char level, WTF::Unicode::Direction, bool override, BidiContext* parent);
+    static PassRefPtr<BidiContext> createUncached(unsigned char level, WTF::Unicode::Direction, bool override, BidiEmbeddingSource, BidiContext* parent);
 
     unsigned char m_level;
     unsigned m_direction : 5; // Direction
     bool m_override : 1;
+    unsigned m_source : 1; // BidiEmbeddingSource
     RefPtr<BidiContext> m_parent;
 };
 
+inline unsigned char nextGreaterOddLevel(unsigned char level)
+{
+    return (level + 1) | 1;
+}
+
+inline unsigned char nextGreaterEvenLevel(unsigned char level)
+{
+    return (level + 2) & ~1;
+}
+
 bool operator==(const BidiContext&, const BidiContext&);
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/text/BidiResolver.h b/Source/WebCore/platform/text/BidiResolver.h
index 07e9274..5b92ee2 100644
--- a/Source/WebCore/platform/text/BidiResolver.h
+++ b/Source/WebCore/platform/text/BidiResolver.h
@@ -75,6 +75,21 @@ struct BidiStatus {
     RefPtr<BidiContext> context;
 };
 
+class BidiEmbedding {
+public:
+    BidiEmbedding(WTF::Unicode::Direction direction, BidiEmbeddingSource source)
+    : m_direction(direction)
+    , m_source(source)
+    {
+    }
+
+    WTF::Unicode::Direction direction() const { return m_direction; }
+    BidiEmbeddingSource source() const { return m_source; }
+private:
+    WTF::Unicode::Direction m_direction;
+    BidiEmbeddingSource m_source;
+};
+
 inline bool operator==(const BidiStatus& status1, const BidiStatus& status2)
 {
     return status1.eor == status2.eor && status1.last == status2.last && status1.lastStrong == status2.lastStrong && *(status1.context) == *(status2.context);
@@ -134,10 +149,10 @@ enum VisualDirectionOverride {
 
 template <class Iterator, class Run> class BidiResolver {
     WTF_MAKE_NONCOPYABLE(BidiResolver);
-public :
+public:
     BidiResolver()
         : m_direction(WTF::Unicode::OtherNeutral)
-        , reachedEndOfLine(false)
+        , m_reachedEndOfLine(false)
         , emptyRun(true)
         , m_firstRun(0)
         , m_lastRun(0)
@@ -146,10 +161,10 @@ public :
     {
     }
 
-    const Iterator& position() const { return current; }
-    void setPosition(const Iterator& position) { current = position; }
+    const Iterator& position() const { return m_current; }
+    void setPosition(const Iterator& position) { m_current = position; }
 
-    void increment() { current.increment(); }
+    void increment() { m_current.increment(); }
 
     BidiContext* context() const { return m_status.context.get(); }
     void setContext(PassRefPtr<BidiContext> c) { m_status.context = c; }
@@ -166,7 +181,7 @@ public :
 
     MidpointState<Iterator>& midpointState() { return m_midpointState; }
 
-    void embed(WTF::Unicode::Direction);
+    void embed(WTF::Unicode::Direction, BidiEmbeddingSource);
     bool commitExplicitEmbedding();
 
     void createBidiRunsForLine(const Iterator& end, VisualDirectionOverride = NoVisualOverride, bool hardLineBreak = false);
@@ -188,14 +203,16 @@ protected:
     void appendRun();
     void reverseRuns(unsigned start, unsigned end);
 
-    Iterator current;
-    Iterator sor;
-    Iterator eor;
-    Iterator last;
+    Iterator m_current;
+    // sor and eor are "start of run" and "end of run" respectively and correpond
+    // to abreviations used in UBA spec: http://unicode.org/reports/tr9/#BD7
+    Iterator m_sor;
+    Iterator m_eor;
+    Iterator m_last;
     BidiStatus m_status;
     WTF::Unicode::Direction m_direction;
     Iterator endOfLine;
-    bool reachedEndOfLine;
+    bool m_reachedEndOfLine;
     Iterator lastBeforeET;
     bool emptyRun;
 
@@ -210,7 +227,10 @@ private:
     void lowerExplicitEmbeddingLevel(WTF::Unicode::Direction from);
     void checkDirectionInLowerRaiseEmbeddingLevel();
 
-    Vector<WTF::Unicode::Direction, 8> m_currentExplicitEmbeddingSequence;
+    void updateStatusLastFromCurrentDirection(WTF::Unicode::Direction);
+    void reorderRunsFromLevels();
+
+    Vector<BidiEmbedding, 8> m_currentExplicitEmbeddingSequence;
 };
 
 template <class Iterator, class Run>
@@ -286,20 +306,20 @@ inline void BidiResolver<Iterator, Run>::moveRunToBeginning(Run* run)
 template <class Iterator, class Run>
 void BidiResolver<Iterator, Run>::appendRun()
 {
-    if (!emptyRun && !eor.atEnd()) {
-        unsigned startOffset = sor.offset();
-        unsigned endOffset = eor.offset();
+    if (!emptyRun && !m_eor.atEnd()) {
+        unsigned startOffset = m_sor.offset();
+        unsigned endOffset = m_eor.offset();
 
         if (!endOfLine.atEnd() && endOffset >= endOfLine.offset()) {
-            reachedEndOfLine = true;
+            m_reachedEndOfLine = true;
             endOffset = endOfLine.offset();
         }
 
         if (endOffset >= startOffset)
             addRun(new Run(startOffset, endOffset + 1, context(), m_direction));
 
-        eor.increment();
-        sor = eor;
+        m_eor.increment();
+        m_sor = m_eor;
     }
 
     m_direction = WTF::Unicode::OtherNeutral;
@@ -307,12 +327,12 @@ void BidiResolver<Iterator, Run>::appendRun()
 }
 
 template <class Iterator, class Run>
-void BidiResolver<Iterator, Run>::embed(WTF::Unicode::Direction d)
+void BidiResolver<Iterator, Run>::embed(WTF::Unicode::Direction dir, BidiEmbeddingSource source)
 {
     using namespace WTF::Unicode;
 
-    ASSERT(d == PopDirectionalFormat || d == LeftToRightEmbedding || d == LeftToRightOverride || d == RightToLeftEmbedding || d == RightToLeftOverride);
-    m_currentExplicitEmbeddingSequence.append(d);
+    ASSERT(dir == PopDirectionalFormat || dir == LeftToRightEmbedding || dir == LeftToRightOverride || dir == RightToLeftEmbedding || dir == RightToLeftOverride);
+    m_currentExplicitEmbeddingSequence.append(BidiEmbedding(dir, source));
 }
 
 template <class Iterator, class Run>
@@ -320,7 +340,7 @@ void BidiResolver<Iterator, Run>::checkDirectionInLowerRaiseEmbeddingLevel()
 {
     using namespace WTF::Unicode;
 
-    ASSERT(m_status.eor != OtherNeutral || eor.atEnd());
+    ASSERT(m_status.eor != OtherNeutral || m_eor.atEnd());
     ASSERT(m_status.last != NonSpacingMark
         && m_status.last != BoundaryNeutral
         && m_status.last != RightToLeftEmbedding
@@ -337,7 +357,7 @@ void BidiResolver<Iterator, Run>::lowerExplicitEmbeddingLevel(WTF::Unicode::Dire
 {
     using namespace WTF::Unicode;
 
-    if (!emptyRun && eor != last) {
+    if (!emptyRun && m_eor != m_last) {
         checkDirectionInLowerRaiseEmbeddingLevel();
         // bidi.sor ... bidi.eor ... bidi.last eor; need to append the bidi.sor-bidi.eor run or extend it through bidi.last
         if (from == LeftToRight) {
@@ -358,14 +378,14 @@ void BidiResolver<Iterator, Run>::lowerExplicitEmbeddingLevel(WTF::Unicode::Dire
             appendRun();
             m_direction = RightToLeft;
         }
-        eor = last;
+        m_eor = m_last;
     }
     appendRun();
     emptyRun = true;
     // sor for the new run is determined by the higher level (rule X10)
     setLastDir(from);
     setLastStrongDir(from);
-    eor = Iterator();
+    m_eor = Iterator();
 }
 
 template <class Iterator, class Run>
@@ -373,7 +393,7 @@ void BidiResolver<Iterator, Run>::raiseExplicitEmbeddingLevel(WTF::Unicode::Dire
 {
     using namespace WTF::Unicode;
 
-    if (!emptyRun && eor != last) {
+    if (!emptyRun && m_eor != m_last) {
         checkDirectionInLowerRaiseEmbeddingLevel();
         // bidi.sor ... bidi.eor ... bidi.last eor; need to append the bidi.sor-bidi.eor run or extend it through bidi.last
         if (to == LeftToRight) {
@@ -396,13 +416,13 @@ void BidiResolver<Iterator, Run>::raiseExplicitEmbeddingLevel(WTF::Unicode::Dire
             appendRun();
             m_direction = RightToLeft;
         }
-        eor = last;
+        m_eor = m_last;
     }
     appendRun();
     emptyRun = true;
     setLastDir(to);
     setLastStrongDir(to);
-    eor = Iterator();
+    m_eor = Iterator();
 }
 
 template <class Iterator, class Run>
@@ -414,25 +434,20 @@ bool BidiResolver<Iterator, Run>::commitExplicitEmbedding()
     RefPtr<BidiContext> toContext = context();
 
     for (size_t i = 0; i < m_currentExplicitEmbeddingSequence.size(); ++i) {
-        Direction embedding = m_currentExplicitEmbeddingSequence[i];
-        if (embedding == PopDirectionalFormat) {
+        BidiEmbedding embedding = m_currentExplicitEmbeddingSequence[i];
+        if (embedding.direction() == PopDirectionalFormat) {
             if (BidiContext* parentContext = toContext->parent())
                 toContext = parentContext;
         } else {
-            Direction direction = (embedding == RightToLeftEmbedding || embedding == RightToLeftOverride) ? RightToLeft : LeftToRight;
-            bool override = embedding == LeftToRightOverride || embedding == RightToLeftOverride;
+            Direction direction = (embedding.direction() == RightToLeftEmbedding || embedding.direction() == RightToLeftOverride) ? RightToLeft : LeftToRight;
+            bool override = embedding.direction() == LeftToRightOverride || embedding.direction() == RightToLeftOverride;
             unsigned char level = toContext->level();
-            if (direction == RightToLeft) {
-                // Go to the least greater odd integer
-                level += 1;
-                level |= 1;
-            } else {
-                // Go to the least greater even integer
-                level += 2;
-                level &= ~1;
-            }
+            if (direction == RightToLeft)
+                level = nextGreaterOddLevel(level);
+            else
+                level = nextGreaterEvenLevel(level);
             if (level < 61)
-                toContext = BidiContext::create(level, direction, override, toContext.get());
+                toContext = BidiContext::create(level, direction, override, embedding.source(), toContext.get());
         }
     }
 
@@ -520,6 +535,85 @@ void BidiResolver<Iterator, Run>::reverseRuns(unsigned start, unsigned end)
 }
 
 template <class Iterator, class Run>
+inline void BidiResolver<Iterator, Run>::updateStatusLastFromCurrentDirection(WTF::Unicode::Direction dirCurrent)
+{
+    using namespace WTF::Unicode;
+    switch (dirCurrent) {
+    case EuropeanNumberTerminator:
+        if (m_status.last != EuropeanNumber)
+            m_status.last = EuropeanNumberTerminator;
+        break;
+    case EuropeanNumberSeparator:
+    case CommonNumberSeparator:
+    case SegmentSeparator:
+    case WhiteSpaceNeutral:
+    case OtherNeutral:
+        switch (m_status.last) {
+        case LeftToRight:
+        case RightToLeft:
+        case RightToLeftArabic:
+        case EuropeanNumber:
+        case ArabicNumber:
+            m_status.last = dirCurrent;
+            break;
+        default:
+            m_status.last = OtherNeutral;
+        }
+        break;
+    case NonSpacingMark:
+    case BoundaryNeutral:
+    case RightToLeftEmbedding:
+    case LeftToRightEmbedding:
+    case RightToLeftOverride:
+    case LeftToRightOverride:
+    case PopDirectionalFormat:
+        // ignore these
+        break;
+    case EuropeanNumber:
+        // fall through
+    default:
+        m_status.last = dirCurrent;
+    }
+}
+
+template <class Iterator, class Run>
+inline void BidiResolver<Iterator, Run>::reorderRunsFromLevels()
+{
+    unsigned char levelLow = 128;
+    unsigned char levelHigh = 0;
+    for (Run* run = firstRun(); run; run = run->next()) {
+        levelHigh = std::max(run->level(), levelHigh);
+        levelLow = std::min(run->level(), levelLow);
+    }
+
+    // This implements reordering of the line (L2 according to Bidi spec):
+    // http://unicode.org/reports/tr9/#L2
+    // L2. From the highest level found in the text to the lowest odd level on each line,
+    // reverse any contiguous sequence of characters that are at that level or higher.
+
+    // Reversing is only done up to the lowest odd level.
+    if (!(levelLow % 2))
+        levelLow++;
+
+    unsigned count = runCount() - 1;
+
+    while (levelHigh >= levelLow) {
+        unsigned i = 0;
+        Run* run = firstRun();
+        while (i < count) {
+            for (;i < count && run && run->level() < levelHigh; i++)
+                run = run->next();
+            unsigned start = i;
+            for (;i <= count && run && run->level() >= levelHigh; i++)
+                run = run->next();
+            unsigned end = i - 1;
+            reverseRuns(start, end);
+        }
+        levelHigh--;
+    }
+}
+
+template <class Iterator, class Run>
 void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, VisualDirectionOverride override, bool hardLineBreak)
 {
     using namespace WTF::Unicode;
@@ -528,10 +622,10 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
 
     if (override != NoVisualOverride) {
         emptyRun = false;
-        sor = current;
-        eor = Iterator();
-        while (current != end && !current.atEnd()) {
-            eor = current;
+        m_sor = m_current;
+        m_eor = Iterator();
+        while (m_current != end && !m_current.atEnd()) {
+            m_eor = m_current;
             increment();
         }
         m_direction = override == VisualLeftToRightOverride ? LeftToRight : RightToLeft;
@@ -544,29 +638,34 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
 
     emptyRun = true;
 
-    eor = Iterator();
+    m_eor = Iterator();
 
-    last = current;
+    m_last = m_current;
     bool pastEnd = false;
     BidiResolver<Iterator, Run> stateAtEnd;
 
     while (true) {
         Direction dirCurrent;
-        if (pastEnd && (hardLineBreak || current.atEnd())) {
+        if (pastEnd && (hardLineBreak || m_current.atEnd())) {
             BidiContext* c = context();
-            while (c->parent())
-                c = c->parent();
-            dirCurrent = c->dir();
             if (hardLineBreak) {
                 // A deviation from the Unicode Bidi Algorithm in order to match
-                // Mac OS X text and WinIE: a hard line break resets bidi state.
-                stateAtEnd.setContext(c);
+                // WinIE and user expectations: hard line breaks reset bidi state
+                // coming from unicode bidi control characters, but not those from
+                // DOM nodes with specified directionality
+                stateAtEnd.setContext(c->copyStackRemovingUnicodeEmbeddingContexts());
+
+                dirCurrent = stateAtEnd.context()->dir();
                 stateAtEnd.setEorDir(dirCurrent);
                 stateAtEnd.setLastDir(dirCurrent);
                 stateAtEnd.setLastStrongDir(dirCurrent);
+            } else {
+                while (c->parent())
+                    c = c->parent();
+                dirCurrent = c->dir();
             }
         } else {
-            dirCurrent = current.direction();
+            dirCurrent = m_current.direction();
             if (context()->override()
                     && dirCurrent != RightToLeftEmbedding
                     && dirCurrent != LeftToRightEmbedding
@@ -578,7 +677,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                 dirCurrent = m_status.last;
         }
 
-        ASSERT(m_status.eor != OtherNeutral || eor.atEnd());
+        ASSERT(m_status.eor != OtherNeutral || m_eor.atEnd());
         switch (dirCurrent) {
 
         // embedding and overrides (X1-X9 in the Bidi specs)
@@ -587,7 +686,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
         case RightToLeftOverride:
         case LeftToRightOverride:
         case PopDirectionalFormat:
-            embed(dirCurrent);
+            embed(dirCurrent, FromUnicode);
             commitExplicitEmbedding();
             break;
 
@@ -618,7 +717,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                             appendRun();
                             if (context()->dir() != LeftToRight) {
                                 // the neutrals take the embedding direction, which is R
-                                eor = last;
+                                m_eor = m_last;
                                 m_direction = RightToLeft;
                                 appendRun();
                             }
@@ -629,14 +728,14 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                         appendRun();
                         if (context()->dir() != LeftToRight) {
                             // the neutrals take the embedding direction, which is R
-                            eor = last;
+                            m_eor = m_last;
                             m_direction = RightToLeft;
                             appendRun();
                         }
                     } else if (m_status.lastStrong != LeftToRight) {
                         //last stuff takes embedding dir
                         if (context()->dir() == RightToLeft) {
-                            eor = last; 
+                            m_eor = m_last; 
                             m_direction = RightToLeft;
                         }
                         appendRun();
@@ -644,7 +743,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                 default:
                     break;
             }
-            eor = current;
+            m_eor = m_current;
             m_status.eor = LeftToRight;
             m_status.lastStrong = LeftToRight;
             m_direction = LeftToRight;
@@ -669,19 +768,19 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                 case OtherNeutral:
                     if (m_status.eor == EuropeanNumber) {
                         if (m_status.lastStrong == LeftToRight && context()->dir() == LeftToRight)
-                            eor = last;
+                            m_eor = m_last;
                         appendRun();
                     } else if (m_status.eor == ArabicNumber)
                         appendRun();
                     else if (m_status.lastStrong == LeftToRight) {
                         if (context()->dir() == LeftToRight)
-                            eor = last;
+                            m_eor = m_last;
                         appendRun();
                     }
                 default:
                     break;
             }
-            eor = current;
+            m_eor = m_current;
             m_status.eor = RightToLeft;
             m_status.lastStrong = dirCurrent;
             m_direction = RightToLeft;
@@ -699,7 +798,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                     case RightToLeft:
                     case RightToLeftArabic:
                     case ArabicNumber:
-                        eor = last;
+                        m_eor = m_last;
                         appendRun();
                         m_direction = EuropeanNumber;
                         break;
@@ -719,7 +818,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                                 // Terminate the EN run.
                                 appendRun();
                                 // Make an R run.
-                                eor = m_status.last == EuropeanNumberTerminator ? lastBeforeET : last;
+                                m_eor = m_status.last == EuropeanNumberTerminator ? lastBeforeET : m_last;
                                 m_direction = RightToLeft;
                                 appendRun();
                                 // Begin a new EN run.
@@ -730,7 +829,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                             appendRun();
                             if (m_status.lastStrong == RightToLeft || context()->dir() == RightToLeft) {
                                 // Make an R run.
-                                eor = m_status.last == EuropeanNumberTerminator ? lastBeforeET : last;
+                                m_eor = m_status.last == EuropeanNumberTerminator ? lastBeforeET : m_last;
                                 m_direction = RightToLeft;
                                 appendRun();
                                 // Begin a new EN run.
@@ -738,7 +837,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                             }
                         } else if (m_status.lastStrong == RightToLeft) {
                             // Extend the R run to include the neutrals.
-                            eor = m_status.last == EuropeanNumberTerminator ? lastBeforeET : last;
+                            m_eor = m_status.last == EuropeanNumberTerminator ? lastBeforeET : m_last;
                             m_direction = RightToLeft;
                             appendRun();
                             // Begin a new EN run.
@@ -747,7 +846,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                     default:
                         break;
                 }
-                eor = current;
+                m_eor = m_current;
                 m_status.eor = EuropeanNumber;
                 if (m_direction == OtherNeutral)
                     m_direction = LeftToRight;
@@ -765,7 +864,7 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                 case RightToLeft:
                 case RightToLeftArabic:
                 case EuropeanNumber:
-                    eor = last;
+                    m_eor = m_last;
                     appendRun();
                     break;
                 case CommonNumberSeparator:
@@ -787,12 +886,12 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                         m_direction = RightToLeft;
                     } else if (m_direction == OtherNeutral)
                         m_direction = m_status.lastStrong == LeftToRight ? LeftToRight : RightToLeft;
-                    eor = last;
+                    m_eor = m_last;
                     appendRun();
                 default:
                     break;
             }
-            eor = current;
+            m_eor = m_current;
             m_status.eor = ArabicNumber;
             if (m_direction == OtherNeutral)
                 m_direction = ArabicNumber;
@@ -803,16 +902,16 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
         case EuropeanNumberTerminator:
             if (m_status.last == EuropeanNumber) {
                 dirCurrent = EuropeanNumber;
-                eor = current;
+                m_eor = m_current;
                 m_status.eor = dirCurrent;
             } else if (m_status.last != EuropeanNumberTerminator)
-                lastBeforeET = emptyRun ? eor : last;
+                lastBeforeET = emptyRun ? m_eor : m_last;
             break;
 
         // boundary neutrals should be ignored
         case BoundaryNeutral:
-            if (eor == last)
-                eor = current;
+            if (m_eor == m_last)
+                m_eor = m_current;
             break;
             // neutrals
         case BlockSeparator:
@@ -829,9 +928,9 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
             break;
         }
 
-        if (pastEnd && eor == current) {
-            if (!reachedEndOfLine) {
-                eor = endOfLine;
+        if (pastEnd && m_eor == m_current) {
+            if (!m_reachedEndOfLine) {
+                m_eor = endOfLine;
                 switch (m_status.eor) {
                     case LeftToRight:
                     case RightToLeft:
@@ -846,60 +945,23 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
                 }
                 appendRun();
             }
-            current = end;
+            m_current = end;
             m_status = stateAtEnd.m_status;
-            sor = stateAtEnd.sor; 
-            eor = stateAtEnd.eor;
-            last = stateAtEnd.last;
-            reachedEndOfLine = stateAtEnd.reachedEndOfLine;
+            m_sor = stateAtEnd.m_sor; 
+            m_eor = stateAtEnd.m_eor;
+            m_last = stateAtEnd.m_last;
+            m_reachedEndOfLine = stateAtEnd.m_reachedEndOfLine;
             lastBeforeET = stateAtEnd.lastBeforeET;
             emptyRun = stateAtEnd.emptyRun;
             m_direction = OtherNeutral;
             break;
         }
 
-        // set m_status.last as needed.
-        switch (dirCurrent) {
-            case EuropeanNumberTerminator:
-                if (m_status.last != EuropeanNumber)
-                    m_status.last = EuropeanNumberTerminator;
-                break;
-            case EuropeanNumberSeparator:
-            case CommonNumberSeparator:
-            case SegmentSeparator:
-            case WhiteSpaceNeutral:
-            case OtherNeutral:
-                switch(m_status.last) {
-                    case LeftToRight:
-                    case RightToLeft:
-                    case RightToLeftArabic:
-                    case EuropeanNumber:
-                    case ArabicNumber:
-                        m_status.last = dirCurrent;
-                        break;
-                    default:
-                        m_status.last = OtherNeutral;
-                    }
-                break;
-            case NonSpacingMark:
-            case BoundaryNeutral:
-            case RightToLeftEmbedding: 
-            case LeftToRightEmbedding: 
-            case RightToLeftOverride: 
-            case LeftToRightOverride: 
-            case PopDirectionalFormat:
-                // ignore these
-                break;
-            case EuropeanNumber:
-                // fall through
-            default:
-                m_status.last = dirCurrent;
-        }
-
-        last = current;
+        updateStatusLastFromCurrentDirection(dirCurrent);
+        m_last = m_current;
 
         if (emptyRun) {
-            sor = current;
+            m_sor = m_current;
             emptyRun = false;
         }
 
@@ -907,12 +969,12 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
         if (!m_currentExplicitEmbeddingSequence.isEmpty()) {
             bool committed = commitExplicitEmbedding();
             if (committed && pastEnd) {
-                current = end;
+                m_current = end;
                 m_status = stateAtEnd.m_status;
-                sor = stateAtEnd.sor; 
-                eor = stateAtEnd.eor;
-                last = stateAtEnd.last;
-                reachedEndOfLine = stateAtEnd.reachedEndOfLine;
+                m_sor = stateAtEnd.m_sor; 
+                m_eor = stateAtEnd.m_eor;
+                m_last = stateAtEnd.m_last;
+                m_reachedEndOfLine = stateAtEnd.m_reachedEndOfLine;
                 lastBeforeET = stateAtEnd.lastBeforeET;
                 emptyRun = stateAtEnd.emptyRun;
                 m_direction = OtherNeutral;
@@ -920,64 +982,23 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, Vis
             }
         }
 
-        if (!pastEnd && (current == end || current.atEnd())) {
+        if (!pastEnd && (m_current == end || m_current.atEnd())) {
             if (emptyRun)
                 break;
             stateAtEnd.m_status = m_status;
-            stateAtEnd.sor = sor; 
-            stateAtEnd.eor = eor;
-            stateAtEnd.last = last;
-            stateAtEnd.reachedEndOfLine = reachedEndOfLine;
+            stateAtEnd.m_sor = m_sor;
+            stateAtEnd.m_eor = m_eor;
+            stateAtEnd.m_last = m_last;
+            stateAtEnd.m_reachedEndOfLine = m_reachedEndOfLine;
             stateAtEnd.lastBeforeET = lastBeforeET;
             stateAtEnd.emptyRun = emptyRun;
-            endOfLine = last;
+            endOfLine = m_last;
             pastEnd = true;
         }
     }
 
     m_logicallyLastRun = m_lastRun;
-
-    // reorder line according to run structure...
-    // first find highest and lowest levels
-    unsigned char levelLow = 128;
-    unsigned char levelHigh = 0;
-    Run* r = firstRun();
-    while (r) {
-        if (r->m_level > levelHigh)
-            levelHigh = r->m_level;
-        if (r->m_level < levelLow)
-            levelLow = r->m_level;
-        r = r->next();
-    }
-
-    // implements reordering of the line (L2 according to Bidi spec):
-    // L2. From the highest level found in the text to the lowest odd level on each line,
-    // reverse any contiguous sequence of characters that are at that level or higher.
-
-    // reversing is only done up to the lowest odd level
-    if (!(levelLow % 2))
-        levelLow++;
-
-    unsigned count = runCount() - 1;
-
-    while (levelHigh >= levelLow) {
-        unsigned i = 0;
-        Run* currRun = firstRun();
-        while (i < count) {
-            while (i < count && currRun && currRun->m_level < levelHigh) {
-                i++;
-                currRun = currRun->next();
-            }
-            unsigned start = i;
-            while (i <= count && currRun && currRun->m_level >= levelHigh) {
-                i++;
-                currRun = currRun->next();
-            }
-            unsigned end = i - 1;
-            reverseRuns(start, end);
-        }
-        levelHigh--;
-    }
+    reorderRunsFromLevels();
     endOfLine = Iterator();
 }
 
diff --git a/Source/WebCore/platform/text/LocalizedNumber.h b/Source/WebCore/platform/text/LocalizedNumber.h
index d70541f..01d2553 100644
--- a/Source/WebCore/platform/text/LocalizedNumber.h
+++ b/Source/WebCore/platform/text/LocalizedNumber.h
@@ -47,7 +47,9 @@ double parseLocalizedNumber(const String&);
 // current locale.  If an implementation doesn't support localized
 // numbers or the input value is NaN or Infinitiy, the function should
 // return an empty string.
-String formatLocalizedNumber(double);
+// fractionDigits is the maximum length of the fractional parts of the
+// resultant string.
+String formatLocalizedNumber(double, unsigned fractionDigits);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/text/LocalizedNumberICU.cpp b/Source/WebCore/platform/text/LocalizedNumberICU.cpp
index 189151e..7c4b1cb 100644
--- a/Source/WebCore/platform/text/LocalizedNumberICU.cpp
+++ b/Source/WebCore/platform/text/LocalizedNumberICU.cpp
@@ -34,6 +34,7 @@
 #include <limits>
 #include <unicode/numfmt.h>
 #include <unicode/parsepos.h>
+#include <wtf/MathExtras.h>
 #include <wtf/PassOwnPtr.h>
 
 using namespace std;
@@ -73,12 +74,13 @@ double parseLocalizedNumber(const String& numberString)
     return U_SUCCESS(status) ? numericResult : numeric_limits<double>::quiet_NaN();
 }
 
-String formatLocalizedNumber(double number)
+String formatLocalizedNumber(double number, unsigned fractionDigits)
 {
     NumberFormat* formatter = numberFormatter();
     if (!formatter)
         return String();
     UnicodeString result;
+    formatter->setMaximumFractionDigits(clampToInteger(fractionDigits));
     formatter->format(number, result);
     return String(result.getBuffer(), result.length());
 }
diff --git a/Source/WebCore/platform/text/LocalizedNumberNone.cpp b/Source/WebCore/platform/text/LocalizedNumberNone.cpp
index 729f2f1..c7a8ed2 100644
--- a/Source/WebCore/platform/text/LocalizedNumberNone.cpp
+++ b/Source/WebCore/platform/text/LocalizedNumberNone.cpp
@@ -42,7 +42,7 @@ double parseLocalizedNumber(const String&)
     return numeric_limits<double>::quiet_NaN();
 }
 
-String formatLocalizedNumber(double)
+String formatLocalizedNumber(double, unsigned)
 {
     return String();
 }
diff --git a/Source/WebCore/platform/text/TextCheckerClient.h b/Source/WebCore/platform/text/TextCheckerClient.h
index acaa02c..8abbed4 100644
--- a/Source/WebCore/platform/text/TextCheckerClient.h
+++ b/Source/WebCore/platform/text/TextCheckerClient.h
@@ -28,6 +28,8 @@
 #ifndef TextCheckerClient_h
 #define TextCheckerClient_h
 
+#include "TextChecking.h"
+
 #include <wtf/Forward.h>
 #include <wtf/Vector.h>
 #include <wtf/text/WTFString.h>
@@ -70,7 +72,7 @@ public:
     virtual void checkSpellingOfString(const UChar*, int length, int* misspellingLocation, int* misspellingLength) = 0;
     virtual String getAutoCorrectSuggestionForMisspelledWord(const String& misspelledWord) = 0;
     virtual void checkGrammarOfString(const UChar*, int length, Vector<GrammarDetail>&, int* badGrammarLocation, int* badGrammarLength) = 0;
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if USE(UNIFIED_TEXT_CHECKING)
     virtual void checkTextOfParagraph(const UChar* text, int length, uint64_t checkingTypes, Vector<TextCheckingResult>& results) = 0;
 #endif
 
diff --git a/Source/WebCore/platform/text/TextChecking.h b/Source/WebCore/platform/text/TextChecking.h
new file mode 100644
index 0000000..022fb82
--- /dev/null
+++ b/Source/WebCore/platform/text/TextChecking.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (c) 2011 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TextChecking_h
+#define TextChecking_h
+
+namespace WebCore {
+
+#if !defined(BUILDING_ON_TIGER)
+#define WTF_USE_GRAMMAR_CHECKING 1
+#endif
+
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#define WTF_USE_UNIFIED_TEXT_CHECKING 1
+#define WTF_USE_AUTOMATIC_TEXT_REPLACEMENT 1
+#endif
+
+}
+
+#endif // TextChecking_h
diff --git a/Source/WebCore/platform/text/TextCodec.h b/Source/WebCore/platform/text/TextCodec.h
index 35229a3..0c2a38a 100644
--- a/Source/WebCore/platform/text/TextCodec.h
+++ b/Source/WebCore/platform/text/TextCodec.h
@@ -52,7 +52,7 @@ namespace WebCore {
         // Encodes the character as en entity as above, but escaped
         // non-alphanumeric characters. This is used in URLs.
         // For example, U+6DE would be "%26%231758%3B".
-        URLEncodedEntitiesForUnencodables,
+        URLEncodedEntitiesForUnencodables
     };
 
     typedef char UnencodableReplacementArray[32];
diff --git a/Source/WebCore/platform/text/TextCodecICU.cpp b/Source/WebCore/platform/text/TextCodecICU.cpp
index d07b50e..0d99196 100644
--- a/Source/WebCore/platform/text/TextCodecICU.cpp
+++ b/Source/WebCore/platform/text/TextCodecICU.cpp
@@ -149,13 +149,6 @@ void TextCodecICU::registerEncodingNames(EncodingNameRegistrar registrar)
     registrar("x-windows-949", "windows-949");
     registrar("x-uhc", "windows-949");
     registrar("shift-jis", "Shift_JIS");
-#if !USE(BUILTIN_UTF8_CODEC)
-    registrar("unicode11utf8", "UTF-8");
-    registrar("unicode20utf8", "UTF-8");
-    registrar("x-unicode20utf8", "UTF-8");
-    registrar("utf8", "UTF-8");
-    registrar("UTF-8", "UTF-8");
-#endif
 
     // These aliases are present in modern versions of ICU, but use different codecs, and have no standard names.
     // They are not present in ICU 3.2.
diff --git a/Source/WebCore/platform/text/TextEncodingRegistry.cpp b/Source/WebCore/platform/text/TextEncodingRegistry.cpp
index f604227..d6450b1 100644
--- a/Source/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/Source/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -223,10 +223,8 @@ static void buildBaseTextCodecMaps()
     TextCodecLatin1::registerEncodingNames(addToTextEncodingNameMap);
     TextCodecLatin1::registerCodecs(addToTextCodecMap);
 
-#if USE(BUILTIN_UTF8_CODEC)
     TextCodecUTF8::registerEncodingNames(addToTextEncodingNameMap);
     TextCodecUTF8::registerCodecs(addToTextCodecMap);
-#endif
 
     TextCodecUTF16::registerEncodingNames(addToTextEncodingNameMap);
     TextCodecUTF16::registerCodecs(addToTextCodecMap);
diff --git a/Source/WebCore/platform/mac/WebCoreKeyGenerator.m b/Source/WebCore/platform/text/TextOrientation.h
index a1e780c..e229f1e 100644
--- a/Source/WebCore/platform/mac/WebCoreKeyGenerator.m
+++ b/Source/WebCore/platform/text/TextOrientation.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,41 +23,13 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#import "config.h"
-#import "WebCoreKeyGenerator.h"
+#ifndef TextOrientation_h
+#define TextOrientation_h
 
-#import <wtf/Assertions.h>
-#import <wtf/UnusedParam.h>
+namespace WebCore {
 
-static WebCoreKeyGenerator *sharedGenerator;
+enum TextOrientation { TextOrientationVerticalRight, TextOrientationUpright };
 
-@implementation WebCoreKeyGenerator
-
-+ (WebCoreKeyGenerator *)sharedGenerator
-{
-    return sharedGenerator;
-}
-
-- init
-{
-    ASSERT(!sharedGenerator);
-    [super init];
-    sharedGenerator = [self retain];
-    return self;
-}
-
-- (NSArray *)strengthMenuItemTitles
-{
-    return nil;
-}
-
-- (NSString *)signedPublicKeyAndChallengeStringWithStrengthIndex:(unsigned)unusedIndex challenge:(NSString *)unusedChallenge pageURL:(NSURL *)unusedPageURL
-{
-    UNUSED_PARAM(unusedIndex);
-    UNUSED_PARAM(unusedChallenge);
-    UNUSED_PARAM(unusedPageURL);
-
-    return nil;
 }
 
-@end
+#endif
diff --git a/Source/WebCore/platform/text/mac/LocalizedNumberMac.mm b/Source/WebCore/platform/text/mac/LocalizedNumberMac.mm
index 8cfe200..826f707 100644
--- a/Source/WebCore/platform/text/mac/LocalizedNumberMac.mm
+++ b/Source/WebCore/platform/text/mac/LocalizedNumberMac.mm
@@ -65,10 +65,12 @@ double parseLocalizedNumber(const String& numberString)
     return [number doubleValue];
 }
 
-String formatLocalizedNumber(double inputNumber)
+String formatLocalizedNumber(double inputNumber, unsigned fractionDigits)
 {
     RetainPtr<NSNumber> number(AdoptNS, [[NSNumber alloc] initWithDouble:inputNumber]);
-    return String([numberFormatter() stringFromNumber:number.get()]);
+    RetainPtr<NSNumberFormatter> formatter = numberFormatter();
+    [formatter.get() setMaximumFractionDigits:fractionDigits];
+    return String([formatter.get() stringFromNumber:number.get()]);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/text/qt/TextBreakIteratorQt.cpp b/Source/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
index 3fae657..1fe400c 100644
--- a/Source/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
+++ b/Source/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
@@ -22,6 +22,7 @@
 #include "TextBreakIterator.h"
 
 #include <QtCore/qtextboundaryfinder.h>
+#include <algorithm>
 #include <qdebug.h>
 
 // #define DEBUG_TEXT_ITERATORS
@@ -89,7 +90,7 @@ const char* currentTextBreakLocaleID()
         TextBreakIterator* lineBreakIterator = 0;
         if (staticLineBreakIterator) {
             setUpIterator(*staticLineBreakIterator, QTextBoundaryFinder::Line, string, length);
-            swap(staticLineBreakIterator, lineBreakIterator);
+            std::swap(staticLineBreakIterator, lineBreakIterator);
         }
 
         if (!lineBreakIterator && string && length)
diff --git a/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp b/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
index 513992d..33d8ccd 100644
--- a/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
+++ b/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
@@ -130,7 +130,7 @@ static bool getWebLocData(const DragDataMap* dataObject, String& url, String* ti
     if (!dataObject->contains(cfHDropFormat()->cfFormat))
         return false;
 
-    wcscpy(filename, dataObject->get(cfHDropFormat()->cfFormat)[0].characters());
+    wcscpy(filename, dataObject->get(cfHDropFormat()->cfFormat)[0].charactersWithNullTermination());
     if (_wcsicmp(PathFindExtensionW(filename), L".url"))
         return false;    
 
diff --git a/Source/WebCore/platform/win/CursorWin.cpp b/Source/WebCore/platform/win/CursorWin.cpp
index 0036388..3a8cc09 100644
--- a/Source/WebCore/platform/win/CursorWin.cpp
+++ b/Source/WebCore/platform/win/CursorWin.cpp
@@ -30,6 +30,7 @@
 #include "BitmapInfo.h"
 #include "Image.h"
 #include "IntPoint.h"
+#include "SystemInfo.h"
 
 #include <wtf/OwnPtr.h>
 
@@ -39,20 +40,12 @@
 
 namespace WebCore {
 
-static inline bool supportsAlphaCursors() 
-{
-    OSVERSIONINFO osinfo = {0};
-    osinfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
-    GetVersionEx(&osinfo);
-    return osinfo.dwMajorVersion > 5 || (osinfo.dwMajorVersion == 5 && osinfo.dwMinorVersion > 0);
-}
-
 static PassRefPtr<SharedCursor> createSharedCursor(Image* img, const IntPoint& hotSpot)
 {
     RefPtr<SharedCursor> impl;
 
     IntPoint effectiveHotSpot = determineHotSpot(img, hotSpot);
-    static bool doAlpha = supportsAlphaCursors();
+    static bool doAlpha = windowsVersion() >= WindowsXP;
     BitmapInfo cursorImage = BitmapInfo::create(IntSize(img->width(), img->height()));
 
     HDC dc = GetDC(0);
diff --git a/Source/WebCore/platform/win/FileSystemWin.cpp b/Source/WebCore/platform/win/FileSystemWin.cpp
index 5ee3b8e..03a2eaf 100644
--- a/Source/WebCore/platform/win/FileSystemWin.cpp
+++ b/Source/WebCore/platform/win/FileSystemWin.cpp
@@ -31,9 +31,11 @@
 #include "FileSystem.h"
 
 #include "NotImplemented.h"
+#include "PathWalker.h"
 #include "PlatformString.h"
 #include <wtf/HashMap.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 #include <windows.h>
 #include <winbase.h>
@@ -184,18 +186,18 @@ static String cachedStorageDirectory(DWORD pathIdentifier)
     return directory;
 }
 
-CString openTemporaryFile(const char*, PlatformFileHandle& handle)
+String openTemporaryFile(const String&, PlatformFileHandle& handle)
 {
     handle = INVALID_HANDLE_VALUE;
 
     char tempPath[MAX_PATH];
     int tempPathLength = ::GetTempPathA(WTF_ARRAY_LENGTH(tempPath), tempPath);
     if (tempPathLength <= 0 || tempPathLength > WTF_ARRAY_LENGTH(tempPath))
-        return CString();
+        return String();
 
     HCRYPTPROV hCryptProv = 0;
     if (!CryptAcquireContext(&hCryptProv, 0, 0, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
-        return CString();
+        return String();
 
     char proposedPath[MAX_PATH];
     while (1) {
@@ -226,9 +228,28 @@ CString openTemporaryFile(const char*, PlatformFileHandle& handle)
     CryptReleaseContext(hCryptProv, 0);
 
     if (!isHandleValid(handle))
-        return CString();
+        return String();
 
-    return proposedPath;
+    return String::fromUTF8(proposedPath);
+}
+
+PlatformFileHandle openFile(const String& path, FileOpenMode mode)
+{
+    DWORD desiredAccess = 0;
+    DWORD creationDisposition = 0;
+    switch (mode) {
+    case OpenForRead:
+        desiredAccess = GENERIC_READ;
+        creationDisposition = OPEN_EXISTING;
+    case OpenForWrite:
+        desiredAccess = GENERIC_WRITE;
+        creationDisposition = CREATE_ALWAYS;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    String destination = path;
+    return CreateFile(destination.charactersWithNullTermination(), desiredAccess, 0, 0, creationDisposition, FILE_ATTRIBUTE_NORMAL, 0);
 }
 
 void closeFile(PlatformFileHandle& handle)
@@ -297,10 +318,21 @@ bool safeCreateFile(const String& path, CFDataRef data)
     return true;
 }
 
-Vector<String> listDirectory(const String& path, const String& filter)
+Vector<String> listDirectory(const String& directory, const String& filter)
 {
     Vector<String> entries;
-    notImplemented();
+
+    PathWalker walker(directory, filter);
+    if (!walker.isValid())
+        return entries;
+
+    do {
+        if (walker.data().dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)
+            continue;
+
+        entries.append(makeString(directory, "\\", reinterpret_cast<const UChar*>(walker.data().cFileName)));
+    } while (walker.step());
+
     return entries;
 }
 
diff --git a/Source/WebCore/platform/win/LocalizedStringsWin.cpp b/Source/WebCore/platform/win/LocalizedStringsWin.cpp
new file mode 100644
index 0000000..67de0fc
--- /dev/null
+++ b/Source/WebCore/platform/win/LocalizedStringsWin.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LocalizedStrings.h"
+
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+String localizedString(const char* key)
+{
+    // FIXME: <rdar://problem/9119405> Win: WebKit2 needs to be made localizable
+    return String::fromUTF8(key, strlen(key));
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/win/PathWalker.cpp b/Source/WebCore/platform/win/PathWalker.cpp
new file mode 100644
index 0000000..cb4fccb
--- /dev/null
+++ b/Source/WebCore/platform/win/PathWalker.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PathWalker.h"
+
+#include <wtf/text/StringConcatenate.h>
+
+namespace WebCore {
+
+PathWalker::PathWalker(const String& directory, const String& pattern)
+{
+    String path = makeString(directory, "\\", pattern);
+    m_handle = ::FindFirstFileW(path.charactersWithNullTermination(), &m_data);
+}
+
+PathWalker::~PathWalker()
+{
+    if (!isValid())
+        return;
+    ::FindClose(m_handle);
+}
+
+bool PathWalker::step()
+{
+    return ::FindNextFileW(m_handle, &m_data);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/win/PathWalker.h b/Source/WebCore/platform/win/PathWalker.h
new file mode 100644
index 0000000..219c837
--- /dev/null
+++ b/Source/WebCore/platform/win/PathWalker.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <Windows.h>
+#include <wtf/Noncopyable.h>
+
+namespace WTF {
+    class String;
+}
+
+namespace WebCore {
+
+class PathWalker {
+    WTF_MAKE_NONCOPYABLE(PathWalker);
+public:
+    PathWalker(const WTF::String& directory, const WTF::String& pattern);
+    ~PathWalker();
+
+    bool isValid() const { return m_handle != INVALID_HANDLE_VALUE; }
+    const WIN32_FIND_DATAW& data() const { return m_data; }
+
+    bool step();
+
+private:
+    HANDLE m_handle;
+    WIN32_FIND_DATAW m_data;
+};
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/win/SSLKeyGeneratorWin.cpp b/Source/WebCore/platform/win/SSLKeyGeneratorWin.cpp
index 50aee8e..b10961b 100644
--- a/Source/WebCore/platform/win/SSLKeyGeneratorWin.cpp
+++ b/Source/WebCore/platform/win/SSLKeyGeneratorWin.cpp
@@ -30,6 +30,7 @@ namespace WebCore {
 
 void WebCore::getSupportedKeySizes(Vector<String>& v)
 {
+    // FIXME: Strings should be localizable.
     v.append("High Grade");
     v.append("Medium Grade");
 }
diff --git a/Source/WebCore/platform/win/ScrollbarThemeWin.cpp b/Source/WebCore/platform/win/ScrollbarThemeWin.cpp
index ff3aaa4..576cd92 100644
--- a/Source/WebCore/platform/win/ScrollbarThemeWin.cpp
+++ b/Source/WebCore/platform/win/ScrollbarThemeWin.cpp
@@ -100,7 +100,7 @@ ScrollbarThemeWin::ScrollbarThemeWin()
     if (!initialized) {
         initialized = true;
         checkAndInitScrollbarTheme();
-        runningVista = isRunningOnVistaOrLater();
+        runningVista = (windowsVersion() >= WindowsVista);
     }
 }
 
diff --git a/Source/WebCore/platform/win/SystemInfo.cpp b/Source/WebCore/platform/win/SystemInfo.cpp
index f2fe62b..878a6cc 100644
--- a/Source/WebCore/platform/win/SystemInfo.cpp
+++ b/Source/WebCore/platform/win/SystemInfo.cpp
@@ -27,30 +27,155 @@
 #include "SystemInfo.h"
 
 #include <windows.h>
+#include <wtf/text/StringConcatenate.h>
 
 namespace WebCore {
 
-bool isRunningOnVistaOrLater()
+WindowsVersion windowsVersion(int* major, int* minor)
 {
+    static bool initialized = false;
+    static WindowsVersion version;
+    static int majorVersion, minorVersion;
+
+    if (!initialized) {
+        initialized = true;
+#if OS(WINCE)
+        OSVERSIONINFO versionInfo;
+#else
+        OSVERSIONINFOEX versionInfo;
+#endif
+        ZeroMemory(&versionInfo, sizeof(versionInfo));
+        versionInfo.dwOSVersionInfoSize = sizeof(versionInfo);
+        GetVersionEx(reinterpret_cast<OSVERSIONINFO*>(&versionInfo));
+        majorVersion = versionInfo.dwMajorVersion;
+        minorVersion = versionInfo.dwMinorVersion;
+
 #if OS(WINCE)
-    return false;
+        if (majorVersion >= 1 && majorVersion <= 7)
+            version = static_cast<WindowsVersion>(WindowsCE1 + (majorVersion - 1));
+        else
+            version = (majorVersion < 1) ? WindowsCE1 : WindowsCE7;
 #else
-    static bool isVistaOrLater;
-    static bool initialized;
+        if (versionInfo.dwPlatformId == VER_PLATFORM_WIN32s)
+            version = Windows3_1;
+        else if (versionInfo.dwPlatformId == VER_PLATFORM_WIN32_WINDOWS) {
+            if (!minorVersion)
+                version = Windows95;
+            else
+                version = (minorVersion == 10) ? Windows98 : WindowsME;
+        } else {
+            if (majorVersion == 5) {
+                if (!minorVersion)
+                    version = Windows2000;
+                else
+                    version = (minorVersion == 1) ? WindowsXP : WindowsServer2003;
+            } else if (majorVersion >= 6) {
+                if (versionInfo.wProductType == VER_NT_WORKSTATION)
+                    version = (majorVersion == 6 && !minorVersion) ? WindowsVista : Windows7;
+                else
+                    version = WindowsServer2008;
+            } else
+                version = (majorVersion == 4) ? WindowsNT4 : WindowsNT3;
+        }
+#endif
+    }
 
-    if (initialized)
-        return isVistaOrLater;
+    if (major)
+        *major = majorVersion;
+    if (minor)
+        *minor = minorVersion;
+    return version;
+}
+
+static String osVersionForUAString()
+{
+    int major, minor;
+    WindowsVersion version = windowsVersion(&major, &minor);
+    switch (version) {
+    case WindowsCE1:
+    case WindowsCE2:
+    case WindowsCE3:
+        return "Windows CE";
+    case WindowsCE4:
+        return "Windows CE .NET";
+    case Windows3_1:
+        return "Windows 3.1";
+    case Windows95:
+        return "Windows 95";
+    case Windows98:
+        return "Windows 98";
+    case WindowsME:
+        return "Windows 98; Win 9x 4.90";
+    case WindowsNT4:
+        return "WinNT4.0";
+    }
 
-    initialized = true;
+    const char* familyName = (version >= WindowsNT3) ? "Windows NT " : "Windows CE ";
+    return makeString(familyName, String::number(major), '.', String::number(minor));
+}
 
-    OSVERSIONINFOEX vi = {0};
-    vi.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);
-    GetVersionEx(reinterpret_cast<OSVERSIONINFO*>(&vi));
+#if !OS(WINCE)
+static bool isWOW64()
+{
+    static bool initialized = false;
+    static bool wow64 = false;
 
-    isVistaOrLater = vi.dwMajorVersion >= 6;
+    if (!initialized) {
+        initialized = true;
+        HMODULE kernel32Module = GetModuleHandleA("kernel32.dll");
+        if (!kernel32Module)
+            return wow64;
+        typedef BOOL (WINAPI* IsWow64ProcessFunc)(HANDLE, PBOOL);
+        IsWow64ProcessFunc isWOW64Process = reinterpret_cast<IsWow64ProcessFunc>(GetProcAddress(kernel32Module, "IsWow64Process"));
+        if (isWOW64Process) {
+            BOOL result = FALSE;
+            wow64 = isWOW64Process(GetCurrentProcess(), &result) && result;
+        }
+    }
 
-    return isVistaOrLater;
+    return wow64;
+}
+
+static WORD processorArchitecture()
+{
+    static bool initialized = false;
+    static WORD architecture = PROCESSOR_ARCHITECTURE_INTEL;
+
+    if (!initialized) {
+        initialized = true;
+        HMODULE kernel32Module = GetModuleHandleA("kernel32.dll");
+        if (!kernel32Module)
+            return architecture;
+        typedef VOID (WINAPI* GetNativeSystemInfoFunc)(LPSYSTEM_INFO);
+        GetNativeSystemInfoFunc getNativeSystemInfo = reinterpret_cast<GetNativeSystemInfoFunc>(GetProcAddress(kernel32Module, "GetNativeSystemInfo"));
+        if (getNativeSystemInfo) {
+            SYSTEM_INFO systemInfo;
+            ZeroMemory(&systemInfo, sizeof(systemInfo));
+            getNativeSystemInfo(&systemInfo);
+            architecture = systemInfo.wProcessorArchitecture;
+        }
+    }
+
+    return architecture;
+}
 #endif
+
+static String architectureTokenForUAString()
+{
+#if !OS(WINCE)
+    if (isWOW64())
+        return "; WOW64";
+    if (processorArchitecture() == PROCESSOR_ARCHITECTURE_AMD64)
+        return "; Win64; x64";
+    if (processorArchitecture() == PROCESSOR_ARCHITECTURE_IA64)
+        return "; Win64; IA64";
+#endif
+    return String();
+}
+
+String windowsVersionForUAString()
+{
+    return makeString(osVersionForUAString(), architectureTokenForUAString());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/win/SystemInfo.h b/Source/WebCore/platform/win/SystemInfo.h
index 9f2c2a0..2631ace 100644
--- a/Source/WebCore/platform/win/SystemInfo.h
+++ b/Source/WebCore/platform/win/SystemInfo.h
@@ -26,9 +26,44 @@
 #ifndef SystemInfo_h
 #define SystemInfo_h
 
+#include <wtf/text/WTFString.h>
+
 namespace WebCore {
 
-bool isRunningOnVistaOrLater();
+// NOTE: Keep these in order so callers can do things like
+// "if (windowsVersion() >= WindowsVista) ...". It's OK to change or add values,
+// though.
+enum WindowsVersion {
+    // CE-based versions
+    WindowsCE1 = 0,
+    WindowsCE2,
+    WindowsCE3,
+    WindowsCE4,
+    WindowsCE5,
+    WindowsCE6,
+    WindowsCE7,
+    // 3.x-based versions
+    Windows3_1,
+    // 9x-based versions
+    Windows95,
+    Windows98,
+    WindowsME,
+    // NT-based versions
+    WindowsNT3,
+    WindowsNT4,
+    Windows2000,
+    WindowsXP,
+    WindowsServer2003,
+    WindowsVista,
+    WindowsServer2008,
+    Windows7,
+};
+
+// If supplied, |major| and |minor| are set to the OSVERSIONINFO::dwMajorVersion
+// and dwMinorVersion field values, respectively.
+WindowsVersion windowsVersion(int* major = 0, int* minor = 0);
+
+String windowsVersionForUAString();
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/wince/FileSystemWinCE.cpp b/Source/WebCore/platform/wince/FileSystemWinCE.cpp
index 49acf12..3e28a01 100644
--- a/Source/WebCore/platform/wince/FileSystemWinCE.cpp
+++ b/Source/WebCore/platform/wince/FileSystemWinCE.cpp
@@ -187,18 +187,18 @@ String directoryName(const String& path)
     return path.left(pos);
 }
 
-CString openTemporaryFile(const char*, PlatformFileHandle& handle)
+String openTemporaryFile(const String&, PlatformFileHandle& handle)
 {
     handle = INVALID_HANDLE_VALUE;
 
     wchar_t tempPath[MAX_PATH];
     int tempPathLength = ::GetTempPath(WTF_ARRAY_LENGTH(tempPath), tempPath);
     if (tempPathLength <= 0 || tempPathLength > WTF_ARRAY_LENGTH(tempPath))
-        return CString();
+        return String();
 
     HCRYPTPROV hCryptProv = 0;
     if (!CryptAcquireContext(&hCryptProv, 0, 0, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
-        return CString();
+        return String();
 
     String proposedPath;
     while (1) {
@@ -229,9 +229,28 @@ CString openTemporaryFile(const char*, PlatformFileHandle& handle)
     CryptReleaseContext(hCryptProv, 0);
 
     if (!isHandleValid(handle))
-        return CString();
+        return String();
+
+    return proposedPath;
+}
+
+PlatformFileHandle openFile(const String& path, FileOpenMode mode)
+{
+    DWORD desiredAccess = 0;
+    DWORD creationDisposition = 0;
+    switch (mode) {
+        case OpenForRead:
+            desiredAccess = GENERIC_READ;
+            creationDisposition = OPEN_EXISTING;
+        case OpenForWrite:
+            desiredAccess = GENERIC_WRITE;
+            creationDisposition = CREATE_ALWAYS;
+        default:
+            ASSERT_NOT_REACHED();
+    }
 
-    return proposedPath.latin1();
+    String destination = path;
+    return CreateFile(destination.charactersWithNullTermination(), desiredAccess, 0, 0, creationDisposition, FILE_ATTRIBUTE_NORMAL, 0);
 }
 
 void closeFile(PlatformFileHandle& handle)
diff --git a/Source/WebCore/platform/wx/FileSystemWx.cpp b/Source/WebCore/platform/wx/FileSystemWx.cpp
index bfcaf88..3c2b453 100644
--- a/Source/WebCore/platform/wx/FileSystemWx.cpp
+++ b/Source/WebCore/platform/wx/FileSystemWx.cpp
@@ -107,11 +107,11 @@ String directoryName(const String& path)
     return wxFileName(path).GetPath();
 }
 
-CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
+String openTemporaryFile(const String&, PlatformFileHandle& handle)
 {
     notImplemented();
     handle = invalidPlatformFileHandle;
-    return CString();
+    return String();
 }
 
 void closeFile(PlatformFileHandle&)
diff --git a/Source/WebCore/platform/wx/LocalizedStringsWx.cpp b/Source/WebCore/platform/wx/LocalizedStringsWx.cpp
index 835c3cd..8ec791e 100644
--- a/Source/WebCore/platform/wx/LocalizedStringsWx.cpp
+++ b/Source/WebCore/platform/wx/LocalizedStringsWx.cpp
@@ -212,7 +212,7 @@ String contextMenuItemTagSearchWeb()
     return String("Search Web");
 }
 
-String contextMenuItemTagLookUpInDictionary() 
+String contextMenuItemTagLookUpInDictionary(const String&)
 {
     return String("Look Up in Dictionary");
 }
diff --git a/Source/WebCore/plugins/PluginPackage.cpp b/Source/WebCore/plugins/PluginPackage.cpp
index 10149bf..285f5c5 100644
--- a/Source/WebCore/plugins/PluginPackage.cpp
+++ b/Source/WebCore/plugins/PluginPackage.cpp
@@ -348,7 +348,7 @@ unsigned PluginPackage::hash() const
         m_lastModified
     };
 
-    return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+    return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
 }
 
 bool PluginPackage::equal(const PluginPackage& a, const PluginPackage& b)
diff --git a/Source/WebCore/plugins/PluginStream.cpp b/Source/WebCore/plugins/PluginStream.cpp
index f9021a8..48379f0 100644
--- a/Source/WebCore/plugins/PluginStream.cpp
+++ b/Source/WebCore/plugins/PluginStream.cpp
@@ -34,7 +34,7 @@
 #include "ResourceLoadScheduler.h"
 #include "SharedBuffer.h"
 #include "SubresourceLoader.h"
-#include <StringExtras.h>
+#include <wtf/StringExtras.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/StringConcatenate.h>
 
@@ -257,7 +257,7 @@ void PluginStream::destroyStream()
 
             if (m_loader)
                 m_loader->setDefersLoading(true);
-            m_pluginFuncs->asfile(m_instance, &m_stream, m_path.data());
+            m_pluginFuncs->asfile(m_instance, &m_stream, m_path.utf8().data());
             if (m_loader)
                 m_loader->setDefersLoading(false);
         }
@@ -306,10 +306,8 @@ void PluginStream::destroyStream()
     if (!m_loadManually && m_client)
         m_client->streamDidFinishLoading(this);
 
-    if (!m_path.isNull()) {
-        String tempFilePath = String::fromUTF8(m_path.data());
-        deleteFile(tempFilePath);
-    }
+    if (!m_path.isNull())
+        deleteFile(m_path);
 }
 
 void PluginStream::delayDeliveryTimerFired(Timer<PluginStream>* timer)
diff --git a/Source/WebCore/plugins/PluginStream.h b/Source/WebCore/plugins/PluginStream.h
index ae69539..fe4d038 100644
--- a/Source/WebCore/plugins/PluginStream.h
+++ b/Source/WebCore/plugins/PluginStream.h
@@ -113,8 +113,8 @@ namespace WebCore {
         NPP m_instance;
         uint16_t m_transferMode;
         int32_t m_offset;
-        WTF::CString m_headers;
-        WTF::CString m_path;
+        CString m_headers;
+        String m_path;
         NPReason m_reason;
         NPStream m_stream;
         PluginQuirkSet m_quirks;
diff --git a/Source/WebCore/plugins/PluginViewNone.cpp b/Source/WebCore/plugins/PluginViewNone.cpp
index 383ac49..3bdec6f 100644
--- a/Source/WebCore/plugins/PluginViewNone.cpp
+++ b/Source/WebCore/plugins/PluginViewNone.cpp
@@ -28,6 +28,7 @@
 
 #if USE(JSC)
 #include "BridgeJSC.h"
+#include <runtime/JSObject.h>
 #include <runtime/ScopeChain.h>
 #endif
 
diff --git a/Source/WebCore/plugins/gtk/PluginViewGtk.cpp b/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
index 75a51c5..58a4f2c 100644
--- a/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
+++ b/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -48,6 +48,7 @@
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
 #include "Page.h"
+#include "PlatformContextCairo.h"
 #include "PlatformKeyboardEvent.h"
 #include "PlatformMouseEvent.h"
 #include "PluginDebug.h"
@@ -217,7 +218,7 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
             // avoid drawing artifacts.
 
             // This Would not work without double buffering, but we always use it.
-            cairo_set_source_surface(cr.get(), cairo_get_group_target(context->platformContext()),
+            cairo_set_source_surface(cr.get(), cairo_get_group_target(context->platformContext()->cr()),
                                      -m_windowRect.x(), -m_windowRect.y());
             cairo_set_operator(cr.get(), CAIRO_OPERATOR_SOURCE);
         } else
@@ -244,7 +245,7 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     if (syncX)
         XSync(m_pluginDisplay, false); // sync changes by plugin
 
-    cairo_t* cr = context->platformContext();
+    cairo_t* cr = context->platformContext()->cr();
     cairo_save(cr);
 
     cairo_set_source_surface(cr, drawableSurface.get(), frameRect().x(), frameRect().y());
diff --git a/Source/WebCore/plugins/qt/PluginPackageQt.cpp b/Source/WebCore/plugins/qt/PluginPackageQt.cpp
index ce07faf..19941d6 100644
--- a/Source/WebCore/plugins/qt/PluginPackageQt.cpp
+++ b/Source/WebCore/plugins/qt/PluginPackageQt.cpp
@@ -121,7 +121,7 @@ static void initializeGtk(QLibrary* module = 0)
         }
     }
 
-    QLibrary library("libgtk-x11-2.0.so.0");
+    QLibrary library(QLatin1String("libgtk-x11-2.0.so.0"));
     if (library.load()) {
         typedef void *(*gtk_init_check_ptr)(int*, char***);
         gtk_init_check_ptr gtkInitCheck = (gtk_init_check_ptr)library.resolve("gtk_init_check");
diff --git a/Source/WebCore/plugins/qt/PluginViewQt.cpp b/Source/WebCore/plugins/qt/PluginViewQt.cpp
index 611abb9..dcb805a 100644
--- a/Source/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/Source/WebCore/plugins/qt/PluginViewQt.cpp
@@ -847,7 +847,7 @@ static Display *getPluginDisplay()
     // support gdk based plugins (like flash) that use a different X connection.
     // The code below has the same effect as this one:
     // Display *gdkDisplay = gdk_x11_display_get_xdisplay(gdk_display_get_default());
-    QLibrary library("libgdk-x11-2.0", 0);
+    QLibrary library(QLatin1String("libgdk-x11-2.0"), 0);
     if (!library.load())
         return 0;
 
diff --git a/Source/WebCore/plugins/win/PluginPackageWin.cpp b/Source/WebCore/plugins/win/PluginPackageWin.cpp
index e06d1f4..e835e3c 100644
--- a/Source/WebCore/plugins/win/PluginPackageWin.cpp
+++ b/Source/WebCore/plugins/win/PluginPackageWin.cpp
@@ -74,6 +74,9 @@ bool PluginPackage::isPluginBlacklisted()
     } else if (fileName() == "npmozax.dll") {
         // Bug 15217: Mozilla ActiveX control complains about missing xpcom_core.dll
         return true;
+    } else if (fileName() == "npwpf.dll") {
+        // Bug 57119: Microsoft Windows Presentation Foundation (WPF) plug-in complains about missing xpcom.dll
+        return true;
     } else if (name() == "Yahoo Application State Plugin") {
         // https://bugs.webkit.org/show_bug.cgi?id=26860
         // Bug in Yahoo Application State plug-in earlier than 1.0.0.6 leads to heap corruption. 
@@ -312,7 +315,7 @@ unsigned PluginPackage::hash() const
         m_mimeToExtensions.size()
     };
 
-    return WTF::StringHasher::createBlobHash<sizeof(hashCodes)>(hashCodes);
+    return StringHasher::hashMemory<sizeof(hashCodes)>(hashCodes);
 }
 
 bool PluginPackage::equal(const PluginPackage& a, const PluginPackage& b)
diff --git a/Source/WebCore/plugins/win/PluginViewWin.cpp b/Source/WebCore/plugins/win/PluginViewWin.cpp
index 208121e..f575709 100644
--- a/Source/WebCore/plugins/win/PluginViewWin.cpp
+++ b/Source/WebCore/plugins/win/PluginViewWin.cpp
@@ -83,6 +83,7 @@
 #endif
 
 #if PLATFORM(CAIRO)
+#include "PlatformContextCairo.h"
 #include <cairo-win32.h>
 #endif
 
@@ -572,8 +573,7 @@ void PluginView::paintWindowedPluginIntoContext(GraphicsContext* context, const
     // Must flush drawings up to this point to the backing metafile, otherwise the
     // plugin region will be overwritten with any clear regions specified in the
     // cairo-controlled portions of the rendering.
-    PlatformGraphicsContext* ctx = context->platformContext();
-    cairo_show_page(ctx);
+    cairo_show_page(context->platformContext()->cr());
 #endif
 
     HDC hdc = windowsContext.hdc();
diff --git a/Source/WebCore/rendering/AutoTableLayout.cpp b/Source/WebCore/rendering/AutoTableLayout.cpp
index 9775ec5..4eef95f 100644
--- a/Source/WebCore/rendering/AutoTableLayout.cpp
+++ b/Source/WebCore/rendering/AutoTableLayout.cpp
@@ -81,8 +81,8 @@ void AutoTableLayout::recalcColumn(int effCol)
 
                     Length cellLogicalWidth = cell->styleOrColLogicalWidth();
                     // FIXME: What is this arbitrary value?
-                    if (cellLogicalWidth.rawValue() > 32760)
-                        cellLogicalWidth.setRawValue(32760);
+                    if (cellLogicalWidth.value() > 32760)
+                        cellLogicalWidth.setValue(32760);
                     if (cellLogicalWidth.isNegative())
                         cellLogicalWidth.setValue(0);
                     switch (cellLogicalWidth.type()) {
@@ -105,13 +105,13 @@ void AutoTableLayout::recalcColumn(int effCol)
                         break;
                     case Percent:
                         m_hasPercent = true;
-                        if (cellLogicalWidth.isPositive() && (!columnLayout.logicalWidth.isPercent() || cellLogicalWidth.rawValue() > columnLayout.logicalWidth.rawValue()))
+                        if (cellLogicalWidth.isPositive() && (!columnLayout.logicalWidth.isPercent() || cellLogicalWidth.value() > columnLayout.logicalWidth.value()))
                             columnLayout.logicalWidth = cellLogicalWidth;
                         break;
                     case Relative:
                         // FIXME: Need to understand this case and whether it makes sense to compare values
                         // which are not necessarily of the same type.
-                        if (cellLogicalWidth.isAuto() || (cellLogicalWidth.isRelative() && cellLogicalWidth.value() > columnLayout.logicalWidth.rawValue()))
+                        if (cellLogicalWidth.isAuto() || (cellLogicalWidth.isRelative() && cellLogicalWidth.value() > columnLayout.logicalWidth.value()))
                             columnLayout.logicalWidth = cellLogicalWidth;
                     default:
                         break;
@@ -232,16 +232,16 @@ void AutoTableLayout::computePreferredLogicalWidths(int& minWidth, int& maxWidth
 
     // We substitute 0 percent by (epsilon / percentScaleFactor) percent in two places below to avoid division by zero.
     // FIXME: Handle the 0% cases properly.
-    const int epsilon = 1;
+    const float epsilon = 1 / 128.0f;
 
-    int remainingPercent = 100 * percentScaleFactor;
+    float remainingPercent = 100;
     for (size_t i = 0; i < m_layoutStruct.size(); ++i) {
         minWidth += m_layoutStruct[i].effectiveMinLogicalWidth;
         maxWidth += m_layoutStruct[i].effectiveMaxLogicalWidth;
         if (scaleColumns) {
             if (m_layoutStruct[i].effectiveLogicalWidth.isPercent()) {
-                int percent = min(m_layoutStruct[i].effectiveLogicalWidth.rawValue(), remainingPercent);
-                float logicalWidth = static_cast<float>(m_layoutStruct[i].effectiveMaxLogicalWidth) * 100 * percentScaleFactor / max(percent, epsilon);
+                float percent = min(static_cast<float>(m_layoutStruct[i].effectiveLogicalWidth.percent()), remainingPercent);
+                float logicalWidth = static_cast<float>(m_layoutStruct[i].effectiveMaxLogicalWidth) * 100 / max(percent, epsilon);
                 maxPercent = max(logicalWidth,  maxPercent);
                 remainingPercent -= percent;
             } else
@@ -250,7 +250,7 @@ void AutoTableLayout::computePreferredLogicalWidths(int& minWidth, int& maxWidth
     }
 
     if (scaleColumns) {
-        maxNonPercent = maxNonPercent * 100 * percentScaleFactor / max(remainingPercent, epsilon);
+        maxNonPercent = maxNonPercent * 100 / max(remainingPercent, epsilon);
         maxWidth = max(maxWidth, static_cast<int>(min(maxNonPercent, INT_MAX / 2.0f)));
         maxWidth = max(maxWidth, static_cast<int>(min(maxPercent, INT_MAX / 2.0f)));
     }
@@ -266,6 +266,10 @@ void AutoTableLayout::computePreferredLogicalWidths(int& minWidth, int& maxWidth
         minWidth = max(minWidth, tableLogicalWidth.value());
         maxWidth = minWidth;
     }
+    
+    // if there was no remaining percent, maxWidth is invalid.
+    if (!remainingPercent && maxNonPercent)
+        maxWidth = intMaxForLength;        
 }
 
 /*
@@ -300,7 +304,7 @@ int AutoTableLayout::calcEffectiveLogicalWidth()
         size_t lastCol = effCol;
         int cellMinLogicalWidth = cell->minPreferredLogicalWidth() + spacingInRowDirection;
         float cellMaxLogicalWidth = cell->maxPreferredLogicalWidth() + spacingInRowDirection;
-        int totalPercent = 0;
+        float totalPercent = 0;
         int spanMinLogicalWidth = 0;
         float spanMaxLogicalWidth = 0;
         bool allColsArePercent = true;
@@ -312,7 +316,7 @@ int AutoTableLayout::calcEffectiveLogicalWidth()
             Layout& columnLayout = m_layoutStruct[lastCol];
             switch (columnLayout.logicalWidth.type()) {
             case Percent:
-                totalPercent += columnLayout.logicalWidth.rawValue();
+                totalPercent += columnLayout.logicalWidth.percent();
                 allColsAreFixed = false;
                 break;
             case Fixed:
@@ -339,7 +343,7 @@ int AutoTableLayout::calcEffectiveLogicalWidth()
                     columnLayout.effectiveLogicalWidth = Length();
                     allColsArePercent = false;
                 } else
-                    totalPercent += columnLayout.effectiveLogicalWidth.rawValue();
+                    totalPercent += columnLayout.effectiveLogicalWidth.percent();
                 allColsAreFixed = false;
             }
             if (!columnLayout.emptyCellsOnly)
@@ -354,14 +358,14 @@ int AutoTableLayout::calcEffectiveLogicalWidth()
 
         // adjust table max width if needed
         if (cellLogicalWidth.isPercent()) {
-            if (totalPercent > cellLogicalWidth.rawValue() || allColsArePercent) {
+            if (totalPercent > cellLogicalWidth.percent() || allColsArePercent) {
                 // can't satify this condition, treat as variable
                 cellLogicalWidth = Length();
             } else {
-                maxLogicalWidth = max(maxLogicalWidth, max(spanMaxLogicalWidth, cellMaxLogicalWidth) * 100 * percentScaleFactor / cellLogicalWidth.rawValue());
+                maxLogicalWidth = max(maxLogicalWidth, static_cast<float>(max(spanMaxLogicalWidth, cellMaxLogicalWidth) * 100  / cellLogicalWidth.percent()));
 
                 // all non percent columns in the span get percent values to sum up correctly.
-                int percentMissing = cellLogicalWidth.rawValue() - totalPercent;
+                float percentMissing = cellLogicalWidth.percent() - totalPercent;
                 float totalWidth = 0;
                 for (unsigned pos = effCol; pos < lastCol; ++pos) {
                     if (!m_layoutStruct[pos].effectiveLogicalWidth.isPercent())
@@ -370,11 +374,11 @@ int AutoTableLayout::calcEffectiveLogicalWidth()
 
                 for (unsigned pos = effCol; pos < lastCol && totalWidth > 0; ++pos) {
                     if (!m_layoutStruct[pos].effectiveLogicalWidth.isPercent()) {
-                        int percent = static_cast<int>(percentMissing * static_cast<float>(m_layoutStruct[pos].effectiveMaxLogicalWidth) / totalWidth);
+                        float percent = percentMissing * static_cast<float>(m_layoutStruct[pos].effectiveMaxLogicalWidth) / totalWidth;
                         totalWidth -= m_layoutStruct[pos].effectiveMaxLogicalWidth;
                         percentMissing -= percent;
                         if (percent > 0)
-                            m_layoutStruct[pos].effectiveLogicalWidth.setRawValue(Percent, percent);
+                            m_layoutStruct[pos].effectiveLogicalWidth.setValue(Percent, percent);
                         else
                             m_layoutStruct[pos].effectiveLogicalWidth = Length();
                     }
@@ -495,7 +499,7 @@ void AutoTableLayout::layout()
     int numFixed = 0;
     float totalAuto = 0;
     float totalFixed = 0;
-    int totalPercent = 0;
+    float totalPercent = 0;
     int allocAuto = 0;
     unsigned numAutoEmptyCellsOnly = 0;
 
@@ -508,7 +512,7 @@ void AutoTableLayout::layout()
         switch (logicalWidth.type()) {
         case Percent:
             havePercent = true;
-            totalPercent += logicalWidth.rawValue();
+            totalPercent += logicalWidth.percent();
             break;
         case Relative:
             totalRelative += logicalWidth.value();
@@ -542,9 +546,9 @@ void AutoTableLayout::layout()
                 m_layoutStruct[i].computedLogicalWidth = cellLogicalWidth;
             }
         }
-        if (totalPercent > 100 * percentScaleFactor) {
+        if (totalPercent > 100) {
             // remove overallocated space from the last columns
-            int excess = tableLogicalWidth * (totalPercent - 100 * percentScaleFactor) / (100 * percentScaleFactor);
+            int excess = tableLogicalWidth * (totalPercent - 100) / 100;
             for (int i = nEffCols - 1; i >= 0; --i) {
                 if (m_layoutStruct[i].effectiveLogicalWidth.isPercent()) {
                     int cellLogicalWidth = m_layoutStruct[i].computedLogicalWidth;
@@ -611,13 +615,13 @@ void AutoTableLayout::layout()
     }
 
     // spread over percent colums
-    if (available > 0 && m_hasPercent && totalPercent < 100 * percentScaleFactor) {
+    if (available > 0 && m_hasPercent && totalPercent < 100) {
         for (size_t i = 0; i < nEffCols; ++i) {
             Length& logicalWidth = m_layoutStruct[i].effectiveLogicalWidth;
             if (logicalWidth.isPercent()) {
-                int cellLogicalWidth = available * logicalWidth.rawValue() / totalPercent;
+                int cellLogicalWidth = available * logicalWidth.percent() / totalPercent;
                 available -= cellLogicalWidth;
-                totalPercent -= logicalWidth.rawValue();
+                totalPercent -= logicalWidth.percent();
                 m_layoutStruct[i].computedLogicalWidth += cellLogicalWidth;
                 if (!available || !totalPercent)
                     break;
diff --git a/Source/WebCore/rendering/CounterNode.cpp b/Source/WebCore/rendering/CounterNode.cpp
index eadd386..323f5db 100644
--- a/Source/WebCore/rendering/CounterNode.cpp
+++ b/Source/WebCore/rendering/CounterNode.cpp
@@ -32,7 +32,8 @@ CounterNode::CounterNode(RenderObject* o, bool hasResetType, int value)
     : m_hasResetType(hasResetType)
     , m_value(value)
     , m_countInParent(0)
-    , m_renderer(o)
+    , m_owner(o)
+    , m_rootRenderer(0)
     , m_parent(0)
     , m_previousSibling(0)
     , m_nextSibling(0)
@@ -41,9 +42,14 @@ CounterNode::CounterNode(RenderObject* o, bool hasResetType, int value)
 {
 }
 
-PassRefPtr<CounterNode> CounterNode::create(RenderObject* renderer, bool hasResetType, int value)
+CounterNode::~CounterNode()
 {
-    return adoptRef(new CounterNode(renderer, hasResetType, value));
+    resetRenderers();
+}
+
+PassRefPtr<CounterNode> CounterNode::create(RenderObject* owner, bool hasResetType, int value)
+{
+    return adoptRef(new CounterNode(owner, hasResetType, value));
 }
 
 CounterNode* CounterNode::nextInPreOrderAfterChildren(const CounterNode* stayWithin) const
@@ -102,24 +108,76 @@ int CounterNode::computeCountInParent() const
     return m_parent->m_value + increment;
 }
 
-void CounterNode::resetRenderer(const AtomicString& identifier) const
+void CounterNode::addRenderer(RenderCounter* value)
+{
+    if (!value) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    if (value->m_counterNode) {
+        ASSERT_NOT_REACHED();
+        value->m_counterNode->removeRenderer(value);
+    }
+    ASSERT(!value->m_nextForSameCounter);
+    for (RenderCounter* iterator = m_rootRenderer;iterator; iterator = iterator->m_nextForSameCounter) {
+        if (iterator == value) {
+            ASSERT_NOT_REACHED();
+            return;
+        }
+    }
+    value->m_nextForSameCounter = m_rootRenderer;
+    m_rootRenderer = value;
+    if (value->m_counterNode != this) {
+        if (value->m_counterNode) {
+            ASSERT_NOT_REACHED();
+            value->m_counterNode->removeRenderer(value);
+        }
+        value->m_counterNode = this;
+    }
+}
+
+void CounterNode::removeRenderer(RenderCounter* value)
 {
-    if (!m_renderer || m_renderer->documentBeingDestroyed())
+    if (!value) {
+        ASSERT_NOT_REACHED();
         return;
-    if (RenderObjectChildList* children = m_renderer->virtualChildren())
-        children->invalidateCounters(m_renderer, identifier);
+    }
+    if (value->m_counterNode && value->m_counterNode != this) {
+        ASSERT_NOT_REACHED();
+        value->m_counterNode->removeRenderer(value);
+    }
+    RenderCounter* previous = 0;
+    for (RenderCounter* iterator = m_rootRenderer;iterator; iterator = iterator->m_nextForSameCounter) {
+        if (iterator == value) {
+            if (previous)
+                previous->m_nextForSameCounter = value->m_nextForSameCounter;
+            else
+                m_rootRenderer = value->m_nextForSameCounter;
+            value->m_nextForSameCounter = 0;
+            value->m_counterNode = 0;
+            return;
+        }
+        previous = iterator;
+    }
+    ASSERT_NOT_REACHED();
+}
+
+void CounterNode::resetRenderers()
+{
+    while (m_rootRenderer)
+        m_rootRenderer->invalidate(); // This makes m_rootRenderer point to the next renderer if any since it disconnects the m_rootRenderer from this.
 }
 
-void CounterNode::resetRenderers(const AtomicString& identifier) const
+void CounterNode::resetThisAndDescendantsRenderers()
 {
-    const CounterNode* node = this;
+    CounterNode* node = this;
     do {
-        node->resetRenderer(identifier);
+        node->resetRenderers();
         node = node->nextInPreOrder(this);
     } while (node);
 }
 
-void CounterNode::recount(const AtomicString& identifier)
+void CounterNode::recount()
 {
     for (CounterNode* node = this; node; node = node->m_nextSibling) {
         int oldCount = node->m_countInParent;
@@ -127,7 +185,7 @@ void CounterNode::recount(const AtomicString& identifier)
         if (oldCount == newCount)
             break;
         node->m_countInParent = newCount;
-        node->resetRenderers(identifier);
+        node->resetThisAndDescendantsRenderers();
     }
 }
 
@@ -141,7 +199,7 @@ void CounterNode::insertAfter(CounterNode* newChild, CounterNode* refChild, cons
 
     if (newChild->m_hasResetType) {
         while (m_lastChild != refChild)
-            RenderCounter::destroyCounterNode(m_lastChild->renderer(), identifier);
+            RenderCounter::destroyCounterNode(m_lastChild->owner(), identifier);
     }
 
     CounterNode* next;
@@ -168,9 +226,9 @@ void CounterNode::insertAfter(CounterNode* newChild, CounterNode* refChild, cons
         }
 
         newChild->m_countInParent = newChild->computeCountInParent();
-        newChild->resetRenderers(identifier);
+        newChild->resetThisAndDescendantsRenderers();
         if (next)
-            next->recount(identifier);
+            next->recount();
         return;
     }
 
@@ -203,11 +261,11 @@ void CounterNode::insertAfter(CounterNode* newChild, CounterNode* refChild, cons
     newChild->m_firstChild = 0;
     newChild->m_lastChild = 0;
     newChild->m_countInParent = newChild->computeCountInParent();
-    newChild->resetRenderer(identifier);
-    first->recount(identifier);
+    newChild->resetRenderers();
+    first->recount();
 }
 
-void CounterNode::removeChild(CounterNode* oldChild, const AtomicString& identifier)
+void CounterNode::removeChild(CounterNode* oldChild)
 {
     ASSERT(oldChild);
     ASSERT(!oldChild->m_firstChild);
@@ -235,7 +293,7 @@ void CounterNode::removeChild(CounterNode* oldChild, const AtomicString& identif
     }
 
     if (next)
-        next->recount(identifier);
+        next->recount();
 }
 
 #ifndef NDEBUG
@@ -253,8 +311,9 @@ static void showTreeAndMark(const CounterNode* node)
         fprintf(stderr, "%p %s: %d %d P:%p PS:%p NS:%p R:%p\n",
             current, current->actsAsReset() ? "reset____" : "increment", current->value(),
             current->countInParent(), current->parent(), current->previousSibling(),
-            current->nextSibling(), current->renderer());
+            current->nextSibling(), current->owner());
     }
+    fflush(stderr);
 }
 
 #endif
diff --git a/Source/WebCore/rendering/CounterNode.h b/Source/WebCore/rendering/CounterNode.h
index 639946c..7d6def8 100644
--- a/Source/WebCore/rendering/CounterNode.h
+++ b/Source/WebCore/rendering/CounterNode.h
@@ -38,16 +38,22 @@
 namespace WebCore {
 
 class RenderObject;
+class RenderCounter;
 
 class CounterNode : public RefCounted<CounterNode> {
 public:
     static PassRefPtr<CounterNode> create(RenderObject*, bool isReset, int value);
-
+    ~CounterNode();
     bool actsAsReset() const { return m_hasResetType || !m_parent; }
     bool hasResetType() const { return m_hasResetType; }
     int value() const { return m_value; }
     int countInParent() const { return m_countInParent; }
-    RenderObject* renderer() const { return m_renderer; }
+    RenderObject* owner() const { return m_owner; }
+    void addRenderer(RenderCounter*);
+    void removeRenderer(RenderCounter*);
+
+    // Invalidates the text in the renderers of this counter, if any.
+    void resetRenderers();
 
     CounterNode* parent() const { return m_parent; }
     CounterNode* previousSibling() const { return m_previousSibling; }
@@ -62,26 +68,21 @@ public:
     void insertAfter(CounterNode* newChild, CounterNode* beforeChild, const AtomicString& identifier);
 
     // identifier must match the identifier of this counter.
-    void removeChild(CounterNode*, const AtomicString& identifier);
+    void removeChild(CounterNode*);
 
 private:
     CounterNode(RenderObject*, bool isReset, int value);
     int computeCountInParent() const;
-    void recount(const AtomicString& identifier);
-
-    // Invalidates the text in the renderer of this counter, if any.
-    // identifier must match the identifier of this counter.
-    void resetRenderer(const AtomicString& identifier) const;
-
     // Invalidates the text in the renderer of this counter, if any,
     // and in the renderers of all descendants of this counter, if any.
-    // identifier must match the identifier of this counter.
-    void resetRenderers(const AtomicString& identifier) const;
+    void resetThisAndDescendantsRenderers();
+    void recount();
 
     bool m_hasResetType;
     int m_value;
     int m_countInParent;
-    RenderObject* m_renderer;
+    RenderObject* m_owner;
+    RenderCounter* m_rootRenderer;
 
     CounterNode* m_parent;
     CounterNode* m_previousSibling;
diff --git a/Source/WebCore/rendering/FixedTableLayout.cpp b/Source/WebCore/rendering/FixedTableLayout.cpp
index 3285d15..b1a61b5 100644
--- a/Source/WebCore/rendering/FixedTableLayout.cpp
+++ b/Source/WebCore/rendering/FixedTableLayout.cpp
@@ -118,7 +118,8 @@ int FixedTableLayout::calcWidthArray(int)
                     spanInCurrentEffectiveColumn = m_table->spanOfEffCol(currentEffectiveColumn);
                 }
                 if ((w.isFixed() || w.isPercent()) && w.isPositive()) {
-                    m_width[currentEffectiveColumn].setRawValue(w.type(), w.rawValue() * spanInCurrentEffectiveColumn);
+                    m_width[currentEffectiveColumn] = w;
+                    m_width[currentEffectiveColumn] *= spanInCurrentEffectiveColumn;
                     usedWidth += effWidth * spanInCurrentEffectiveColumn;
                 }
                 span -= spanInCurrentEffectiveColumn;
@@ -164,10 +165,11 @@ int FixedTableLayout::calcWidthArray(int)
                 int usedSpan = 0;
                 int i = 0;
                 while (usedSpan < span && cCol + i < nEffCols) {
-                    int eSpan = m_table->spanOfEffCol(cCol + i);
+                    float eSpan = m_table->spanOfEffCol(cCol + i);
                     // Only set if no col element has already set it.
                     if (m_width[cCol + i].isAuto() && w.type() != Auto) {
-                        m_width[cCol + i].setRawValue(w.type(), w.rawValue() * eSpan / span);
+                        m_width[cCol + i] = w;
+                        m_width[cCol + i] *= eSpan / span;
                         usedWidth += effWidth * eSpan / span;
                     }
                     usedSpan += eSpan;
@@ -234,7 +236,7 @@ void FixedTableLayout::layout()
     int autoSpan = 0;
     int totalFixedWidth = 0;
     int totalPercentWidth = 0;
-    int totalRawPercent = 0;
+    float totalPercent = 0;
 
     // Compute requirements and try to satisfy fixed and percent widths.
     // Percentages are of the table's width, so for example
@@ -247,7 +249,7 @@ void FixedTableLayout::layout()
         } else if (m_width[i].isPercent()) {
             calcWidth[i] = m_width[i].calcValue(tableLogicalWidth);
             totalPercentWidth += calcWidth[i];
-            totalRawPercent += m_width[i].rawValue();
+            totalPercent += m_width[i].percent();
         } else if (m_width[i].isAuto()) {
             numAuto++;
             autoSpan += m_table->spanOfEffCol(i);
@@ -270,11 +272,11 @@ void FixedTableLayout::layout()
                     }
                 }
             }
-            if (totalRawPercent) {
+            if (totalPercent) {
                 totalPercentWidth = 0;
                 for (int i = 0; i < nEffCols; i++) {
                     if (m_width[i].isPercent()) {
-                        calcWidth[i] = m_width[i].rawValue() * (tableLogicalWidth - totalFixedWidth) / totalRawPercent;
+                        calcWidth[i] = m_width[i].percent() * (tableLogicalWidth - totalFixedWidth) / totalPercent;
                         totalPercentWidth += calcWidth[i];
                     }
                 }
diff --git a/Source/WebCore/rendering/HitTestResult.cpp b/Source/WebCore/rendering/HitTestResult.cpp
index ba98eff..e5638c9 100644
--- a/Source/WebCore/rendering/HitTestResult.cpp
+++ b/Source/WebCore/rendering/HitTestResult.cpp
@@ -95,16 +95,17 @@ HitTestResult::HitTestResult(const HitTestResult& other)
     , m_scrollbar(other.scrollbar())
     , m_isOverWidget(other.isOverWidget())
 {
-    // Only copy the padding and ListHashSet in case of rect hit test.
+    // Only copy the padding and NodeSet in case of rect hit test.
     // Copying the later is rather expensive.
     if ((m_isRectBased = other.isRectBasedTest())) {
         m_topPadding = other.m_topPadding;
         m_rightPadding = other.m_rightPadding;
         m_bottomPadding = other.m_bottomPadding;
         m_leftPadding = other.m_leftPadding;
-        m_rectBasedTestResult = other.rectBasedTestResult();
     } else
         m_topPadding = m_rightPadding = m_bottomPadding = m_leftPadding = 0;
+
+    m_rectBasedTestResult = adoptPtr(other.m_rectBasedTestResult ? new NodeSet(*other.m_rectBasedTestResult) : 0);
 }
 
 HitTestResult::~HitTestResult()
@@ -120,16 +121,17 @@ HitTestResult& HitTestResult::operator=(const HitTestResult& other)
     m_innerURLElement = other.URLElement();
     m_scrollbar = other.scrollbar();
     m_isOverWidget = other.isOverWidget();
-    // Only copy the padding and ListHashSet in case of rect hit test.
+    // Only copy the padding and NodeSet in case of rect hit test.
     // Copying the later is rather expensive.
     if ((m_isRectBased = other.isRectBasedTest())) {
         m_topPadding = other.m_topPadding;
         m_rightPadding = other.m_rightPadding;
         m_bottomPadding = other.m_bottomPadding;
         m_leftPadding = other.m_leftPadding;
-        m_rectBasedTestResult = other.rectBasedTestResult();
     } else
         m_topPadding = m_rightPadding = m_bottomPadding = m_leftPadding = 0;
+
+    m_rectBasedTestResult = adoptPtr(other.m_rectBasedTestResult ? new NodeSet(*other.m_rectBasedTestResult) : 0);
     return *this;
 }
 
@@ -525,7 +527,7 @@ bool HitTestResult::isContentEditable() const
     if (m_innerNonSharedNode->hasTagName(inputTag))
         return static_cast<HTMLInputElement*>(m_innerNonSharedNode.get())->isTextField();
 
-    return m_innerNonSharedNode->isContentEditable();
+    return m_innerNonSharedNode->rendererIsEditable();
 }
 
 bool HitTestResult::addNodeToRectBasedTestResult(Node* node, int x, int y, const IntRect& rect)
@@ -540,7 +542,7 @@ bool HitTestResult::addNodeToRectBasedTestResult(Node* node, int x, int y, const
         return true;
 
     node = node->shadowAncestorNode();
-    m_rectBasedTestResult.add(node);
+    mutableRectBasedTestResult().add(node);
 
     return !rect.contains(rectForPoint(x, y));
 }
@@ -557,7 +559,7 @@ bool HitTestResult::addNodeToRectBasedTestResult(Node* node, int x, int y, const
         return true;
 
     node = node->shadowAncestorNode();
-    m_rectBasedTestResult.add(node);
+    mutableRectBasedTestResult().add(node);
 
     return !rect.contains(rectForPoint(x, y));
 }
@@ -575,10 +577,11 @@ void HitTestResult::append(const HitTestResult& other)
         m_isOverWidget = other.isOverWidget();
     }
 
-    const ListHashSet<RefPtr<Node> >& list = other.rectBasedTestResult();
-    ListHashSet<RefPtr<Node> >::const_iterator last = list.end();
-    for (ListHashSet<RefPtr<Node> >::const_iterator it = list.begin(); it != last; ++it)
-        m_rectBasedTestResult.add(it->get());
+    if (other.m_rectBasedTestResult) {
+        NodeSet& set = mutableRectBasedTestResult();
+        for (NodeSet::const_iterator it = other.m_rectBasedTestResult->begin(), last = other.m_rectBasedTestResult->end(); it != last; ++it)
+            set.add(it->get());
+    }
 }
 
 IntRect HitTestResult::rectForPoint(const IntPoint& point, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding)
@@ -593,4 +596,18 @@ IntRect HitTestResult::rectForPoint(const IntPoint& point, unsigned topPadding,
     return IntRect(actualPoint, actualPadding);
 }
 
+const HitTestResult::NodeSet& HitTestResult::rectBasedTestResult() const
+{
+    if (!m_rectBasedTestResult)
+        m_rectBasedTestResult = adoptPtr(new NodeSet);
+    return *m_rectBasedTestResult;
+}
+
+HitTestResult::NodeSet& HitTestResult::mutableRectBasedTestResult()
+{
+    if (!m_rectBasedTestResult)
+        m_rectBasedTestResult = adoptPtr(new NodeSet);
+    return *m_rectBasedTestResult;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/HitTestResult.h b/Source/WebCore/rendering/HitTestResult.h
index 3aa17e3..89b5ea1 100644
--- a/Source/WebCore/rendering/HitTestResult.h
+++ b/Source/WebCore/rendering/HitTestResult.h
@@ -27,6 +27,7 @@
 #include "TextDirection.h"
 #include <wtf/Forward.h>
 #include <wtf/ListHashSet.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
@@ -44,6 +45,8 @@ class Scrollbar;
 
 class HitTestResult {
 public:
+    typedef ListHashSet<RefPtr<Node> > NodeSet;
+
     HitTestResult();
     HitTestResult(const IntPoint&);
     // Pass non-negative padding values to perform a rect-based hit test.
@@ -112,10 +115,15 @@ public:
     // enclosed by the boundaries of a node.
     bool addNodeToRectBasedTestResult(Node*, int x, int y, const IntRect& = IntRect());
     bool addNodeToRectBasedTestResult(Node*, int x, int y, const FloatRect&);
-    const ListHashSet<RefPtr<Node> >& rectBasedTestResult() const { return m_rectBasedTestResult; }
     void append(const HitTestResult&);
 
+    // If m_rectBasedTestResult is 0 then set it to a new NodeSet. Return *m_rectBasedTestResult. Lazy allocation makes
+    // sense because the NodeSet is seldom necessary, and it's somewhat expensive to allocate and initialize. This method does
+    // the same thing as mutableRectBasedTestResult(), but here the return value is const.
+    const NodeSet& rectBasedTestResult() const;
+
 private:
+    NodeSet& mutableRectBasedTestResult(); // See above.
 
 #if ENABLE(VIDEO)
     HTMLMediaElement* mediaElement() const;
@@ -134,7 +142,7 @@ private:
     int m_rightPadding;
     int m_bottomPadding;
     int m_leftPadding;
-    ListHashSet<RefPtr<Node> > m_rectBasedTestResult;
+    mutable OwnPtr<NodeSet> m_rectBasedTestResult;
 };
 
 inline IntRect HitTestResult::rectForPoint(int x, int y) const
diff --git a/Source/WebCore/rendering/InlineBox.cpp b/Source/WebCore/rendering/InlineBox.cpp
index 1f4e244..930071e 100644
--- a/Source/WebCore/rendering/InlineBox.cpp
+++ b/Source/WebCore/rendering/InlineBox.cpp
@@ -154,8 +154,9 @@ void InlineBox::adjustPosition(float dx, float dy)
 {
     m_x += dx;
     m_y += dy;
-    if (m_renderer->isReplaced())
-        toRenderBox(m_renderer)->positionLineBox(this);
+
+    if (m_renderer->isReplaced()) 
+        toRenderBox(m_renderer)->move(dx, dy); 
 }
 
 void InlineBox::paint(PaintInfo& paintInfo, int tx, int ty)
diff --git a/Source/WebCore/rendering/InlineBox.h b/Source/WebCore/rendering/InlineBox.h
index de7b224..9335970 100644
--- a/Source/WebCore/rendering/InlineBox.h
+++ b/Source/WebCore/rendering/InlineBox.h
@@ -53,7 +53,7 @@ public:
 #endif
         , m_isHorizontal(true)
         , m_endsWithBreak(false)
-        , m_hasSelectedChildren(false)
+        , m_hasSelectedChildrenOrCanHaveLeadingExpansion(false)
         , m_hasEllipsisBoxOrHyphen(false)
         , m_dirOverride(false)
         , m_isText(false)
@@ -87,7 +87,7 @@ public:
 #endif
         , m_isHorizontal(isHorizontal)
         , m_endsWithBreak(false)
-        , m_hasSelectedChildren(false)   
+        , m_hasSelectedChildrenOrCanHaveLeadingExpansion(false)   
         , m_hasEllipsisBoxOrHyphen(false)
         , m_dirOverride(false)
         , m_isText(false)
@@ -340,8 +340,9 @@ protected:
 
     // for RootInlineBox
     bool m_endsWithBreak : 1;  // Whether the line ends with a <br>.
-    bool m_hasSelectedChildren : 1; // Whether we have any children selected (this bit will also be set if the <br> that terminates our line is selected).
-    bool m_hasEllipsisBoxOrHyphen : 1; 
+    // shared between RootInlineBox and InlineTextBox
+    bool m_hasSelectedChildrenOrCanHaveLeadingExpansion : 1; // Whether we have any children selected (this bit will also be set if the <br> that terminates our line is selected).
+    bool m_hasEllipsisBoxOrHyphen : 1;
 
     // for InlineTextBox
 public:
diff --git a/Source/WebCore/rendering/InlineFlowBox.cpp b/Source/WebCore/rendering/InlineFlowBox.cpp
index e146dd9..b58a30e 100644
--- a/Source/WebCore/rendering/InlineFlowBox.cpp
+++ b/Source/WebCore/rendering/InlineFlowBox.cpp
@@ -38,7 +38,6 @@
 #include "RenderTableCell.h"
 #include "RootInlineBox.h"
 #include "Text.h"
-#include "VerticalPositionCache.h"
 
 #include <math.h>
 
@@ -97,8 +96,48 @@ void InlineFlowBox::addToLine(InlineBox* child)
     }
     child->setFirstLineStyleBit(m_firstLine);
     child->setIsHorizontal(isHorizontal());
-    if (child->isText())
+    if (child->isText()) {
         m_hasTextChildren = true;
+        m_hasTextDescendants = true;
+    } else if (child->isInlineFlowBox()) {
+        if (static_cast<InlineFlowBox*>(child)->hasTextDescendants())
+            m_hasTextDescendants = true;
+    }
+
+    if (descendantsHaveSameLineHeightAndBaseline() && !child->renderer()->isPositioned()) {
+        RenderStyle* parentStyle = renderer()->style(m_firstLine);
+        RenderStyle* childStyle = child->renderer()->style(m_firstLine);
+        bool shouldClearDescendantsHaveSameLineHeightAndBaseline = false;
+        if (child->renderer()->isReplaced())
+            shouldClearDescendantsHaveSameLineHeightAndBaseline = true;
+        else if (child->isText()) {
+            if (child->renderer()->isBR()) {
+                if (parentStyle->font().fontMetrics().ascent() != childStyle->font().fontMetrics().ascent()
+                    || parentStyle->font().fontMetrics().descent() != childStyle->font().fontMetrics().descent() || parentStyle->lineHeight() != childStyle->lineHeight()
+                    || (parentStyle->verticalAlign() != BASELINE && !isRootInlineBox()) || childStyle->verticalAlign() != BASELINE)
+                    shouldClearDescendantsHaveSameLineHeightAndBaseline = true;
+            } else if (childStyle->hasTextCombine() || childStyle->textEmphasisMark() != TextEmphasisMarkNone)
+                shouldClearDescendantsHaveSameLineHeightAndBaseline = true;
+        } else {
+            if (child->renderer()->isBR()) {
+                // FIXME: This is dumb. We only turn off because current layout test results expect the <br> to be 0-height on the baseline.
+                // Other than making a zillion tests have to regenerate results, there's no reason to ditch the optimization here.
+                shouldClearDescendantsHaveSameLineHeightAndBaseline = true;
+            } else {
+                ASSERT(isInlineFlowBox());
+                InlineFlowBox* childFlowBox = static_cast<InlineFlowBox*>(child);
+                // Check the child's bit, and then also check for differences in font, line-height, vertical-align
+                if (!childFlowBox->descendantsHaveSameLineHeightAndBaseline() || parentStyle->font().fontMetrics().ascent() != childStyle->font().fontMetrics().ascent()
+                    || parentStyle->font().fontMetrics().descent() != childStyle->font().fontMetrics().descent() || parentStyle->lineHeight() != childStyle->lineHeight()
+                    || (parentStyle->verticalAlign() != BASELINE && !isRootInlineBox()) || childStyle->verticalAlign() != BASELINE
+                    || childStyle->hasBorder() || childStyle->hasPadding() || childStyle->hasTextCombine())
+                    shouldClearDescendantsHaveSameLineHeightAndBaseline = true;
+            }
+        }
+
+        if (shouldClearDescendantsHaveSameLineHeightAndBaseline)
+            clearDescendantsHaveSameLineHeightAndBaseline();
+    }
 
     checkConsistency();
 }
@@ -214,7 +253,18 @@ bool InlineFlowBox::onEndChain(RenderObject* endObject)
     return true;
 }
 
-void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* endObject)
+static bool isAnsectorAndWithinBlock(RenderObject* ancestor, RenderObject* child)
+{
+    RenderObject* object = child;
+    while (object && !object->isRenderBlock()) {
+        if (object == ancestor)
+            return true;
+        object = object->parent();
+    }
+    return false;
+}
+
+void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* endObject, RenderObject* logicallyLastRunRenderer)
 {
     // All boxes start off open.  They will not apply any margins/border/padding on
     // any side.
@@ -234,23 +284,18 @@ void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* en
             else if (!ltr && lineBoxList->lastLineBox() == this)
                 includeRightEdge = true;
         }
-    
-        // In order to determine if the inline ends on this line, we check three things:
-        // (1) If we are the last line and we don't have a continuation(), then we can
-        // close up.
-        // (2) If the last line box for the flow has an object following it on the line (ltr,
-        // reverse for rtl), then the inline has closed.
-        // (3) The line may end on the inline.  If we are the last child (climbing up
-        // the end object's chain), then we just closed as well.
+
         if (!lineBoxList->lastLineBox()->isConstructed()) {
             RenderInline* inlineFlow = toRenderInline(renderer());
+            bool isLastObjectOnLine = (endObject && endObject->isText()) ? !isAnsectorAndWithinBlock(renderer(), logicallyLastRunRenderer->parent()) : onEndChain(logicallyLastRunRenderer);
+
             if (ltr) {
-                if (!nextLineBox() &&
-                    ((lastLine && !inlineFlow->continuation()) || nextOnLineExists() || onEndChain(endObject)))
+                if (!nextLineBox()
+                    && ((lastLine || isLastObjectOnLine) && !inlineFlow->continuation()))
                     includeRightEdge = true;
             } else {
-                if ((!prevLineBox() || prevLineBox()->isConstructed()) &&
-                    ((lastLine && !inlineFlow->continuation()) || prevOnLineExists() || onEndChain(endObject)))
+                if ((!prevLineBox() || prevLineBox()->isConstructed())
+                    && ((lastLine || isLastObjectOnLine) && !inlineFlow->continuation()))
                     includeLeftEdge = true;
             }
         }
@@ -262,7 +307,7 @@ void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* en
     for (InlineBox* currChild = firstChild(); currChild; currChild = currChild->nextOnLine()) {
         if (currChild->isInlineFlowBox()) {
             InlineFlowBox* currFlow = static_cast<InlineFlowBox*>(currChild);
-            currFlow->determineSpacingForFlowBoxes(lastLine, endObject);
+            currFlow->determineSpacingForFlowBoxes(lastLine, endObject, logicallyLastRunRenderer);
         }
     }
 }
@@ -325,7 +370,8 @@ bool InlineFlowBox::requiresIdeographicBaseline(const GlyphOverflowAndFallbackFo
     if (isHorizontal())
         return false;
     
-    if (renderer()->style(m_firstLine)->font().primaryFont()->orientation() == Vertical)
+    if (renderer()->style(m_firstLine)->fontDescription().textOrientation() == TextOrientationUpright
+        || renderer()->style(m_firstLine)->font().primaryFont()->hasVerticalGlyphs())
         return true;
 
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
@@ -336,7 +382,7 @@ bool InlineFlowBox::requiresIdeographicBaseline(const GlyphOverflowAndFallbackFo
             if (static_cast<InlineFlowBox*>(curr)->requiresIdeographicBaseline(textBoxDataMap))
                 return true;
         } else {
-            if (curr->renderer()->style(m_firstLine)->font().primaryFont()->orientation() == Vertical)
+            if (curr->renderer()->style(m_firstLine)->font().primaryFont()->hasVerticalGlyphs())
                 return true;
             
             const Vector<const SimpleFontData*>* usedFonts = 0;
@@ -347,7 +393,7 @@ bool InlineFlowBox::requiresIdeographicBaseline(const GlyphOverflowAndFallbackFo
 
             if (usedFonts) {
                 for (size_t i = 0; i < usedFonts->size(); ++i) {
-                    if (usedFonts->at(i)->orientation() == Vertical)
+                    if (usedFonts->at(i)->hasVerticalGlyphs())
                         return true;
                 }
             }
@@ -384,92 +430,36 @@ void InlineFlowBox::adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent, i
     }
 }
 
-static int verticalPositionForBox(InlineBox* box, FontBaseline baselineType, bool firstLine, VerticalPositionCache& verticalPositionCache)
-{
-    if (box->renderer()->isText())
-        return box->parent()->logicalTop();
-    
-    RenderBoxModelObject* renderer = box->boxModelObject();
-    ASSERT(renderer->isInline());
-    if (!renderer->isInline())
-        return 0;
-
-    // This method determines the vertical position for inline elements.
-    if (firstLine && !renderer->document()->usesFirstLineRules())
-        firstLine = false;
-
-    // Check the cache.
-    bool isRenderInline = renderer->isRenderInline();
-    if (isRenderInline && !firstLine) {
-        int verticalPosition = verticalPositionCache.get(renderer, baselineType);
-        if (verticalPosition != PositionUndefined)
-            return verticalPosition;
-    }
-
-    int verticalPosition = 0;
-    EVerticalAlign verticalAlign = renderer->style()->verticalAlign();
-    if (verticalAlign == TOP || verticalAlign == BOTTOM)
-        return 0;
-   
-    RenderObject* parent = renderer->parent();
-    if (parent->isRenderInline() && parent->style()->verticalAlign() != TOP && parent->style()->verticalAlign() != BOTTOM)
-        verticalPosition = box->parent()->logicalTop();
-    
-    if (verticalAlign != BASELINE) {
-        const Font& font = parent->style(firstLine)->font();
-        const FontMetrics& fontMetrics = font.fontMetrics();
-        int fontSize = font.pixelSize();
-
-        LineDirectionMode lineDirection = parent->style()->isHorizontalWritingMode() ? HorizontalLine : VerticalLine;
-
-        if (verticalAlign == SUB)
-            verticalPosition += fontSize / 5 + 1;
-        else if (verticalAlign == SUPER)
-            verticalPosition -= fontSize / 3 + 1;
-        else if (verticalAlign == TEXT_TOP)
-            verticalPosition += renderer->baselinePosition(baselineType, firstLine, lineDirection) - fontMetrics.ascent(baselineType);
-        else if (verticalAlign == MIDDLE)
-            verticalPosition += -static_cast<int>(fontMetrics.xHeight() / 2) - renderer->lineHeight(firstLine, lineDirection) / 2 + renderer->baselinePosition(baselineType, firstLine, lineDirection);
-        else if (verticalAlign == TEXT_BOTTOM) {
-            verticalPosition += fontMetrics.descent(baselineType);
-            // lineHeight - baselinePosition is always 0 for replaced elements (except inline blocks), so don't bother wasting time in that case.
-            if (!renderer->isReplaced() || renderer->isInlineBlockOrInlineTable())
-                verticalPosition -= (renderer->lineHeight(firstLine, lineDirection) - renderer->baselinePosition(baselineType, firstLine, lineDirection));
-        } else if (verticalAlign == BASELINE_MIDDLE)
-            verticalPosition += -renderer->lineHeight(firstLine, lineDirection) / 2 + renderer->baselinePosition(baselineType, firstLine, lineDirection);
-        else if (verticalAlign == LENGTH)
-            verticalPosition -= renderer->style()->verticalAlignLength().calcValue(renderer->lineHeight(firstLine, lineDirection));
-    }
-
-    // Store the cached value.
-    if (isRenderInline && !firstLine)
-        verticalPositionCache.set(renderer, baselineType, verticalPosition);
-
-    return verticalPosition;
-}
-
-void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositionBottom,
+void InlineFlowBox::computeLogicalBoxHeights(RootInlineBox* rootBox, int& maxPositionTop, int& maxPositionBottom,
                                              int& maxAscent, int& maxDescent, bool& setMaxAscent, bool& setMaxDescent,
                                              bool strictMode, GlyphOverflowAndFallbackFontsMap& textBoxDataMap,
                                              FontBaseline baselineType, VerticalPositionCache& verticalPositionCache)
 {
     // The primary purpose of this function is to compute the maximal ascent and descent values for
-    // a line.
+    // a line. These values are computed based off the block's line-box-contain property, which indicates
+    // what parts of descendant boxes have to fit within the line.
+    //
+    // The maxAscent value represents the distance of the highest point of any box (typically including line-height) from
+    // the root box's baseline. The maxDescent value represents the distance of the lowest point of any box
+    // (also typically including line-height) from the root box baseline. These values can be negative.
     //
-    // The maxAscent value represents the distance of the highest point of any box (including line-height) from
-    // the root box's baseline.  The maxDescent value represents the distance of the lowest point of any box
-    // (also including line-height) from the root box baseline.  These values can be negative.
+    // A secondary purpose of this function is to store the offset of every box's baseline from the root box's
+    // baseline. This information is cached in the logicalTop() of every box. We're effectively just using
+    // the logicalTop() as scratch space.
     //
-    // A secondary purpose of this function is to store the offset of very box's baseline from the root box's
-    // baseline.  This information is cached in the logicalTop() of every box. We're effectively just using
-    // the logicalTop() as scratch space. 
+    // Because a box can be positioned such that it ends up fully above or fully below the
+    // root line box, we only consider it to affect the maxAscent and maxDescent values if some
+    // part of the box (EXCLUDING leading) is above (for ascent) or below (for descent) the root box's baseline.
+    bool affectsAscent = false;
+    bool affectsDescent = false;
+    bool checkChildren = !descendantsHaveSameLineHeightAndBaseline();
+    
     if (isRootInlineBox()) {
         // Examine our root box.
-        int height = lineHeight();
-        int baseline = baselinePosition(baselineType);
-        if (hasTextChildren() || strictMode) {
-            int ascent = baseline;
-            int descent = height - ascent;
+        int ascent = 0;
+        int descent = 0;
+        rootBox->ascentAndDescentForBox(rootBox, textBoxDataMap, ascent, descent, affectsAscent, affectsDescent);
+        if (strictMode || hasTextChildren() || (!checkChildren && hasTextDescendants())) {
             if (maxAscent < ascent || !setMaxAscent) {
                 maxAscent = ascent;
                 setMaxAscent = true;
@@ -481,131 +471,96 @@ void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositi
         }
     }
 
+    if (!checkChildren)
+        return;
+
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
         if (curr->renderer()->isPositioned())
             continue; // Positioned placeholders don't affect calculations.
         
-        bool isInlineFlow = curr->isInlineFlowBox();
+        InlineFlowBox* inlineFlowBox = curr->isInlineFlowBox() ? static_cast<InlineFlowBox*>(curr) : 0;
         
-        // Because a box can be positioned such that it ends up fully above or fully below the
-        // root line box, we only consider it to affect the maxAscent and maxDescent values if some
-        // part of the box (EXCLUDING line-height) is above (for ascent) or below (for descent) the root box's baseline.
         bool affectsAscent = false;
         bool affectsDescent = false;
         
         // The verticalPositionForBox function returns the distance between the child box's baseline
         // and the root box's baseline.  The value is negative if the child box's baseline is above the
         // root box's baseline, and it is positive if the child box's baseline is below the root box's baseline.
-        curr->setLogicalTop(verticalPositionForBox(curr, baselineType, m_firstLine, verticalPositionCache));
+        curr->setLogicalTop(rootBox->verticalPositionForBox(curr, verticalPositionCache));
         
-        int lineHeight;
-        int baseline;
-        Vector<const SimpleFontData*>* usedFonts = 0;
-        if (curr->isInlineTextBox()) {
-            GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.find(static_cast<InlineTextBox*>(curr));
-            usedFonts = it == textBoxDataMap.end() ? 0 : &it->second.first;
-        }
-
-        if (usedFonts && !usedFonts->isEmpty() && curr->renderer()->style(m_firstLine)->lineHeight().isNegative()) {
-            usedFonts->append(curr->renderer()->style(m_firstLine)->font().primaryFont());
-            bool baselineSet = false;
-            baseline = 0;
-            int baselineToBottom = 0;
-            for (size_t i = 0; i < usedFonts->size(); ++i) {
-                const FontMetrics& fontMetrics = usedFonts->at(i)->fontMetrics();
-                int halfLeading = (fontMetrics.lineSpacing() - fontMetrics.height()) / 2;
-                int usedFontBaseline = halfLeading + fontMetrics.ascent(baselineType);
-                int usedFontBaselineToBottom = fontMetrics.lineSpacing() - usedFontBaseline;
-                if (!baselineSet) {
-                    baselineSet = true;
-                    baseline = usedFontBaseline;
-                    baselineToBottom = usedFontBaselineToBottom;
-                } else {
-                    baseline = max(baseline, usedFontBaseline);
-                    baselineToBottom = max(baselineToBottom, usedFontBaselineToBottom);
-                }
-                if (!affectsAscent)
-                    affectsAscent = fontMetrics.ascent() - curr->logicalTop() > 0;
-                if (!affectsDescent)
-                    affectsDescent = fontMetrics.descent() + curr->logicalTop() > 0;
-            }
-            lineHeight = baseline + baselineToBottom;
-        } else {
-            lineHeight = curr->lineHeight();
-            baseline = curr->baselinePosition(baselineType);
-            if (curr->isText() || isInlineFlow) {
-                // Examine the font box for inline flows and text boxes to see if any part of it is above the baseline.
-                // If the top of our font box relative to the root box baseline is above the root box baseline, then
-                // we are contributing to the maxAscent value.
-                const FontMetrics& fontMetrics = curr->renderer()->style(m_firstLine)->fontMetrics();
-                affectsAscent = fontMetrics.ascent(baselineType) - curr->logicalTop() > 0;
-                
-                // Descent is similar.  If any part of our font box is below the root box's baseline, then
-                // we contribute to the maxDescent value.
-                affectsDescent = fontMetrics.descent(baselineType) + curr->logicalTop() > 0;
-            } else {
-                // Replaced elements always affect both the ascent and descent.
-                affectsAscent = true;
-                affectsDescent = true;
-            }
-        }
+        int ascent = 0;
+        int descent = 0;
+        rootBox->ascentAndDescentForBox(curr, textBoxDataMap, ascent, descent, affectsAscent, affectsDescent);
 
+        int boxHeight = ascent + descent;
         if (curr->verticalAlign() == TOP) {
-            if (maxPositionTop < lineHeight)
-                maxPositionTop = lineHeight;
+            if (maxPositionTop < ascent)
+                maxPositionTop = boxHeight;
         } else if (curr->verticalAlign() == BOTTOM) {
-            if (maxPositionBottom < lineHeight)
-                maxPositionBottom = lineHeight;
-        } else if ((!isInlineFlow || static_cast<InlineFlowBox*>(curr)->hasTextChildren()) || curr->boxModelObject()->hasInlineDirectionBordersOrPadding() || strictMode) {
+            if (maxPositionBottom < boxHeight)
+                maxPositionBottom = boxHeight;
+        } else if (!inlineFlowBox || strictMode || inlineFlowBox->hasTextChildren() || (inlineFlowBox->descendantsHaveSameLineHeightAndBaseline() && inlineFlowBox->hasTextDescendants())
+                   || inlineFlowBox->boxModelObject()->hasInlineDirectionBordersOrPadding()) {
             // Note that these values can be negative.  Even though we only affect the maxAscent and maxDescent values
             // if our box (excluding line-height) was above (for ascent) or below (for descent) the root baseline, once you factor in line-height
             // the final box can end up being fully above or fully below the root box's baseline!  This is ok, but what it
             // means is that ascent and descent (including leading), can end up being negative.  The setMaxAscent and
             // setMaxDescent booleans are used to ensure that we're willing to initially set maxAscent/Descent to negative
             // values.
-            int ascent = baseline - curr->logicalTop();
-            int descent = lineHeight - ascent;
+            ascent -= curr->logicalTop();
+            descent += curr->logicalTop();
             if (affectsAscent && (maxAscent < ascent || !setMaxAscent)) {
                 maxAscent = ascent;
                 setMaxAscent = true;
             }
+
             if (affectsDescent && (maxDescent < descent || !setMaxDescent)) {
                 maxDescent = descent;
                 setMaxDescent = true;
             }
         }
 
-        if (curr->isInlineFlowBox())
-            static_cast<InlineFlowBox*>(curr)->computeLogicalBoxHeights(maxPositionTop, maxPositionBottom, maxAscent, maxDescent,
-                                                                        setMaxAscent, setMaxDescent, strictMode, textBoxDataMap,
-                                                                        baselineType, verticalPositionCache);
+        if (inlineFlowBox)
+            inlineFlowBox->computeLogicalBoxHeights(rootBox, maxPositionTop, maxPositionBottom, maxAscent, maxDescent,
+                                                    setMaxAscent, setMaxDescent, strictMode, textBoxDataMap,
+                                                    baselineType, verticalPositionCache);
     }
 }
 
 void InlineFlowBox::placeBoxesInBlockDirection(int top, int maxHeight, int maxAscent, bool strictMode, int& lineTop, int& lineBottom, bool& setLineTop,
                                                int& lineTopIncludingMargins, int& lineBottomIncludingMargins, bool& hasAnnotationsBefore, bool& hasAnnotationsAfter, FontBaseline baselineType)
 {
-    if (isRootInlineBox())
-        setLogicalTop(top + maxAscent - baselinePosition(baselineType)); // Place our root box.
+    bool isRootBox = isRootInlineBox();
+    if (isRootBox) {
+        const FontMetrics& fontMetrics = renderer()->style(m_firstLine)->fontMetrics();
+        setLogicalTop(top + maxAscent - fontMetrics.ascent(baselineType));
+    }
+
+    int adjustmentForChildrenWithSameLineHeightAndBaseline = 0;
+    if (descendantsHaveSameLineHeightAndBaseline()) {
+        adjustmentForChildrenWithSameLineHeightAndBaseline = logicalTop();
+        if (parent())
+            adjustmentForChildrenWithSameLineHeightAndBaseline += (boxModelObject()->borderBefore() + boxModelObject()->paddingBefore());
+    }
 
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
         if (curr->renderer()->isPositioned())
             continue; // Positioned placeholders don't affect calculations.
-        
-        // Adjust boxes to use their real box y/height and not the logical height (as dictated by
-        // line-height).
-        bool isInlineFlow = curr->isInlineFlowBox();
-        if (isInlineFlow)
-            static_cast<InlineFlowBox*>(curr)->placeBoxesInBlockDirection(top, maxHeight, maxAscent, strictMode, lineTop, lineBottom, setLineTop,
-                                                                          lineTopIncludingMargins, lineBottomIncludingMargins, hasAnnotationsBefore, hasAnnotationsAfter, baselineType);
 
+        if (descendantsHaveSameLineHeightAndBaseline()) {
+            curr->adjustBlockDirectionPosition(adjustmentForChildrenWithSameLineHeightAndBaseline);
+            continue;
+        }
+
+        InlineFlowBox* inlineFlowBox = curr->isInlineFlowBox() ? static_cast<InlineFlowBox*>(curr) : 0;
         bool childAffectsTopBottomPos = true;
         if (curr->verticalAlign() == TOP)
             curr->setLogicalTop(top);
         else if (curr->verticalAlign() == BOTTOM)
             curr->setLogicalTop(top + maxHeight - curr->lineHeight());
         else {
-            if ((isInlineFlow && !static_cast<InlineFlowBox*>(curr)->hasTextChildren()) && !curr->boxModelObject()->hasInlineDirectionBordersOrPadding() && !strictMode)
+            if (!strictMode && inlineFlowBox && !inlineFlowBox->hasTextChildren() && !curr->boxModelObject()->hasInlineDirectionBordersOrPadding()
+                && !(inlineFlowBox->descendantsHaveSameLineHeightAndBaseline() && inlineFlowBox->hasTextDescendants()))
                 childAffectsTopBottomPos = false;
             int posAdjust = maxAscent - curr->baselinePosition(baselineType);
             curr->setLogicalTop(curr->logicalTop() + top + posAdjust);
@@ -676,13 +631,16 @@ void InlineFlowBox::placeBoxesInBlockDirection(int top, int maxHeight, int maxAs
             lineBottom = max(lineBottom, newLogicalTop + boxHeight);
             lineBottomIncludingMargins = max(lineBottom, max(lineBottomIncludingMargins, newLogicalTopIncludingMargins + boxHeightIncludingMargins));
         }
+        
+        // Adjust boxes to use their real box y/height and not the logical height (as dictated by
+        // line-height).
+        if (inlineFlowBox)
+            inlineFlowBox->placeBoxesInBlockDirection(top, maxHeight, maxAscent, strictMode, lineTop, lineBottom, setLineTop,
+                                                      lineTopIncludingMargins, lineBottomIncludingMargins, hasAnnotationsBefore, hasAnnotationsAfter, baselineType);
     }
 
-    if (isRootInlineBox()) {
-        const FontMetrics& fontMetrics = renderer()->style(m_firstLine)->fontMetrics();
-        setLogicalTop(logicalTop() + baselinePosition(baselineType) - fontMetrics.ascent(baselineType));
-        
-        if (hasTextChildren() || strictMode) {
+    if (isRootBox) {
+        if (strictMode || hasTextChildren() || (descendantsHaveSameLineHeightAndBaseline() && hasTextDescendants())) {
             if (!setLineTop) {
                 setLineTop = true;
                 lineTop = logicalTop();
@@ -919,10 +877,29 @@ bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
         }
     }
 
-    // Now check ourselves.
-    FloatPoint boxOrigin = locationIncludingFlipping();
-    boxOrigin.move(tx, ty);
-    FloatRect rect(boxOrigin, IntSize(width(), height()));
+    // Now check ourselves. Pixel snap hit testing.
+    IntRect frameRect = roundedFrameRect();
+    int minX = frameRect.x();
+    int minY = frameRect.y();
+    int width = frameRect.width();
+    int height = frameRect.height();
+
+    // Constrain our hit testing to the line top and bottom if necessary.
+    bool noQuirksMode = renderer()->document()->inNoQuirksMode();
+    if (!noQuirksMode && !hasTextChildren() && !(descendantsHaveSameLineHeightAndBaseline() && hasTextDescendants())) {
+        RootInlineBox* rootBox = root();
+        int& top = isHorizontal() ? minY : minX;
+        int& logicalHeight = isHorizontal() ? height : width;
+        int bottom = min(rootBox->lineBottom(), top + logicalHeight);
+        top = max(rootBox->lineTop(), top);
+        logicalHeight = bottom - top;
+    }
+    
+    // Move x/y to our coordinates.
+    IntRect rect(minX, minY, width, height);
+    flipForWritingMode(rect);
+    rect.move(tx, ty);
+
     if (visibleToHitTesting() && rect.intersects(result.rectForPoint(x, y))) {
         renderer()->updateHitTestResult(result, flipForWritingMode(IntPoint(x - tx, y - ty))); // Don't add in m_x or m_y here, we want coords in the containing block's space.
         if (!result.addNodeToRectBasedTestResult(renderer()->node(), x, y, rect))
@@ -1074,7 +1051,7 @@ void InlineFlowBox::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 
     // Constrain our background/border painting to the line top and bottom if necessary.
     bool noQuirksMode = renderer()->document()->inNoQuirksMode();
-    if (!hasTextChildren() && !noQuirksMode) {
+    if (!noQuirksMode && !hasTextChildren() && !(descendantsHaveSameLineHeightAndBaseline() && hasTextDescendants())) {
         RootInlineBox* rootBox = root();
         int& top = isHorizontal() ? y : x;
         int& logicalHeight = isHorizontal() ? h : w;
@@ -1156,7 +1133,7 @@ void InlineFlowBox::paintMask(PaintInfo& paintInfo, int tx, int ty)
 
     // Constrain our background/border painting to the line top and bottom if necessary.
     bool noQuirksMode = renderer()->document()->inNoQuirksMode();
-    if (!hasTextChildren() && !noQuirksMode) {
+    if (!noQuirksMode && !hasTextChildren() && !(descendantsHaveSameLineHeightAndBaseline() && hasTextDescendants())) {
         RootInlineBox* rootBox = root();
         int& top = isHorizontal() ? y : x;
         int& logicalHeight = isHorizontal() ? h : w;
@@ -1363,6 +1340,59 @@ int InlineFlowBox::computeUnderAnnotationAdjustment(int allowedPosition) const
     return result;
 }
 
+void InlineFlowBox::collectLeafBoxesInLogicalOrder(Vector<InlineBox*>& leafBoxesInLogicalOrder, CustomInlineBoxRangeReverse customReverseImplementation, void* userData) const
+{
+    InlineBox* leaf = firstLeafChild();
+
+    // FIXME: The reordering code is a copy of parts from BidiResolver::createBidiRunsForLine, operating directly on InlineBoxes, instead of BidiRuns.
+    // Investigate on how this code could possibly be shared.
+    unsigned char minLevel = 128;
+    unsigned char maxLevel = 0;
+
+    // First find highest and lowest levels, and initialize leafBoxesInLogicalOrder with the leaf boxes in visual order.
+    for (; leaf; leaf = leaf->nextLeafChild()) {
+        minLevel = min(minLevel, leaf->bidiLevel());
+        maxLevel = max(maxLevel, leaf->bidiLevel());
+        leafBoxesInLogicalOrder.append(leaf);
+    }
+
+    if (renderer()->style()->visuallyOrdered())
+        return;
+
+    // Reverse of reordering of the line (L2 according to Bidi spec):
+    // L2. From the highest level found in the text to the lowest odd level on each line,
+    // reverse any contiguous sequence of characters that are at that level or higher.
+
+    // Reversing the reordering of the line is only done up to the lowest odd level.
+    if (!(minLevel % 2))
+        ++minLevel;
+
+    Vector<InlineBox*>::iterator end = leafBoxesInLogicalOrder.end();
+    while (minLevel <= maxLevel) {
+        Vector<InlineBox*>::iterator it = leafBoxesInLogicalOrder.begin();
+        while (it != end) {
+            while (it != end) {
+                if ((*it)->bidiLevel() >= minLevel)
+                    break;
+                ++it;
+            }
+            Vector<InlineBox*>::iterator first = it;
+            while (it != end) {
+                if ((*it)->bidiLevel() < minLevel)
+                    break;
+                ++it;
+            }
+            Vector<InlineBox*>::iterator last = it;
+            if (customReverseImplementation) {
+                ASSERT(userData);
+                (*customReverseImplementation)(userData, first, last);
+            } else
+                std::reverse(first, last);
+        }                
+        ++minLevel;
+    }
+}
+
 #ifndef NDEBUG
 
 void InlineFlowBox::checkConsistency() const
diff --git a/Source/WebCore/rendering/InlineFlowBox.h b/Source/WebCore/rendering/InlineFlowBox.h
index 918cf5d..9b6f8e4 100644
--- a/Source/WebCore/rendering/InlineFlowBox.h
+++ b/Source/WebCore/rendering/InlineFlowBox.h
@@ -45,6 +45,7 @@ public:
         , m_nextLineBox(0)
         , m_includeLogicalLeftEdge(false)
         , m_includeLogicalRightEdge(false)
+        , m_descendantsHaveSameLineHeightAndBaseline(true)
 #ifndef NDEBUG
         , m_hasBadChildList(false)
 #endif
@@ -55,6 +56,7 @@ public:
         // text children must not apply.  This change also means that gaps will exist between image bullet list items.  Even when the list bullet
         // is an image, the line is still considered to be immune from the quirk.
         m_hasTextChildren = obj->style()->display() == LIST_ITEM;
+        m_hasTextDescendants = m_hasTextChildren;
     }
 
 #ifndef NDEBUG
@@ -74,6 +76,9 @@ public:
     InlineBox* firstLeafChild() const;
     InlineBox* lastLeafChild() const;
 
+    typedef void (*CustomInlineBoxRangeReverse)(void* userData, Vector<InlineBox*>::iterator first, Vector<InlineBox*>::iterator last);
+    void collectLeafBoxesInLogicalOrder(Vector<InlineBox*>&, CustomInlineBoxRangeReverse customReverseImplementation = 0, void* userData = 0) const;
+
     virtual void setConstructed()
     {
         InlineBox::setConstructed();
@@ -154,11 +159,11 @@ public:
     }
 
     // Helper functions used during line construction and placement.
-    void determineSpacingForFlowBoxes(bool lastLine, RenderObject* endObject);
+    void determineSpacingForFlowBoxes(bool lastLine, RenderObject* endObject, RenderObject* logicallyLastRunRenderer);
     int getFlowSpacingLogicalWidth();
     bool onEndChain(RenderObject* endObject);
     float placeBoxesInInlineDirection(float logicalLeft, bool& needsWordSpacing, GlyphOverflowAndFallbackFontsMap&);
-    void computeLogicalBoxHeights(int& maxPositionTop, int& maxPositionBottom,
+    void computeLogicalBoxHeights(RootInlineBox*, int& maxPositionTop, int& maxPositionBottom,
                                   int& maxAscent, int& maxDescent, bool& setMaxAscent, bool& setMaxDescent,
                                   bool strictMode, GlyphOverflowAndFallbackFontsMap&, FontBaseline, VerticalPositionCache&);
     void adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent,
@@ -181,6 +186,7 @@ public:
     virtual float placeEllipsisBox(bool ltr, float blockLeftEdge, float blockRightEdge, float ellipsisWidth, bool&);
 
     bool hasTextChildren() const { return m_hasTextChildren; }
+    bool hasTextDescendants() const { return m_hasTextDescendants; }
 
     void checkConsistency() const;
     void setHasBadChildList();
@@ -226,6 +232,14 @@ public:
     void setLayoutOverflow(const IntRect&);
     void setVisualOverflow(const IntRect&);
 
+    bool descendantsHaveSameLineHeightAndBaseline() const { return m_descendantsHaveSameLineHeightAndBaseline; }
+    void clearDescendantsHaveSameLineHeightAndBaseline()
+    { 
+        m_descendantsHaveSameLineHeightAndBaseline = false;
+        if (parent() && parent()->descendantsHaveSameLineHeightAndBaseline())
+            parent()->clearDescendantsHaveSameLineHeightAndBaseline();
+    }
+
 private:
     void addBoxShadowVisualOverflow(IntRect& logicalVisualOverflow);
     void addTextBoxVisualOverflow(const InlineTextBox*, GlyphOverflowAndFallbackFontsMap&, IntRect& logicalVisualOverflow);
@@ -245,6 +259,8 @@ protected:
     bool m_includeLogicalLeftEdge : 1;
     bool m_includeLogicalRightEdge : 1;
     bool m_hasTextChildren : 1;
+    bool m_hasTextDescendants : 1;
+    bool m_descendantsHaveSameLineHeightAndBaseline : 1;
 
 #ifndef NDEBUG
     bool m_hasBadChildList;
diff --git a/Source/WebCore/rendering/InlineIterator.h b/Source/WebCore/rendering/InlineIterator.h
index 270364f..75d9763 100644
--- a/Source/WebCore/rendering/InlineIterator.h
+++ b/Source/WebCore/rendering/InlineIterator.h
@@ -34,43 +34,89 @@ namespace WebCore {
 class InlineIterator {
 public:
     InlineIterator()
-        : block(0)
-        , obj(0)
-        , pos(0)
-        , nextBreakablePosition(-1)
+        : m_block(0)
+        , m_obj(0)
+        , m_pos(0)
+        , m_nextBreakablePosition(-1)
     {
     }
 
     InlineIterator(RenderBlock* b, RenderObject* o, unsigned p)
-        : block(b)
-        , obj(o)
-        , pos(p)
-        , nextBreakablePosition(-1)
+        : m_block(b)
+        , m_obj(o)
+        , m_pos(p)
+        , m_nextBreakablePosition(-1)
     {
     }
 
+    void clear() { moveTo(0, 0); }
+
+    void moveToStartOf(RenderObject* object)
+    {
+        moveTo(object, 0);
+    }
+
+    void moveTo(RenderObject* object, unsigned offset, int nextBreak = -1)
+    {
+        m_obj = object;
+        m_pos = offset;
+        m_nextBreakablePosition = nextBreak;
+    }
+
     void increment(InlineBidiResolver* resolver = 0);
     bool atEnd() const;
 
     UChar current() const;
     ALWAYS_INLINE WTF::Unicode::Direction direction() const;
 
-    RenderBlock* block;
-    RenderObject* obj;
-    unsigned pos;
-    int nextBreakablePosition;
+    RenderBlock* m_block;
+    RenderObject* m_obj;
+    unsigned m_pos;
+    int m_nextBreakablePosition;
 };
 
 inline bool operator==(const InlineIterator& it1, const InlineIterator& it2)
 {
-    return it1.pos == it2.pos && it1.obj == it2.obj;
+    return it1.m_pos == it2.m_pos && it1.m_obj == it2.m_obj;
 }
 
 inline bool operator!=(const InlineIterator& it1, const InlineIterator& it2)
 {
-    return it1.pos != it2.pos || it1.obj != it2.obj;
+    return it1.m_pos != it2.m_pos || it1.m_obj != it2.m_obj;
+}
+
+static inline WTF::Unicode::Direction embedCharFromDirection(TextDirection dir, EUnicodeBidi unicodeBidi)
+{
+    using namespace WTF::Unicode;
+    if (unicodeBidi == Embed)
+        return dir == RTL ? RightToLeftEmbedding : LeftToRightEmbedding;
+    return dir == RTL ? RightToLeftOverride : LeftToRightOverride;
+}
+
+static inline void notifyResolverEnteredObject(InlineBidiResolver* resolver, RenderObject* object)
+{
+    if (!resolver || !object || !object->isRenderInline())
+        return;
+
+    RenderStyle* style = object->style();
+    EUnicodeBidi unicodeBidi = style->unicodeBidi();
+    if (unicodeBidi == UBNormal)
+        return;
+    resolver->embed(embedCharFromDirection(style->direction(), unicodeBidi), FromStyleOrDOM);
+}
+
+static inline void notifyResolverWillExitObject(InlineBidiResolver* resolver, RenderObject* object)
+{
+    if (!resolver || !object || !object->isRenderInline())
+        return;
+    if (object->style()->unicodeBidi() == UBNormal)
+        return;
+    resolver->embed(WTF::Unicode::PopDirectionalFormat, FromStyleOrDOM);
 }
 
+// FIXME: This function is misleadingly named. It has little to do with bidi.
+// This function will iterate over inlines within a block, optionally notifying
+// a bidi resolver as it enters/exits inlines (so it can push/pop embedding levels).
 static inline RenderObject* bidiNext(RenderBlock* block, RenderObject* current, InlineBidiResolver* resolver = 0, bool skipInlines = true, bool* endOfInlinePtr = 0)
 {
     RenderObject* next = 0;
@@ -81,16 +127,7 @@ static inline RenderObject* bidiNext(RenderBlock* block, RenderObject* current,
         next = 0;
         if (!oldEndOfInline && !current->isFloating() && !current->isReplaced() && !current->isPositioned() && !current->isText()) {
             next = current->firstChild();
-            if (next && resolver && next->isRenderInline()) {
-                EUnicodeBidi ub = next->style()->unicodeBidi();
-                if (ub != UBNormal) {
-                    TextDirection dir = next->style()->direction();
-                    WTF::Unicode::Direction d = (ub == Embed
-                        ? (dir == RTL ? WTF::Unicode::RightToLeftEmbedding : WTF::Unicode::LeftToRightEmbedding)
-                        : (dir == RTL ? WTF::Unicode::RightToLeftOverride : WTF::Unicode::LeftToRightOverride));
-                    resolver->embed(d);
-                }
-            }
+            notifyResolverEnteredObject(resolver, next);
         }
 
         if (!next) {
@@ -101,24 +138,14 @@ static inline RenderObject* bidiNext(RenderBlock* block, RenderObject* current,
             }
 
             while (current && current != block) {
-                if (resolver && current->isRenderInline() && current->style()->unicodeBidi() != UBNormal)
-                    resolver->embed(WTF::Unicode::PopDirectionalFormat);
+                notifyResolverWillExitObject(resolver, current);
 
                 next = current->nextSibling();
                 if (next) {
-                    if (resolver && next->isRenderInline()) {
-                        EUnicodeBidi ub = next->style()->unicodeBidi();
-                        if (ub != UBNormal) {
-                            TextDirection dir = next->style()->direction();
-                            WTF::Unicode::Direction d = (ub == Embed
-                                ? (dir == RTL ? WTF::Unicode::RightToLeftEmbedding: WTF::Unicode::LeftToRightEmbedding)
-                                : (dir == RTL ? WTF::Unicode::RightToLeftOverride : WTF::Unicode::LeftToRightOverride));
-                            resolver->embed(d);
-                        }
-                    }
+                    notifyResolverEnteredObject(resolver, next);
                     break;
                 }
-                
+
                 current = current->parent();
                 if (!skipInlines && current && current != block && current->isRenderInline()) {
                     next = current;
@@ -148,19 +175,10 @@ static inline RenderObject* bidiFirst(RenderBlock* block, InlineBidiResolver* re
 {
     if (!block->firstChild())
         return 0;
-    
+
     RenderObject* o = block->firstChild();
     if (o->isRenderInline()) {
-        if (resolver) {
-            EUnicodeBidi ub = o->style()->unicodeBidi();
-            if (ub != UBNormal) {
-                TextDirection dir = o->style()->direction();
-                WTF::Unicode::Direction d = (ub == Embed
-                    ? (dir == RTL ? WTF::Unicode::RightToLeftEmbedding : WTF::Unicode::LeftToRightEmbedding)
-                    : (dir == RTL ? WTF::Unicode::RightToLeftOverride : WTF::Unicode::LeftToRightOverride));
-                resolver->embed(d);
-            }
-        }
+        notifyResolverEnteredObject(resolver, o);
         if (skipInlines && o->firstChild())
             o = bidiNext(block, o, resolver, skipInlines);
         else {
@@ -181,37 +199,32 @@ static inline RenderObject* bidiFirst(RenderBlock* block, InlineBidiResolver* re
 
 inline void InlineIterator::increment(InlineBidiResolver* resolver)
 {
-    if (!obj)
+    if (!m_obj)
         return;
-    if (obj->isText()) {
-        pos++;
-        if (pos >= toRenderText(obj)->textLength()) {
-            obj = bidiNext(block, obj, resolver);
-            pos = 0;
-            nextBreakablePosition = -1;
-        }
-    } else {
-        obj = bidiNext(block, obj, resolver);
-        pos = 0;
-        nextBreakablePosition = -1;
+    if (m_obj->isText()) {
+        m_pos++;
+        if (m_pos < toRenderText(m_obj)->textLength())
+            return;
     }
+    // bidiNext can return 0, so use moveTo instead of moveToStartOf
+    moveTo(bidiNext(m_block, m_obj, resolver), 0);
 }
 
 inline bool InlineIterator::atEnd() const
 {
-    return !obj;
+    return !m_obj;
 }
 
 inline UChar InlineIterator::current() const
 {
-    if (!obj || !obj->isText())
+    if (!m_obj || !m_obj->isText())
         return 0;
 
-    RenderText* text = toRenderText(obj);
-    if (pos >= text->textLength())
+    RenderText* text = toRenderText(m_obj);
+    if (m_pos >= text->textLength())
         return 0;
 
-    return text->characters()[pos];
+    return text->characters()[m_pos];
 }
 
 ALWAYS_INLINE WTF::Unicode::Direction InlineIterator::direction() const
@@ -219,8 +232,8 @@ ALWAYS_INLINE WTF::Unicode::Direction InlineIterator::direction() const
     if (UChar c = current())
         return WTF::Unicode::direction(c);
 
-    if (obj && obj->isListMarker())
-        return obj->style()->isLeftToRightDirection() ? WTF::Unicode::LeftToRight : WTF::Unicode::RightToLeft;
+    if (m_obj && m_obj->isListMarker())
+        return m_obj->style()->isLeftToRightDirection() ? WTF::Unicode::LeftToRight : WTF::Unicode::RightToLeft;
 
     return WTF::Unicode::OtherNeutral;
 }
@@ -228,33 +241,33 @@ ALWAYS_INLINE WTF::Unicode::Direction InlineIterator::direction() const
 template<>
 inline void InlineBidiResolver::increment()
 {
-    current.increment(this);
+    m_current.increment(this);
 }
 
 template <>
 inline void InlineBidiResolver::appendRun()
 {
-    if (!emptyRun && !eor.atEnd()) {
-        int start = sor.pos;
-        RenderObject *obj = sor.obj;
-        while (obj && obj != eor.obj && obj != endOfLine.obj) {
+    if (!emptyRun && !m_eor.atEnd()) {
+        int start = m_sor.m_pos;
+        RenderObject* obj = m_sor.m_obj;
+        while (obj && obj != m_eor.m_obj && obj != endOfLine.m_obj) {
             RenderBlock::appendRunsForObject(start, obj->length(), obj, *this);        
             start = 0;
-            obj = bidiNext(sor.block, obj);
+            obj = bidiNext(m_sor.m_block, obj);
         }
         if (obj) {
-            unsigned pos = obj == eor.obj ? eor.pos : UINT_MAX;
-            if (obj == endOfLine.obj && endOfLine.pos <= pos) {
-                reachedEndOfLine = true;
-                pos = endOfLine.pos;
+            unsigned pos = obj == m_eor.m_obj ? m_eor.m_pos : UINT_MAX;
+            if (obj == endOfLine.m_obj && endOfLine.m_pos <= pos) {
+                m_reachedEndOfLine = true;
+                pos = endOfLine.m_pos;
             }
             // It's OK to add runs for zero-length RenderObjects, just don't make the run larger than it should be
-            int end = obj->length() ? pos+1 : 0;
+            int end = obj->length() ? pos + 1 : 0;
             RenderBlock::appendRunsForObject(start, end, obj, *this);
         }
         
-        eor.increment();
-        sor = eor;
+        m_eor.increment();
+        m_sor = m_eor;
     }
 
     m_direction = WTF::Unicode::OtherNeutral;
diff --git a/Source/WebCore/rendering/InlineTextBox.cpp b/Source/WebCore/rendering/InlineTextBox.cpp
index 3c3e450..b614f0f 100644
--- a/Source/WebCore/rendering/InlineTextBox.cpp
+++ b/Source/WebCore/rendering/InlineTextBox.cpp
@@ -163,7 +163,7 @@ IntRect InlineTextBox::selectionRect(int tx, int ty, int startPos, int endPos)
         ePos = len;
     }
 
-    IntRect r = enclosingIntRect(f.selectionRectForText(TextRun(characters, len, textObj->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride),
+    IntRect r = enclosingIntRect(f.selectionRectForText(TextRun(characters, len, textObj->allowTabs(), textPos(), m_expansion, expansionBehavior(), !isLeftToRightDirection(), m_dirOverride),
                                                         IntPoint(), selHeight, sPos, ePos));
                                                         
     int logicalWidth = r.width();
@@ -427,6 +427,14 @@ bool InlineTextBox::getEmphasisMarkPosition(RenderStyle* style, TextEmphasisPosi
     return !rubyText || !rubyText->firstLineBox();
 }
 
+enum RotationDirection { Counterclockwise, Clockwise };
+
+static inline AffineTransform rotation(const FloatRect& boxRect, RotationDirection clockwise)
+{
+    return clockwise ? AffineTransform(0, 1, -1, 0, boxRect.x() + boxRect.maxY(), boxRect.maxY() - boxRect.x())
+        : AffineTransform(0, -1, 1, 0, boxRect.x() - boxRect.maxY(), boxRect.x() + boxRect.maxY());
+}
+
 void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
 {
     if (isLineBreak() || !paintInfo.shouldPaintWithinRoot(renderer()) || renderer()->style()->visibility() != VISIBLE ||
@@ -485,26 +493,22 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
     FloatPoint boxOrigin = locationIncludingFlipping();
     boxOrigin.move(tx, ty);    
     FloatRect boxRect(boxOrigin, IntSize(logicalWidth(), logicalHeight()));
-    FloatPoint textOrigin = FloatPoint(boxOrigin.x(), boxOrigin.y() + styleToUse->fontMetrics().ascent());
 
-    RenderCombineText* combinedText = styleToUse->hasTextCombine() ? toRenderCombineText(textRenderer()) : 0;
-    bool shouldRotate = !isHorizontal() && (!combinedText || !combinedText->isCombined());
-    if (shouldRotate) {
-        context->save();
-        context->translate(boxRect.x(), boxRect.maxY());
-        context->rotate(static_cast<float>(deg2rad(90.)));
-        context->translate(-boxRect.x(), -boxRect.maxY());
-    }
-    
-    
+    RenderCombineText* combinedText = styleToUse->hasTextCombine() && textRenderer()->isCombineText() && toRenderCombineText(textRenderer())->isCombined() ? toRenderCombineText(textRenderer()) : 0;
+
+    bool shouldRotate = !isHorizontal() && !combinedText;
+    if (shouldRotate)
+        context->concatCTM(rotation(boxRect, Clockwise));
+
     // Determine whether or not we have composition underlines to draw.
     bool containsComposition = renderer()->node() && renderer()->frame()->editor()->compositionNode() == renderer()->node();
     bool useCustomUnderlines = containsComposition && renderer()->frame()->editor()->compositionUsesCustomUnderlines();
 
     // Set our font.
-    int d = styleToUse->textDecorationsInEffect();
     const Font& font = styleToUse->font();
 
+    FloatPoint textOrigin = FloatPoint(boxOrigin.x(), boxOrigin.y() + font.fontMetrics().ascent());
+
     if (combinedText)
         combinedText->adjustTextOrigin(textOrigin, boxRect);
 
@@ -618,7 +622,7 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
     if (hasHyphen())
         adjustCharactersAndLengthForHyphen(charactersWithHyphen, styleToUse, characters, length);
 
-    TextRun textRun(characters, length, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride || styleToUse->visuallyOrdered());
+    TextRun textRun(characters, length, textRenderer()->allowTabs(), textPos(), m_expansion, expansionBehavior(), !isLeftToRightDirection(), m_dirOverride || styleToUse->visuallyOrdered());
 
     int sPos = 0;
     int ePos = 0;
@@ -653,11 +657,21 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
 
         if (!emphasisMark.isEmpty()) {
             updateGraphicsContext(context, emphasisMarkColor, textStrokeColor, textStrokeWidth, styleToUse->colorSpace());
+
+            static TextRun objectReplacementCharacterTextRun(&objectReplacementCharacter, 1);
+            TextRun& emphasisMarkTextRun = combinedText ? objectReplacementCharacterTextRun : textRun;
+            FloatPoint emphasisMarkTextOrigin = combinedText ? FloatPoint(boxOrigin.x() + boxRect.width() / 2, boxOrigin.y() + font.fontMetrics().ascent()) : textOrigin;
+            if (combinedText)
+                context->concatCTM(rotation(boxRect, Clockwise));
+
             if (!paintSelectedTextSeparately || ePos <= sPos) {
                 // FIXME: Truncate right-to-left text correctly.
-                paintTextWithShadows(context, font, textRun, emphasisMark, emphasisMarkOffset, 0, length, length, textOrigin, boxRect, textShadow, textStrokeWidth > 0, isHorizontal());
+                paintTextWithShadows(context, combinedText ? combinedText->originalFont() : font, emphasisMarkTextRun, emphasisMark, emphasisMarkOffset, 0, length, length, emphasisMarkTextOrigin, boxRect, textShadow, textStrokeWidth > 0, isHorizontal());
             } else
-                paintTextWithShadows(context, font, textRun, emphasisMark, emphasisMarkOffset, ePos, sPos, length, textOrigin, boxRect, textShadow, textStrokeWidth > 0, isHorizontal());
+                paintTextWithShadows(context, combinedText ? combinedText->originalFont() : font, emphasisMarkTextRun, emphasisMark, emphasisMarkOffset, ePos, sPos, length, emphasisMarkTextOrigin, boxRect, textShadow, textStrokeWidth > 0, isHorizontal());
+
+            if (combinedText)
+                context->concatCTM(rotation(boxRect, Counterclockwise));
         }
 
         if (textStrokeWidth > 0)
@@ -673,16 +687,27 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
         paintTextWithShadows(context, font, textRun, nullAtom, 0, sPos, ePos, length, textOrigin, boxRect, selectionShadow, selectionStrokeWidth > 0, isHorizontal());
         if (!emphasisMark.isEmpty()) {
             updateGraphicsContext(context, selectionEmphasisMarkColor, textStrokeColor, textStrokeWidth, styleToUse->colorSpace());
-            paintTextWithShadows(context, font, textRun, emphasisMark, emphasisMarkOffset, sPos, ePos, length, textOrigin, boxRect, selectionShadow, selectionStrokeWidth > 0, isHorizontal());
+
+            static TextRun objectReplacementCharacterTextRun(&objectReplacementCharacter, 1);
+            TextRun& emphasisMarkTextRun = combinedText ? objectReplacementCharacterTextRun : textRun;
+            FloatPoint emphasisMarkTextOrigin = combinedText ? FloatPoint(boxOrigin.x() + boxRect.width() / 2, boxOrigin.y() + font.fontMetrics().ascent()) : textOrigin;
+            if (combinedText)
+                context->concatCTM(rotation(boxRect, Clockwise));
+
+            paintTextWithShadows(context, combinedText ? combinedText->originalFont() : font, emphasisMarkTextRun, emphasisMark, emphasisMarkOffset, sPos, ePos, length, emphasisMarkTextOrigin, boxRect, selectionShadow, selectionStrokeWidth > 0, isHorizontal());
+
+            if (combinedText)
+                context->concatCTM(rotation(boxRect, Counterclockwise));
         }
         if (selectionStrokeWidth > 0)
             context->restore();
     }
 
     // Paint decorations
-    if (d != TDNONE && paintInfo.phase != PaintPhaseSelection) {
+    int textDecorations = styleToUse->textDecorationsInEffect();
+    if (textDecorations != TDNONE && paintInfo.phase != PaintPhaseSelection) {
         updateGraphicsContext(context, textFillColor, textStrokeColor, textStrokeWidth, styleToUse->colorSpace());
-        paintDecoration(context, boxOrigin, d, textShadow);
+        paintDecoration(context, boxOrigin, textDecorations, textShadow);
     }
 
     if (paintInfo.phase == PaintPhaseForeground) {
@@ -715,7 +740,7 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
     }
     
     if (shouldRotate)
-        context->restore();
+        context->concatCTM(rotation(boxRect, Counterclockwise));
 }
 
 void InlineTextBox::selectionStartEnd(int& sPos, int& ePos)
@@ -772,7 +797,7 @@ void InlineTextBox::paintSelection(GraphicsContext* context, const FloatPoint& b
     int selHeight = selectionHeight();
     FloatPoint localOrigin(boxOrigin.x(), boxOrigin.y() - deltaY);
     context->clip(FloatRect(localOrigin, FloatSize(m_logicalWidth, selHeight)));
-    context->drawHighlightForText(font, TextRun(characters, length, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), 
+    context->drawHighlightForText(font, TextRun(characters, length, textRenderer()->allowTabs(), textPos(), m_expansion, expansionBehavior(), 
                                   !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered()),
                                   localOrigin, selHeight, c, style->colorSpace(), sPos, ePos);
     context->restore();
@@ -796,7 +821,7 @@ void InlineTextBox::paintCompositionBackground(GraphicsContext* context, const F
     int deltaY = renderer()->style()->isFlippedLinesWritingMode() ? selectionBottom() - logicalBottom() : logicalTop() - selectionTop();
     int selHeight = selectionHeight();
     FloatPoint localOrigin(boxOrigin.x(), boxOrigin.y() - deltaY);
-    context->drawHighlightForText(font, TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(),
+    context->drawHighlightForText(font, TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, expansionBehavior(),
                                   !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered()),
                                   localOrigin, selHeight, c, style->colorSpace(), sPos, ePos);
     context->restore();
@@ -958,7 +983,7 @@ void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, const Floa
         int deltaY = renderer()->style()->isFlippedLinesWritingMode() ? selectionBottom() - logicalBottom() : logicalTop() - selectionTop();
         int selHeight = selectionHeight();
         FloatPoint startPoint(boxOrigin.x(), boxOrigin.y() - deltaY);
-        TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
+        TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, expansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
         
         // FIXME: Convert the document markers to float rects.
         IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, startPoint, selHeight, startPosition, endPosition));
@@ -1003,7 +1028,7 @@ void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, const FloatPoint&
 
     int sPos = max(marker.startOffset - m_start, (unsigned)0);
     int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
-    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
+    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, expansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
     
     // Always compute and store the rect associated with this marker. The computed rect is in absolute coordinates.
     IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, IntPoint(m_x, selectionTop()), selHeight, sPos, ePos));
@@ -1031,7 +1056,7 @@ void InlineTextBox::computeRectForReplacementMarker(const DocumentMarker& marker
     
     int sPos = max(marker.startOffset - m_start, (unsigned)0);
     int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
-    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
+    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, expansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
     IntPoint startPoint = IntPoint(m_x, y);
     
     // Compute and store the rect associated with this marker.
@@ -1192,7 +1217,7 @@ int InlineTextBox::offsetForPosition(float lineOffset, bool includePartialGlyphs
     RenderStyle* style = text->style(m_firstLine);
     const Font* f = &style->font();
     int offset = f->offsetForPosition(TextRun(textRenderer()->text()->characters() + m_start, m_len,
-        textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered()),
+        textRenderer()->allowTabs(), textPos(), m_expansion, expansionBehavior(), !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered()),
         lineOffset - logicalLeft(), includePartialGlyphs);
     if (blockIsInOppositeDirection && (!offset || offset == m_len))
         return !offset ? m_len : 0;
@@ -1212,7 +1237,7 @@ float InlineTextBox::positionForOffset(int offset) const
     int from = !isLeftToRightDirection() ? offset - m_start : 0;
     int to = !isLeftToRightDirection() ? m_len : offset - m_start;
     // FIXME: Do we need to add rightBearing here?
-    return f.selectionRectForText(TextRun(text->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, trailingExpansionBehavior(), !isLeftToRightDirection(), m_dirOverride),
+    return f.selectionRectForText(TextRun(text->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_expansion, expansionBehavior(), !isLeftToRightDirection(), m_dirOverride),
                                   IntPoint(logicalLeft(), 0), 0, from, to).maxX();
 }
 
diff --git a/Source/WebCore/rendering/InlineTextBox.h b/Source/WebCore/rendering/InlineTextBox.h
index d894b85..98a1b78 100644
--- a/Source/WebCore/rendering/InlineTextBox.h
+++ b/Source/WebCore/rendering/InlineTextBox.h
@@ -69,6 +69,10 @@ public:
 
     bool hasHyphen() const { return m_hasEllipsisBoxOrHyphen; }
     void setHasHyphen(bool hasHyphen) { m_hasEllipsisBoxOrHyphen = hasHyphen; }
+
+    bool canHaveLeadingExpansion() const { return m_hasSelectedChildrenOrCanHaveLeadingExpansion; }
+    void setCanHaveLeadingExpansion(bool canHaveLeadingExpansion) { m_hasSelectedChildrenOrCanHaveLeadingExpansion = canHaveLeadingExpansion; }
+
     static inline bool compareByStart(const InlineTextBox* first, const InlineTextBox* second) { return first->start() < second->start(); }
 
     virtual int baselinePosition(FontBaseline) const;
@@ -158,7 +162,11 @@ private:
     void paintTextMatchMarker(GraphicsContext*, const FloatPoint& boxOrigin, const DocumentMarker&, RenderStyle*, const Font&);
     void computeRectForReplacementMarker(const DocumentMarker&, RenderStyle*, const Font&);
 
-    TextRun::TrailingExpansionBehavior trailingExpansionBehavior() const { return m_expansion && nextLeafChild() ? TextRun::AllowTrailingExpansion : TextRun::ForbidTrailingExpansion; }
+    TextRun::ExpansionBehavior expansionBehavior() const
+    {
+        return (canHaveLeadingExpansion() ? TextRun::AllowLeadingExpansion : TextRun::ForbidLeadingExpansion)
+            | (m_expansion && nextLeafChild() ? TextRun::AllowTrailingExpansion : TextRun::ForbidTrailingExpansion);
+    }
 };
 
 inline RenderText* InlineTextBox::textRenderer() const
diff --git a/Source/WebCore/rendering/MediaControlElements.cpp b/Source/WebCore/rendering/MediaControlElements.cpp
index 32aac90..07df4d9 100644
--- a/Source/WebCore/rendering/MediaControlElements.cpp
+++ b/Source/WebCore/rendering/MediaControlElements.cpp
@@ -41,9 +41,11 @@
 #include "MediaControls.h"
 #include "MouseEvent.h"
 #include "Page.h"
+#include "RenderFlexibleBox.h"
 #include "RenderMedia.h"
 #include "RenderSlider.h"
 #include "RenderTheme.h"
+#include "RenderView.h"
 #include "Settings.h"
 
 namespace WebCore {
@@ -250,11 +252,41 @@ const AtomicString& MediaControlTimelineContainerElement::shadowPseudoId() const
 
 // ----------------------------
 
+class RenderMediaVolumeSliderContainer : public RenderBlock {
+public:
+    RenderMediaVolumeSliderContainer(Node*);
+
+private:
+    virtual void layout();
+};
+
+RenderMediaVolumeSliderContainer::RenderMediaVolumeSliderContainer(Node* node)
+    : RenderBlock(node)
+{
+}
+
+void RenderMediaVolumeSliderContainer::layout()
+{
+    RenderBlock::layout();
+    if (style()->display() == NONE || !previousSibling() || !previousSibling()->isBox())
+        return;
+
+    RenderBox* buttonBox = toRenderBox(previousSibling());
+
+    if (view())
+        view()->disableLayoutState();
+
+    IntPoint offset = theme()->volumeSliderOffsetFromMuteButton(buttonBox, IntSize(width(), height()));
+    setX(offset.x() + buttonBox->offsetLeft());
+    setY(offset.y() + buttonBox->offsetTop());
+
+    if (view())
+        view()->enableLayoutState();
+}
+
 inline MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement(HTMLMediaElement* mediaElement)
     : MediaControlElement(mediaElement)
     , m_isVisible(false)
-    , m_x(0)
-    , m_y(0)
 {
 }
 
@@ -263,12 +295,15 @@ PassRefPtr<MediaControlVolumeSliderContainerElement> MediaControlVolumeSliderCon
     return adoptRef(new MediaControlVolumeSliderContainerElement(mediaElement));
 }
 
+RenderObject* MediaControlVolumeSliderContainerElement::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    return new (arena) RenderMediaVolumeSliderContainer(this);
+}
+
 PassRefPtr<RenderStyle> MediaControlVolumeSliderContainerElement::styleForElement()
 {
     RefPtr<RenderStyle> style = MediaControlElement::styleForElement();
     style->setPosition(AbsolutePosition);
-    style->setLeft(Length(m_x, Fixed));
-    style->setTop(Length(m_y, Fixed));
     style->setDisplay(m_isVisible ? BLOCK : NONE);
     return style;
 }
@@ -280,14 +315,6 @@ void MediaControlVolumeSliderContainerElement::setVisible(bool visible)
     m_isVisible = visible;
 }
 
-void MediaControlVolumeSliderContainerElement::setPosition(int x, int y)
-{
-    if (x == m_x && y == m_y)
-        return;
-    m_x = x;
-    m_y = y;
-}
-
 bool MediaControlVolumeSliderContainerElement::hitTest(const IntPoint& absPoint)
 {
     if (renderer() && renderer()->style()->hasAppearance())
@@ -776,6 +803,7 @@ PassRefPtr<MediaControlTimelineElement> MediaControlTimelineElement::create(HTML
 {
     RefPtr<MediaControlTimelineElement> timeline = adoptRef(new MediaControlTimelineElement(mediaElement));
     timeline->setType("range");
+    timeline->setAttribute(precisionAttr, "float");
     return timeline.release();
 }
 
@@ -841,6 +869,9 @@ PassRefPtr<MediaControlVolumeSliderElement> MediaControlVolumeSliderElement::cre
 {
     RefPtr<MediaControlVolumeSliderElement> slider = adoptRef(new MediaControlVolumeSliderElement(mediaElement));
     slider->setType("range");
+    slider->setAttribute(precisionAttr, "float");
+    slider->setAttribute(maxAttr, "1");
+    slider->setAttribute(valueAttr, String::number(mediaElement->volume()));
     return slider.release();
 }
 
@@ -882,6 +913,29 @@ const AtomicString& MediaControlVolumeSliderElement::shadowPseudoId() const
 
 // ----------------------------
 
+inline MediaControlFullscreenVolumeSliderElement::MediaControlFullscreenVolumeSliderElement(HTMLMediaElement* mediaElement)
+: MediaControlVolumeSliderElement(mediaElement)
+{
+}
+
+PassRefPtr<MediaControlFullscreenVolumeSliderElement> MediaControlFullscreenVolumeSliderElement::create(HTMLMediaElement* mediaElement)
+{
+    RefPtr<MediaControlFullscreenVolumeSliderElement> slider = adoptRef(new MediaControlFullscreenVolumeSliderElement(mediaElement));
+    slider->setType("range");
+    slider->setAttribute(precisionAttr, "float");
+    slider->setAttribute(maxAttr, "1");
+    slider->setAttribute(valueAttr, String::number(mediaElement->volume()));
+    return slider.release();
+}
+
+const AtomicString& MediaControlFullscreenVolumeSliderElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-fullscreen-volume-slider"));
+    return id;
+}
+
+// ----------------------------
+
 inline MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(HTMLMediaElement* mediaElement)
     : MediaControlInputElement(mediaElement, MediaFullscreenButton)
 {
@@ -924,36 +978,95 @@ const AtomicString& MediaControlFullscreenButtonElement::shadowPseudoId() const
 
 // ----------------------------
 
-inline MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(HTMLMediaElement* mediaElement)
-    : MediaControlElement(mediaElement)
-    , m_currentValue(0)
-    , m_isVisible(true)
+inline MediaControlFullscreenVolumeMinButtonElement::MediaControlFullscreenVolumeMinButtonElement(HTMLMediaElement* mediaElement)
+: MediaControlInputElement(mediaElement, MediaUnMuteButton)
 {
 }
 
-PassRefPtr<RenderStyle> MediaControlTimeDisplayElement::styleForElement()
+PassRefPtr<MediaControlFullscreenVolumeMinButtonElement> MediaControlFullscreenVolumeMinButtonElement::create(HTMLMediaElement* mediaElement)
 {
-    RefPtr<RenderStyle> style = MediaControlElement::styleForElement();
-    if (!m_isVisible) {
-        style = RenderStyle::clone(style.get());
-        style->setWidth(Length(0, Fixed));
+    RefPtr<MediaControlFullscreenVolumeMinButtonElement> button = adoptRef(new MediaControlFullscreenVolumeMinButtonElement(mediaElement));
+    button->setType("button");
+    return button.release();
+}
+
+void MediaControlFullscreenVolumeMinButtonElement::defaultEventHandler(Event* event)
+{
+    if (event->type() == eventNames().clickEvent) {
+        ExceptionCode code = 0;
+        mediaElement()->setVolume(0, code);
+        event->setDefaultHandled();
     }
-    return style;
+    HTMLInputElement::defaultEventHandler(event);
 }
 
-void MediaControlTimeDisplayElement::setVisible(bool visible)
+const AtomicString& MediaControlFullscreenVolumeMinButtonElement::shadowPseudoId() const
 {
-    if (visible == m_isVisible)
-        return;
-    m_isVisible = visible;
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-fullscreen-volume-min-button"));
+    return id;
+}
 
-    // This function is used during the RenderMedia::layout()
-    // call, where we cannot change the renderer at this time.
-    if (!renderer() || !renderer()->style())
-        return;
+// ----------------------------
 
-    RefPtr<RenderStyle> style = styleForElement();
-    renderer()->setStyle(style.get());
+inline MediaControlFullscreenVolumeMaxButtonElement::MediaControlFullscreenVolumeMaxButtonElement(HTMLMediaElement* mediaElement)
+: MediaControlInputElement(mediaElement, MediaMuteButton)
+{
+}
+
+PassRefPtr<MediaControlFullscreenVolumeMaxButtonElement> MediaControlFullscreenVolumeMaxButtonElement::create(HTMLMediaElement* mediaElement)
+{
+    RefPtr<MediaControlFullscreenVolumeMaxButtonElement> button = adoptRef(new MediaControlFullscreenVolumeMaxButtonElement(mediaElement));
+    button->setType("button");
+    return button.release();
+}
+
+void MediaControlFullscreenVolumeMaxButtonElement::defaultEventHandler(Event* event)
+{
+    if (event->type() == eventNames().clickEvent) {
+        ExceptionCode code = 0;
+        mediaElement()->setVolume(1, code);
+        event->setDefaultHandled();
+    }
+    HTMLInputElement::defaultEventHandler(event);
+}
+
+const AtomicString& MediaControlFullscreenVolumeMaxButtonElement::shadowPseudoId() const
+{
+    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls-fullscreen-volume-max-button"));
+    return id;
+}
+
+// ----------------------------
+
+class RenderMediaControlTimeDisplay : public RenderFlexibleBox {
+public:
+    RenderMediaControlTimeDisplay(Node*);
+
+private:
+    virtual void layout();
+};
+
+RenderMediaControlTimeDisplay::RenderMediaControlTimeDisplay(Node* node)
+    : RenderFlexibleBox(node)
+{
+}
+
+// We want the timeline slider to be at least 100 pixels wide.
+// FIXME: Eliminate hard-coded widths altogether.
+static const int minWidthToDisplayTimeDisplays = 45 + 100 + 45;
+
+void RenderMediaControlTimeDisplay::layout()
+{
+    RenderFlexibleBox::layout();
+    RenderBox* timelineContainerBox = parentBox();
+    if (timelineContainerBox && timelineContainerBox->width() < minWidthToDisplayTimeDisplays)
+        setWidth(0);
+}
+
+inline MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(HTMLMediaElement* mediaElement)
+    : MediaControlElement(mediaElement)
+    , m_currentValue(0)
+{
 }
 
 void MediaControlTimeDisplayElement::setCurrentValue(float time)
@@ -961,6 +1074,11 @@ void MediaControlTimeDisplayElement::setCurrentValue(float time)
     m_currentValue = time;
 }
 
+RenderObject* MediaControlTimeDisplayElement::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    return new (arena) RenderMediaControlTimeDisplay(this);
+}
+
 // ----------------------------
 
 PassRefPtr<MediaControlTimeRemainingDisplayElement> MediaControlTimeRemainingDisplayElement::create(HTMLMediaElement* mediaElement)
diff --git a/Source/WebCore/rendering/MediaControlElements.h b/Source/WebCore/rendering/MediaControlElements.h
index 44e8811..77116e3 100644
--- a/Source/WebCore/rendering/MediaControlElements.h
+++ b/Source/WebCore/rendering/MediaControlElements.h
@@ -142,16 +142,16 @@ public:
     virtual PassRefPtr<RenderStyle> styleForElement();
     void setVisible(bool);
     bool isVisible() { return m_isVisible; }
-    void setPosition(int x, int y);
     bool hitTest(const IntPoint& absPoint);
 
 private:
     MediaControlVolumeSliderContainerElement(HTMLMediaElement*);
+
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual MediaControlElementType displayType() const;
     virtual const AtomicString& shadowPseudoId() const;
 
     bool m_isVisible;
-    int m_x, m_y;
 };
 
 // ----------------------------
@@ -372,9 +372,10 @@ public:
     virtual void defaultEventHandler(Event*);
     void update();
 
-private:
+protected:
     MediaControlVolumeSliderElement(HTMLMediaElement*);
 
+private:
     virtual const AtomicString& shadowPseudoId() const;
 };
 
@@ -394,10 +395,48 @@ private:
 
 // ----------------------------
 
-class MediaControlTimeDisplayElement : public MediaControlElement {
+class MediaControlFullscreenVolumeSliderElement : public MediaControlVolumeSliderElement {
 public:
-    void setVisible(bool);
+    static PassRefPtr<MediaControlFullscreenVolumeSliderElement> create(HTMLMediaElement*);
+    
+private:
+    MediaControlFullscreenVolumeSliderElement(HTMLMediaElement*);
+    
+    virtual const AtomicString& shadowPseudoId() const;
+};
+
+// ----------------------------
+
+class MediaControlFullscreenVolumeMinButtonElement : public MediaControlInputElement {
+public:
+    static PassRefPtr<MediaControlFullscreenVolumeMinButtonElement> create(HTMLMediaElement*);
+    
+    virtual void defaultEventHandler(Event*);
+    
+private:
+    MediaControlFullscreenVolumeMinButtonElement(HTMLMediaElement*);
+    
+    virtual const AtomicString& shadowPseudoId() const;
+};
+
+// ----------------------------
+
+class MediaControlFullscreenVolumeMaxButtonElement : public MediaControlInputElement {
+public:
+    static PassRefPtr<MediaControlFullscreenVolumeMaxButtonElement> create(HTMLMediaElement*);
+    
+    virtual void defaultEventHandler(Event*);
+    
+private:
+    MediaControlFullscreenVolumeMaxButtonElement(HTMLMediaElement*);
+    
+    virtual const AtomicString& shadowPseudoId() const;
+};
+
+// ----------------------------
 
+class MediaControlTimeDisplayElement : public MediaControlElement {
+public:
     void setCurrentValue(float);
     float currentValue() const { return m_currentValue; }
 
@@ -405,9 +444,9 @@ protected:
     MediaControlTimeDisplayElement(HTMLMediaElement*);
 
 private:
-    virtual PassRefPtr<RenderStyle> styleForElement();
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+
     float m_currentValue;
-    bool m_isVisible;
 };
 
 // ----------------------------
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index 7488ff5..919e23b 100644
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -34,6 +34,7 @@
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
 #include "HitTestResult.h"
+#include "InlineIterator.h"
 #include "InlineTextBox.h"
 #include "PaintInfo.h"
 #include "RenderCombineText.h"
@@ -51,6 +52,7 @@
 #include "Settings.h"
 #include "TextRun.h"
 #include "TransformState.h"
+#include "visible_units.h"
 #include <wtf/StdLibExtras.h>
 
 #ifdef ANDROID_LAYOUT
@@ -243,8 +245,7 @@ void RenderBlock::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
     // FIXME: We could save this call when the change only affected non-inherited properties
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (child->isAnonymousBlock()) {
-            RefPtr<RenderStyle> newStyle = RenderStyle::create();
-            newStyle->inheritFrom(style());
+            RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
             if (style()->specifiesColumns()) {
                 if (child->style()->specifiesColumns())
                     newStyle->inheritColumnPropertiesFrom(style());
@@ -937,6 +938,9 @@ static bool canMergeContiguousAnonymousBlocks(RenderObject* oldChild, RenderObje
     if (oldChild->documentBeingDestroyed() || oldChild->isInline() || oldChild->virtualContinuation())
         return false;
 
+    if (oldChild->parent() && oldChild->parent()->isDetails())
+        return false;
+
     if ((prev && (!prev->isAnonymousBlock() || toRenderBlock(prev)->continuation() || toRenderBlock(prev)->beingDestroyed()))
         || (next && (!next->isAnonymousBlock() || toRenderBlock(next)->continuation() || toRenderBlock(next)->beingDestroyed())))
         return false;
@@ -979,8 +983,7 @@ void RenderBlock::removeChild(RenderObject* oldChild)
             // to clear out inherited column properties by just making a new style, and to also clear the
             // column span flag if it is set.
             ASSERT(!inlineChildrenBlock->continuation());
-            RefPtr<RenderStyle> newStyle = RenderStyle::create();
-            newStyle->inheritFrom(style());
+            RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
             children()->removeChildNode(this, inlineChildrenBlock, inlineChildrenBlock->hasLayer());
             inlineChildrenBlock->setStyle(newStyle);
             
@@ -1136,7 +1139,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren, int pageLogicalHeight)
     if (isInline() && !isInlineBlockOrInlineTable()) // Inline <form>s inside various table elements can
         return;                                      // cause us to come in here.  Just bail.
 
-    if (!relayoutChildren && layoutOnlyPositionedObjects())
+    if (!relayoutChildren && simplifiedLayout())
         return;
 
     LayoutRepainter repainter(*this, m_everHadLayout && checkForRepaintDuringLayout());
@@ -1292,7 +1295,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren, int pageLogicalHeight)
         }
         
         IntRect repaintRect;
-        if (style()->isHorizontalWritingMode())
+        if (isHorizontalWritingMode())
             repaintRect = IntRect(repaintLogicalLeft, repaintLogicalTop, repaintLogicalRight - repaintLogicalLeft, repaintLogicalBottom - repaintLogicalTop);
         else
             repaintRect = IntRect(repaintLogicalTop, repaintLogicalLeft, repaintLogicalBottom - repaintLogicalTop, repaintLogicalRight - repaintLogicalLeft);
@@ -1331,17 +1334,21 @@ void RenderBlock::addOverflowFromChildren()
         ColumnInfo* colInfo = columnInfo();
         if (columnCount(colInfo)) {
             IntRect lastRect = columnRectAt(colInfo, columnCount(colInfo) - 1);
-            if (style()->isHorizontalWritingMode()) {
+            if (isHorizontalWritingMode()) {
                 int overflowLeft = !style()->isLeftToRightDirection() ? min(0, lastRect.x()) : 0;
                 int overflowRight = style()->isLeftToRightDirection() ? max(width(), lastRect.maxX()) : 0;
                 int overflowHeight = borderBefore() + paddingBefore() + colInfo->columnHeight();
                 addLayoutOverflow(IntRect(overflowLeft, 0, overflowRight - overflowLeft, overflowHeight));
+                if (!hasOverflowClip())
+                    addVisualOverflow(IntRect(overflowLeft, 0, overflowRight - overflowLeft, overflowHeight));
             } else {
                 IntRect lastRect = columnRectAt(colInfo, columnCount(colInfo) - 1);
                 int overflowTop = !style()->isLeftToRightDirection() ? min(0, lastRect.y()) : 0;
                 int overflowBottom = style()->isLeftToRightDirection() ? max(height(), lastRect.maxY()) : 0;
                 int overflowWidth = borderBefore() + paddingBefore() + colInfo->columnHeight();
                 addLayoutOverflow(IntRect(0, overflowTop, overflowWidth, overflowBottom - overflowTop));
+                if (!hasOverflowClip())
+                    addVisualOverflow(IntRect(0, overflowTop, overflowWidth, overflowBottom - overflowTop));
             }
         }
     }
@@ -1364,7 +1371,7 @@ void RenderBlock::computeOverflow(int oldClientAfterEdge, bool recomputeFloats)
         // be considered reachable.
         IntRect clientRect(clientBoxRect());
         IntRect rectToApply;
-        if (style()->isHorizontalWritingMode())
+        if (isHorizontalWritingMode())
             rectToApply = IntRect(clientRect.x(), clientRect.y(), 1, max(0, oldClientAfterEdge - clientRect.y()));
         else
             rectToApply = IntRect(clientRect.x(), clientRect.y(), max(0, oldClientAfterEdge - clientRect.x()), 1);
@@ -1422,34 +1429,31 @@ bool RenderBlock::expandsToEncloseOverhangingFloats() const
 
 void RenderBlock::adjustPositionedBlock(RenderBox* child, const MarginInfo& marginInfo)
 {
-    bool isHorizontal = style()->isHorizontalWritingMode();
-    bool hasStaticInlinePosition = child->style()->hasStaticInlinePosition(isHorizontal);
+    bool isHorizontal = isHorizontalWritingMode();
     bool hasStaticBlockPosition = child->style()->hasStaticBlockPosition(isHorizontal);
     RenderLayer* childLayer = child->layer();
         
-    if (hasStaticInlinePosition)
-        childLayer->setStaticInlinePosition(borderAndPaddingStart());
-
-    if (hasStaticBlockPosition) {
-        int logicalTop = logicalHeight();
-        if (!marginInfo.canCollapseWithMarginBefore()) {
-            child->computeBlockDirectionMargins(this);
-            int marginBefore = marginBeforeForChild(child);
-            int collapsedBeforePos = marginInfo.positiveMargin();
-            int collapsedBeforeNeg = marginInfo.negativeMargin();
-            if (marginBefore > 0) {
-                if (marginBefore > collapsedBeforePos)
-                    collapsedBeforePos = marginBefore;
-            } else {
-                if (-marginBefore > collapsedBeforeNeg)
-                    collapsedBeforeNeg = -marginBefore;
-            }
-            logicalTop += (collapsedBeforePos - collapsedBeforeNeg) - marginBefore;
+    childLayer->setStaticInlinePosition(borderAndPaddingStart());
+
+    int logicalTop = logicalHeight();
+    if (!marginInfo.canCollapseWithMarginBefore()) {
+        child->computeBlockDirectionMargins(this);
+        int marginBefore = marginBeforeForChild(child);
+        int collapsedBeforePos = marginInfo.positiveMargin();
+        int collapsedBeforeNeg = marginInfo.negativeMargin();
+        if (marginBefore > 0) {
+            if (marginBefore > collapsedBeforePos)
+                collapsedBeforePos = marginBefore;
+        } else {
+            if (-marginBefore > collapsedBeforeNeg)
+                collapsedBeforeNeg = -marginBefore;
         }
-        if (childLayer->staticBlockPosition() != logicalTop) {
-            childLayer->setStaticBlockPosition(logicalTop);
+        logicalTop += (collapsedBeforePos - collapsedBeforeNeg) - marginBefore;
+    }
+    if (childLayer->staticBlockPosition() != logicalTop) {
+        childLayer->setStaticBlockPosition(logicalTop);
+        if (hasStaticBlockPosition)
             child->setChildNeedsLayout(true, false);
-        }
     }
 }
 
@@ -1818,7 +1822,7 @@ void RenderBlock::handleAfterSideOfBlock(int beforeSide, int afterSide, MarginIn
 
 void RenderBlock::setLogicalLeftForChild(RenderBox* child, int logicalLeft, ApplyLayoutDeltaMode applyDelta)
 {
-    if (style()->isHorizontalWritingMode()) {
+    if (isHorizontalWritingMode()) {
         if (applyDelta == ApplyLayoutDelta)
             view()->addLayoutDelta(IntSize(child->x() - logicalLeft, 0));
         child->setX(logicalLeft);
@@ -1831,7 +1835,7 @@ void RenderBlock::setLogicalLeftForChild(RenderBox* child, int logicalLeft, Appl
 
 void RenderBlock::setLogicalTopForChild(RenderBox* child, int logicalTop, ApplyLayoutDeltaMode applyDelta)
 {
-    if (style()->isHorizontalWritingMode()) {
+    if (isHorizontalWritingMode()) {
         if (applyDelta == ApplyLayoutDelta)
             view()->addLayoutDelta(IntSize(0, child->y() - logicalTop));
         child->setY(logicalTop);
@@ -2080,21 +2084,58 @@ void RenderBlock::layoutBlockChild(RenderBox* child, MarginInfo& marginInfo, int
     ASSERT(oldLayoutDelta == view()->layoutDelta());
 }
 
-bool RenderBlock::layoutOnlyPositionedObjects()
+void RenderBlock::simplifiedNormalFlowLayout()
 {
-    if (!posChildNeedsLayout() || normalChildNeedsLayout() || selfNeedsLayout())
+    if (childrenInline()) {
+        ListHashSet<RootInlineBox*> lineBoxes;
+        bool endOfInline = false;
+        RenderObject* o = bidiFirst(this, 0, false);
+        while (o) {
+            if (!o->isPositioned() && (o->isReplaced() || o->isFloating())) {
+                o->layoutIfNeeded();
+                if (toRenderBox(o)->inlineBoxWrapper()) {
+                    RootInlineBox* box = toRenderBox(o)->inlineBoxWrapper()->root();
+                    lineBoxes.add(box);
+                }
+            } else if (o->isText() || (o->isRenderInline() && !endOfInline))
+                o->setNeedsLayout(false);
+            o = bidiNext(this, o, 0, false, &endOfInline);
+        }
+
+        // FIXME: Glyph overflow will get lost in this case, but not really a big deal.
+        GlyphOverflowAndFallbackFontsMap textBoxDataMap;                  
+        for (ListHashSet<RootInlineBox*>::const_iterator it = lineBoxes.begin(); it != lineBoxes.end(); ++it) {
+            RootInlineBox* box = *it;
+            box->computeOverflow(box->lineTop(), box->lineBottom(), document()->inNoQuirksMode(), textBoxDataMap);
+        }
+    } else {
+        for (RenderBox* box = firstChildBox(); box; box = box->nextSiblingBox()) {
+            if (!box->isPositioned())
+                box->layoutIfNeeded();
+        }
+    }
+}
+
+bool RenderBlock::simplifiedLayout()
+{
+    if ((!posChildNeedsLayout() && !needsSimplifiedNormalFlowLayout()) || normalChildNeedsLayout() || selfNeedsLayout())
         return false;
 
     LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), hasColumns() || hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
-
+    
     if (needsPositionedMovementLayout()) {
         tryLayoutDoingPositionedMovementOnly();
         if (needsLayout())
             return false;
     }
 
-    // All we have to is lay out our positioned objects.
-    layoutPositionedObjects(false);
+    // Lay out positioned descendants or objects that just need to recompute overflow.
+    if (needsSimplifiedNormalFlowLayout())
+        simplifiedNormalFlowLayout();
+
+    // Lay out our positioned objects if our positioned child bit is set.
+    if (posChildNeedsLayout())
+        layoutPositionedObjects(false);
 
     // Recompute our overflow information.
     // FIXME: We could do better here by computing a temporary overflow object from layoutPositionedObjects and only
@@ -2137,7 +2178,7 @@ void RenderBlock::layoutPositionedObjects(bool relayoutChildren)
         // non-positioned block.  Rather than trying to detect all of these movement cases, we just always lay out positioned
         // objects that are positioned implicitly like this.  Such objects are rare, and so in typical DHTML menu usage (where everything is
         // positioned explicitly) this should not incur a performance penalty.
-        if (relayoutChildren || (r->style()->hasStaticBlockPosition(style()->isHorizontalWritingMode()) && r->parent() != this && r->parent()->isBlockFlow()))
+        if (relayoutChildren || (r->style()->hasStaticBlockPosition(isHorizontalWritingMode()) && r->parent() != this && r->parent()->isBlockFlow()))
             r->setChildNeedsLayout(true, false);
             
         // If relayoutChildren is set and we have percentage padding, we also need to invalidate the child's pref widths.
@@ -2221,6 +2262,7 @@ void RenderBlock::paint(PaintInfo& paintInfo, int tx, int ty)
     // paints the root's background.
     if (!isRoot()) {
         IntRect overflowBox = visualOverflowRect();
+        flipForWritingMode(overflowBox);
         overflowBox.inflate(maximalOutlineSize(paintInfo.phase));
         overflowBox.move(tx, ty);
         if (!overflowBox.intersects(paintInfo.rect))
@@ -2259,7 +2301,7 @@ void RenderBlock::paintColumnRules(PaintInfo& paintInfo, int tx, int ty)
     for (unsigned i = 0; i < colCount; i++) {
         IntRect colRect = columnRectAt(colInfo, i);
 
-        int inlineDirectionSize = style()->isHorizontalWritingMode() ? colRect.width() : colRect.height();
+        int inlineDirectionSize = isHorizontalWritingMode() ? colRect.width() : colRect.height();
         
         // Move to the next position.
         if (style()->isLeftToRightDirection()) {
@@ -2272,10 +2314,10 @@ void RenderBlock::paintColumnRules(PaintInfo& paintInfo, int tx, int ty)
        
         // Now paint the column rule.
         if (i < colCount - 1) {
-            int ruleLeft = style()->isHorizontalWritingMode() ? tx + ruleLogicalLeft - ruleWidth / 2 + ruleAdd : tx + borderBefore() + paddingBefore();
-            int ruleRight = style()->isHorizontalWritingMode() ? ruleLeft + ruleWidth : ruleLeft + contentWidth();
-            int ruleTop = style()->isHorizontalWritingMode() ? ty + borderTop() + paddingTop() : ty + ruleLogicalLeft - ruleWidth / 2 + ruleAdd;
-            int ruleBottom = style()->isHorizontalWritingMode() ? ruleTop + contentHeight() : ruleTop + ruleWidth;
+            int ruleLeft = isHorizontalWritingMode() ? tx + ruleLogicalLeft - ruleWidth / 2 + ruleAdd : tx + borderBefore() + paddingBefore();
+            int ruleRight = isHorizontalWritingMode() ? ruleLeft + ruleWidth : ruleLeft + contentWidth();
+            int ruleTop = isHorizontalWritingMode() ? ty + borderTop() + paddingTop() : ty + ruleLogicalLeft - ruleWidth / 2 + ruleAdd;
+            int ruleBottom = isHorizontalWritingMode() ? ruleTop + contentHeight() : ruleTop + ruleWidth;
             drawLineForBoxSide(paintInfo.context, ruleLeft, ruleTop, ruleRight, ruleBottom,
                                style()->isLeftToRightDirection() ? BSLeft : BSRight, ruleColor, ruleStyle, 0, 0);
         }
@@ -2297,8 +2339,8 @@ void RenderBlock::paintColumnContents(PaintInfo& paintInfo, int tx, int ty, bool
         // For each rect, we clip to the rect, and then we adjust our coords.
         IntRect colRect = columnRectAt(colInfo, i);
         flipForWritingMode(colRect);
-        int logicalLeftOffset = (style()->isHorizontalWritingMode() ? colRect.x() : colRect.y()) - logicalLeftOffsetForContent();
-        IntSize offset = style()->isHorizontalWritingMode() ? IntSize(logicalLeftOffset, currLogicalTopOffset) : IntSize(currLogicalTopOffset, logicalLeftOffset);
+        int logicalLeftOffset = (isHorizontalWritingMode() ? colRect.x() : colRect.y()) - logicalLeftOffsetForContent();
+        IntSize offset = isHorizontalWritingMode() ? IntSize(logicalLeftOffset, currLogicalTopOffset) : IntSize(currLogicalTopOffset, logicalLeftOffset);
         colRect.move(tx, ty);
         PaintInfo info(paintInfo);
         info.rect.intersect(colRect);
@@ -2321,7 +2363,7 @@ void RenderBlock::paintColumnContents(PaintInfo& paintInfo, int tx, int ty, bool
             context->restore();
         }
 
-        int blockDelta = (style()->isHorizontalWritingMode() ? colRect.height() : colRect.width());
+        int blockDelta = (isHorizontalWritingMode() ? colRect.height() : colRect.width());
         if (style()->isFlippedBlocksWritingMode())
             currLogicalTopOffset += blockDelta;
         else
@@ -2510,7 +2552,7 @@ IntPoint RenderBlock::flipFloatForWritingMode(const FloatingObject* child, const
     // This is similar to the ParentToChildFlippingAdjustment in RenderBox::flipForWritingMode.  We have to subtract out our left/top offsets twice, since
     // it's going to get added back in.  We hide this complication here so that the calling code looks normal for the unflipped
     // case.
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return IntPoint(point.x(), point.y() + height() - child->renderer()->height() - 2 * yPositionForFloatIncludingMargin(child));
     return IntPoint(point.x() + width() - child->width() - 2 * xPositionForFloatIncludingMargin(child), point.y());
 }
@@ -2738,18 +2780,18 @@ static void clipOutPositionedObjects(const PaintInfo* paintInfo, const IntPoint&
 
 static int blockDirectionOffset(RenderBlock* rootBlock, const IntSize& offsetFromRootBlock)
 {
-    return rootBlock->style()->isHorizontalWritingMode() ? offsetFromRootBlock.height() : offsetFromRootBlock.width();
+    return rootBlock->isHorizontalWritingMode() ? offsetFromRootBlock.height() : offsetFromRootBlock.width();
 }
 
 static int inlineDirectionOffset(RenderBlock* rootBlock, const IntSize& offsetFromRootBlock)
 {
-    return rootBlock->style()->isHorizontalWritingMode() ? offsetFromRootBlock.width() : offsetFromRootBlock.height();
+    return rootBlock->isHorizontalWritingMode() ? offsetFromRootBlock.width() : offsetFromRootBlock.height();
 }
 
 IntRect RenderBlock::logicalRectToPhysicalRect(const IntPoint& rootBlockPhysicalPosition, const IntRect& logicalRect)
 {
     IntRect result;
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         result = logicalRect;
     else
         result = IntRect(logicalRect.y(), logicalRect.x(), logicalRect.height(), logicalRect.width());
@@ -2846,10 +2888,10 @@ GapRects RenderBlock::inlineSelectionGaps(RenderBlock* rootBlock, const IntPoint
                                                  selTop, paintInfo));
         
         IntRect logicalRect(curr->logicalLeft(), selTop, curr->logicalWidth(), selTop + selHeight);
-        logicalRect.move(style()->isHorizontalWritingMode() ? offsetFromRootBlock : IntSize(offsetFromRootBlock.height(), offsetFromRootBlock.width()));
+        logicalRect.move(isHorizontalWritingMode() ? offsetFromRootBlock : IntSize(offsetFromRootBlock.height(), offsetFromRootBlock.width()));
         IntRect physicalRect = rootBlock->logicalRectToPhysicalRect(rootBlockPhysicalPosition, logicalRect);
-        if (!paintInfo || (style()->isHorizontalWritingMode() && physicalRect.y() < paintInfo->rect.maxY() && physicalRect.maxY() > paintInfo->rect.y())
-            || (!style()->isHorizontalWritingMode() && physicalRect.x() < paintInfo->rect.maxX() && physicalRect.maxX() > paintInfo->rect.x()))
+        if (!paintInfo || (isHorizontalWritingMode() && physicalRect.y() < paintInfo->rect.maxY() && physicalRect.maxY() > paintInfo->rect.y())
+            || (!isHorizontalWritingMode() && physicalRect.x() < paintInfo->rect.maxX() && physicalRect.maxX() > paintInfo->rect.x()))
             result.unite(curr->lineSelectionGap(rootBlock, rootBlockPhysicalPosition, offsetFromRootBlock, selTop, selHeight, paintInfo));
 
         lastSelectedLine = curr;
@@ -3294,12 +3336,23 @@ bool RenderBlock::positionNewFloats()
     return true;
 }
 
-bool RenderBlock::positionNewFloatOnLine(FloatingObject* newFloat, FloatingObject* lastFloatFromPreviousLine)
+bool RenderBlock::positionNewFloatOnLine(FloatingObject* newFloat, FloatingObject* lastFloatFromPreviousLine, bool firstLine, int& lineLeftOffset, int& lineRightOffset)
 {
     bool didPosition = positionNewFloats();
-    if (!didPosition || !newFloat->m_paginationStrut)
+    if (!didPosition)
         return didPosition;
+
+    int blockOffset = logicalHeight();
+    if (blockOffset >= logicalTopForFloat(newFloat) && blockOffset < logicalBottomForFloat(newFloat)) {
+        if (newFloat->type() == FloatingObject::FloatLeft)
+            lineLeftOffset = logicalRightForFloat(newFloat);
+        else
+            lineRightOffset = logicalLeftForFloat(newFloat);
+    }
     
+    if (!newFloat->m_paginationStrut)
+        return didPosition;
+     
     FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
     ASSERT(floatingObjectSet.last() == newFloat);
 
@@ -3329,8 +3382,10 @@ bool RenderBlock::positionNewFloatOnLine(FloatingObject* newFloat, FloatingObjec
         }
     }
         
-    setLogicalHeight(logicalHeight() + paginationStrut);
-    
+    setLogicalHeight(blockOffset + paginationStrut);
+    lineLeftOffset = logicalLeftOffsetForLine(logicalHeight(), firstLine);
+    lineRightOffset = logicalRightOffsetForLine(logicalHeight(), firstLine);
+
     return didPosition;
 }
 
@@ -3416,6 +3471,11 @@ HashSet<RenderBox*>* RenderBlock::percentHeightDescendants() const
     return gPercentHeightDescendantsMap ? gPercentHeightDescendantsMap->get(this) : 0;
 }
 
+// FIXME: The logicalLeftOffsetForLine/logicalRightOffsetForLine functions are very slow if there are many floats
+// present. We need to add a structure to floating objects to represent "lines" of floats.  Then instead of checking
+// each float individually, we'd just walk backwards through the "lines" and stop when we hit a line that is fully above
+// the vertical offset that we'd like to check.  Computing the "lines" would be rather complicated, but could replace the left
+// objects and right objects count hack that is currently used here.
 int RenderBlock::logicalLeftOffsetForLine(int logicalTop, int fixedOffset, bool applyTextIndent, int* heightRemaining) const
 {
     int left = fixedOffset;
@@ -3423,18 +3483,23 @@ int RenderBlock::logicalLeftOffsetForLine(int logicalTop, int fixedOffset, bool
         if (heightRemaining)
             *heightRemaining = 1;
 
+        // We know the list is non-empty, since we have "left" objects to search for.
+        // Therefore we can assume that begin != end, and that we can do at least one
+        // decrement.
         FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
-        FloatingObjectSetIterator end = floatingObjectSet.end();
-        for (FloatingObjectSetIterator it = floatingObjectSet.begin(); it != end; ++it) {
+        FloatingObjectSetIterator begin = floatingObjectSet.begin();
+        FloatingObjectSetIterator it = floatingObjectSet.end();
+        do {
+            --it;
             FloatingObject* r = *it;
             if (r->isPlaced() && logicalTopForFloat(r) <= logicalTop && logicalBottomForFloat(r) > logicalTop
                 && r->type() == FloatingObject::FloatLeft
                 && logicalRightForFloat(r) > left) {
-                left = logicalRightForFloat(r);
+                left = max(left, logicalRightForFloat(r));
                 if (heightRemaining)
                     *heightRemaining = logicalBottomForFloat(r) - logicalTop;
             }
-        }
+        } while (it != begin);
     }
 
     if (applyTextIndent && style()->isLeftToRightDirection()) {
@@ -3454,18 +3519,24 @@ int RenderBlock::logicalRightOffsetForLine(int logicalTop, int fixedOffset, bool
     if (m_floatingObjects && m_floatingObjects->hasRightObjects()) {
         if (heightRemaining)
             *heightRemaining = 1;
+            
+        // We know the list is non-empty, since we have "right" objects to search for.
+        // Therefore we can assume that begin != end, and that we can do at least one
+        // decrement.
         FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
-        FloatingObjectSetIterator end = floatingObjectSet.end();
-        for (FloatingObjectSetIterator it = floatingObjectSet.begin(); it != end; ++it) {
+        FloatingObjectSetIterator begin = floatingObjectSet.begin();
+        FloatingObjectSetIterator it = floatingObjectSet.end();
+        do {
+            --it;
             FloatingObject* r = *it;
             if (r->isPlaced() && logicalTopForFloat(r) <= logicalTop && logicalBottomForFloat(r) > logicalTop
                 && r->type() == FloatingObject::FloatRight
                 && logicalLeftForFloat(r) < right) {
-                right = logicalLeftForFloat(r);
+                right = min(right, logicalLeftForFloat(r));
                 if (heightRemaining)
                     *heightRemaining = logicalBottomForFloat(r) - logicalTop;
             }
-        }
+        } while (it != begin);
     }
     
     if (applyTextIndent && !style()->isLeftToRightDirection()) {
@@ -3663,8 +3734,8 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int logicalLeftOffset,
         if (logicalBottom > logicalHeight()) {
             // If the object is not in the list, we add it now.
             if (!containsFloat(r->m_renderer)) {
-                int leftOffset = style()->isHorizontalWritingMode() ? logicalLeftOffset : logicalTopOffset;
-                int topOffset = style()->isHorizontalWritingMode() ? logicalTopOffset : logicalLeftOffset;
+                int leftOffset = isHorizontalWritingMode() ? logicalLeftOffset : logicalTopOffset;
+                int topOffset = isHorizontalWritingMode() ? logicalTopOffset : logicalLeftOffset;
                 FloatingObject* floatingObj = new FloatingObject(r->type(), IntRect(r->x() - leftOffset, r->y() - topOffset, r->width(), r->height()));
                 floatingObj->m_renderer = r->m_renderer;
 
@@ -3712,7 +3783,7 @@ void RenderBlock::addIntrudingFloats(RenderBlock* prev, int logicalLeftOffset, i
     if (!prev->m_floatingObjects)
         return;
 
-    logicalLeftOffset += (style()->isHorizontalWritingMode() ? marginLeft() : marginTop());
+    logicalLeftOffset += (isHorizontalWritingMode() ? marginLeft() : marginTop());
 
     FloatingObjectSet& prevSet = prev->m_floatingObjects->set();
     FloatingObjectSetIterator prevEnd = prevSet.end();
@@ -3720,8 +3791,8 @@ void RenderBlock::addIntrudingFloats(RenderBlock* prev, int logicalLeftOffset, i
         FloatingObject* r = *prevIt;
         if (logicalBottomForFloat(r) > logicalTopOffset) {
             if (!m_floatingObjects || !m_floatingObjects->set().contains(r)) {
-                int leftOffset = style()->isHorizontalWritingMode() ? logicalLeftOffset : logicalTopOffset;
-                int topOffset = style()->isHorizontalWritingMode() ? logicalTopOffset : logicalLeftOffset;
+                int leftOffset = isHorizontalWritingMode() ? logicalLeftOffset : logicalTopOffset;
+                int topOffset = isHorizontalWritingMode() ? logicalTopOffset : logicalLeftOffset;
                 
                 FloatingObject* floatingObj = new FloatingObject(r->type(), IntRect(r->x() - leftOffset, r->y() - topOffset, r->width(), r->height()));
 
@@ -3731,7 +3802,7 @@ void RenderBlock::addIntrudingFloats(RenderBlock* prev, int logicalLeftOffset, i
                 // into account.  Only apply this code if prev is the parent, since otherwise the left margin
                 // will get applied twice.
                 if (prev != parent()) {
-                    if (style()->isHorizontalWritingMode())
+                    if (isHorizontalWritingMode())
                         floatingObj->setX(floatingObj->x() + prev->marginLeft());
                     else
                         floatingObj->setY(floatingObj->y() + prev->marginTop());
@@ -3868,7 +3939,7 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
     bool useOverflowClip = hasOverflowClip() && !hasSelfPaintingLayer();
     bool useClip = (hasControlClip() || useOverflowClip);
     IntRect hitTestArea(result.rectForPoint(_x, _y));
-    bool checkChildren = !useClip || (hasControlClip() ? controlClipRect(tx, ty).intersects(hitTestArea) : overflowClipRect(tx, ty).intersects(hitTestArea));
+    bool checkChildren = !useClip || (hasControlClip() ? controlClipRect(tx, ty).intersects(hitTestArea) : overflowClipRect(tx, ty, IncludeOverlayScrollbarSize).intersects(hitTestArea));
     if (checkChildren) {
         // Hit test descendants first.
         int scrolledX = tx;
@@ -3945,7 +4016,7 @@ bool RenderBlock::hitTestColumns(const HitTestRequest& request, HitTestResult& r
     int logicalLeft = logicalLeftOffsetForContent();
     int currLogicalTopOffset = 0;
     int i;
-    bool isHorizontal = style()->isHorizontalWritingMode();
+    bool isHorizontal = isHorizontalWritingMode();
     for (i = 0; i < colCount; i++) {
         IntRect colRect = columnRectAt(colInfo, i);
         int blockDelta =  (isHorizontal ? colRect.height() : colRect.width());
@@ -4038,12 +4109,12 @@ static VisiblePosition positionForPointRespectingEditingBoundaries(RenderBlock*
         ancestor = ancestor->parent();
 
     // If we can't find an ancestor to check editability on, or editability is unchanged, we recur like normal
-    if (!ancestor || ancestor->node()->isContentEditable() == childNode->isContentEditable())
+    if (!ancestor || ancestor->node()->rendererIsEditable() == childNode->rendererIsEditable())
         return child->positionForPoint(pointInChildCoordinates);
 
     // Otherwise return before or after the child, depending on if the click was to the logical left or logical right of the child
     int childMiddle = parent->logicalWidthForChild(child) / 2;
-    int logicalLeft = parent->style()->isHorizontalWritingMode() ? pointInChildCoordinates.x() : pointInChildCoordinates.y();
+    int logicalLeft = parent->isHorizontalWritingMode() ? pointInChildCoordinates.x() : pointInChildCoordinates.y();
     if (logicalLeft < childMiddle)
         return ancestor->createVisiblePosition(childNode->nodeIndex(), DOWNSTREAM);
     return ancestor->createVisiblePosition(childNode->nodeIndex() + 1, UPSTREAM);
@@ -4090,7 +4161,7 @@ VisiblePosition RenderBlock::positionForPointWithInlineChildren(const IntPoint&
 
         // pass the box a top position that is inside it
         IntPoint point(pointInLogicalContents.x(), closestBox->logicalTop());
-        if (!style()->isHorizontalWritingMode())
+        if (!isHorizontalWritingMode())
             point = point.transposedPoint();
         if (closestBox->renderer()->isReplaced())
             return positionForPointRespectingEditingBoundaries(this, toRenderBox(closestBox->renderer()), point);
@@ -4100,7 +4171,9 @@ VisiblePosition RenderBlock::positionForPointWithInlineChildren(const IntPoint&
     if (lastRootBoxWithChildren) {
         // We hit this case for Mac behavior when the Y coordinate is below the last box.
         ASSERT(moveCaretToBoundary);
-        return VisiblePosition(positionForBox(lastRootBoxWithChildren->lastLeafChild(), false), DOWNSTREAM);
+        InlineBox* logicallyLastBox;
+        if (lastRootBoxWithChildren->getLogicalEndBoxWithNode(logicallyLastBox))
+            return VisiblePosition(positionForBox(logicallyLastBox, false), DOWNSTREAM);
     }
 
     // Can't reach this. We have a root line box, but it has no kids.
@@ -4121,8 +4194,8 @@ VisiblePosition RenderBlock::positionForPoint(const IntPoint& point)
 
     if (isReplaced()) {
         // FIXME: This seems wrong when the object's writing-mode doesn't match the line's writing-mode.
-        int pointLogicalLeft = style()->isHorizontalWritingMode() ? point.x() : point.y();
-        int pointLogicalTop = style()->isHorizontalWritingMode() ? point.y() : point.x();
+        int pointLogicalLeft = isHorizontalWritingMode() ? point.x() : point.y();
+        int pointLogicalTop = isHorizontalWritingMode() ? point.y() : point.x();
 
         if (pointLogicalTop < 0 || (pointLogicalTop < logicalHeight() && pointLogicalLeft < 0))
             return createVisiblePosition(caretMinOffset(), DOWNSTREAM);
@@ -4135,7 +4208,7 @@ VisiblePosition RenderBlock::positionForPoint(const IntPoint& point)
     offsetForContents(contentsX, contentsY);
     IntPoint pointInContents(contentsX, contentsY);
     IntPoint pointInLogicalContents(pointInContents);
-    if (!style()->isHorizontalWritingMode())
+    if (!isHorizontalWritingMode())
         pointInLogicalContents = pointInLogicalContents.transposedPoint();
 
     if (childrenInline())
@@ -4303,7 +4376,7 @@ IntRect RenderBlock::columnRectAt(ColumnInfo* colInfo, unsigned index) const
                           logicalLeftOffsetForContent() + (index * (colLogicalWidth + colGap))
                         : logicalLeftOffsetForContent() + contentLogicalWidth() - colLogicalWidth - (index * (colLogicalWidth + colGap));
     IntRect rect(colLogicalLeft, colLogicalTop, colLogicalWidth, colLogicalHeight);
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return IntRect(colLogicalLeft, colLogicalTop, colLogicalWidth, colLogicalHeight);
     return IntRect(colLogicalTop, colLogicalLeft, colLogicalHeight, colLogicalWidth);
 }
@@ -4370,7 +4443,7 @@ void RenderBlock::adjustPointToColumnContents(IntPoint& point) const
     for (unsigned i = 0; i < colInfo->columnCount(); i++) {
         // Add in half the column gap to the left and right of the rect.
         IntRect colRect = columnRectAt(colInfo, i);
-        if (style()->isHorizontalWritingMode()) {
+        if (isHorizontalWritingMode()) {
             IntRect gapAndColumnRect(colRect.x() - halfColGap, colRect.y(), colRect.width() + colGap, colRect.height());
             if (point.x() >= gapAndColumnRect.x() && point.x() < gapAndColumnRect.maxX()) {
                 // FIXME: The clamping that follows is not completely right for right-to-left
@@ -4440,7 +4513,7 @@ void RenderBlock::adjustRectForColumns(IntRect& r) const
     for (unsigned i = 0; i < colCount; i++) {
         IntRect colRect = columnRectAt(colInfo, i);
         IntRect repaintRect = r;
-        if (style()->isHorizontalWritingMode()) {
+        if (isHorizontalWritingMode()) {
             int currXOffset = colRect.x() - logicalLeft;
             repaintRect.move(currXOffset, currLogicalOffset);
             currLogicalOffset -= colRect.height();
@@ -4464,7 +4537,7 @@ IntPoint RenderBlock::flipForWritingModeIncludingColumns(const IntPoint& point)
     ColumnInfo* colInfo = columnInfo();
     int columnLogicalHeight = colInfo->columnHeight();
     int expandedLogicalHeight = borderBefore() + paddingBefore() + columnCount(colInfo) * columnLogicalHeight + borderAfter() + paddingAfter() + scrollbarLogicalHeight();
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return IntPoint(point.x(), expandedLogicalHeight - point.y());
     return IntPoint(expandedLogicalHeight - point.x(), point.y());
 }
@@ -4478,7 +4551,7 @@ void RenderBlock::flipForWritingModeIncludingColumns(IntRect& rect) const
     ColumnInfo* colInfo = columnInfo();
     int columnLogicalHeight = colInfo->columnHeight();
     int expandedLogicalHeight = borderBefore() + paddingBefore() + columnCount(colInfo) * columnLogicalHeight + borderAfter() + paddingAfter() + scrollbarLogicalHeight();
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         rect.setY(expandedLogicalHeight - rect.maxY());
     else
         rect.setX(expandedLogicalHeight - rect.maxX());
@@ -4499,7 +4572,7 @@ void RenderBlock::adjustForColumns(IntSize& offset, const IntPoint& point) const
     for (size_t i = 0; i < colCount; ++i) {
         // Compute the edges for a given column in the block progression direction.
         IntRect sliceRect = IntRect(logicalLeft, borderBefore() + paddingBefore() + i * colLogicalHeight, colLogicalWidth, colLogicalHeight);
-        if (!style()->isHorizontalWritingMode())
+        if (!isHorizontalWritingMode())
             sliceRect = sliceRect.transposedRect();
         
         // If we have a flipped blocks writing mode, then convert the column so that it's coming from the after edge (either top or left edge).
@@ -4508,7 +4581,7 @@ void RenderBlock::adjustForColumns(IntSize& offset, const IntPoint& point) const
         int logicalOffset = style()->isFlippedBlocksWritingMode() ? (colCount - 1 - i) * colLogicalHeight : i * colLogicalHeight;
 
         // Now we're in the same coordinate space as the point.  See if it is inside the rectangle.
-        if (style()->isHorizontalWritingMode()) {
+        if (isHorizontalWritingMode()) {
             if (point.y() >= sliceRect.y() && point.y() < sliceRect.maxY()) {
                 offset.expand(columnRectAt(colInfo, i).x() - logicalLeft, -logicalOffset);
                 return;
@@ -4851,7 +4924,7 @@ void RenderBlock::computeInlinePreferredLogicalWidths()
                     continue;
                 }
 
-                if (t->style()->hasTextCombine())
+                if (t->style()->hasTextCombine() && t->isCombineText())
                     toRenderCombineText(t)->combineText();
 
                 // Determine if we have a breakable character.  Pass in
@@ -5064,7 +5137,7 @@ bool RenderBlock::hasLineIfEmpty() const
     if (!node())
         return false;
     
-    if (node()->isContentEditable() && node()->rootEditableElement() == node())
+    if (node()->rendererIsEditable() && node()->rootEditableElement() == node())
         return true;
     
     if (node()->isShadowRoot() && (node()->shadowHost()->hasTagName(inputTag)))
@@ -5159,7 +5232,7 @@ int RenderBlock::lastLineBoxBaseline() const
     if (!isBlockFlow() || (isWritingModeRoot() && !isRubyRun()))
         return -1;
 
-    LineDirectionMode lineDirection = style()->isHorizontalWritingMode() ? HorizontalLine : VerticalLine;
+    LineDirectionMode lineDirection = isHorizontalWritingMode() ? HorizontalLine : VerticalLine;
 
     if (childrenInline()) {
         if (!firstLineBox() && hasLineIfEmpty()) {
@@ -5766,6 +5839,14 @@ IntRect RenderBlock::localCaretRect(InlineBox* inlineBox, int caretOffset, int*
         case WEBKIT_RIGHT:
             alignment = alignRight;
             break;
+        case TASTART:
+            if (!currentStyle->isLeftToRightDirection())
+                alignment = alignRight;
+            break;
+        case TAEND:
+            if (currentStyle->isLeftToRightDirection())
+                alignment = alignRight;
+            break;
     }
 
     int x = borderLeft() + paddingLeft();
@@ -5857,8 +5938,7 @@ void RenderBlock::addFocusRingRects(Vector<IntRect>& rects, int tx, int ty)
 
 RenderBlock* RenderBlock::createAnonymousBlock(bool isFlexibleBox) const
 {
-    RefPtr<RenderStyle> newStyle = RenderStyle::create();
-    newStyle->inheritFrom(style());
+    RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
 
     RenderBlock* newBox = 0;
     if (isFlexibleBox) {
@@ -5884,8 +5964,7 @@ RenderBlock* RenderBlock::createAnonymousBlockWithSameTypeAs(RenderBlock* otherA
 
 RenderBlock* RenderBlock::createAnonymousColumnsBlock() const
 {
-    RefPtr<RenderStyle> newStyle = RenderStyle::create();
-    newStyle->inheritFrom(style());
+    RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
     newStyle->inheritColumnPropertiesFrom(style());
     newStyle->setDisplay(BLOCK);
 
@@ -5896,8 +5975,7 @@ RenderBlock* RenderBlock::createAnonymousColumnsBlock() const
 
 RenderBlock* RenderBlock::createAnonymousColumnSpanBlock() const
 {
-    RefPtr<RenderStyle> newStyle = RenderStyle::create();
-    newStyle->inheritFrom(style());
+    RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
     newStyle->setColumnSpan(true);
     newStyle->setDisplay(BLOCK);
 
@@ -5915,7 +5993,7 @@ int RenderBlock::nextPageLogicalTop(int logicalOffset) const
     // The logicalOffset is in our coordinate space.  We can add in our pushed offset.
     int pageLogicalHeight = layoutState->m_pageLogicalHeight;
     IntSize delta = layoutState->m_layoutOffset - layoutState->m_pageOffset;
-    int offset = style()->isHorizontalWritingMode() ? delta.height() : delta.width();
+    int offset = isHorizontalWritingMode() ? delta.height() : delta.width();
     int remainingLogicalHeight = (pageLogicalHeight - (offset + logicalOffset) % pageLogicalHeight) % pageLogicalHeight;
     return logicalOffset + remainingLogicalHeight;
 }
@@ -5976,7 +6054,7 @@ int RenderBlock::adjustForUnsplittableChild(RenderBox* child, int logicalOffset,
     if (!pageLogicalHeight || childLogicalHeight > pageLogicalHeight)
         return logicalOffset;
     IntSize delta = layoutState->m_layoutOffset - layoutState->m_pageOffset;
-    int offset = style()->isHorizontalWritingMode() ? delta.height() : delta.width();
+    int offset = isHorizontalWritingMode() ? delta.height() : delta.width();
     int remainingLogicalHeight = (pageLogicalHeight - (offset + logicalOffset) % pageLogicalHeight) % pageLogicalHeight;
     if (remainingLogicalHeight < childLogicalHeight)
         return logicalOffset + remainingLogicalHeight;
@@ -6012,7 +6090,7 @@ void RenderBlock::adjustLinePositionForPagination(RootInlineBox* lineBox, int& d
     if (!pageLogicalHeight || lineHeight > pageLogicalHeight)
         return;
     IntSize offsetDelta = layoutState->m_layoutOffset - layoutState->m_pageOffset;
-    int offset = style()->isHorizontalWritingMode() ? offsetDelta.height() : offsetDelta.width();
+    int offset = isHorizontalWritingMode() ? offsetDelta.height() : offsetDelta.width();
     int remainingLogicalHeight = pageLogicalHeight - (offset + logicalOffset) % pageLogicalHeight;
     if (remainingLogicalHeight < lineHeight) {
         int totalLogicalHeight = lineHeight + max(0, logicalOffset);
@@ -6034,7 +6112,7 @@ int RenderBlock::collapsedMarginBeforeForChild(RenderBox* child) const
     
     // The child has a different directionality.  If the child is parallel, then it's just
     // flipped relative to us.  We can use the collapsed margin for the opposite edge.
-    if (child->style()->isHorizontalWritingMode() == style()->isHorizontalWritingMode())
+    if (child->isHorizontalWritingMode() == isHorizontalWritingMode())
         return child->collapsedMarginAfter();
     
     // The child is perpendicular to us, which means its margins don't collapse but are on the
@@ -6051,7 +6129,7 @@ int RenderBlock::collapsedMarginAfterForChild(RenderBox* child) const
     
     // The child has a different directionality.  If the child is parallel, then it's just
     // flipped relative to us.  We can use the collapsed margin for the opposite edge.
-    if (child->style()->isHorizontalWritingMode() == style()->isHorizontalWritingMode())
+    if (child->isHorizontalWritingMode() == isHorizontalWritingMode())
         return child->collapsedMarginBefore();
     
     // The child is perpendicular to us, which means its margins don't collapse but are on the
@@ -6093,21 +6171,21 @@ int RenderBlock::marginAfterForChild(RenderBoxModelObject* child) const
     
 int RenderBlock::marginStartForChild(RenderBoxModelObject* child) const
 {
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return style()->isLeftToRightDirection() ? child->marginLeft() : child->marginRight();
     return style()->isLeftToRightDirection() ? child->marginTop() : child->marginBottom();
 }
 
 int RenderBlock::marginEndForChild(RenderBoxModelObject* child) const
 {
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return style()->isLeftToRightDirection() ? child->marginRight() : child->marginLeft();
     return style()->isLeftToRightDirection() ? child->marginBottom() : child->marginTop();
 }
 
 void RenderBlock::setMarginStartForChild(RenderBox* child, int margin)
 {
-    if (style()->isHorizontalWritingMode()) {
+    if (isHorizontalWritingMode()) {
         if (style()->isLeftToRightDirection())
             child->setMarginLeft(margin);
         else
@@ -6122,7 +6200,7 @@ void RenderBlock::setMarginStartForChild(RenderBox* child, int margin)
 
 void RenderBlock::setMarginEndForChild(RenderBox* child, int margin)
 {
-    if (style()->isHorizontalWritingMode()) {
+    if (isHorizontalWritingMode()) {
         if (style()->isLeftToRightDirection())
             child->setMarginRight(margin);
         else
@@ -6195,7 +6273,7 @@ RenderBlock::MarginValues RenderBlock::marginValuesForChild(RenderBox* child)
             beforeMargin = child->marginBefore();
             afterMargin = child->marginAfter();
         }
-    } else if (child->style()->isHorizontalWritingMode() == style()->isHorizontalWritingMode()) {
+    } else if (child->isHorizontalWritingMode() == isHorizontalWritingMode()) {
         // The child has a different directionality.  If the child is parallel, then it's just
         // flipped relative to us.  We can use the margins for the opposite edges.
         if (childRenderBlock) {
diff --git a/Source/WebCore/rendering/RenderBlock.h b/Source/WebCore/rendering/RenderBlock.h
index 8d054a6..74751e1 100644
--- a/Source/WebCore/rendering/RenderBlock.h
+++ b/Source/WebCore/rendering/RenderBlock.h
@@ -171,9 +171,9 @@ public:
 
     // Accessors for logical width/height and margins in the containing block's block-flow direction.
     enum ApplyLayoutDeltaMode { ApplyLayoutDelta, DoNotApplyLayoutDelta };
-    int logicalWidthForChild(RenderBox* child) { return style()->isHorizontalWritingMode() ? child->width() : child->height(); }
-    int logicalHeightForChild(RenderBox* child) { return style()->isHorizontalWritingMode() ? child->height() : child->width(); }
-    int logicalTopForChild(RenderBox* child) { return style()->isHorizontalWritingMode() ? child->y() : child->x(); }
+    int logicalWidthForChild(RenderBox* child) { return isHorizontalWritingMode() ? child->width() : child->height(); }
+    int logicalHeightForChild(RenderBox* child) { return isHorizontalWritingMode() ? child->height() : child->width(); }
+    int logicalTopForChild(RenderBox* child) { return isHorizontalWritingMode() ? child->y() : child->x(); }
     void setLogicalLeftForChild(RenderBox* child, int logicalLeft, ApplyLayoutDeltaMode = DoNotApplyLayoutDelta);
     void setLogicalTopForChild(RenderBox* child, int logicalTop, ApplyLayoutDeltaMode = DoNotApplyLayoutDelta);
     int marginBeforeForChild(RenderBoxModelObject* child) const;
@@ -218,8 +218,8 @@ public:
 
     virtual void scrollbarsChanged(bool /*horizontalScrollbarChanged*/, bool /*verticalScrollbarChanged*/) { };
 
-    int logicalRightOffsetForContent() const { return style()->isHorizontalWritingMode() ? borderLeft() + paddingLeft() + availableLogicalWidth() : borderTop() + paddingTop() + availableLogicalWidth(); }
-    int logicalLeftOffsetForContent() const { return style()->isHorizontalWritingMode() ? borderLeft() + paddingLeft() : borderTop() + paddingTop(); }
+    int logicalRightOffsetForContent() const { return isHorizontalWritingMode() ? borderLeft() + paddingLeft() + availableLogicalWidth() : borderTop() + paddingTop() + availableLogicalWidth(); }
+    int logicalLeftOffsetForContent() const { return isHorizontalWritingMode() ? borderLeft() + paddingLeft() : borderTop() + paddingTop(); }
 
 protected:
     // These functions are only used internally to manipulate the render tree structure via remove/insert/appendChildNode.
@@ -297,7 +297,9 @@ protected:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     virtual bool hasLineIfEmpty() const;
-    bool layoutOnlyPositionedObjects();
+    
+    bool simplifiedLayout();
+    void simplifiedNormalFlowLayout();
 
     void computeOverflow(int oldClientAfterEdge, bool recomputeFloats = false);
     virtual void addOverflowFromChildren();
@@ -429,35 +431,35 @@ private:
 
     IntPoint flipFloatForWritingMode(const FloatingObject*, const IntPoint&) const;
 
-    int logicalTopForFloat(const FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->y() : child->x(); }
-    int logicalBottomForFloat(const FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->maxY() : child->maxX(); }
-    int logicalLeftForFloat(const FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->x() : child->y(); }
-    int logicalRightForFloat(const FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->maxX() : child->maxY(); }
-    int logicalWidthForFloat(const FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->width() : child->height(); }
+    int logicalTopForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->y() : child->x(); }
+    int logicalBottomForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->maxY() : child->maxX(); }
+    int logicalLeftForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->x() : child->y(); }
+    int logicalRightForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->maxX() : child->maxY(); }
+    int logicalWidthForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->width() : child->height(); }
     void setLogicalTopForFloat(FloatingObject* child, int logicalTop)
     {
-        if (style()->isHorizontalWritingMode())
+        if (isHorizontalWritingMode())
             child->setY(logicalTop);
         else
             child->setX(logicalTop);
     }
     void setLogicalLeftForFloat(FloatingObject* child, int logicalLeft)
     {
-        if (style()->isHorizontalWritingMode())
+        if (isHorizontalWritingMode())
             child->setX(logicalLeft);
         else
             child->setY(logicalLeft);
     }
     void setLogicalHeightForFloat(FloatingObject* child, int logicalHeight)
     {
-        if (style()->isHorizontalWritingMode())
+        if (isHorizontalWritingMode())
             child->setHeight(logicalHeight);
         else
             child->setWidth(logicalHeight);
     }
     void setLogicalWidthForFloat(FloatingObject* child, int logicalWidth)
     {
-        if (style()->isHorizontalWritingMode())
+        if (isHorizontalWritingMode())
             child->setWidth(logicalWidth);
         else
             child->setHeight(logicalWidth);
@@ -465,7 +467,7 @@ private:
 
     int xPositionForFloatIncludingMargin(const FloatingObject* child) const
     {
-        if (style()->isHorizontalWritingMode())
+        if (isHorizontalWritingMode())
             return child->x() + child->renderer()->marginLeft();
         else
             return child->x() + marginBeforeForChild(child->renderer());
@@ -473,31 +475,32 @@ private:
         
     int yPositionForFloatIncludingMargin(const FloatingObject* child) const
     {
-        if (style()->isHorizontalWritingMode())
+        if (isHorizontalWritingMode())
             return child->y() + marginBeforeForChild(child->renderer());
         else
             return child->y() + child->renderer()->marginTop();
     }
 
     // The following functions' implementations are in RenderBlockLineLayout.cpp.
+    void checkFloatsInCleanLine(RootInlineBox*, Vector<FloatWithRect>&, size_t& floatIndex, bool& encounteredNewFloat, bool& dirtiedByFloat);
     RootInlineBox* determineStartPosition(bool& firstLine, bool& fullLayout, bool& previousLineBrokeCleanly,
                                           InlineBidiResolver&, Vector<FloatWithRect>& floats, unsigned& numCleanFloats,
                                           bool& useRepaintBounds, int& repaintTop, int& repaintBottom);
-    RootInlineBox* determineEndPosition(RootInlineBox* startBox, InlineIterator& cleanLineStart,
-                                        BidiStatus& cleanLineBidiStatus,
-                                        int& yPos);
+    RootInlineBox* determineEndPosition(RootInlineBox* startBox, Vector<FloatWithRect>& floats, size_t floatIndex, InlineIterator& cleanLineStart,
+                                        BidiStatus& cleanLineBidiStatus, int& yPos);
     bool matchedEndLine(const InlineBidiResolver&, const InlineIterator& endLineStart, const BidiStatus& endLineStatus,
                         RootInlineBox*& endLine, int& endYPos, int& repaintBottom, int& repaintTop);
 
     void skipTrailingWhitespace(InlineIterator&, bool isLineEmpty, bool previousLineBrokeCleanly);
-    int skipLeadingWhitespace(InlineBidiResolver&, bool firstLine, bool isLineEmpty, bool previousLineBrokeCleanly, FloatingObject* lastFloatFromPreviousLine);
+    void skipLeadingWhitespace(InlineBidiResolver&, bool firstLine, bool isLineEmpty, bool previousLineBrokeCleanly, FloatingObject* lastFloatFromPreviousLine, int& lineLeftOffset, int& lineRightOffset);
     void fitBelowFloats(float widthToFit, bool firstLine, float& availableWidth);
     typedef std::pair<RenderText*, LazyLineBreakIterator> LineBreakIteratorInfo;
-    InlineIterator findNextLineBreak(InlineBidiResolver&, bool firstLine, bool& isLineEmpty, LineBreakIteratorInfo&, bool& previousLineBrokeCleanly, bool& hyphenated, EClear*, FloatingObject* lastFloatFromPreviousLine);
-    RootInlineBox* constructLine(unsigned runCount, BidiRun* firstRun, BidiRun* lastRun, bool firstLine, bool lastLine, RenderObject* endObject);
-    InlineFlowBox* createLineBoxes(RenderObject*, bool firstLine);
+    InlineIterator findNextLineBreak(InlineBidiResolver&, bool firstLine, bool& isLineEmpty, LineBreakIteratorInfo&, bool& previousLineBrokeCleanly, bool& hyphenated,
+                                     EClear*, FloatingObject* lastFloatFromPreviousLine, Vector<RenderBox*>& positionedObjects);
+    RootInlineBox* constructLine(unsigned runCount, BidiRun* firstRun, BidiRun* lastRun, bool firstLine, bool lastLine, RenderObject* endObject, RenderObject* logicallyLastRunRenderer);
+    InlineFlowBox* createLineBoxes(RenderObject*, bool firstLine, InlineBox* childBox);
 
-    void computeInlineDirectionPositionsForLine(RootInlineBox*, bool firstLine, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd, GlyphOverflowAndFallbackFontsMap&);
+    void computeInlineDirectionPositionsForLine(RootInlineBox*, bool firstLine, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd, GlyphOverflowAndFallbackFontsMap&, VerticalPositionCache&);
     void computeBlockDirectionPositionsForLine(RootInlineBox*, BidiRun*, GlyphOverflowAndFallbackFontsMap&, VerticalPositionCache&);
     void deleteEllipsisLineBoxes();
     void checkLinesForTextOverflow();
@@ -526,7 +529,7 @@ private:
     
     // Positions new floats and also adjust all floats encountered on the line if any of them
     // have to move to the next page/column.
-    bool positionNewFloatOnLine(FloatingObject* newFloat, FloatingObject* lastFloatFromPreviousLine);
+    bool positionNewFloatOnLine(FloatingObject* newFloat, FloatingObject* lastFloatFromPreviousLine, bool firstLine, int& lineLeftOffset, int& lineRightOffset);
 
     void clearFloats();
     int getClearDelta(RenderBox* child, int yPos);
diff --git a/Source/WebCore/rendering/RenderBlockLineLayout.cpp b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
index d1fce88..3a0f016 100644
--- a/Source/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -95,7 +95,7 @@ static void checkMidpoints(LineMidpointState& lineMidpointState, InlineIterator&
     // Check to see if our last midpoint is a start point beyond the line break.  If so,
     // shave it off the list, and shave off a trailing space if the previous end point doesn't
     // preserve whitespace.
-    if (lBreak.obj && lineMidpointState.numMidpoints && !(lineMidpointState.numMidpoints % 2)) {
+    if (lBreak.m_obj && lineMidpointState.numMidpoints && !(lineMidpointState.numMidpoints % 2)) {
         InlineIterator* midpoints = lineMidpointState.midpoints.data();
         InlineIterator& endpoint = midpoints[lineMidpointState.numMidpoints - 2];
         const InlineIterator& startpoint = midpoints[lineMidpointState.numMidpoints - 1];
@@ -105,8 +105,8 @@ static void checkMidpoints(LineMidpointState& lineMidpointState, InlineIterator&
         if (currpoint == lBreak) {
             // We hit the line break before the start point.  Shave off the start point.
             lineMidpointState.numMidpoints--;
-            if (endpoint.obj->style()->collapseWhiteSpace())
-                endpoint.pos--;
+            if (endpoint.m_obj->style()->collapseWhiteSpace())
+                endpoint.m_pos--;
         }
     }    
 }
@@ -132,31 +132,31 @@ void RenderBlock::appendRunsForObject(int start, int end, RenderObject* obj, Inl
     if (haveNextMidpoint)
         nextMidpoint = lineMidpointState.midpoints[lineMidpointState.currentMidpoint];
     if (lineMidpointState.betweenMidpoints) {
-        if (!(haveNextMidpoint && nextMidpoint.obj == obj))
+        if (!(haveNextMidpoint && nextMidpoint.m_obj == obj))
             return;
         // This is a new start point. Stop ignoring objects and 
         // adjust our start.
         lineMidpointState.betweenMidpoints = false;
-        start = nextMidpoint.pos;
+        start = nextMidpoint.m_pos;
         lineMidpointState.currentMidpoint++;
         if (start < end)
             return appendRunsForObject(start, end, obj, resolver);
     } else {
-        if (!haveNextMidpoint || (obj != nextMidpoint.obj)) {
+        if (!haveNextMidpoint || (obj != nextMidpoint.m_obj)) {
             resolver.addRun(new (obj->renderArena()) BidiRun(start, end, obj, resolver.context(), resolver.dir()));
             return;
         }
 
         // An end midpoint has been encountered within our object.  We
         // need to go ahead and append a run with our endpoint.
-        if (static_cast<int>(nextMidpoint.pos + 1) <= end) {
+        if (static_cast<int>(nextMidpoint.m_pos + 1) <= end) {
             lineMidpointState.betweenMidpoints = true;
             lineMidpointState.currentMidpoint++;
-            if (nextMidpoint.pos != UINT_MAX) { // UINT_MAX means stop at the object and don't include any of it.
-                if (static_cast<int>(nextMidpoint.pos + 1) > start)
+            if (nextMidpoint.m_pos != UINT_MAX) { // UINT_MAX means stop at the object and don't include any of it.
+                if (static_cast<int>(nextMidpoint.m_pos + 1) > start)
                     resolver.addRun(new (obj->renderArena())
-                        BidiRun(start, nextMidpoint.pos + 1, obj, resolver.context(), resolver.dir()));
-                return appendRunsForObject(nextMidpoint.pos + 1, end, obj, resolver);
+                        BidiRun(start, nextMidpoint.m_pos + 1, obj, resolver.context(), resolver.dir()));
+                return appendRunsForObject(nextMidpoint.m_pos + 1, end, obj, resolver);
             }
         } else
            resolver.addRun(new (obj->renderArena()) BidiRun(start, end, obj, resolver.context(), resolver.dir()));
@@ -203,14 +203,14 @@ static bool parentIsConstructedOrHaveNext(InlineFlowBox* parentBox)
     return false;
 }
 
-InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj, bool firstLine)
+InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj, bool firstLine, InlineBox* childBox)
 {
     // See if we have an unconstructed line box for this object that is also
     // the last item on the line.
     unsigned lineDepth = 1;
-    InlineFlowBox* childBox = 0;
     InlineFlowBox* parentBox = 0;
     InlineFlowBox* result = 0;
+    bool hasDefaultLineBoxContain = style()->lineBoxContain() == RenderStyle::initialLineBoxContain();
     do {
         ASSERT(obj->isRenderInline() || obj == this);
         
@@ -230,7 +230,9 @@ InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj, bool firstLine)
             ASSERT(newBox->isInlineFlowBox());
             parentBox = static_cast<InlineFlowBox*>(newBox);
             parentBox->setFirstLineStyleBit(firstLine);
-            parentBox->setIsHorizontal(style()->isHorizontalWritingMode());
+            parentBox->setIsHorizontal(isHorizontalWritingMode());
+            if (!hasDefaultLineBoxContain)
+                parentBox->clearDescendantsHaveSameLineHeightAndBaseline();
             constructedNewBox = true;
         }
 
@@ -257,7 +259,7 @@ InlineFlowBox* RenderBlock::createLineBoxes(RenderObject* obj, bool firstLine)
     return result;
 }
 
-RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun, BidiRun* lastRun, bool firstLine, bool lastLine, RenderObject* endObject)
+RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun, BidiRun* lastRun, bool firstLine, bool lastLine, RenderObject* endObject, RenderObject* logicallyLastRunRenderer)
 {
     ASSERT(firstRun);
 
@@ -284,10 +286,11 @@ RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun,
         // run's inline box.
         if (!parentBox || parentBox->renderer() != r->m_object->parent())
             // Create new inline boxes all the way back to the appropriate insertion point.
-            parentBox = createLineBoxes(r->m_object->parent(), firstLine);
-
-        // Append the inline box to this line.
-        parentBox->addToLine(box);
+            parentBox = createLineBoxes(r->m_object->parent(), firstLine, box);
+        else {
+            // Append the inline box to this line.
+            parentBox->addToLine(box);
+        }
 
         bool visuallyOrdered = r->m_object->style()->visuallyOrdered();
         box->setBidiLevel(r->level());
@@ -315,7 +318,7 @@ RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun,
     // paint borders/margins/padding.  This knowledge will ultimately be used when
     // we determine the horizontal positions and widths of all the inline boxes on
     // the line.
-    lastLineBox()->determineSpacingForFlowBoxes(lastLine, endObject);
+    lastLineBox()->determineSpacingForFlowBoxes(lastLine, endObject, logicallyLastRunRenderer);
 
     // Now mark the line boxes as being constructed.
     lastLineBox()->setConstructed();
@@ -333,7 +336,60 @@ ETextAlign RenderBlock::textAlignmentForLine(bool endsWithSoftBreak) const
     return alignment;
 }
 
-void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox, bool firstLine, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd, GlyphOverflowAndFallbackFontsMap& textBoxDataMap)
+static void updateLogicalWidthForLeftAlignedBlock(bool isLeftToRightDirection, BidiRun* trailingSpaceRun, float& logicalLeft, float& totalLogicalWidth, float availableLogicalWidth)
+{
+    // The direction of the block should determine what happens with wide lines.
+    // In particular with RTL blocks, wide lines should still spill out to the left.
+    if (isLeftToRightDirection) {
+        if (totalLogicalWidth > availableLogicalWidth && trailingSpaceRun)
+            trailingSpaceRun->m_box->setLogicalWidth(max<float>(0, trailingSpaceRun->m_box->logicalWidth() - totalLogicalWidth + availableLogicalWidth));
+        return;
+    }
+
+    if (trailingSpaceRun)
+        trailingSpaceRun->m_box->setLogicalWidth(0);
+    else if (totalLogicalWidth > availableLogicalWidth)
+        logicalLeft -= (totalLogicalWidth - availableLogicalWidth);
+}
+
+static void updateLogicalWidthForRightAlignedBlock(bool isLeftToRightDirection, BidiRun* trailingSpaceRun, float& logicalLeft, float& totalLogicalWidth, float availableLogicalWidth)
+{
+    // Wide lines spill out of the block based off direction.
+    // So even if text-align is right, if direction is LTR, wide lines should overflow out of the right
+    // side of the block.
+    if (isLeftToRightDirection) {
+        if (trailingSpaceRun) {
+            totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
+            trailingSpaceRun->m_box->setLogicalWidth(0);
+        }
+        if (totalLogicalWidth < availableLogicalWidth)
+            logicalLeft += availableLogicalWidth - totalLogicalWidth;
+        return;
+    }
+
+    if (totalLogicalWidth > availableLogicalWidth && trailingSpaceRun) {
+        trailingSpaceRun->m_box->setLogicalWidth(max<float>(0, trailingSpaceRun->m_box->logicalWidth() - totalLogicalWidth + availableLogicalWidth));
+        totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
+    } else
+        logicalLeft += availableLogicalWidth - totalLogicalWidth;
+}
+
+static void updateLogicalWidthForCenterAlignedBlock(bool isLeftToRightDirection, BidiRun* trailingSpaceRun, float& logicalLeft, float& totalLogicalWidth, float availableLogicalWidth)
+{
+    float trailingSpaceWidth = 0;
+    if (trailingSpaceRun) {
+        totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
+        trailingSpaceWidth = min(trailingSpaceRun->m_box->logicalWidth(), (availableLogicalWidth - totalLogicalWidth + 1) / 2);
+        trailingSpaceRun->m_box->setLogicalWidth(max<float>(0, trailingSpaceWidth));
+    }
+    if (isLeftToRightDirection)
+        logicalLeft += max<float>((availableLogicalWidth - totalLogicalWidth) / 2, 0);
+    else
+        logicalLeft += totalLogicalWidth > availableLogicalWidth ? (availableLogicalWidth - totalLogicalWidth) : (availableLogicalWidth - totalLogicalWidth) / 2 - trailingSpaceWidth;
+}
+
+void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox, bool firstLine, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd,
+                                                         GlyphOverflowAndFallbackFontsMap& textBoxDataMap, VerticalPositionCache& verticalPositionCache)
 {
     ETextAlign textAlign = textAlignmentForLine(!reachedEnd && !lineBox->endsWithBreak());
     float logicalLeft = logicalLeftOffsetForLine(logicalHeight(), firstLine);
@@ -354,6 +410,8 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
             RenderText* rt = toRenderText(r->m_object);
 
             if (textAlign == JUSTIFY && r != trailingSpaceRun) {
+                if (!isAfterExpansion)
+                    static_cast<InlineTextBox*>(r->m_box)->setCanHaveLeadingExpansion(true);
                 unsigned opportunitiesInRun = Font::expansionOpportunityCount(rt->characters() + r->m_start, r->m_stop - r->m_start, r->m_box->direction(), isAfterExpansion);
                 expansionOpportunities.append(opportunitiesInRun);
                 expansionOpportunityCount += opportunitiesInRun;
@@ -366,6 +424,21 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
             }
             HashSet<const SimpleFontData*> fallbackFonts;
             GlyphOverflow glyphOverflow;
+            
+            // Always compute glyph overflow if the block's line-box-contain value is "glyphs".
+            if (lineBox->fitsToGlyphs()) {
+                // If we don't stick out of the root line's font box, then don't bother computing our glyph overflow. This optimization
+                // will keep us from computing glyph bounds in nearly all cases.
+                bool includeRootLine = lineBox->includesRootLineBoxFontOrLeading();
+                int baselineShift = lineBox->verticalPositionForBox(r->m_box, verticalPositionCache);
+                int rootDescent = includeRootLine ? lineBox->renderer()->style(firstLine)->font().fontMetrics().descent() : 0;
+                int rootAscent = includeRootLine ? lineBox->renderer()->style(firstLine)->font().fontMetrics().ascent() : 0;
+                int boxAscent = rt->style(firstLine)->font().fontMetrics().ascent() - baselineShift;
+                int boxDescent = rt->style(firstLine)->font().fontMetrics().descent() + baselineShift;
+                if (boxAscent > rootDescent ||  boxDescent > rootAscent)
+                    glyphOverflow.computeBounds = true; 
+            }
+
             int hyphenWidth = 0;
             if (static_cast<InlineTextBox*>(r->m_box)->hasHyphen()) {
                 const AtomicString& hyphenString = rt->style()->hyphenString();
@@ -377,6 +450,7 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
                 GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.add(static_cast<InlineTextBox*>(r->m_box), make_pair(Vector<const SimpleFontData*>(), GlyphOverflow())).first;
                 ASSERT(it->second.first.isEmpty());
                 copyToVector(fallbackFonts, it->second.first);
+                r->m_box->parent()->clearDescendantsHaveSameLineHeightAndBaseline();
             }
             if ((glyphOverflow.top || glyphOverflow.bottom || glyphOverflow.left || glyphOverflow.right)) {
                 ASSERT(r->m_box->isText());
@@ -408,17 +482,7 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
     switch (textAlign) {
         case LEFT:
         case WEBKIT_LEFT:
-            // The direction of the block should determine what happens with wide lines.  In
-            // particular with RTL blocks, wide lines should still spill out to the left.
-            if (style()->isLeftToRightDirection()) {
-                if (totalLogicalWidth > availableLogicalWidth && trailingSpaceRun)
-                    trailingSpaceRun->m_box->setLogicalWidth(max<float>(0, trailingSpaceRun->m_box->logicalWidth() - totalLogicalWidth + availableLogicalWidth));
-            } else {
-                if (trailingSpaceRun)
-                    trailingSpaceRun->m_box->setLogicalWidth(0);
-                else if (totalLogicalWidth > availableLogicalWidth)
-                    logicalLeft -= (totalLogicalWidth - availableLogicalWidth);
-            }
+            updateLogicalWidthForLeftAlignedBlock(style()->isLeftToRightDirection(), trailingSpaceRun, logicalLeft, totalLogicalWidth, availableLogicalWidth);
             break;
         case JUSTIFY:
             adjustInlineDirectionLineBounds(expansionOpportunityCount, logicalLeft, availableLogicalWidth);
@@ -439,40 +503,27 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
             }
         case RIGHT:
         case WEBKIT_RIGHT:
-            // Wide lines spill out of the block based off direction.
-            // So even if text-align is right, if direction is LTR, wide lines should overflow out of the right
-            // side of the block.
-            if (style()->isLeftToRightDirection()) {
-                if (trailingSpaceRun) {
-                    totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
-                    trailingSpaceRun->m_box->setLogicalWidth(0);
-                }
-                if (totalLogicalWidth < availableLogicalWidth)
-                    logicalLeft += availableLogicalWidth - totalLogicalWidth;
-            } else {
-                if (totalLogicalWidth > availableLogicalWidth && trailingSpaceRun) {
-                    trailingSpaceRun->m_box->setLogicalWidth(max<float>(0, trailingSpaceRun->m_box->logicalWidth() - totalLogicalWidth + availableLogicalWidth));
-                    totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
-                } else
-                    logicalLeft += availableLogicalWidth - totalLogicalWidth;
-            }
+            updateLogicalWidthForRightAlignedBlock(style()->isLeftToRightDirection(), trailingSpaceRun, logicalLeft, totalLogicalWidth, availableLogicalWidth);
             break;
         case CENTER:
         case WEBKIT_CENTER:
-            float trailingSpaceWidth = 0;
-            if (trailingSpaceRun) {
-                totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
-                trailingSpaceWidth = min(trailingSpaceRun->m_box->logicalWidth(), (availableLogicalWidth - totalLogicalWidth + 1) / 2);
-                trailingSpaceRun->m_box->setLogicalWidth(max<float>(0, trailingSpaceWidth));
-            }
+            updateLogicalWidthForCenterAlignedBlock(style()->isLeftToRightDirection(), trailingSpaceRun, logicalLeft, totalLogicalWidth, availableLogicalWidth);
+            break;
+        case TASTART:
             if (style()->isLeftToRightDirection())
-                logicalLeft += max<float>((availableLogicalWidth - totalLogicalWidth) / 2, 0);
+                updateLogicalWidthForLeftAlignedBlock(style()->isLeftToRightDirection(), trailingSpaceRun, logicalLeft, totalLogicalWidth, availableLogicalWidth);
             else
-                logicalLeft += totalLogicalWidth > availableLogicalWidth ? (availableLogicalWidth - totalLogicalWidth) : (availableLogicalWidth - totalLogicalWidth) / 2 - trailingSpaceWidth;
+                updateLogicalWidthForRightAlignedBlock(style()->isLeftToRightDirection(), trailingSpaceRun, logicalLeft, totalLogicalWidth, availableLogicalWidth);
+            break;
+        case TAEND:
+            if (style()->isLeftToRightDirection())
+                updateLogicalWidthForRightAlignedBlock(style()->isLeftToRightDirection(), trailingSpaceRun, logicalLeft, totalLogicalWidth, availableLogicalWidth);
+            else
+                updateLogicalWidthForLeftAlignedBlock(style()->isLeftToRightDirection(), trailingSpaceRun, logicalLeft, totalLogicalWidth, availableLogicalWidth);
             break;
     }
 
-    if (expansionOpportunityCount) {
+    if (expansionOpportunityCount && availableLogicalWidth > totalLogicalWidth) {
         size_t i = 0;
         for (BidiRun* r = firstRun; r; r = r->next()) {
             if (!r->m_box || r == trailingSpaceRun)
@@ -543,6 +594,49 @@ static inline bool isCollapsibleSpace(UChar character, RenderText* renderer)
     return false;
 }
 
+
+static void setStaticPositions(RenderBlock* block, RenderBox* child)
+{
+    // FIXME: The math here is actually not really right. It's a best-guess approximation that
+    // will work for the common cases
+    RenderObject* containerBlock = child->container();
+    int blockHeight = block->logicalHeight();
+    if (containerBlock->isRenderInline()) {
+        // A relative positioned inline encloses us. In this case, we also have to determine our
+        // position as though we were an inline. Set |staticInlinePosition| and |staticBlockPosition| on the relative positioned
+        // inline so that we can obtain the value later.
+        toRenderInline(containerBlock)->layer()->setStaticInlinePosition(block->startOffsetForLine(blockHeight, false));
+        toRenderInline(containerBlock)->layer()->setStaticBlockPosition(blockHeight);
+    }
+
+    if (child->style()->isOriginalDisplayInlineType())
+        child->layer()->setStaticInlinePosition(block->startOffsetForLine(blockHeight, false));
+    else
+        child->layer()->setStaticInlinePosition(block->borderAndPaddingStart());
+    child->layer()->setStaticBlockPosition(blockHeight);
+}
+
+static bool reachedEndOfTextRenderer(InlineBidiResolver& resolver)
+{
+    BidiRun* run = resolver.logicallyLastRun();
+    if (!run)
+        return true;
+    unsigned int pos = run->stop();
+    RenderObject* r = run->m_object;
+    if (!r->isText() || r->isBR())
+        return false;
+    RenderText* renderText = toRenderText(r);
+    if (pos >= renderText->textLength())
+        return true;
+
+    while (isASCIISpace(renderText->characters()[pos])) {
+        pos++;
+        if (pos >= renderText->textLength())
+            return true;
+    }
+    return false;
+}
+    
 void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogicalTop, int& repaintLogicalBottom)
 {
     bool useRepaintBounds = false;
@@ -748,7 +842,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
         BidiStatus cleanLineBidiStatus;
         int endLineLogicalTop = 0;
         RootInlineBox* endLine = (fullLayout || !startLine) ? 
-                                 0 : determineEndPosition(startLine, cleanLineStart, cleanLineBidiStatus, endLineLogicalTop);
+                                 0 : determineEndPosition(startLine, floats, floatIndex, cleanLineStart, cleanLineBidiStatus, endLineLogicalTop);
 
         if (startLine) {
             if (!useRepaintBounds) {
@@ -806,10 +900,11 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
             
             EClear clear = CNONE;
             bool hyphenated;
+            Vector<RenderBox*> positionedObjects;
             
             InlineIterator oldEnd = end;
             FloatingObject* lastFloatFromPreviousLine = (m_floatingObjects && !m_floatingObjects->set().isEmpty()) ? m_floatingObjects->set().last() : 0;
-            end = findNextLineBreak(resolver, firstLine, isLineEmpty, lineBreakIteratorInfo, previousLineBrokeCleanly, hyphenated, &clear, lastFloatFromPreviousLine);
+            end = findNextLineBreak(resolver, firstLine, isLineEmpty, lineBreakIteratorInfo, previousLineBrokeCleanly, hyphenated, &clear, lastFloatFromPreviousLine, positionedObjects);
             if (resolver.position().atEnd()) {
                 resolver.deleteRuns();
                 checkForFloatsFromLastLine = true;
@@ -817,7 +912,10 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
             }
             ASSERT(end != resolver.position());
 
-            if (!isLineEmpty) {
+            if (isLineEmpty) {
+                if (lastRootBox())
+                    lastRootBox()->setLineBreakInfo(end.m_obj, end.m_pos, resolver.status());
+            } else {
                 VisualDirectionOverride override = (style()->visuallyOrdered() ? (style()->direction() == LTR ? VisualLeftToRightOverride : VisualRightToLeftOverride) : NoVisualOverride);
                 resolver.createBidiRunsForLine(end, override, previousLineBrokeCleanly);
                 ASSERT(resolver.position() == end);
@@ -879,7 +977,8 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                 if (resolver.runCount()) {
                     if (hyphenated)
                         resolver.logicallyLastRun()->m_hasHyphen = true;
-                    lineBox = constructLine(resolver.runCount(), resolver.firstRun(), resolver.lastRun(), firstLine, !end.obj, end.obj && !end.pos ? end.obj : 0);
+                    bool lastLine = end.m_obj && end.m_obj->isText() ? reachedEndOfTextRenderer(resolver) : !end.m_obj;
+                    lineBox = constructLine(resolver.runCount(), resolver.firstRun(), resolver.lastRun(), firstLine, lastLine, end.m_obj && !end.m_pos ? end.m_obj : 0, resolver.logicallyLastRun()->m_object);
                     if (lineBox) {
                         lineBox->setEndsWithBreak(previousLineBrokeCleanly);
 
@@ -890,10 +989,10 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
 #endif
 
                         GlyphOverflowAndFallbackFontsMap textBoxDataMap;
-
+                    
                         // Now we position all of our text runs horizontally.
                         if (!isSVGRootInlineBox)
-                            computeInlineDirectionPositionsForLine(lineBox, firstLine, resolver.firstRun(), trailingSpaceRun, end.atEnd(), textBoxDataMap);
+                            computeInlineDirectionPositionsForLine(lineBox, firstLine, resolver.firstRun(), trailingSpaceRun, end.atEnd(), textBoxDataMap, verticalPositionCache);
 
                         // Now position our text runs vertically.
                         computeBlockDirectionPositionsForLine(lineBox, resolver.firstRun(), textBoxDataMap, verticalPositionCache);
@@ -924,7 +1023,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                 resolver.deleteRuns();
 
                 if (lineBox) {
-                    lineBox->setLineBreakInfo(end.obj, end.pos, resolver.status());
+                    lineBox->setLineBreakInfo(end.m_obj, end.m_pos, resolver.status());
                     if (useRepaintBounds) {
                         repaintLogicalTop = min(repaintLogicalTop, beforeSideVisualOverflowForLine(lineBox));
                         repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisualOverflowForLine(lineBox));
@@ -954,6 +1053,9 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
                     }
                 }
 
+                for (size_t i = 0; i < positionedObjects.size(); ++i)
+                    setStaticPositions(this, positionedObjects[i]);
+
                 firstLine = false;
                 newLine(clear);
             }
@@ -1081,7 +1183,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
     setLogicalHeight(logicalHeight() + lastLineAnnotationsAdjustment + borderAfter() + paddingAfter() + scrollbarLogicalHeight());
 
     if (!firstLineBox() && hasLineIfEmpty())
-        setLogicalHeight(logicalHeight() + lineHeight(true, style()->isHorizontalWritingMode() ? HorizontalLine : VerticalLine, PositionOfInteriorLineBoxes));
+        setLogicalHeight(logicalHeight() + lineHeight(true, isHorizontalWritingMode() ? HorizontalLine : VerticalLine, PositionOfInteriorLineBoxes));
 
     // See if we have any lines that spill out of our block.  If we do, then we will possibly need to
     // truncate text.
@@ -1089,6 +1191,35 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogica
         checkLinesForTextOverflow();
 }
 
+void RenderBlock::checkFloatsInCleanLine(RootInlineBox* line, Vector<FloatWithRect>& floats, size_t& floatIndex, bool& encounteredNewFloat, bool& dirtiedByFloat)
+{
+    Vector<RenderBox*>* cleanLineFloats = line->floatsPtr();
+    if (!cleanLineFloats)
+        return;
+
+    Vector<RenderBox*>::iterator end = cleanLineFloats->end();
+    for (Vector<RenderBox*>::iterator it = cleanLineFloats->begin(); it != end; ++it) {
+        RenderBox* floatingBox = *it;
+        floatingBox->layoutIfNeeded();
+        IntSize newSize(floatingBox->width() + floatingBox->marginLeft() + floatingBox->marginRight(), floatingBox->height() + floatingBox->marginTop() + floatingBox->marginBottom());
+        ASSERT(floatIndex < floats.size());
+        if (floats[floatIndex].object != floatingBox) {
+            encounteredNewFloat = true;
+            return;
+        }
+        if (floats[floatIndex].rect.size() != newSize) {
+            int floatTop = isHorizontalWritingMode() ? floats[floatIndex].rect.y() : floats[floatIndex].rect.x();
+            int floatHeight = isHorizontalWritingMode() ? max(floats[floatIndex].rect.height(), newSize.height()) 
+                                                                 : max(floats[floatIndex].rect.width(), newSize.width());
+            line->markDirty();
+            markLinesDirtyInBlockRange(line->blockLogicalHeight(), floatTop + floatHeight, line);
+            floats[floatIndex].rect.setSize(newSize);
+            dirtiedByFloat = true;
+        }
+        floatIndex++;
+    }
+}
+
 RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLayout, bool& previousLineBrokeCleanly, 
                                                    InlineBidiResolver& resolver, Vector<FloatWithRect>& floats, unsigned& numCleanFloats,
                                                    bool& useRepaintBounds, int& repaintLogicalTop, int& repaintLogicalBottom)
@@ -1121,32 +1252,9 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLa
                     curr->adjustBlockDirectionPosition(paginationDelta);
                 }                
             }
-            
-            if (Vector<RenderBox*>* cleanLineFloats = curr->floatsPtr()) {
-                Vector<RenderBox*>::iterator end = cleanLineFloats->end();
-                for (Vector<RenderBox*>::iterator o = cleanLineFloats->begin(); o != end; ++o) {
-                    RenderBox* f = *o;
-                    f->layoutIfNeeded();
-                    IntSize newSize(f->width() + f->marginLeft() + f->marginRight(), f->height() + f->marginTop() + f->marginBottom());
-                    ASSERT(floatIndex < floats.size());
-                    if (floats[floatIndex].object != f) {
-                        // A new float has been inserted before this line or before its last known float.
-                        // Just do a full layout.
-                        fullLayout = true;
-                        break;
-                    }
-                    if (floats[floatIndex].rect.size() != newSize) {
-                        int floatTop = style()->isHorizontalWritingMode() ? floats[floatIndex].rect.y() : floats[floatIndex].rect.x();
-                        int floatHeight = style()->isHorizontalWritingMode() ? max(floats[floatIndex].rect.height(), newSize.height()) 
-                                                                             : max(floats[floatIndex].rect.width(), newSize.width());
-                        curr->markDirty();
-                        markLinesDirtyInBlockRange(curr->blockLogicalHeight(), floatTop + floatHeight, curr);
-                        floats[floatIndex].rect.setSize(newSize);
-                        dirtiedByFloat = true;
-                    }
-                    floatIndex++;
-                }
-            }
+
+            // If a new float has been inserted before this line or before its last known float,just do a full layout.
+            checkFloatsInCleanLine(curr, floats, floatIndex, fullLayout, dirtiedByFloat);
             if (dirtiedByFloat || fullLayout)
                 break;
         }
@@ -1220,17 +1328,12 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLa
         pos = last->lineBreakPos();
         resolver.setStatus(last->lineBreakBidiStatus());
     } else {
-        bool ltr = style()->isLeftToRightDirection()
-    #if ENABLE(SVG)   
-            || (style()->unicodeBidi() == UBNormal && isSVGText())
-    #endif
-            ;
-
+        bool ltr = style()->isLeftToRightDirection();
         Direction direction = ltr ? LeftToRight : RightToLeft;
         resolver.setLastStrongDir(direction);
         resolver.setLastDir(direction);
         resolver.setEorDir(direction);
-        resolver.setContext(BidiContext::create(ltr ? 0 : 1, direction, style()->unicodeBidi() == Override));
+        resolver.setContext(BidiContext::create(ltr ? 0 : 1, direction, style()->unicodeBidi() == Override, FromStyleOrDOM));
 
         startObj = bidiFirst(this, &resolver);
     }
@@ -1240,23 +1343,29 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLa
     return curr;
 }
 
-RootInlineBox* RenderBlock::determineEndPosition(RootInlineBox* startLine, InlineIterator& cleanLineStart, BidiStatus& cleanLineBidiStatus, int& logicalTop)
+RootInlineBox* RenderBlock::determineEndPosition(RootInlineBox* startLine, Vector<FloatWithRect>& floats, size_t floatIndex, InlineIterator& cleanLineStart, BidiStatus& cleanLineBidiStatus, int& logicalTop)
 {
     RootInlineBox* last = 0;
-    if (!startLine)
-        last = 0;
-    else {
-        for (RootInlineBox* curr = startLine->nextRootBox(); curr; curr = curr->nextRootBox()) {
-            if (curr->isDirty())
-                last = 0;
-            else if (!last)
-                last = curr;
+    for (RootInlineBox* curr = startLine->nextRootBox(); curr; curr = curr->nextRootBox()) {
+        if (!curr->isDirty()) {
+            bool encounteredNewFloat = false;
+            bool dirtiedByFloat = false;
+            checkFloatsInCleanLine(curr, floats, floatIndex, encounteredNewFloat, dirtiedByFloat);
+            if (encounteredNewFloat)
+                return 0;
         }
+        if (curr->isDirty())
+            last = 0;
+        else if (!last)
+            last = curr;
     }
 
     if (!last)
         return 0;
 
+    // At this point, |last| is the first line in a run of clean lines that ends with the last line
+    // in the block.
+
     RootInlineBox* prev = last->prevRootBox();
     cleanLineStart = InlineIterator(this, prev->lineBreakObj(), prev->lineBreakPos());
     cleanLineBidiStatus = prev->lineBreakBidiStatus();
@@ -1305,7 +1414,7 @@ bool RenderBlock::matchedEndLine(const InlineBidiResolver& resolver, const Inlin
     static int numLines = 8; // The # of lines we're willing to match against.
     RootInlineBox* line = endLine;
     for (int i = 0; i < numLines && line; i++, line = line->nextRootBox()) {
-        if (line->lineBreakObj() == resolver.position().obj && line->lineBreakPos() == resolver.position().pos) {
+        if (line->lineBreakObj() == resolver.position().m_obj && line->lineBreakPos() == resolver.position().m_pos) {
             // We have a match.
             if (line->lineBreakBidiStatus() != resolver.status())
                 return false; // ...but the bidi state doesn't match.
@@ -1356,7 +1465,7 @@ bool RenderBlock::matchedEndLine(const InlineBidiResolver& resolver, const Inlin
 
 static inline bool skipNonBreakingSpace(const InlineIterator& it, bool isLineEmpty, bool previousLineBrokeCleanly)
 {
-    if (it.obj->style()->nbspMode() != SPACE || it.current() != noBreakSpace)
+    if (it.m_obj->style()->nbspMode() != SPACE || it.current() != noBreakSpace)
         return false;
 
     // FIXME: This is bad.  It makes nbsp inconsistent with space and won't work correctly
@@ -1395,17 +1504,17 @@ static bool inlineFlowRequiresLineBox(RenderInline* flow)
 
 bool RenderBlock::requiresLineBox(const InlineIterator& it, bool isLineEmpty, bool previousLineBrokeCleanly)
 {
-    if (it.obj->isFloatingOrPositioned())
+    if (it.m_obj->isFloatingOrPositioned())
         return false;
 
-    if (it.obj->isRenderInline() && !inlineFlowRequiresLineBox(toRenderInline(it.obj)))
+    if (it.m_obj->isRenderInline() && !inlineFlowRequiresLineBox(toRenderInline(it.m_obj)))
         return false;
 
-    if (!shouldCollapseWhiteSpace(it.obj->style(), isLineEmpty, previousLineBrokeCleanly) || it.obj->isBR())
+    if (!shouldCollapseWhiteSpace(it.m_obj->style(), isLineEmpty, previousLineBrokeCleanly) || it.m_obj->isBR())
         return true;
 
     UChar current = it.current();
-    return current != ' ' && current != '\t' && current != softHyphen && (current != '\n' || shouldPreserveNewline(it.obj)) 
+    return current != ' ' && current != '\t' && current != softHyphen && (current != '\n' || shouldPreserveNewline(it.m_obj)) 
             && !skipNonBreakingSpace(it, isLineEmpty, previousLineBrokeCleanly);
 }
 
@@ -1420,34 +1529,6 @@ bool RenderBlock::generatesLineBoxesForInlineChild(RenderObject* inlineObj, bool
     return !it.atEnd();
 }
 
-static void setStaticPositions(RenderBlock* block, RenderBox* child)
-{
-    // FIXME: The math here is actually not really right. It's a best-guess approximation that
-    // will work for the common cases
-    RenderObject* containerBlock = child->container();
-    if (containerBlock->isRenderInline()) {
-        // A relative positioned inline encloses us. In this case, we also have to determine our
-        // position as though we were an inline. Set |staticInlinePosition| and |staticBlockPosition| on the relative positioned
-        // inline so that we can obtain the value later.
-        toRenderInline(containerBlock)->layer()->setStaticInlinePosition(block->startOffsetForLine(block->logicalHeight(), false));
-        toRenderInline(containerBlock)->layer()->setStaticBlockPosition(block->logicalHeight());
-    }
-
-    bool isHorizontal = block->style()->isHorizontalWritingMode();
-    bool hasStaticInlinePosition = child->style()->hasStaticInlinePosition(isHorizontal);
-    bool hasStaticBlockPosition = child->style()->hasStaticBlockPosition(isHorizontal);
-
-    if (hasStaticInlinePosition) {
-        if (child->style()->isOriginalDisplayInlineType())
-            child->layer()->setStaticInlinePosition(block->startOffsetForLine(block->logicalHeight(), false));
-        else
-            child->layer()->setStaticInlinePosition(block->borderAndPaddingStart());
-    }
-
-    if (hasStaticBlockPosition)
-        child->layer()->setStaticBlockPosition(block->logicalHeight());
-}
-
 // FIXME: The entire concept of the skipTrailingWhitespace function is flawed, since we really need to be building
 // line boxes even for containers that may ultimately collapse away.  Otherwise we'll never get positioned
 // elements quite right.  In other words, we need to build this function's work into the normal line
@@ -1457,7 +1538,7 @@ static void setStaticPositions(RenderBlock* block, RenderBox* child)
 void RenderBlock::skipTrailingWhitespace(InlineIterator& iterator, bool isLineEmpty, bool previousLineBrokeCleanly)
 {
     while (!iterator.atEnd() && !requiresLineBox(iterator, isLineEmpty, previousLineBrokeCleanly)) {
-        RenderObject* object = iterator.obj;
+        RenderObject* object = iterator.m_obj;
         if (object->isFloating()) {
             insertFloatingObject(toRenderBox(object));
         } else if (object->isPositioned())
@@ -1466,21 +1547,18 @@ void RenderBlock::skipTrailingWhitespace(InlineIterator& iterator, bool isLineEm
     }
 }
 
-int RenderBlock::skipLeadingWhitespace(InlineBidiResolver& resolver, bool firstLine, bool isLineEmpty, bool previousLineBrokeCleanly,
-                                       FloatingObject* lastFloatFromPreviousLine)
+void RenderBlock::skipLeadingWhitespace(InlineBidiResolver& resolver, bool firstLine, bool isLineEmpty, bool previousLineBrokeCleanly,
+                                       FloatingObject* lastFloatFromPreviousLine, int& lineLeftOffset, int& lineRightOffset)
 {
-    int availableWidth = availableLogicalWidthForLine(logicalHeight(), firstLine);
     while (!resolver.position().atEnd() && !requiresLineBox(resolver.position(), isLineEmpty, previousLineBrokeCleanly)) {
-        RenderObject* object = resolver.position().obj;
-        if (object->isFloating()) {
-            positionNewFloatOnLine(insertFloatingObject(toRenderBox(object)), lastFloatFromPreviousLine);
-            availableWidth = availableLogicalWidthForLine(logicalHeight(), firstLine);
-        } else if (object->isPositioned())
+        RenderObject* object = resolver.position().m_obj;
+        if (object->isFloating())
+            positionNewFloatOnLine(insertFloatingObject(toRenderBox(object)), lastFloatFromPreviousLine, firstLine, lineLeftOffset, lineRightOffset);
+        else if (object->isPositioned())
             setStaticPositions(this, toRenderBox(object));
         resolver.increment();
     }
     resolver.commitExplicitEmbedding();
-    return availableWidth;
 }
 
 // This is currently just used for list markers and inline flows that have line boxes. Neither should 
@@ -1560,7 +1638,7 @@ static void tryHyphenating(RenderText* text, const Font& font, const AtomicStrin
     // FIXME: The following assumes that the character at lastSpace is a space (and therefore should not factor
     // into hyphenate-limit-before) unless lastSpace is 0. This is wrong in the rare case of hyphenating
     // the first word in a text node which has leading whitespace.
-    if (prefixLength - (lastSpace ? 1 : 0) < static_cast<unsigned>(minimumPrefixLength))
+    if (!prefixLength || prefixLength - (lastSpace ? 1 : 0) < static_cast<unsigned>(minimumPrefixLength))
         return;
 
     ASSERT(pos - lastSpace - prefixLength >= static_cast<unsigned>(minimumSuffixLength));
@@ -1572,22 +1650,25 @@ static void tryHyphenating(RenderText* text, const Font& font, const AtomicStrin
     UNUSED_PARAM(isFixedPitch);
 #endif
 
-    lineBreak.obj = text;
-    lineBreak.pos = lastSpace + prefixLength;
-    lineBreak.nextBreakablePosition = nextBreakable;
+    lineBreak.moveTo(text, lastSpace + prefixLength, nextBreakable);
     hyphenated = true;
 }
 
 InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool firstLine, bool& isLineEmpty, LineBreakIteratorInfo& lineBreakIteratorInfo, bool& previousLineBrokeCleanly, 
-                                              bool& hyphenated, EClear* clear, FloatingObject* lastFloatFromPreviousLine)
+                                              bool& hyphenated, EClear* clear, FloatingObject* lastFloatFromPreviousLine, Vector<RenderBox*>& positionedBoxes)
 {
-    ASSERT(resolver.position().block == this);
+    ASSERT(resolver.position().m_block == this);
 
-    bool appliedStartWidth = resolver.position().pos > 0;
+    bool appliedStartWidth = resolver.position().m_pos > 0;
     LineMidpointState& lineMidpointState = resolver.midpointState();
     
-    float width = skipLeadingWhitespace(resolver, firstLine, isLineEmpty, previousLineBrokeCleanly, lastFloatFromPreviousLine);
+    int blockOffset = logicalHeight();
+    int lineLeftOffset = logicalLeftOffsetForLine(blockOffset, firstLine);
+    int lineRightOffset = logicalRightOffsetForLine(blockOffset, firstLine);
+    
+    skipLeadingWhitespace(resolver, firstLine, isLineEmpty, previousLineBrokeCleanly, lastFloatFromPreviousLine, lineLeftOffset, lineRightOffset);
 
+    float width = max(0, lineRightOffset - lineLeftOffset);
     float w = 0;
     float tmpW = 0;
 
@@ -1605,13 +1686,16 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
     bool currentCharacterIsSpace = false;
     bool currentCharacterIsWS = false;
     RenderObject* trailingSpaceObject = 0;
+    Vector<RenderBox*, 4> trailingPositionedBoxes;
 
     InlineIterator lBreak = resolver.position();
 
-    RenderObject* o = resolver.position().obj;
+    // FIXME: It is error-prone to split the position object out like this.
+    // Teach this code to work with objects instead of this split tuple.
+    RenderObject* o = resolver.position().m_obj;
     RenderObject* last = o;
-    unsigned pos = resolver.position().pos;
-    int nextBreakable = resolver.position().nextBreakablePosition;
+    unsigned pos = resolver.position().m_pos;
+    int nextBreakable = resolver.position().m_nextBreakablePosition;
     bool atStart = true;
 
     bool prevLineBrokeCleanly = previousLineBrokeCleanly;
@@ -1646,9 +1730,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             
         if (o->isBR()) {
             if (w + tmpW <= width) {
-                lBreak.obj = o;
-                lBreak.pos = 0;
-                lBreak.nextBreakablePosition = -1;
+                lBreak.moveToStartOf(o);
                 lBreak.increment();
 
                 // A <br> always breaks a line, so don't let the line be collapsed
@@ -1676,8 +1758,12 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                 // If it does, position it now, otherwise, position
                 // it after moving to next line (in newLine() func)
                 if (floatsFitOnLine && logicalWidthForFloat(f) + w + tmpW <= width) {
-                    positionNewFloatOnLine(f, lastFloatFromPreviousLine);
-                    width = availableLogicalWidthForLine(logicalHeight(), firstLine);
+                    positionNewFloatOnLine(f, lastFloatFromPreviousLine, firstLine, lineLeftOffset, lineRightOffset);
+                    width = max(0, lineRightOffset - lineLeftOffset);
+                    if (lBreak.m_obj == o) {
+                        ASSERT(!lBreak.m_pos);
+                        lBreak.increment();
+                    }
                 } else
                     floatsFitOnLine = false;
             } else if (o->isPositioned()) {
@@ -1685,37 +1771,27 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                 // go ahead and determine our static inline position now.
                 RenderBox* box = toRenderBox(o);
                 bool isInlineType = box->style()->isOriginalDisplayInlineType();
-                bool needToSetStaticInlinePosition = box->style()->hasStaticInlinePosition(style()->isHorizontalWritingMode());
-                if (needToSetStaticInlinePosition && !isInlineType) {
+                if (!isInlineType)
                     box->layer()->setStaticInlinePosition(borderAndPaddingStart());
-                    needToSetStaticInlinePosition = false;
-                }
-
-                // If our original display was an INLINE type, then we can go ahead
-                // and determine our static y position now.
-                bool needToSetStaticBlockPosition = box->style()->hasStaticBlockPosition(style()->isHorizontalWritingMode());
-                if (needToSetStaticBlockPosition && isInlineType) {
+                else  {
+                    // If our original display was an INLINE type, then we can go ahead
+                    // and determine our static y position now.
                     box->layer()->setStaticBlockPosition(logicalHeight());
-                    needToSetStaticBlockPosition = false;
                 }
                 
-                bool needToCreateLineBox = needToSetStaticInlinePosition || needToSetStaticBlockPosition;
-                RenderObject* c = o->container();
-                if (c->isRenderInline() && (!needToSetStaticInlinePosition || !needToSetStaticBlockPosition))
-                    needToCreateLineBox = true;
-
                 // If we're ignoring spaces, we have to stop and include this object and
                 // then start ignoring spaces again.
-                if (needToCreateLineBox) {
-                    trailingSpaceObject = 0;
-                    ignoreStart.obj = o;
-                    ignoreStart.pos = 0;
+                if (isInlineType || o->container()->isRenderInline()) {
                     if (ignoringSpaces) {
+                        ignoreStart.m_obj = o;
+                        ignoreStart.m_pos = 0;
                         addMidpoint(lineMidpointState, ignoreStart); // Stop ignoring spaces.
                         addMidpoint(lineMidpointState, ignoreStart); // Start ignoring again.
                     }
-                    
-                }
+                    if (trailingSpaceObject)
+                        trailingPositionedBoxes.append(box);
+                } else
+                    positionedBoxes.append(box);
             }
         } else if (o->isRenderInline()) {
             // Right now, we should only encounter empty inlines here.
@@ -1731,9 +1807,10 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                 isLineEmpty = false;
                 if (ignoringSpaces) {
                     trailingSpaceObject = 0;
+                    trailingPositionedBoxes.clear();
                     addMidpoint(lineMidpointState, InlineIterator(0, o, 0)); // Stop ignoring spaces.
                     addMidpoint(lineMidpointState, InlineIterator(0, o, 0)); // Start ignoring again.
-                } else if (style()->collapseWhiteSpace() && resolver.position().obj == o
+                } else if (style()->collapseWhiteSpace() && resolver.position().m_obj == o
                     && shouldSkipWhitespaceAfterStartObject(this, o, lineMidpointState)) {
                     // Like with list markers, we start ignoring spaces to make sure that any 
                     // additional spaces we see will be discarded.
@@ -1752,9 +1829,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             if ((autoWrap || RenderStyle::autoWrap(lastWS)) && (!o->isImage() || allowImagesToBreak)) {
                 w += tmpW;
                 tmpW = 0;
-                lBreak.obj = o;
-                lBreak.pos = 0;
-                lBreak.nextBreakablePosition = -1;
+                lBreak.moveToStartOf(o);
             }
 
             if (ignoringSpaces)
@@ -1765,6 +1840,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             currentCharacterIsSpace = false;
             currentCharacterIsWS = false;
             trailingSpaceObject = 0;
+            trailingPositionedBoxes.clear();
 
             // Optimize for a common case. If we can't find whitespace after the list
             // item, then this is all moot.
@@ -1792,7 +1868,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
 #endif
 
             RenderStyle* style = t->style(firstLine);
-            if (style->hasTextCombine())
+            if (style->hasTextCombine() && o->isCombineText())
                 toRenderCombineText(o)->combineText();
 
             int strlen = t->textLength();
@@ -1824,9 +1900,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             if (t->isWordBreak()) {
                 w += tmpW;
                 tmpW = 0;
-                lBreak.obj = o;
-                lBreak.pos = 0;
-                lBreak.nextBreakablePosition = -1;
+                lBreak.moveToStartOf(o);
                 ASSERT(!len);
             }
 
@@ -1922,9 +1996,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                             // additional whitespace.
                             if (w + tmpW + charWidth > width) {
                                 lineWasTooWide = true;
-                                lBreak.obj = o;
-                                lBreak.pos = pos;
-                                lBreak.nextBreakablePosition = nextBreakable;
+                                lBreak.moveTo(o, pos, nextBreakable);
                                 skipTrailingWhitespace(lBreak, isLineEmpty, previousLineBrokeCleanly);
                             }
                         }
@@ -1934,7 +2006,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                                 if (hyphenated)
                                     goto end;
                             }
-                            if (lBreak.obj && shouldPreserveNewline(lBreak.obj) && lBreak.obj->isText() && toRenderText(lBreak.obj)->textLength() && !toRenderText(lBreak.obj)->isWordBreak() && toRenderText(lBreak.obj)->characters()[lBreak.pos] == '\n') {
+                            if (lBreak.m_obj && shouldPreserveNewline(lBreak.m_obj) && lBreak.m_obj->isText() && toRenderText(lBreak.m_obj)->textLength() && !toRenderText(lBreak.m_obj)->isWordBreak() && toRenderText(lBreak.m_obj)->characters()[lBreak.m_pos] == '\n') {
                                 if (!stoppedIgnoringSpaces && pos > 0) {
                                     // We need to stop right before the newline and then start up again.
                                     addMidpoint(lineMidpointState, InlineIterator(0, o, pos - 1)); // Stop
@@ -1943,7 +2015,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                                 lBreak.increment();
                                 previousLineBrokeCleanly = true;
                             }
-                            if (lBreak.obj && lBreak.pos && lBreak.obj->isText() && toRenderText(lBreak.obj)->textLength() && toRenderText(lBreak.obj)->characters()[lBreak.pos - 1] == softHyphen && style->hyphens() != HyphensNone)
+                            if (lBreak.m_obj && lBreak.m_pos && lBreak.m_obj->isText() && toRenderText(lBreak.m_obj)->textLength() && toRenderText(lBreak.m_obj)->characters()[lBreak.m_pos - 1] == softHyphen && style->hyphens() != HyphensNone)
                                 hyphenated = true;
                             goto end; // Didn't fit. Jump to the end.
                         } else {
@@ -1963,9 +2035,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                             addMidpoint(lineMidpointState, InlineIterator(0, o, pos - 1)); // Stop
                             addMidpoint(lineMidpointState, InlineIterator(0, o, pos)); // Start
                         }
-                        lBreak.obj = o;
-                        lBreak.pos = pos;
-                        lBreak.nextBreakablePosition = nextBreakable;
+                        lBreak.moveTo(o, pos, nextBreakable);
                         lBreak.increment();
                         previousLineBrokeCleanly = true;
                         return lBreak;
@@ -1975,9 +2045,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                         w += tmpW;
                         wrapW = 0;
                         tmpW = 0;
-                        lBreak.obj = o;
-                        lBreak.pos = pos;
-                        lBreak.nextBreakablePosition = nextBreakable;
+                        lBreak.moveTo(o, pos, nextBreakable);
                         // Auto-wrapping text should not wrap in the middle of a word once it has had an
                         // opportunity to break after a word.
                         breakWords = false;
@@ -1986,9 +2054,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                     if (midWordBreak) {
                         // Remember this as a breakable position in case
                         // adding the end width forces a break.
-                        lBreak.obj = o;
-                        lBreak.pos = pos;
-                        lBreak.nextBreakablePosition = nextBreakable;
+                        lBreak.moveTo(o, pos, nextBreakable);
                         midWordBreak &= (breakWords || breakAll);
                     }
 
@@ -2020,22 +2086,21 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                 }
 
                 if (currentCharacterIsSpace && !previousCharacterIsSpace) {
-                    ignoreStart.obj = o;
-                    ignoreStart.pos = pos;
+                    ignoreStart.m_obj = o;
+                    ignoreStart.m_pos = pos;
                 }
 
                 if (!currentCharacterIsWS && previousCharacterIsWS) {
-                    if (autoWrap && o->style()->breakOnlyAfterWhiteSpace()) {
-                        lBreak.obj = o;
-                        lBreak.pos = pos;
-                        lBreak.nextBreakablePosition = nextBreakable;
-                    }
+                    if (autoWrap && o->style()->breakOnlyAfterWhiteSpace())
+                        lBreak.moveTo(o, pos, nextBreakable);
                 }
                 
                 if (collapseWhiteSpace && currentCharacterIsSpace && !ignoringSpaces)
                     trailingSpaceObject = o;
-                else if (!o->style()->collapseWhiteSpace() || !currentCharacterIsSpace)
+                else if (!o->style()->collapseWhiteSpace() || !currentCharacterIsSpace) {
                     trailingSpaceObject = 0;
+                    trailingPositionedBoxes.clear();
+                }
                     
                 pos++;
                 len--;
@@ -2047,8 +2112,13 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             tmpW += additionalTmpW;
             tmpW += inlineLogicalWidth(o, !appliedStartWidth, true);
 
-            if (canHyphenate && w + tmpW > width) {
-                tryHyphenating(t, f, style->locale(), style->hyphenationLimitBefore(), style->hyphenationLimitAfter(), lastSpace, pos, w + tmpW - additionalTmpW, width, isFixedPitch, collapseWhiteSpace, lastSpaceWordSpacing, lBreak, nextBreakable, hyphenated);
+            if (w + tmpW > width) {
+                if (canHyphenate)
+                    tryHyphenating(t, f, style->locale(), style->hyphenationLimitBefore(), style->hyphenationLimitAfter(), lastSpace, pos, w + tmpW - additionalTmpW, width, isFixedPitch, collapseWhiteSpace, lastSpaceWordSpacing, lBreak, nextBreakable, hyphenated);
+                
+                if (!hyphenated && lBreak.m_obj && lBreak.m_pos && lBreak.m_obj->isText() && toRenderText(lBreak.m_obj)->textLength() && toRenderText(lBreak.m_obj)->characters()[lBreak.m_pos - 1] == softHyphen && style->hyphens() != HyphensNone)
+                    hyphenated = true;
+                
                 if (hyphenated)
                     goto end;
             }
@@ -2057,7 +2127,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
 
         RenderObject* next = bidiNext(this, o);
         bool checkForBreak = autoWrap;
-        if (w && w + tmpW > width && lBreak.obj && currWS == NOWRAP)
+        if (w && w + tmpW > width && lBreak.m_obj && currWS == NOWRAP)
             checkForBreak = true;
         else if (next && o->isText() && next->isText() && !next->isBR()) {
             if (autoWrap || (next->style()->autoWrap())) {
@@ -2084,9 +2154,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                     if (canPlaceOnLine && checkForBreak) {
                         w += tmpW;
                         tmpW = 0;
-                        lBreak.obj = next;
-                        lBreak.pos = 0;
-                        lBreak.nextBreakablePosition = -1;
+                        lBreak.moveToStartOf(next);
                     }
                 }
             }
@@ -2094,8 +2162,10 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
 
         if (checkForBreak && (w + tmpW > width)) {
             // if we have floats, try to get below them.
-            if (currentCharacterIsSpace && !ignoringSpaces && o->style()->collapseWhiteSpace())
+            if (currentCharacterIsSpace && !ignoringSpaces && o->style()->collapseWhiteSpace()) {
                 trailingSpaceObject = 0;
+                trailingPositionedBoxes.clear();
+            }
 
             if (w)
                 goto end;
@@ -2114,9 +2184,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             if (last->isReplaced() && autoWrap && (!last->isImage() || allowImagesToBreak) && (!last->isListMarker() || toRenderListMarker(last)->isInside())) {
                 w += tmpW;
                 tmpW = 0;
-                lBreak.obj = next;
-                lBreak.pos = 0;
-                lBreak.nextBreakablePosition = -1;
+                lBreak.moveToStartOf(next);
             }
         }
 
@@ -2133,32 +2201,26 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
     }
 
     
-    if (w + tmpW <= width || lastWS == NOWRAP) {
-        lBreak.obj = 0;
-        lBreak.pos = 0;
-        lBreak.nextBreakablePosition = -1;
-    }
+    if (w + tmpW <= width || lastWS == NOWRAP)
+        lBreak.clear();
 
  end:
-    if (lBreak == resolver.position() && (!lBreak.obj || !lBreak.obj->isBR())) {
+    if (lBreak == resolver.position() && (!lBreak.m_obj || !lBreak.m_obj->isBR())) {
         // we just add as much as possible
         if (style()->whiteSpace() == PRE) {
             // FIXME: Don't really understand this case.
             if (pos != 0) {
-                lBreak.obj = o;
-                lBreak.pos = pos - 1;
-            } else {
-                lBreak.obj = last;
-                lBreak.pos = last->isText() ? last->length() : 0;
-                lBreak.nextBreakablePosition = -1;
-            }
-        } else if (lBreak.obj) {
+                // FIXME: This should call moveTo which would clear m_nextBreakablePosition
+                // this code as-is is likely wrong.
+                lBreak.m_obj = o;
+                lBreak.m_pos = pos - 1;
+            } else
+                lBreak.moveTo(last, last->isText() ? last->length() : 0);
+        } else if (lBreak.m_obj) {
             // Don't ever break in the middle of a word if we can help it.
             // There's no room at all. We just have to be on this line,
             // even though we'll spill out.
-            lBreak.obj = o;
-            lBreak.pos = pos;
-            lBreak.nextBreakablePosition = -1;
+            lBreak.moveTo(o, pos);
         }
     }
 
@@ -2174,18 +2236,40 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
         // to be the actual endpoint.  In both cases we just decrease our pos by 1 level to
         // exclude the space, allowing it to - in effect - collapse into the newline.
         if (lineMidpointState.numMidpoints % 2) {
-            InlineIterator* midpoints = lineMidpointState.midpoints.data();
-            midpoints[lineMidpointState.numMidpoints - 1].pos--;
-        }
-        //else if (lBreak.pos > 0)
-        //    lBreak.pos--;
-        else if (lBreak.obj == 0 && trailingSpaceObject->isText()) {
+            // Find the trailing space object's midpoint.
+            int trailingSpaceMidpoint = lineMidpointState.numMidpoints - 1;
+            for ( ; trailingSpaceMidpoint >= 0 && lineMidpointState.midpoints[trailingSpaceMidpoint].m_obj != trailingSpaceObject; --trailingSpaceMidpoint) { }
+            ASSERT(trailingSpaceMidpoint >= 0);
+            lineMidpointState.midpoints[trailingSpaceMidpoint].m_pos--;
+
+            // Now make sure every single trailingPositionedBox following the trailingSpaceMidpoint properly stops and starts 
+            // ignoring spaces.
+            size_t currentMidpoint = trailingSpaceMidpoint + 1;
+            for (size_t i = 0; i < trailingPositionedBoxes.size(); ++i) {
+                if (currentMidpoint >= lineMidpointState.numMidpoints) {
+                    // We don't have a midpoint for this box yet.
+                    InlineIterator ignoreStart(this, trailingPositionedBoxes[i], 0);
+                    addMidpoint(lineMidpointState, ignoreStart); // Stop ignoring.
+                    addMidpoint(lineMidpointState, ignoreStart); // Start ignoring again.
+                } else {
+                    ASSERT(lineMidpointState.midpoints[currentMidpoint].m_obj == trailingPositionedBoxes[i]);
+                    ASSERT(lineMidpointState.midpoints[currentMidpoint + 1].m_obj == trailingPositionedBoxes[i]);
+                }
+                currentMidpoint += 2;
+            }
+        } else if (!lBreak.m_obj && trailingSpaceObject->isText()) {
             // Add a new end midpoint that stops right at the very end.
             RenderText* text = toRenderText(trailingSpaceObject);
             unsigned length = text->textLength();
             unsigned pos = length >= 2 ? length - 2 : UINT_MAX;
             InlineIterator endMid(0, trailingSpaceObject, pos);
             addMidpoint(lineMidpointState, endMid);
+            for (size_t i = 0; i < trailingPositionedBoxes.size(); ++i) {
+                ignoreStart.m_obj = trailingPositionedBoxes[i];
+                ignoreStart.m_pos = 0;
+                addMidpoint(lineMidpointState, ignoreStart); // Stop ignoring spaces.
+                addMidpoint(lineMidpointState, ignoreStart); // Start ignoring again.
+            }
         }
     }
 
@@ -2193,8 +2277,8 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
     // of the object. Do this adjustment to make it point to the start
     // of the next object instead to avoid confusing the rest of the
     // code.
-    if (lBreak.pos > 0) {
-        lBreak.pos--;
+    if (lBreak.m_pos > 0) {
+        lBreak.m_pos--;
         lBreak.increment();
     }
 
@@ -2205,7 +2289,7 @@ void RenderBlock::addOverflowFromInlineChildren()
 {
     int endPadding = hasOverflowClip() ? paddingEnd() : 0;
     // FIXME: Need to find another way to do this, since scrollbars could show when we don't want them to.
-    if (hasOverflowClip() && !endPadding && node() && node()->isContentEditable() && node() == node()->rootEditableElement() && style()->isLeftToRightDirection())
+    if (hasOverflowClip() && !endPadding && node() && node()->rendererIsEditable() && node() == node()->rootEditableElement() && style()->isLeftToRightDirection())
         endPadding = 1;
     for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
         addLayoutOverflow(curr->paddedLayoutOverflowRect(endPadding));
@@ -2217,7 +2301,7 @@ void RenderBlock::addOverflowFromInlineChildren()
 int RenderBlock::beforeSideVisualOverflowForLine(RootInlineBox* line) const
 {
     // Overflow is in the block's coordinate space, which means it isn't purely physical.
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return line->minYVisualOverflow();
     return line->minXVisualOverflow();
 }
@@ -2225,7 +2309,7 @@ int RenderBlock::beforeSideVisualOverflowForLine(RootInlineBox* line) const
 int RenderBlock::afterSideVisualOverflowForLine(RootInlineBox* line) const
 {
     // Overflow is in the block's coordinate space, which means it isn't purely physical.
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return line->maxYVisualOverflow();
     return line->maxXVisualOverflow();
 }
@@ -2233,7 +2317,7 @@ int RenderBlock::afterSideVisualOverflowForLine(RootInlineBox* line) const
 int RenderBlock::beforeSideLayoutOverflowForLine(RootInlineBox* line) const
 {
     // Overflow is in the block's coordinate space, which means it isn't purely physical.
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return line->minYLayoutOverflow();
     return line->minXLayoutOverflow();
 }
@@ -2241,7 +2325,7 @@ int RenderBlock::beforeSideLayoutOverflowForLine(RootInlineBox* line) const
 int RenderBlock::afterSideLayoutOverflowForLine(RootInlineBox* line) const
 {
     // Overflow is in the block's coordinate space, which means it isn't purely physical.
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return line->maxYLayoutOverflow();
     return line->maxXLayoutOverflow();
 }
diff --git a/Source/WebCore/rendering/RenderBox.cpp b/Source/WebCore/rendering/RenderBox.cpp
index 6e7c0f2..28334dd 100644
--- a/Source/WebCore/rendering/RenderBox.cpp
+++ b/Source/WebCore/rendering/RenderBox.cpp
@@ -130,21 +130,21 @@ int RenderBox::marginAfter() const
 
 int RenderBox::marginStart() const
 {
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return style()->isLeftToRightDirection() ? m_marginLeft : m_marginRight;
     return style()->isLeftToRightDirection() ? m_marginTop : m_marginBottom;
 }
 
 int RenderBox::marginEnd() const
 {
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return style()->isLeftToRightDirection() ? m_marginRight : m_marginLeft;
     return style()->isLeftToRightDirection() ? m_marginBottom : m_marginTop;
 }
 
 void RenderBox::setMarginStart(int margin)
 {
-    if (style()->isHorizontalWritingMode()) {
+    if (isHorizontalWritingMode()) {
         if (style()->isLeftToRightDirection())
             m_marginLeft = margin;
         else
@@ -159,7 +159,7 @@ void RenderBox::setMarginStart(int margin)
 
 void RenderBox::setMarginEnd(int margin)
 {
-    if (style()->isHorizontalWritingMode()) {
+    if (isHorizontalWritingMode()) {
         if (style()->isLeftToRightDirection())
             m_marginRight = margin;
         else
@@ -216,7 +216,7 @@ void RenderBox::destroy()
     if (hasOverrideSize())
         gOverrideSizeMap->remove(this);
 
-    if (style() && (style()->height().isPercent() || style()->minHeight().isPercent() || style()->maxHeight().isPercent()))
+    if (style() && (style()->logicalHeight().isPercent() || style()->logicalMinHeight().isPercent() || style()->logicalMaxHeight().isPercent()))
         RenderBlock::removePercentHeightDescendant(this);
 
     RenderBoxModelObject::destroy();
@@ -299,8 +299,17 @@ void RenderBox::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle
 {
     RenderBoxModelObject::styleDidChange(diff, oldStyle);
 
-    if (needsLayout() && oldStyle && (oldStyle->height().isPercent() || oldStyle->minHeight().isPercent() || oldStyle->maxHeight().isPercent()))
-        RenderBlock::removePercentHeightDescendant(this);
+    if (needsLayout() && oldStyle) {
+        if (oldStyle && (oldStyle->logicalHeight().isPercent() || oldStyle->logicalMinHeight().isPercent() || oldStyle->logicalMaxHeight().isPercent()))
+            RenderBlock::removePercentHeightDescendant(this);
+
+        // Normally we can do optimized positioning layout for absolute/fixed positioned objects. There is one special case, however, which is
+        // when the positioned object's margin-before is changed. In this case the parent has to get a layout in order to run margin collapsing
+        // to determine the new static position.
+        if (isPositioned() && style()->hasStaticBlockPosition(isHorizontalWritingMode()) && oldStyle->marginBefore() != style()->marginBefore()
+            && parent() && !parent()->normalChildNeedsLayout())
+            parent()->setChildNeedsLayout(true);
+    }
 
     // If our zoom factor changes and we have a defined scrollLeft/Top, we need to adjust that value into the
     // new zoomed coordinate space.
@@ -335,8 +344,11 @@ void RenderBox::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle
 
         if (viewStyle->writingMode() != style()->writingMode() && (isRootRenderer || !document()->writingModeSetOnDocumentElement())) {
             viewStyle->setWritingMode(style()->writingMode());
-            if (isBodyRenderer)
+            viewRenderer->setHorizontalWritingMode(style()->isHorizontalWritingMode());
+            if (isBodyRenderer) {
                 document()->documentElement()->renderer()->style()->setWritingMode(style()->writingMode());
+                document()->documentElement()->renderer()->setHorizontalWritingMode(style()->isHorizontalWritingMode());
+            }
             setNeedsLayoutAndPrefWidthsRecalc();
         }
     }
@@ -621,9 +633,9 @@ bool RenderBox::logicalScroll(ScrollLogicalDirection direction, ScrollGranularit
 #if PLATFORM(MAC)
         // On Mac only we reset the inline direction position when doing a document scroll (e.g., hitting Home/End).
         if (granularity == ScrollByDocument)
-            scrolled = l->scroll(logicalToPhysical(ScrollInlineDirectionBackward, style()->isHorizontalWritingMode(), style()->isFlippedBlocksWritingMode()), ScrollByDocument, multiplier);
+            scrolled = l->scroll(logicalToPhysical(ScrollInlineDirectionBackward, isHorizontalWritingMode(), style()->isFlippedBlocksWritingMode()), ScrollByDocument, multiplier);
 #endif
-        if (l->scroll(logicalToPhysical(direction, style()->isHorizontalWritingMode(), style()->isFlippedBlocksWritingMode()), granularity, multiplier))
+        if (l->scroll(logicalToPhysical(direction, isHorizontalWritingMode(), style()->isFlippedBlocksWritingMode()), granularity, multiplier))
             scrolled = true;
         
         if (scrolled) {
@@ -649,7 +661,7 @@ bool RenderBox::canBeScrolledAndHasScrollableArea() const
     
 bool RenderBox::canBeProgramaticallyScrolled(bool) const
 {
-    return (hasOverflowClip() && (scrollsOverflow() || (node() && node()->isContentEditable()))) || (node() && node()->isDocumentNode());
+    return (hasOverflowClip() && (scrollsOverflow() || (node() && node()->rendererIsEditable()))) || (node() && node()->isDocumentNode());
 }
 
 void RenderBox::autoscroll()
@@ -782,7 +794,7 @@ void RenderBox::paint(PaintInfo& paintInfo, int tx, int ty)
         child->paint(childInfo, tx, ty);
 }
 
-void RenderBox::paintRootBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
+void RenderBox::paintRootBoxFillLayers(const PaintInfo& paintInfo)
 {
     const FillLayer* bgLayer = style()->backgroundLayers();
     Color bgColor = style()->visitedDependentColor(CSSPropertyBackgroundColor);
@@ -803,21 +815,12 @@ void RenderBox::paintRootBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
     // The background of the box generated by the root element covers the entire canvas, so just use
     // the RenderView's docTop/Left/Width/Height accessors.
     paintFillLayers(paintInfo, bgColor, bgLayer, view()->docLeft(), view()->docTop(), view()->docWidth(), view()->docHeight(), CompositeSourceOver, bodyObject);
-
-    if (style()->hasBorder() && style()->display() != INLINE)
-        paintBorder(paintInfo.context, tx, ty, width(), height(), style());
 }
 
 void RenderBox::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 {
     if (!paintInfo.shouldPaintWithinRoot(this))
         return;
-
-    if (isRoot()) {
-        paintRootBoxDecorations(paintInfo, tx, ty);
-        return;
-    }
-
     return paintBoxDecorationsWithSize(paintInfo, tx, ty, width(), height());
 }
 
@@ -835,11 +838,13 @@ void RenderBox::paintBoxDecorationsWithSize(PaintInfo& paintInfo, int tx, int ty
     // The theme will tell us whether or not we should also paint the CSS background.
     bool themePainted = style()->hasAppearance() && !theme()->paint(this, paintInfo, IntRect(tx, ty, width, height));
     if (!themePainted) {
-        // The <body> only paints its background if the root element has defined a background
-        // independent of the body.  Go through the DOM to get to the root element's render object,
-        // since the root could be inline and wrapped in an anonymous block.
-        if (!isBody() || document()->documentElement()->renderer()->hasBackground())
+        if (isRoot())
+            paintRootBoxFillLayers(paintInfo);
+        else if (!isBody() || document()->documentElement()->renderer()->hasBackground()) {
+            // The <body> only paints its background if the root element has defined a background
+            // independent of the body.
             paintFillLayers(paintInfo, style()->visitedDependentColor(CSSPropertyBackgroundColor), style()->backgroundLayers(), tx, ty, width, height);
+        }
         if (style()->hasAppearance())
             theme()->paintDecorations(this, paintInfo, IntRect(tx, ty, width, height));
     }
@@ -1108,7 +1113,7 @@ void RenderBox::popContentsClip(PaintInfo& paintInfo, PaintPhase originalPhase,
         paintInfo.phase = originalPhase;
 }
 
-IntRect RenderBox::overflowClipRect(int tx, int ty)
+IntRect RenderBox::overflowClipRect(int tx, int ty, OverlayScrollbarSizeRelevancy relevancy)
 {
     // FIXME: When overflow-clip (CSS3) is implemented, we'll obtain the property
     // here.
@@ -1123,8 +1128,8 @@ IntRect RenderBox::overflowClipRect(int tx, int ty)
 
     // Subtract out scrollbars if we have them.
     if (layer()) {
-        clipWidth -= layer()->verticalScrollbarWidth();
-        clipHeight -= layer()->horizontalScrollbarHeight();
+        clipWidth -= layer()->verticalScrollbarWidth(relevancy);
+        clipHeight -= layer()->horizontalScrollbarHeight(relevancy);
     }
 
     return IntRect(clipX, clipY, clipWidth, clipHeight);
@@ -1319,19 +1324,21 @@ void RenderBox::positionLineBox(InlineBox* box)
     if (isPositioned()) {
         // Cache the x position only if we were an INLINE type originally.
         bool wasInline = style()->isOriginalDisplayInlineType();
-        if (wasInline && style()->hasStaticInlinePosition(box->isHorizontal())) {
+        if (wasInline) {
             // The value is cached in the xPos of the box.  We only need this value if
             // our object was inline originally, since otherwise it would have ended up underneath
             // the inlines.
             layer()->setStaticInlinePosition(lroundf(box->logicalLeft()));
-            setChildNeedsLayout(true, false); // Just go ahead and mark the positioned object as needing layout, so it will update its position properly.
-        } else if (!wasInline && style()->hasStaticBlockPosition(box->isHorizontal())) {
+            if (style()->hasStaticInlinePosition(box->isHorizontal()))
+                setChildNeedsLayout(true, false); // Just go ahead and mark the positioned object as needing layout, so it will update its position properly.
+        } else {
             // Our object was a block originally, so we make our normal flow position be
             // just below the line box (as though all the inlines that came before us got
             // wrapped in an anonymous block, which is what would have happened had we been
             // in flow).  This value was cached in the y() of the box.
             layer()->setStaticBlockPosition(box->logicalTop());
-            setChildNeedsLayout(true, false); // Just go ahead and mark the positioned object as needing layout, so it will update its position properly.
+            if (style()->hasStaticBlockPosition(box->isHorizontal()))
+                setChildNeedsLayout(true, false); // Just go ahead and mark the positioned object as needing layout, so it will update its position properly.
         }
 
         // Nuke the box.
@@ -1569,7 +1576,7 @@ void RenderBox::computeLogicalWidth()
 
     RenderBlock* cb = containingBlock();
     int containerLogicalWidth = max(0, containingBlockLogicalWidthForContent());
-    bool hasPerpendicularContainingBlock = cb->style()->isHorizontalWritingMode() != style()->isHorizontalWritingMode();
+    bool hasPerpendicularContainingBlock = cb->isHorizontalWritingMode() != isHorizontalWritingMode();
     int containerWidthInInlineDirection = containerLogicalWidth;
     if (hasPerpendicularContainingBlock)
         containerWidthInInlineDirection = perpendicularContainingBlockLogicalHeight();
@@ -1776,7 +1783,7 @@ void RenderBox::computeLogicalHeight()
         computePositionedLogicalHeight();
     } else {
         RenderBlock* cb = containingBlock();
-        bool hasPerpendicularContainingBlock = cb->style()->isHorizontalWritingMode() != style()->isHorizontalWritingMode();
+        bool hasPerpendicularContainingBlock = cb->isHorizontalWritingMode() != isHorizontalWritingMode();
     
         if (!hasPerpendicularContainingBlock)
             computeBlockDirectionMargins(cb);
@@ -1863,7 +1870,7 @@ void RenderBox::computeLogicalHeight()
         if (document()->printing())
             visHeight = static_cast<int>(view()->pageLogicalHeight());
         else  {
-            if (style()->isHorizontalWritingMode())
+            if (isHorizontalWritingMode())
                 visHeight = view()->viewHeight();
             else
                 visHeight = view()->viewWidth();
@@ -1896,18 +1903,20 @@ int RenderBox::computeLogicalHeightUsing(const Length& h)
 int RenderBox::computePercentageLogicalHeight(const Length& height)
 {
     int result = -1;
+    
+    // In quirks mode, blocks with auto height are skipped, and we keep looking for an enclosing
+    // block that may have a specified height and then use it. In strict mode, this violates the
+    // specification, which states that percentage heights just revert to auto if the containing
+    // block has an auto height. We still skip anonymous containing blocks in both modes, though, and look
+    // only at explicit containers.
     bool skippedAutoHeightContainingBlock = false;
     RenderBlock* cb = containingBlock();
-    if (document()->inQuirksMode()) {
-        // In quirks mode, blocks with auto height are skipped, and we keep looking for an enclosing
-        // block that may have a specified height and then use it.  In strict mode, this violates the
-        // specification, which states that percentage heights just revert to auto if the containing
-        // block has an auto height.
-        while (!cb->isRenderView() && !cb->isBody() && !cb->isTableCell() && !cb->isPositioned() && cb->style()->logicalHeight().isAuto()) {
-            skippedAutoHeightContainingBlock = true;
-            cb = cb->containingBlock();
-            cb->addPercentHeightDescendant(this);
-        }
+    while (!cb->isRenderView() && !cb->isBody() && !cb->isTableCell() && !cb->isPositioned() && cb->style()->logicalHeight().isAuto()) {
+        if (!document()->inQuirksMode() && !cb->isAnonymousBlock())
+            break;
+        skippedAutoHeightContainingBlock = true;
+        cb = cb->containingBlock();
+        cb->addPercentHeightDescendant(this);
     }
 
     // A positioned element that specified both top/bottom or that specifies height should be treated as though it has a height
@@ -2071,7 +2080,7 @@ int RenderBox::availableLogicalHeightUsing(const Length& h) const
         return computeContentBoxLogicalHeight(h.value());
 
     if (isRenderView())
-        return style()->isHorizontalWritingMode() ? toRenderView(this)->frameView()->visibleHeight() : toRenderView(this)->frameView()->visibleWidth();
+        return isHorizontalWritingMode() ? toRenderView(this)->frameView()->visibleHeight() : toRenderView(this)->frameView()->visibleWidth();
 
     // We need to stop here, since we don't want to increase the height of the table
     // artificially.  We're going to rely on this cell getting expanded to some new
@@ -2117,6 +2126,7 @@ void RenderBox::computeBlockDirectionMargins(RenderBlock* containingBlock)
 
 int RenderBox::containingBlockLogicalWidthForPositioned(const RenderBoxModelObject* containingBlock, bool checkForPerpendicularWritingMode) const
 {
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
     // Fixed element's position should be decided by the visible screen size.
     // That is in the doc coordindate.
@@ -2127,6 +2137,9 @@ int RenderBox::containingBlockLogicalWidthForPositioned(const RenderBoxModelObje
 #endif
 
     if (checkForPerpendicularWritingMode && containingBlock->style()->isHorizontalWritingMode() != style()->isHorizontalWritingMode())
+=======
+    if (checkForPerpendicularWritingMode && containingBlock->isHorizontalWritingMode() != isHorizontalWritingMode())
+>>>>>>> webkit.org at r82507
         return containingBlockLogicalHeightForPositioned(containingBlock, false);
 
     if (containingBlock->isBox())
@@ -2157,6 +2170,7 @@ int RenderBox::containingBlockLogicalWidthForPositioned(const RenderBoxModelObje
 
 int RenderBox::containingBlockLogicalHeightForPositioned(const RenderBoxModelObject* containingBlock, bool checkForPerpendicularWritingMode) const
 {
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
     // Fixed element's position should be decided by the visible screen size.
     // That is in the doc coordindate.
@@ -2167,6 +2181,9 @@ int RenderBox::containingBlockLogicalHeightForPositioned(const RenderBoxModelObj
 #endif
 
     if (checkForPerpendicularWritingMode && containingBlock->style()->isHorizontalWritingMode() != style()->isHorizontalWritingMode())
+=======
+    if (checkForPerpendicularWritingMode && containingBlock->isHorizontalWritingMode() != isHorizontalWritingMode())
+>>>>>>> webkit.org at r82507
         return containingBlockLogicalWidthForPositioned(containingBlock, false);
 
     if (containingBlock->isBox())
@@ -2184,7 +2201,7 @@ int RenderBox::containingBlockLogicalHeightForPositioned(const RenderBoxModelObj
 
     int heightResult;
     IntRect boundingBox = flow->linesBoundingBox();
-    if (containingBlock->style()->isHorizontalWritingMode())
+    if (containingBlock->isHorizontalWritingMode())
         heightResult = boundingBox.height();
     else
         heightResult = boundingBox.width();
@@ -2201,7 +2218,7 @@ static void computeInlineStaticDistance(Length& logicalLeft, Length& logicalRigh
     // FIXME: The static distance computation has not been patched for mixed writing modes yet.
     if (containerDirection == LTR) {
         int staticPosition = child->layer()->staticInlinePosition() - containerBlock->borderLogicalLeft();
-        for (RenderObject* curr = child->parent(); curr && curr != containerBlock; curr = curr->parent()) {
+        for (RenderObject* curr = child->parent(); curr && curr != containerBlock; curr = curr->container()) {
             if (curr->isBox())
                 staticPosition += toRenderBox(curr)->logicalLeft();
         }
@@ -2210,7 +2227,7 @@ static void computeInlineStaticDistance(Length& logicalLeft, Length& logicalRigh
         RenderBox* enclosingBox = child->parent()->enclosingBox();
         int staticPosition = child->layer()->staticInlinePosition() + containerLogicalWidth + containerBlock->borderLogicalRight();
         staticPosition -= enclosingBox->logicalWidth();
-        for (RenderObject* curr = enclosingBox; curr && curr != containerBlock; curr = curr->parent()) {
+        for (RenderObject* curr = enclosingBox; curr && curr != containerBlock; curr = curr->container()) {
             if (curr->isBox())
                 staticPosition -= toRenderBox(curr)->logicalLeft();
         }
@@ -2260,7 +2277,7 @@ void RenderBox::computePositionedLogicalWidth()
     // instead of the the container block's.
     TextDirection containerDirection = (document()->inQuirksMode()) ? parent()->style()->direction() : containerBlock->style()->direction();
 
-    bool isHorizontal = style()->isHorizontalWritingMode();
+    bool isHorizontal = isHorizontalWritingMode();
     const int bordersPlusPadding = borderAndPaddingLogicalWidth();
     const Length marginLogicalLeft = isHorizontal ? style()->marginLeft() : style()->marginTop();
     const Length marginLogicalRight = isHorizontal ? style()->marginRight() : style()->marginBottom();
@@ -2365,11 +2382,11 @@ static void computeLogicalLeftPositionedOffset(int& logicalLeftPos, const Render
 {
     // Deal with differing writing modes here.  Our offset needs to be in the containing block's coordinate space. If the containing block is flipped
     // along this axis, then we need to flip the coordinate.  This can only happen if the containing block is both a flipped mode and perpendicular to us.
-    if (containerBlock->style()->isHorizontalWritingMode() != child->style()->isHorizontalWritingMode() && containerBlock->style()->isFlippedBlocksWritingMode()) {
+    if (containerBlock->isHorizontalWritingMode() != child->isHorizontalWritingMode() && containerBlock->style()->isFlippedBlocksWritingMode()) {
         logicalLeftPos = containerLogicalWidth - logicalWidthValue - logicalLeftPos;
-        logicalLeftPos += (child->style()->isHorizontalWritingMode() ? containerBlock->borderRight() : containerBlock->borderBottom());
+        logicalLeftPos += (child->isHorizontalWritingMode() ? containerBlock->borderRight() : containerBlock->borderBottom());
     } else
-        logicalLeftPos += (child->style()->isHorizontalWritingMode() ? containerBlock->borderLeft() : containerBlock->borderTop());
+        logicalLeftPos += (child->isHorizontalWritingMode() ? containerBlock->borderLeft() : containerBlock->borderTop());
 }
 
 void RenderBox::computePositionedLogicalWidthUsing(Length logicalWidth, const RenderBoxModelObject* containerBlock, TextDirection containerDirection,
@@ -2552,7 +2569,7 @@ static void computeBlockStaticDistance(Length& logicalTop, Length& logicalBottom
     
     // FIXME: The static distance computation has not been patched for mixed writing modes.
     int staticLogicalTop = child->layer()->staticBlockPosition() - containerBlock->borderBefore();
-    for (RenderObject* curr = child->parent(); curr && curr != containerBlock; curr = curr->parent()) {
+    for (RenderObject* curr = child->parent(); curr && curr != containerBlock; curr = curr->container()) {
         if (curr->isBox() && !curr->isTableRow())
             staticLogicalTop += toRenderBox(curr)->logicalTop();
     }
@@ -2578,7 +2595,7 @@ void RenderBox::computePositionedLogicalHeight()
 
     const int containerLogicalHeight = containingBlockLogicalHeightForPositioned(containerBlock);
 
-    bool isHorizontal = style()->isHorizontalWritingMode();
+    bool isHorizontal = isHorizontalWritingMode();
     bool isFlipped = style()->isFlippedBlocksWritingMode();
     const int bordersPlusPadding = borderAndPaddingLogicalHeight();
     const Length marginBefore = style()->marginBefore();
@@ -2668,18 +2685,18 @@ static void computeLogicalTopPositionedOffset(int& logicalTopPos, const RenderBo
 {
     // Deal with differing writing modes here.  Our offset needs to be in the containing block's coordinate space. If the containing block is flipped
     // along this axis, then we need to flip the coordinate.  This can only happen if the containing block is both a flipped mode and perpendicular to us.
-    if ((child->style()->isFlippedBlocksWritingMode() && child->style()->isHorizontalWritingMode() != containerBlock->style()->isHorizontalWritingMode())
-        || (child->style()->isFlippedBlocksWritingMode() != containerBlock->style()->isFlippedBlocksWritingMode() && child->style()->isHorizontalWritingMode() == containerBlock->style()->isHorizontalWritingMode()))
+    if ((child->style()->isFlippedBlocksWritingMode() && child->isHorizontalWritingMode() != containerBlock->isHorizontalWritingMode())
+        || (child->style()->isFlippedBlocksWritingMode() != containerBlock->style()->isFlippedBlocksWritingMode() && child->isHorizontalWritingMode() == containerBlock->isHorizontalWritingMode()))
         logicalTopPos = containerLogicalHeight - logicalHeightValue - logicalTopPos;
 
     // Our offset is from the logical bottom edge in a flipped environment, e.g., right for vertical-rl and bottom for horizontal-bt.
-    if (containerBlock->style()->isFlippedBlocksWritingMode() && child->style()->isHorizontalWritingMode() == containerBlock->style()->isHorizontalWritingMode()) {
-        if (child->style()->isHorizontalWritingMode())
+    if (containerBlock->style()->isFlippedBlocksWritingMode() && child->isHorizontalWritingMode() == containerBlock->isHorizontalWritingMode()) {
+        if (child->isHorizontalWritingMode())
             logicalTopPos += containerBlock->borderBottom();
         else
             logicalTopPos += containerBlock->borderRight();
     } else {
-        if (child->style()->isHorizontalWritingMode())
+        if (child->isHorizontalWritingMode())
             logicalTopPos += containerBlock->borderTop();
         else
             logicalTopPos += containerBlock->borderLeft();
@@ -2825,7 +2842,7 @@ void RenderBox::computePositionedLogicalWidthReplaced()
     TextDirection containerDirection = (document()->inQuirksMode()) ? parent()->style()->direction() : containerBlock->style()->direction();
 
     // Variables to solve.
-    bool isHorizontal = style()->isHorizontalWritingMode();
+    bool isHorizontal = isHorizontalWritingMode();
     Length logicalLeft = style()->logicalLeft();
     Length logicalRight = style()->logicalRight();
     Length marginLogicalLeft = isHorizontal ? style()->marginLeft() : style()->marginTop();
@@ -2985,7 +3002,7 @@ void RenderBox::computePositionedLogicalHeightReplaced()
     const int containerLogicalHeight = containingBlockLogicalHeightForPositioned(containerBlock);
 
     // Variables to solve.
-    bool isHorizontal = style()->isHorizontalWritingMode();
+    bool isHorizontal = isHorizontalWritingMode();
     bool isFlipped = style()->isFlippedBlocksWritingMode();
     Length marginBefore = style()->marginBefore();
     Length marginAfter = style()->marginAfter();
@@ -3146,7 +3163,7 @@ VisiblePosition RenderBox::positionForPoint(const IntPoint& point)
 {
     // no children...return this render object's element, if there is one, and offset 0
     if (!firstChild())
-        return createVisiblePosition(node() ? firstDeepEditingPositionForNode(node()) : Position(0, 0));
+        return createVisiblePosition(node() ? firstPositionInOrBeforeNode(node()) : Position(0, 0));
 
     int xPos = point.x();
     int yPos = point.y();
@@ -3157,8 +3174,8 @@ VisiblePosition RenderBox::positionForPoint(const IntPoint& point)
         
         if (xPos < 0 || xPos > right || yPos < 0 || yPos > bottom) {
             if (xPos <= right / 2)
-                return createVisiblePosition(firstDeepEditingPositionForNode(node()));
-            return createVisiblePosition(lastDeepEditingPositionForNode(node()));
+                return createVisiblePosition(firstPositionInOrBeforeNode(node()));
+            return createVisiblePosition(lastPositionInOrAfterNode(node()));
         }
     }
 
@@ -3229,7 +3246,7 @@ VisiblePosition RenderBox::positionForPoint(const IntPoint& point)
     if (closestRenderer)
         return closestRenderer->positionForCoordinates(newX - closestRenderer->x(), newY - closestRenderer->y());
     
-    return createVisiblePosition(firstDeepEditingPositionForNode(node()));
+    return createVisiblePosition(firstPositionInOrBeforeNode(node()));
 }
 
 bool RenderBox::shrinkToAvoidFloats() const
@@ -3293,8 +3310,8 @@ void RenderBox::addLayoutOverflow(const IntRect& rect)
         // Overflow is in the block's coordinate space and thus is flipped for horizontal-bt and vertical-rl 
         // writing modes.  At this stage that is actually a simplification, since we can treat horizontal-tb/bt as the same
         // and vertical-lr/rl as the same.
-        bool hasTopOverflow = !style()->isLeftToRightDirection() && !style()->isHorizontalWritingMode();
-        bool hasLeftOverflow = !style()->isLeftToRightDirection() && style()->isHorizontalWritingMode();
+        bool hasTopOverflow = !style()->isLeftToRightDirection() && !isHorizontalWritingMode();
+        bool hasLeftOverflow = !style()->isLeftToRightDirection() && isHorizontalWritingMode();
         
         if (!hasTopOverflow)
             overflowRect.shiftYEdgeTo(max(overflowRect.y(), clientBox.y()));
@@ -3414,13 +3431,14 @@ IntRect RenderBox::layoutOverflowRectForPropagation(RenderStyle* parentStyle) co
     if (!hasOverflowClip())
         rect.unite(layoutOverflowRect());
 
-    if (isRelPositioned() || hasTransform()) {
+    bool hasTransform = hasLayer() && layer()->transform();
+    if (isRelPositioned() || hasTransform) {
         // If we are relatively positioned or if we have a transform, then we have to convert
         // this rectangle into physical coordinates, apply relative positioning and transforms
         // to it, and then convert it back.
         flipForWritingMode(rect);
         
-        if (hasTransform())
+        if (hasTransform)
             rect = layer()->currentTransform().mapRect(rect);
 
         if (isRelPositioned())
@@ -3452,7 +3470,7 @@ IntPoint RenderBox::flipForWritingMode(const RenderBox* child, const IntPoint& p
     
     // The child is going to add in its x() and y(), so we have to make sure it ends up in
     // the right place.
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         return IntPoint(point.x(), point.y() + height() - child->height() - child->y() - (adjustment == ParentToChildFlippingAdjustment ? child->y() : 0));
     return IntPoint(point.x() + width() - child->width() - child->x() - (adjustment == ParentToChildFlippingAdjustment ? child->x() : 0), point.y());
 }
@@ -3462,7 +3480,7 @@ void RenderBox::flipForWritingMode(IntRect& rect) const
     if (!style()->isFlippedBlocksWritingMode())
         return;
 
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         rect.setY(height() - rect.maxY());
     else
         rect.setX(width() - rect.maxX());
@@ -3479,7 +3497,7 @@ IntPoint RenderBox::flipForWritingMode(const IntPoint& position) const
 {
     if (!style()->isFlippedBlocksWritingMode())
         return position;
-    return style()->isHorizontalWritingMode() ? IntPoint(position.x(), height() - position.y()) : IntPoint(width() - position.x(), position.y());
+    return isHorizontalWritingMode() ? IntPoint(position.x(), height() - position.y()) : IntPoint(width() - position.x(), position.y());
 }
 
 IntPoint RenderBox::flipForWritingModeIncludingColumns(const IntPoint& point) const
@@ -3493,14 +3511,14 @@ IntSize RenderBox::flipForWritingMode(const IntSize& offset) const
 {
     if (!style()->isFlippedBlocksWritingMode())
         return offset;
-    return style()->isHorizontalWritingMode() ? IntSize(offset.width(), height() - offset.height()) : IntSize(width() - offset.width(), offset.height());
+    return isHorizontalWritingMode() ? IntSize(offset.width(), height() - offset.height()) : IntSize(width() - offset.width(), offset.height());
 }
 
 FloatPoint RenderBox::flipForWritingMode(const FloatPoint& position) const
 {
     if (!style()->isFlippedBlocksWritingMode())
         return position;
-    return style()->isHorizontalWritingMode() ? FloatPoint(position.x(), height() - position.y()) : FloatPoint(width() - position.x(), position.y());
+    return isHorizontalWritingMode() ? FloatPoint(position.x(), height() - position.y()) : FloatPoint(width() - position.x(), position.y());
 }
 
 void RenderBox::flipForWritingMode(FloatRect& rect) const
@@ -3508,7 +3526,7 @@ void RenderBox::flipForWritingMode(FloatRect& rect) const
     if (!style()->isFlippedBlocksWritingMode())
         return;
 
-    if (style()->isHorizontalWritingMode())
+    if (isHorizontalWritingMode())
         rect.setY(height() - rect.maxY());
     else
         rect.setX(width() - rect.maxX());
diff --git a/Source/WebCore/rendering/RenderBox.h b/Source/WebCore/rendering/RenderBox.h
index f0bd30d..ccedc66 100644
--- a/Source/WebCore/rendering/RenderBox.h
+++ b/Source/WebCore/rendering/RenderBox.h
@@ -33,6 +33,8 @@ struct PaintInfo;
 
 enum LogicalWidthType { LogicalWidth, MinLogicalWidth, MaxLogicalWidth };
 
+enum OverlayScrollbarSizeRelevancy { IgnoreOverlayScrollbarSize, IncludeOverlayScrollbarSize };
+
 class RenderBox : public RenderBoxModelObject {
 public:
     RenderBox(Node*);
@@ -334,7 +336,7 @@ public:
     
     virtual IntRect localCaretRect(InlineBox*, int caretOffset, int* extraWidthToEndOfLine = 0);
 
-    virtual IntRect overflowClipRect(int tx, int ty);
+    virtual IntRect overflowClipRect(int tx, int ty, OverlayScrollbarSizeRelevancy relevancy = IgnoreOverlayScrollbarSize);
     IntRect clipRect(int tx, int ty);
     virtual bool hasControlClip() const { return false; }
     virtual IntRect controlClipRect(int /*tx*/, int /*ty*/) const { return IntRect(); }
@@ -422,11 +424,12 @@ protected:
     virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState&) const;
     virtual void mapAbsoluteToLocalPoint(bool fixed, bool useTransforms, TransformState&) const;
 
+    void paintRootBoxFillLayers(const PaintInfo&);
+
 private:
     bool includeVerticalScrollbarSize() const;
     bool includeHorizontalScrollbarSize() const;
 
-    void paintRootBoxDecorations(PaintInfo&, int tx, int ty);
     // Returns true if we did a full repaint
     bool repaintLayerRectsForImage(WrappedImagePtr image, const FillLayer* layers, bool drawingBackground);
    
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.cpp b/Source/WebCore/rendering/RenderBoxModelObject.cpp
index eec048e..3e2974d 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/Source/WebCore/rendering/RenderBoxModelObject.cpp
@@ -303,7 +303,7 @@ void RenderBoxModelObject::styleWillChange(StyleDifference diff, const RenderSty
                 repaint();
         }
         
-        if (diff == StyleDifferenceLayout) {
+        if (diff == StyleDifferenceLayout || diff == StyleDifferenceSimplifiedLayout) {
             // When a layout hint happens, we go ahead and do a repaint of the layer, since the layer could
             // end up being destroyed.
             if (hasLayer()) {
@@ -346,8 +346,10 @@ void RenderBoxModelObject::styleDidChange(StyleDifference diff, const RenderStyl
             m_layer = new (renderArena()) RenderLayer(this);
             setHasLayer(true);
             m_layer->insertOnlyThisLayer();
-            if (parent() && !needsLayout() && containingBlock())
+            if (parent() && !needsLayout() && containingBlock()) {
+                m_layer->setNeedsFullRepaint();
                 m_layer->updateLayerPositions();
+            }
         }
     } else if (layer() && layer()->parent()) {
         setHasTransform(false); // Either a transform wasn't specified or the object doesn't support transforms, so just null out the bit.
@@ -371,6 +373,7 @@ void RenderBoxModelObject::updateBoxModelInfoFromStyle()
     setHasBoxDecorations(hasBackground() || style()->hasBorder() || style()->hasAppearance() || style()->boxShadow());
     setInline(style()->isDisplayInlineType());
     setRelPositioned(style()->position() == RelativePosition);
+    setHorizontalWritingMode(style()->isHorizontalWritingMode());
 }
 
 int RenderBoxModelObject::relativePositionOffsetX() const
diff --git a/Source/WebCore/rendering/RenderCombineText.cpp b/Source/WebCore/rendering/RenderCombineText.cpp
index 250ec9b..37ca1ed 100644
--- a/Source/WebCore/rendering/RenderCombineText.cpp
+++ b/Source/WebCore/rendering/RenderCombineText.cpp
@@ -37,6 +37,7 @@ RenderCombineText::RenderCombineText(Node* node, PassRefPtr<StringImpl> string)
 
 void RenderCombineText::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
+    setStyleInternal(RenderStyle::clone(style()));
     RenderText::styleDidChange(diff, oldStyle);
 
     if (m_isCombined)
@@ -93,12 +94,12 @@ void RenderCombineText::combineText()
         return;
 
     TextRun run = TextRun(String(text()));
-    FontDescription description = style()->font().fontDescription();
+    FontDescription description = originalFont().fontDescription();
     float emWidth = description.computedSize() * textCombineMargin;
     bool shouldUpdateFont = false;
 
     description.setOrientation(Horizontal); // We are going to draw combined text horizontally.
-    m_combinedTextWidth = style()->font().width(run);
+    m_combinedTextWidth = originalFont().width(run);
     m_isCombined = m_combinedTextWidth <= emWidth;
 
     if (m_isCombined)
@@ -122,12 +123,14 @@ void RenderCombineText::combineText()
         }
     }
 
+    if (!m_isCombined)
+        shouldUpdateFont = style()->setFontDescription(originalFont().fontDescription());
+
     if (shouldUpdateFont)
         style()->font().update(style()->font().fontSelector());
 
     if (m_isCombined) {
-        static const UChar newCharacter = objectReplacementCharacter;
-        DEFINE_STATIC_LOCAL(String, objectReplacementCharacterString, (&newCharacter, 1));
+        DEFINE_STATIC_LOCAL(String, objectReplacementCharacterString, (&objectReplacementCharacter, 1));
         RenderText::setTextInternal(objectReplacementCharacterString.impl());
     }
 }
diff --git a/Source/WebCore/rendering/RenderCombineText.h b/Source/WebCore/rendering/RenderCombineText.h
index 3484ab7..406c3f6 100644
--- a/Source/WebCore/rendering/RenderCombineText.h
+++ b/Source/WebCore/rendering/RenderCombineText.h
@@ -34,8 +34,10 @@ public:
     void charactersToRender(int start, const UChar*& characters, int& length) const;
     bool isCombined() const { return m_isCombined; }
     float combinedTextWidth(const Font& font) const { return font.size(); }
+    const Font& originalFont() const { return parent()->style()->font(); }
 
 private:
+    virtual bool isCombineText() const { return true; }
     virtual float width(unsigned from, unsigned length, const Font&, float xPosition, HashSet<const SimpleFontData*>* fallbackFonts = 0, GlyphOverflow* = 0) const;
     virtual const char* renderName() const { return "RenderCombineText"; }
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
@@ -48,13 +50,13 @@ private:
 
 inline RenderCombineText* toRenderCombineText(RenderObject* object)
 { 
-    ASSERT(!object || object->isText());
+    ASSERT(!object || object->isCombineText());
     return static_cast<RenderCombineText*>(object);
 }
 
 inline const RenderCombineText* toRenderCombineText(const RenderObject* object)
 { 
-    ASSERT(!object || object->isText());
+    ASSERT(!object || object->isCombineText());
     return static_cast<const RenderCombineText*>(object);
 }
 
diff --git a/Source/WebCore/rendering/RenderCounter.cpp b/Source/WebCore/rendering/RenderCounter.cpp
index f4a8736..9b8c493 100644
--- a/Source/WebCore/rendering/RenderCounter.cpp
+++ b/Source/WebCore/rendering/RenderCounter.cpp
@@ -316,7 +316,7 @@ static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString&
                             previousSibling = parent ? currentCounter : 0;
                             return parent;
                         }
-                        // We are not a reset node or the previous reset must be on an ancestor of our renderer
+                        // We are not a reset node or the previous reset must be on an ancestor of our owner renderer
                         // hence we must be a child of that reset counter.
                         parent = currentCounter;
                         ASSERT(previousSibling->parent() == currentCounter);
@@ -325,7 +325,7 @@ static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString&
                     // CurrentCounter, the counter at the EndSearchRenderer, is not reset.
                     if (!isReset || !areRenderersElementsSiblings(currentRenderer, counterOwner)) {
                         // If the node we are placing is not reset or we have found a counter that is attached
-                        // to an ancestor of the placed counter's renderer we know we are a sibling of that node.
+                        // to an ancestor of the placed counter's owner renderer we know we are a sibling of that node.
                         ASSERT(currentCounter->parent() == previousSibling->parent());
                         parent = currentCounter->parent();
                         return true;
@@ -352,9 +352,9 @@ static bool findPlaceForCounter(RenderObject* counterOwner, const AtomicString&
                     previousSibling = currentCounter;
                 }
             }
-            // We come here if the previous sibling or parent of our renderer had no 
+            // We come here if the previous sibling or parent of our owner renderer had no
             // good counter, or we are a reset node and the counter on the previous sibling
-            // of our renderer was not a reset counter.
+            // of our owner renderer was not a reset counter.
             // Set a new goal for the end of the search.
             searchEndRenderer = previousSiblingOrParent(currentRenderer);
         } else {
@@ -450,11 +450,16 @@ RenderCounter::RenderCounter(Document* node, const CounterContent& counter)
     : RenderText(node, StringImpl::empty())
     , m_counter(counter)
     , m_counterNode(0)
+    , m_nextForSameCounter(0)
 {
 }
 
 RenderCounter::~RenderCounter()
 {
+    if (m_counterNode) {
+        m_counterNode->removeRenderer(this);
+        ASSERT(!m_counterNode);
+    }
 }
 
 const char* RenderCounter::renderName() const
@@ -469,12 +474,21 @@ bool RenderCounter::isCounter() const
 
 PassRefPtr<StringImpl> RenderCounter::originalText() const
 {
-    if (!parent())
-        return 0;
-
-    if (!m_counterNode)
-        m_counterNode = makeCounterNode(parent(), m_counter.identifier(), true);
-
+    if (!m_counterNode) {
+        RenderObject* beforeAfterContainer = parent();
+        while (true) {
+            if (!beforeAfterContainer)
+                return 0;
+            if (!beforeAfterContainer->isAnonymous())
+                return 0; // RenderCounters are restricted to before and after pseudo elements
+            PseudoId containerStyle = beforeAfterContainer->style()->styleType();
+            if ((containerStyle == BEFORE) || (containerStyle == AFTER))
+                break;
+            beforeAfterContainer = beforeAfterContainer->parent();
+        }
+        makeCounterNode(beforeAfterContainer, m_counter.identifier(), true)->addRenderer(const_cast<RenderCounter*>(this));
+        ASSERT(m_counterNode);
+    }
     CounterNode* child = m_counterNode;
     int value = child->actsAsReset() ? child->value() : child->countInParent();
 
@@ -499,11 +513,12 @@ void RenderCounter::computePreferredLogicalWidths(float lead)
     RenderText::computePreferredLogicalWidths(lead);
 }
 
-void RenderCounter::invalidate(const AtomicString& identifier)
+void RenderCounter::invalidate()
 {
-    if (m_counter.identifier() != identifier)
+    m_counterNode->removeRenderer(this);
+    ASSERT(!m_counterNode);
+    if (documentBeingDestroyed())
         return;
-    m_counterNode = 0;
     setNeedsLayoutAndPrefWidthsRecalc();
 }
 
@@ -512,28 +527,18 @@ static void destroyCounterNodeWithoutMapRemoval(const AtomicString& identifier,
     CounterNode* previous;
     for (RefPtr<CounterNode> child = node->lastDescendant(); child && child != node; child = previous) {
         previous = child->previousInPreOrder();
-        child->parent()->removeChild(child.get(), identifier);
-        ASSERT(counterMaps().get(child->renderer())->get(identifier.impl()) == child);
-        counterMaps().get(child->renderer())->remove(identifier.impl());
-        if (!child->renderer()->documentBeingDestroyed()) {
-            RenderObjectChildList* children = child->renderer()->virtualChildren();
-            if (children)
-                children->invalidateCounters(child->renderer(), identifier);
-        }
-    }
-    RenderObject* renderer = node->renderer();
-    if (!renderer->documentBeingDestroyed()) {
-        if (RenderObjectChildList* children = renderer->virtualChildren())
-            children->invalidateCounters(renderer, identifier);
+        child->parent()->removeChild(child.get());
+        ASSERT(counterMaps().get(child->owner())->get(identifier.impl()) == child);
+        counterMaps().get(child->owner())->remove(identifier.impl());
     }
     if (CounterNode* parent = node->parent())
-        parent->removeChild(node, identifier);
+        parent->removeChild(node);
 }
 
-void RenderCounter::destroyCounterNodes(RenderObject* renderer)
+void RenderCounter::destroyCounterNodes(RenderObject* owner)
 {
     CounterMaps& maps = counterMaps();
-    CounterMaps::iterator mapsIterator = maps.find(renderer);
+    CounterMaps::iterator mapsIterator = maps.find(owner);
     if (mapsIterator == maps.end())
         return;
     CounterMap* map = mapsIterator->second;
@@ -544,12 +549,12 @@ void RenderCounter::destroyCounterNodes(RenderObject* renderer)
     }
     maps.remove(mapsIterator);
     delete map;
-    renderer->m_hasCounterNodeMap = false;
+    owner->m_hasCounterNodeMap = false;
 }
 
-void RenderCounter::destroyCounterNode(RenderObject* renderer, const AtomicString& identifier)
+void RenderCounter::destroyCounterNode(RenderObject* owner, const AtomicString& identifier)
 {
-    CounterMap* map = counterMaps().get(renderer);
+    CounterMap* map = counterMaps().get(owner);
     if (!map)
         return;
     CounterMap::iterator mapIterator = map->find(identifier.impl());
@@ -600,7 +605,7 @@ static void updateCounters(RenderObject* renderer)
         if (newParent == parent && newPreviousSibling == node->previousSibling())
             continue;
         if (parent)
-            parent->removeChild(node.get(), it->first.get());
+            parent->removeChild(node.get());
         if (newParent)
             newParent->insertAfter(node.get(), newPreviousSibling, it->first.get());
     }
@@ -684,6 +689,7 @@ void showCounterRendererTree(const WebCore::RenderObject* renderer, const char*
             current->nextSibling(), current->m_hasCounterNodeMap?
             counterName ? WebCore::counterMaps().get(current)->get(identifier.impl()).get() : (WebCore::CounterNode*)1 : (WebCore::CounterNode*)0);
     }
+    fflush(stderr);
 }
 
 #endif // NDEBUG
diff --git a/Source/WebCore/rendering/RenderCounter.h b/Source/WebCore/rendering/RenderCounter.h
index 35ffc35..9557ae3 100644
--- a/Source/WebCore/rendering/RenderCounter.h
+++ b/Source/WebCore/rendering/RenderCounter.h
@@ -34,12 +34,6 @@ public:
     RenderCounter(Document*, const CounterContent&);
     virtual ~RenderCounter();
 
-    // Removes the reference to the CounterNode associated with this renderer
-    // if its identifier matches the argument.
-    // This is used to cause a counter display update when the CounterNode
-    // tree for identifier changes.
-    void invalidate(const AtomicString& identifier);
-
     static void destroyCounterNodes(RenderObject*);
     static void destroyCounterNode(RenderObject*, const AtomicString& identifier);
     static void rendererSubtreeAttached(RenderObject*);
@@ -52,8 +46,14 @@ private:
     
     virtual void computePreferredLogicalWidths(float leadWidth);
 
+    // Removes the reference to the CounterNode associated with this renderer.
+    // This is used to cause a counter display update when the CounterNode tree changes.
+    void invalidate();
+
     CounterContent m_counter;
-    mutable CounterNode* m_counterNode;
+    CounterNode* m_counterNode;
+    RenderCounter* m_nextForSameCounter;
+    friend class CounterNode;
 };
 
 inline RenderCounter* toRenderCounter(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderDataGrid.cpp b/Source/WebCore/rendering/RenderDataGrid.cpp
index c322389..5057a5f 100644
--- a/Source/WebCore/rendering/RenderDataGrid.cpp
+++ b/Source/WebCore/rendering/RenderDataGrid.cpp
@@ -46,10 +46,16 @@ static const int cDefaultWidth = 300;
 RenderDataGrid::RenderDataGrid(Element* elt)
     : RenderBlock(elt)
 {
+    if (Page* page = frame()->page()) {
+        m_page = page;
+        m_page->addScrollableArea(this);
+    }
 }
 
 RenderDataGrid::~RenderDataGrid()
 {
+    if (m_page)
+        m_page->removeScrollableArea(this);
 }
 
 void RenderDataGrid::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
@@ -256,6 +262,14 @@ IntPoint RenderDataGrid::convertFromContainingViewToScrollbar(const Scrollbar* s
     return point;
 }
 
+bool RenderDataGrid::shouldSuspendScrollAnimations() const
+{
+    RenderView* view = this->view();
+    if (!view)
+        return true;
+    return view->frameView()->shouldSuspendScrollAnimations();
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/rendering/RenderDataGrid.h b/Source/WebCore/rendering/RenderDataGrid.h
index 852010c..4f897d1 100644
--- a/Source/WebCore/rendering/RenderDataGrid.h
+++ b/Source/WebCore/rendering/RenderDataGrid.h
@@ -77,8 +77,13 @@ private:
     virtual IntRect convertFromContainingViewToScrollbar(const Scrollbar*, const IntRect&) const;
     virtual IntPoint convertFromScrollbarToContainingView(const Scrollbar*, const IntPoint&) const;
     virtual IntPoint convertFromContainingViewToScrollbar(const Scrollbar*, const IntPoint&) const;
+    virtual bool shouldSuspendScrollAnimations() const;
+
+    virtual void disconnectFromPage() { m_page = 0; }
 
     RefPtr<Scrollbar> m_vBar;
+
+    Page* m_page;
 };
 
 }
diff --git a/Source/WebCore/rendering/RenderDetails.cpp b/Source/WebCore/rendering/RenderDetails.cpp
index a1039f9..be2b435 100644
--- a/Source/WebCore/rendering/RenderDetails.cpp
+++ b/Source/WebCore/rendering/RenderDetails.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,20 +21,316 @@
 #include "config.h"
 #include "RenderDetails.h"
 
+#include "CSSStyleSelector.h"
+#include "HTMLDetailsElement.h"
+#include "HTMLNames.h"
+#include "LocalizedStrings.h"
+#include "RenderDetailsMarker.h"
+#include "RenderTextFragment.h"
+#include "RenderView.h"
+
 namespace WebCore {
 
-RenderDetails::RenderDetails(Node* element)
-    : RenderBlock(element)
+using namespace HTMLNames;
+
+RenderDetails::RenderDetails(Node* node)
+    : RenderBlock(node)
+    , m_summaryBlock(0)
+    , m_contentBlock(0)
+    , m_defaultSummaryBlock(0)
+    , m_defaultSummaryText(0)
+    , m_marker(0)
+    , m_mainSummary(0)
+{
+}
+
+void RenderDetails::destroy()
+{
+    if (m_marker) {
+        m_marker->destroy();
+        m_marker = 0;
+    }
+
+    RenderBlock::destroy();
+}
+
+RenderBlock* RenderDetails::summaryBlock()
+{
+    if (!m_summaryBlock) {
+        m_summaryBlock = createAnonymousBlock();
+        RenderBlock::addChild(m_summaryBlock, m_contentBlock);
+    }
+    return m_summaryBlock;
+}
+
+RenderBlock* RenderDetails::contentBlock()
 {
+    if (!m_contentBlock) {
+        m_contentBlock = createAnonymousBlock();
+        RenderBlock::addChild(m_contentBlock);
+    }
+    return m_contentBlock;
+}
+
+void RenderDetails::addChild(RenderObject* newChild, RenderObject* beforeChild)
+{
+    if (beforeChild && beforeChild == m_mainSummary)
+        beforeChild = getRenderPosition(m_mainSummary);
+    contentBlock()->addChild(newChild, beforeChild);
+}
+
+void RenderDetails::removeChild(RenderObject* oldChild)
+{
+    if (oldChild == m_summaryBlock) {
+        RenderBlock::removeChild(oldChild);
+        m_summaryBlock = 0;
+        return;
+    }
+
+    if (oldChild == m_contentBlock) {
+        RenderBlock::removeChild(oldChild);
+        m_contentBlock = 0;
+        return;
+    }
+
+    if (oldChild == m_mainSummary && m_summaryBlock) {
+        m_summaryBlock->removeChild(m_mainSummary);
+        return;
+    }
+
+    if (m_contentBlock) {
+        m_contentBlock->removeChild(oldChild);
+        return;
+    }
+
+    ASSERT_NOT_REACHED();
+}
+
+void RenderDetails::setMarkerStyle()
+{
+    if (m_marker) {
+        RefPtr<RenderStyle> markerStyle = RenderStyle::create();
+        markerStyle->inheritFrom(style());
+        m_marker->setStyle(markerStyle.release());
+    }
 }
 
 void RenderDetails::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
 
+    if (m_defaultSummaryBlock) {
+        m_defaultSummaryBlock->setStyle(createSummaryStyle());
+        m_defaultSummaryText->setStyle(m_defaultSummaryBlock->style());
+    }
+
+    setMarkerStyle();
+
     // Ensure that if we ended up being inline that we set our replaced flag
     // so that we're treated like an inline-block.
     setReplaced(isInline());
 }
 
+RenderObject* RenderDetails::getRenderPosition(RenderObject* object)
+{
+    if (!object || !object->node())
+        return 0;
+
+    Node* element = object->node()->nextSibling();
+
+    while (element && !element->renderer())
+        element = element->nextSibling();
+
+    return element ? element->renderer() : 0;
+}
+
+void RenderDetails::markerDestroyed()
+{
+    m_marker = 0;
+}
+
+void RenderDetails::summaryDestroyed(RenderObject* summary)
+{
+    if (summary == m_mainSummary)
+        m_mainSummary = 0;
+}
+
+void RenderDetails::moveSummaryToContents()
+{
+    if (m_defaultSummaryBlock) {
+        ASSERT(!m_mainSummary);
+        m_defaultSummaryBlock->destroy();
+        m_defaultSummaryBlock = 0;
+        m_defaultSummaryText = 0;
+        return;
+    }
+
+    if (!m_mainSummary)
+        return;
+
+    m_mainSummary->remove();
+    contentBlock()->addChild(m_mainSummary, getRenderPosition(m_mainSummary));
+    m_mainSummary = 0;
+}
+
+PassRefPtr<RenderStyle> RenderDetails::createSummaryStyle()
+{
+    RefPtr<HTMLElement> summary(HTMLElement::create(summaryTag, document()));
+    return document()->styleSelector()->styleForElement(summary.get(), style(), true);
+}
+
+void RenderDetails::replaceMainSummary(RenderObject* newSummary)
+{
+    ASSERT(newSummary);
+    if (m_mainSummary == newSummary)
+        return;
+
+    moveSummaryToContents();
+    newSummary->remove();
+    summaryBlock()->addChild(newSummary);
+    m_mainSummary = newSummary;
+}
+
+void RenderDetails::createDefaultSummary()
+{
+    if (m_defaultSummaryBlock)
+        return;
+
+    moveSummaryToContents();
+
+    m_defaultSummaryBlock = summaryBlock()->createAnonymousBlock();
+    m_defaultSummaryBlock->setStyle(createSummaryStyle());
+
+    m_defaultSummaryText = new (renderArena()) RenderTextFragment(document(), defaultDetailsSummaryText().impl());
+    m_defaultSummaryText->setStyle(m_defaultSummaryBlock->style());
+    m_defaultSummaryBlock->addChild(m_defaultSummaryText);
+
+    summaryBlock()->addChild(m_defaultSummaryBlock);
+}
+
+void RenderDetails::checkMainSummary()
+{
+    if (!node() || !node()->hasTagName(detailsTag))
+        return;
+
+    Node* mainSummaryNode = static_cast<HTMLDetailsElement*>(node())->mainSummary();
+
+    if (!mainSummaryNode || !mainSummaryNode->renderer() || mainSummaryNode->renderer()->isFloatingOrPositioned())
+        createDefaultSummary();
+    else
+        replaceMainSummary(mainSummaryNode->renderer());
+
+}
+
+void RenderDetails::layout()
+{
+    ASSERT(needsLayout());
+
+    checkMainSummary();
+    ASSERT(m_summaryBlock);
+
+    if (!m_marker) {
+        m_marker = new (renderArena()) RenderDetailsMarker(this);
+        setMarkerStyle();
+    }
+    updateMarkerLocation();
+
+    RenderBlock::layout();
+
+    m_interactiveArea = m_summaryBlock->frameRect();
+
+    // FIXME: the following code will not be needed once absoluteToLocal get patched to handle flipped blocks writing modes.
+    switch (style()->writingMode()) {
+    case TopToBottomWritingMode:
+    case LeftToRightWritingMode:
+        break;
+    case RightToLeftWritingMode: {
+        m_interactiveArea.setX(width() - m_interactiveArea.x() - m_interactiveArea.width());
+        break;
+    }
+    case BottomToTopWritingMode: {
+        m_interactiveArea.setY(height() - m_interactiveArea.y() - m_interactiveArea.height());
+        break;
+    }
+    }
 }
+
+bool RenderDetails::isOpen() const
+{
+    return node() && node()->isElementNode() ? !static_cast<Element*>(node())->getAttribute(openAttr).isNull() : false;
+}
+
+RenderObject* RenderDetails::getParentOfFirstLineBox(RenderBlock* curr)
+{
+    RenderObject* firstChild = curr->firstChild();
+    if (!firstChild)
+        return 0;
+
+    for (RenderObject* currChild = firstChild; currChild; currChild = currChild->nextSibling()) {
+        if (currChild == m_marker)
+            continue;
+
+        if (currChild->isInline() && (!currChild->isRenderInline() || curr->generatesLineBoxesForInlineChild(currChild)))
+            return curr;
+
+        if (currChild->isFloating() || currChild->isPositioned())
+            continue;
+
+        if (currChild->isTable() || !currChild->isRenderBlock() || (currChild->isBox() && toRenderBox(currChild)->isWritingModeRoot()))
+            break;
+
+        if (currChild->isDetails())
+            break;
+
+        RenderObject* lineBox = getParentOfFirstLineBox(toRenderBlock(currChild));
+        if (lineBox)
+            return lineBox;
+    }
+
+    return 0;
+}
+
+RenderObject* RenderDetails::firstNonMarkerChild(RenderObject* parent)
+{
+    RenderObject* result = parent->firstChild();
+    while (result && result->isDetailsMarker())
+        result = result->nextSibling();
+    return result;
+}
+
+void RenderDetails::updateMarkerLocation()
+{
+    // Sanity check the location of our marker.
+    if (m_marker) {
+        RenderObject* markerPar = m_marker->parent();
+        RenderObject* lineBoxParent = getParentOfFirstLineBox(m_summaryBlock);
+        if (!lineBoxParent) {
+            // If the marker is currently contained inside an anonymous box,
+            // then we are the only item in that anonymous box (since no line box
+            // parent was found). It's ok to just leave the marker where it is
+            // in this case.
+            if (markerPar && markerPar->isAnonymousBlock())
+                lineBoxParent = markerPar;
+            else
+                lineBoxParent = m_summaryBlock;
+        }
+
+        if (markerPar != lineBoxParent || m_marker->preferredLogicalWidthsDirty()) {
+            // Removing and adding the marker can trigger repainting in
+            // containers other than ourselves, so we need to disable LayoutState.
+            view()->disableLayoutState();
+            m_marker->remove();
+            if (!lineBoxParent)
+                lineBoxParent = m_summaryBlock;
+            lineBoxParent->addChild(m_marker, firstNonMarkerChild(lineBoxParent));
+
+            if (m_marker->preferredLogicalWidthsDirty())
+                m_marker->computePreferredLogicalWidths();
+
+            view()->enableLayoutState();
+        }
+    }
+}
+
+} // namespace WebCore
+
diff --git a/Source/WebCore/rendering/RenderDetails.h b/Source/WebCore/rendering/RenderDetails.h
index b8aebab..0b56c13 100644
--- a/Source/WebCore/rendering/RenderDetails.h
+++ b/Source/WebCore/rendering/RenderDetails.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,18 +21,65 @@
 #ifndef RenderDetails_h
 #define RenderDetails_h
 
-#include "RenderBlock.h"
+#include "RenderFlexibleBox.h"
+#include "Timer.h"
+#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
+class RenderDetailsMarker;
+
 class RenderDetails : public RenderBlock {
 public:
     explicit RenderDetails(Node*);
 
-private:
     virtual const char* renderName() const { return "RenderDetails"; }
     virtual bool isDetails() const { return true; }
+
+    bool isOpen() const;
+    IntRect interactiveArea() const { return m_interactiveArea; }
+    void markerDestroyed();
+    void summaryDestroyed(RenderObject*);
+
+private:
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+
+    virtual void addChild(RenderObject* newChild, RenderObject *beforeChild = 0);
+    virtual void removeChild(RenderObject*);
+    virtual void removeLeftoverAnonymousBlock(RenderBlock*) { }
+    virtual bool createsAnonymousWrapper() const { return true; }
+
+    virtual bool requiresForcedStyleRecalcPropagation() const { return true; }
+
+    virtual void layout();
+    virtual void destroy();
+
+    void createDefaultSummary();
+    void replaceMainSummary(RenderObject*);
+    void moveSummaryToContents();
+    void checkMainSummary();
+    RenderObject* getRenderPosition(RenderObject*);
+    PassRefPtr<RenderStyle> createSummaryStyle();
+    void setMarkerStyle();
+
+    RenderBlock* summaryBlock();
+    RenderBlock* contentBlock();
+
+    RenderObject* getParentOfFirstLineBox(RenderBlock* curr);
+    RenderObject* firstNonMarkerChild(RenderObject* parent);
+    void updateMarkerLocation();
+
+    RenderBlock* m_summaryBlock;
+    RenderBlock* m_contentBlock;
+
+    RenderObject* m_defaultSummaryBlock;
+    RenderObject* m_defaultSummaryText;
+
+    IntRect m_interactiveArea;
+
+    RenderDetailsMarker* m_marker;
+
+    RenderObject* m_mainSummary;
 };
 
 inline RenderDetails* toRenderDetails(RenderObject* object)
@@ -44,6 +91,6 @@ inline RenderDetails* toRenderDetails(RenderObject* object)
 // This will catch anyone doing an unnecessary cast.
 void toRenderDetails(const RenderDetails*);
 
-}
+} // namespace WebCore
 
 #endif // RenderDetails_h
diff --git a/Source/WebCore/rendering/RenderDetailsMarker.cpp b/Source/WebCore/rendering/RenderDetailsMarker.cpp
index 26e49d9..e040eb3 100644
--- a/Source/WebCore/rendering/RenderDetailsMarker.cpp
+++ b/Source/WebCore/rendering/RenderDetailsMarker.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,11 +21,182 @@
 #include "config.h"
 #include "RenderDetailsMarker.h"
 
+#include "GraphicsContext.h"
+#include "HTMLNames.h"
+#include "PaintInfo.h"
+#include "RenderDetails.h"
+#include "RenderSummary.h"
+
 namespace WebCore {
 
-RenderDetailsMarker::RenderDetailsMarker(Node* element)
-    : RenderBlock(element)
+using namespace HTMLNames;
+
+RenderDetailsMarker::RenderDetailsMarker(RenderDetails* item)
+    : RenderBox(item->document())
+    , m_details(item)
+{
+    setInline(true);
+    setReplaced(true);
+}
+
+void RenderDetailsMarker::destroy()
+{
+    if (m_details)
+        m_details->markerDestroyed();
+
+    RenderBox::destroy();
+}
+
+int RenderDetailsMarker::lineHeight(bool firstLine, LineDirectionMode direction, LinePositionMode) const
+{
+    return m_details->lineHeight(firstLine, direction, PositionOfInteriorLineBoxes);
+}
+
+int RenderDetailsMarker::baselinePosition(FontBaseline baselineType, bool firstLine, LineDirectionMode direction, LinePositionMode) const
+{
+    return m_details->baselinePosition(baselineType, firstLine, direction, PositionOfInteriorLineBoxes);
+}
+
+void RenderDetailsMarker::computePreferredLogicalWidths()
+{
+    ASSERT(preferredLogicalWidthsDirty());
+
+    m_minPreferredLogicalWidth = 2 * style()->fontMetrics().ascent() / 3;
+    m_maxPreferredLogicalWidth = m_minPreferredLogicalWidth;
+
+    setPreferredLogicalWidthsDirty(false);
+}
+
+void RenderDetailsMarker::layout()
+{
+    ASSERT(needsLayout());
+
+    setLogicalWidth(minPreferredLogicalWidth());
+    setLogicalHeight(style()->fontMetrics().height());
+
+    setMarginStart(0);
+    setMarginEnd(style()->fontMetrics().ascent() - minPreferredLogicalWidth() + 1);
+
+    setNeedsLayout(false);
+}
+
+IntRect RenderDetailsMarker::getRelativeMarkerRect() const
+{
+    IntRect relativeRect;
+
+    int bulletWidth = minPreferredLogicalWidth();
+    relativeRect = IntRect((logicalWidth() - bulletWidth) / 2, (logicalHeight() - bulletWidth) / 2, bulletWidth, bulletWidth);
+
+    if (!style()->isHorizontalWritingMode()) {
+        relativeRect = relativeRect.transposedRect();
+        relativeRect.setX(width() - relativeRect.x() - relativeRect.width());
+    }
+
+    return relativeRect;
+}
+
+bool RenderDetailsMarker::isOpen() const
 {
+    return m_details && m_details->isOpen();
+}
+
+static Path createPath(const FloatPoint* path)
+{
+    Path result;
+    result.moveTo(FloatPoint(path[0].x(), path[0].y()));
+    for (int i = 1; i < 4; ++i)
+        result.addLineTo(FloatPoint(path[i].x(), path[i].y()));
+    return result;
+}
+
+static Path createDownArrowPath()
+{
+    FloatPoint points[4] = { FloatPoint(0.0f, 0.07f), FloatPoint(0.5f, 0.93f), FloatPoint(1.0f, 0.07f), FloatPoint(0.0f, 0.07f) };
+    return createPath(points);
+}
+
+static Path createUpArrowPath()
+{
+    FloatPoint points[4] = { FloatPoint(0.0f, 0.93f), FloatPoint(0.5f, 0.07f), FloatPoint(1.0f, 0.93f), FloatPoint(0.0f, 0.93f) };
+    return createPath(points);
+}
+
+static Path createLeftArrowPath()
+{
+    FloatPoint points[4] = { FloatPoint(1.0f, 0.0f), FloatPoint(0.14f, 0.5f), FloatPoint(1.0f, 1.0f), FloatPoint(1.0f, 0.0f) };
+    return createPath(points);
+}
+
+static Path createRightArrowPath()
+{
+    FloatPoint points[4] = { FloatPoint(0.0f, 0.0f), FloatPoint(0.86f, 0.5f), FloatPoint(0.0f, 1.0f), FloatPoint(0.0f, 0.0f) };
+    return createPath(points);
+}
+
+RenderDetailsMarker::Orientation RenderDetailsMarker::orientation() const
+{
+    switch (style()->writingMode()) {
+    case TopToBottomWritingMode:
+        if (style()->isLeftToRightDirection())
+            return isOpen() ? Down : Right;
+        return isOpen() ? Down : Left;
+    case RightToLeftWritingMode:
+        if (style()->isLeftToRightDirection())
+            return isOpen() ? Left : Down;
+        return isOpen() ? Left : Up;
+    case LeftToRightWritingMode:
+        if (style()->isLeftToRightDirection())
+            return isOpen() ? Right : Down;
+        return isOpen() ? Right : Up;
+    case BottomToTopWritingMode:
+        if (style()->isLeftToRightDirection())
+            return isOpen() ? Up : Right;
+        return isOpen() ? Up : Left;
+    }
+    return Right;
+}
+
+Path RenderDetailsMarker::getCanonicalPath() const
+{
+    switch (orientation()) {
+    case Left: return createLeftArrowPath();
+    case Right: return createRightArrowPath();
+    case Up: return createUpArrowPath();
+    case Down: return createDownArrowPath();
+    }
+
+    return Path();
+}
+
+Path RenderDetailsMarker::getPath(const IntPoint& origin) const
+{
+    IntRect rect = getRelativeMarkerRect();
+    Path result = getCanonicalPath();
+    result.transform(AffineTransform().scale(rect.width()));
+    result.translate(FloatSize(origin.x() + rect.x(), origin.y() + rect.y()));
+    return result;
+}
+
+void RenderDetailsMarker::paint(PaintInfo& paintInfo, int tx, int ty)
+{
+    if (paintInfo.phase != PaintPhaseForeground || style()->visibility() != VISIBLE)
+        return;
+
+    IntPoint boxOrigin(tx + x(), ty + y());
+    IntRect overflowRect(visualOverflowRect());
+    overflowRect.move(boxOrigin.x(), boxOrigin.y());
+    overflowRect.inflate(maximalOutlineSize(paintInfo.phase));
+
+    if (!paintInfo.rect.intersects(overflowRect))
+        return;
+
+    const Color color(style()->visitedDependentColor(CSSPropertyColor));
+    paintInfo.context->setStrokeColor(color, style()->colorSpace());
+    paintInfo.context->setStrokeStyle(SolidStroke);
+    paintInfo.context->setStrokeThickness(1.0f);
+    paintInfo.context->setFillColor(color, style()->colorSpace());
+
+    paintInfo.context->fillPath(getPath(boxOrigin));
 }
 
 }
diff --git a/Source/WebCore/rendering/RenderDetailsMarker.h b/Source/WebCore/rendering/RenderDetailsMarker.h
index 08bdbd8..de8f60b 100644
--- a/Source/WebCore/rendering/RenderDetailsMarker.h
+++ b/Source/WebCore/rendering/RenderDetailsMarker.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,25 +21,52 @@
 #ifndef RenderDetailsMarker_h
 #define RenderDetailsMarker_h
 
-#include "RenderBlock.h"
+#include "RenderBox.h"
 
 namespace WebCore {
 
-class RenderDetailsMarker : public RenderBlock {
+class RenderDetails;
+
+class RenderDetailsMarker : public RenderBox {
 public:
-    explicit RenderDetailsMarker(Node*);
+    RenderDetailsMarker(RenderDetails*);
+
+    enum Orientation { Up, Down, Left, Right };
+
+    Orientation orientation() const;
+
+    virtual void computePreferredLogicalWidths();
+    virtual void destroy();
 
 private:
     virtual const char* renderName() const { return "RenderDetailsMarker"; }
     virtual bool isDetailsMarker() const { return true; }
+    virtual void paint(PaintInfo&, int tx, int ty);
+    virtual void layout();
+    virtual int lineHeight(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
+    virtual int baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
+
+    IntRect getRelativeMarkerRect() const;
+
+    bool isOpen() const;
+    Path getCanonicalPath() const;
+    Path getPath(const IntPoint& origin) const;
+
+    RenderDetails* m_details;
 };
 
 inline RenderDetailsMarker* toRenderDetailsMarker(RenderObject* object)
 {
-    ASSERT(!object || object->isDetails());
+    ASSERT(!object || object->isDetailsMarker());
     return static_cast<RenderDetailsMarker*>(object);
 }
 
+inline const RenderDetailsMarker* toRenderDetailsMarker(const RenderObject* object)
+{
+    ASSERT(!object || object->isDetailsMarker());
+    return static_cast<const RenderDetailsMarker*>(object);
+}
+
 // This will catch anyone doing an unnecessary cast.
 void toRenderDetailsMarker(const RenderDetailsMarker*);
 
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.cpp b/Source/WebCore/rendering/RenderFlexibleBox.cpp
index 8241dcd..4d97da0 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderFlexibleBox.cpp
@@ -214,7 +214,7 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren, int /*pageHeight FIXM
 {
     ASSERT(needsLayout());
 
-    if (!relayoutChildren && layoutOnlyPositionedObjects())
+    if (!relayoutChildren && simplifiedLayout())
         return;
 
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
@@ -421,13 +421,11 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             if (child->isPositioned()) {
                 child->containingBlock()->insertPositionedObject(child);
                 RenderLayer* childLayer = child->layer();
-                if (child->style()->hasStaticInlinePosition(style()->isHorizontalWritingMode()))
-                    childLayer->setStaticInlinePosition(xPos);
-                if (child->style()->hasStaticBlockPosition(style()->isHorizontalWritingMode())) {
-                    if (childLayer->staticBlockPosition() != yPos) {
-                        childLayer->setStaticBlockPosition(yPos);
+                childLayer->setStaticInlinePosition(xPos);
+                if (childLayer->staticBlockPosition() != yPos) {
+                    childLayer->setStaticBlockPosition(yPos);
+                    if (child->style()->hasStaticBlockPosition(style()->isHorizontalWritingMode()))
                         child->setChildNeedsLayout(true, false);
-                    }
                 }
                 child = iterator.next();
                 continue;
@@ -684,17 +682,11 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             if (child->isPositioned()) {
                 child->containingBlock()->insertPositionedObject(child);
                 RenderLayer* childLayer = child->layer();
-                if (child->style()->hasStaticInlinePosition(style()->isHorizontalWritingMode())) {
-                    if (style()->isLeftToRightDirection())
-                        childLayer->setStaticInlinePosition(borderLeft() + paddingLeft());
-                    else
-                        childLayer->setStaticInlinePosition(borderRight() + paddingRight());
-                }
-                if (child->style()->hasStaticBlockPosition(style()->isHorizontalWritingMode())) {
-                    if (childLayer->staticBlockPosition() != height()) {
-                        childLayer->setStaticBlockPosition(height());
+                childLayer->setStaticInlinePosition(borderStart() + paddingStart());
+                if (childLayer->staticBlockPosition() != height()) {
+                    childLayer->setStaticBlockPosition(height());
+                    if (child->style()->hasStaticBlockPosition(style()->isHorizontalWritingMode()))
                         child->setChildNeedsLayout(true, false);
-                    }
                 }
                 child = iterator.next();
                 continue;
diff --git a/Source/WebCore/rendering/RenderFullScreen.cpp b/Source/WebCore/rendering/RenderFullScreen.cpp
index cc53a6e..a685064 100644
--- a/Source/WebCore/rendering/RenderFullScreen.cpp
+++ b/Source/WebCore/rendering/RenderFullScreen.cpp
@@ -64,7 +64,7 @@ PassRefPtr<RenderStyle> RenderFullScreen::createFullScreenStyle()
     
     fullscreenStyle->setBackgroundColor(Color::black);
     
-    return fullscreenStyle;
+    return fullscreenStyle.release();
 }
 
 #endif
diff --git a/Source/WebCore/rendering/RenderInline.cpp b/Source/WebCore/rendering/RenderInline.cpp
index 234d63c..3a27307 100644
--- a/Source/WebCore/rendering/RenderInline.cpp
+++ b/Source/WebCore/rendering/RenderInline.cpp
@@ -201,8 +201,7 @@ void RenderInline::addChildIgnoringContinuation(RenderObject* newChild, RenderOb
         // inline into continuations.  This involves creating an anonymous block box to hold
         // |newChild|.  We then make that block box a continuation of this inline.  We take all of
         // the children after |beforeChild| and put them in a clone of this object.
-        RefPtr<RenderStyle> newStyle = RenderStyle::create();
-        newStyle->inheritFrom(style());
+        RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
         newStyle->setDisplay(BLOCK);
 
         RenderBlock* newBox = new (renderArena()) RenderBlock(document() /* anonymous box */);
@@ -485,29 +484,21 @@ static int computeMargin(const RenderInline* renderer, const Length& margin)
 
 int RenderInline::marginLeft() const
 {
-    if (!style()->isHorizontalWritingMode())
-        return 0;
     return computeMargin(this, style()->marginLeft());
 }
 
 int RenderInline::marginRight() const
 {
-    if (!style()->isHorizontalWritingMode())
-        return 0;
     return computeMargin(this, style()->marginRight());
 }
 
 int RenderInline::marginTop() const
 {
-    if (style()->isHorizontalWritingMode())
-        return 0;
     return computeMargin(this, style()->marginTop());
 }
 
 int RenderInline::marginBottom() const
 {
-    if (style()->isHorizontalWritingMode())
-        return 0;
     return computeMargin(this, style()->marginBottom());
 }
 
@@ -521,6 +512,16 @@ int RenderInline::marginEnd() const
     return computeMargin(this, style()->marginEnd());
 }
 
+int RenderInline::marginBefore() const
+{
+    return computeMargin(this, style()->marginBefore());
+}
+
+int RenderInline::marginAfter() const
+{
+    return computeMargin(this, style()->marginAfter());
+}
+
 const char* RenderInline::renderName() const
 {
     if (isRelPositioned())
diff --git a/Source/WebCore/rendering/RenderInline.h b/Source/WebCore/rendering/RenderInline.h
index 18b4a3c..08ac002 100644
--- a/Source/WebCore/rendering/RenderInline.h
+++ b/Source/WebCore/rendering/RenderInline.h
@@ -42,8 +42,8 @@ public:
     virtual int marginRight() const;
     virtual int marginTop() const;
     virtual int marginBottom() const;
-    virtual int marginBefore() const { return 0; }
-    virtual int marginAfter() const { return 0; }
+    virtual int marginBefore() const;
+    virtual int marginAfter() const;
     virtual int marginStart() const;
     virtual int marginEnd() const;
 
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index bc0d440..1c60500 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -178,9 +178,13 @@ RenderLayer::RenderLayer(RenderBoxModelObject* renderer)
     , m_hasCompositingDescendant(false)
     , m_mustOverlapCompositedLayers(false)
 #endif
+<<<<<<< HEAD
 #if ENABLE(ANDROID_OVERFLOW_SCROLL)
     , m_hasOverflowScroll(false)
 #endif
+=======
+    , m_containsDirtyOverlayScrollbars(false)
+>>>>>>> webkit.org at r82507
     , m_marquee(0)
     , m_staticInlinePosition(0)
     , m_staticBlockPosition(0)
@@ -194,6 +198,13 @@ RenderLayer::RenderLayer(RenderBoxModelObject* renderer)
         m_visibleContentStatusDirty = false;
         m_hasVisibleContent = renderer->style()->visibility() == VISIBLE;
     }
+
+    if (Frame* frame = renderer->frame()) {
+        if (Page* page = frame->page()) {
+            m_page = page;
+            m_page->addScrollableArea(this);
+        }
+    }
 }
 
 RenderLayer::~RenderLayer()
@@ -203,6 +214,9 @@ RenderLayer::~RenderLayer()
             frame->eventHandler()->resizeLayerDestroyed();
     }
 
+    if (m_page)
+        m_page->removeScrollableArea(this);
+
     destroyScrollbar(HorizontalScrollbar);
     destroyScrollbar(VerticalScrollbar);
 
@@ -268,19 +282,6 @@ bool RenderLayer::canRender3DTransforms() const
 
 void RenderLayer::updateLayerPositions(UpdateLayerPositionsFlags flags, IntPoint* cachedOffset)
 {
-    if (flags & DoFullRepaint) {
-        renderer()->repaint();
-#if USE(ACCELERATED_COMPOSITING)
-        flags &= ~CheckForRepaint;
-        // We need the full repaint to propagate to child layers if we are hardware compositing.
-        if (!compositor()->inCompositingMode())
-            flags &= ~DoFullRepaint;
-#else
-        flags &= ~(CheckForRepaint | DoFullRepaint);
-#endif
-    }
-    
-
     updateLayerPosition(); // For relpositioned layers or non-positioned layers,
                            // we need to keep in sync, since we may have shifted relative
                            // to our parent layer.
@@ -1121,6 +1122,7 @@ void RenderLayer::removeOnlyThisLayer()
         RenderLayer* next = current->nextSibling();
         removeChild(current);
         parent->addChild(current, nextSib);
+        current->setNeedsFullRepaint();
         current->updateLayerPositions(); // Depends on hasLayer() already being false for proper layout.
         current = next;
     }
@@ -1806,6 +1808,19 @@ int RenderLayer::visibleWidth() const
     return m_width;
 }
 
+bool RenderLayer::shouldSuspendScrollAnimations() const
+{
+    RenderView* view = renderer()->view();
+    if (!view)
+        return true;
+    return view->frameView()->shouldSuspendScrollAnimations();
+}
+
+IntPoint RenderLayer::currentMousePosition() const
+{
+    return renderer()->frame() ? renderer()->frame()->eventHandler()->currentMousePosition() : IntPoint();
+}
+
 IntSize RenderLayer::scrollbarOffset(const Scrollbar* scrollbar) const
 {
     RenderBox* box = renderBox();
@@ -1915,16 +1930,16 @@ void RenderLayer::setHasVerticalScrollbar(bool hasScrollbar)
 #endif
 }
 
-int RenderLayer::verticalScrollbarWidth() const
+int RenderLayer::verticalScrollbarWidth(OverlayScrollbarSizeRelevancy relevancy) const
 {
-    if (!m_vBar || m_vBar->isOverlayScrollbar())
+    if (!m_vBar || (m_vBar->isOverlayScrollbar() && relevancy == IgnoreOverlayScrollbarSize))
         return 0;
     return m_vBar->width();
 }
 
-int RenderLayer::horizontalScrollbarHeight() const
+int RenderLayer::horizontalScrollbarHeight(OverlayScrollbarSizeRelevancy relevancy) const
 {
-    if (!m_hBar || m_hBar->isOverlayScrollbar())
+    if (!m_hBar || (m_hBar->isOverlayScrollbar() && relevancy == IgnoreOverlayScrollbarSize))
         return 0;
     return m_hBar->height();
 }
@@ -2214,16 +2229,36 @@ void RenderLayer::updateScrollInfoAfterLayout()
 #endif
 }
 
-void RenderLayer::paintOverflowControls(GraphicsContext* context, int tx, int ty, const IntRect& damageRect)
+void RenderLayer::paintOverflowControls(GraphicsContext* context, int tx, int ty, const IntRect& damageRect, bool paintingOverlayControls)
 {
     // Don't do anything if we have no overflow.
     if (!renderer()->hasOverflowClip())
         return;
-    
+
+    // Overlay scrollbars paint in a second pass through the layer tree so that they will paint
+    // on top of everything else. If this is the normal painting pass, paintingOverlayControls
+    // will be false, and we should just tell the root layer that there are overlay scrollbars
+    // that need to be painted. That will cause the second pass through the layer tree to run,
+    // and we'll paint the scrollbars then. In the meantime, cache tx and ty so that the 
+    // second pass doesn't need to re-enter the RenderTree to get it right.
+    if (hasOverlayScrollbars() && !paintingOverlayControls) {
+        RenderLayer* rootLayer = renderer()->view()->layer();
+        rootLayer->setContainsDirtyOverlayScrollbars(true);
+        m_cachedOverlayScrollbarOffset = IntPoint(tx, ty);
+        return;
+    }
+
+    int offsetX = tx;
+    int offsetY = ty;
+    if (paintingOverlayControls) {
+        offsetX = m_cachedOverlayScrollbarOffset.x();
+        offsetY = m_cachedOverlayScrollbarOffset.y();
+    }
+
     // Move the scrollbar widgets if necessary.  We normally move and resize widgets during layout, but sometimes
     // widgets can move without layout occurring (most notably when you scroll a document that
     // contains fixed positioned elements).
-    positionOverflowControls(tx, ty);
+    positionOverflowControls(offsetX, offsetY);
 
     // Now that we're sure the scrollbars are in the right place, paint them.
     if (m_hBar)
@@ -2233,10 +2268,10 @@ void RenderLayer::paintOverflowControls(GraphicsContext* context, int tx, int ty
 
     // We fill our scroll corner with white if we have a scrollbar that doesn't run all the way up to the
     // edge of the box.
-    paintScrollCorner(context, tx, ty, damageRect);
+    paintScrollCorner(context, offsetX, offsetY, damageRect);
     
     // Paint our resizer last, since it sits on top of the scroll corner.
-    paintResizer(context, tx, ty, damageRect);
+    paintResizer(context, offsetX, offsetY, damageRect);
 }
 
 void RenderLayer::paintScrollCorner(GraphicsContext* context, int tx, int ty, const IntRect& damageRect)
@@ -2258,8 +2293,11 @@ void RenderLayer::paintScrollCorner(GraphicsContext* context, int tx, int ty, co
         m_scrollCorner->paintIntoRect(context, tx, ty, absRect);
         return;
     }
-    
-    context->fillRect(absRect, Color::white, box->style()->colorSpace());
+
+    // We don't want to paint white if we have overlay scrollbars, since we need
+    // to see what is behind it.
+    if (!hasOverlayScrollbars())
+        context->fillRect(absRect, Color::white, box->style()->colorSpace());
 }
 
 void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const IntRect& damageRect)
@@ -2376,6 +2414,15 @@ void RenderLayer::paint(GraphicsContext* p, const IntRect& damageRect, PaintBeha
         it->first->setOverlapTestResult(false);
 }
 
+void RenderLayer::paintOverlayScrollbars(GraphicsContext* p, const IntRect& damageRect, PaintBehavior paintBehavior, RenderObject *paintingRoot)
+{
+    if (!m_containsDirtyOverlayScrollbars)
+        return;
+    paintLayer(this, p, damageRect, paintBehavior, paintingRoot, 0, PaintLayerHaveTransparency | PaintLayerTemporaryClipRects 
+               | PaintLayerPaintingOverlayScrollbars);
+    m_containsDirtyOverlayScrollbars = false;
+}
+
 static void setClip(GraphicsContext* p, const IntRect& paintDirtyRect, const IntRect& clipRect)
 {
     if (paintDirtyRect == clipRect)
@@ -2526,9 +2573,11 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     if (overlapTestRequests && isSelfPaintingLayer())
         performOverlapTests(*overlapTestRequests, rootLayer, this);
 
+    bool paintingOverlayScrollbars = paintFlags & PaintLayerPaintingOverlayScrollbars;
+
     // We want to paint our layer, but only if we intersect the damage rect.
     bool shouldPaint = intersectsDamageRect(layerBounds, damageRect, rootLayer) && m_hasVisibleContent && isSelfPaintingLayer();
-    if (shouldPaint && !selectionOnly && !damageRect.isEmpty()) {
+    if (shouldPaint && !selectionOnly && !damageRect.isEmpty() && !paintingOverlayScrollbars) {
         // Begin transparency layers lazily now that we know we have to paint something.
         if (haveTransparency)
             beginTransparencyLayers(p, rootLayer, paintBehavior);
@@ -2549,7 +2598,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     paintList(m_negZOrderList, rootLayer, p, paintDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, localPaintFlags);
 
     // Now establish the appropriate clip and paint our child RenderObjects.
-    if (shouldPaint && !clipRectToApply.isEmpty()) {
+    if (shouldPaint && !clipRectToApply.isEmpty() && !paintingOverlayScrollbars) {
         // Begin transparency layers lazily now that we know we have to paint something.
         if (haveTransparency)
             beginTransparencyLayers(p, rootLayer, paintBehavior);
@@ -2574,7 +2623,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
         restoreClip(p, paintDirtyRect, clipRectToApply);
     }
     
-    if (!outlineRect.isEmpty() && isSelfPaintingLayer()) {
+    if (!outlineRect.isEmpty() && isSelfPaintingLayer() && !paintingOverlayScrollbars) {
         // Paint our own outline
         PaintInfo paintInfo(p, outlineRect, PaintPhaseSelfOutline, false, paintingRootForRenderer, 0);
         setClip(p, paintDirtyRect, outlineRect);
@@ -2588,7 +2637,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     // Now walk the sorted list of children with positive z-indices.
     paintList(m_posZOrderList, rootLayer, p, paintDirtyRect, paintBehavior, paintingRoot, overlapTestRequests, localPaintFlags);
         
-    if (renderer()->hasMask() && shouldPaint && !selectionOnly && !damageRect.isEmpty()) {
+    if (renderer()->hasMask() && shouldPaint && !selectionOnly && !damageRect.isEmpty() && !paintingOverlayScrollbars) {
         setClip(p, paintDirtyRect, damageRect);
 
         // Paint the mask.
@@ -2599,6 +2648,12 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
         restoreClip(p, paintDirtyRect, damageRect);
     }
 
+    if (paintingOverlayScrollbars) {
+        setClip(p, paintDirtyRect, damageRect);
+        paintOverflowControls(p, tx, ty, damageRect, true);
+        restoreClip(p, paintDirtyRect, damageRect);
+    }
+
     // End our transparency layer
     if (haveTransparency && m_usedTransparency && !m_paintingInsideReflection) {
         p->endTransparencyLayer();
diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h
index 7dddbc8..d2d41df 100644
--- a/Source/WebCore/rendering/RenderLayer.h
+++ b/Source/WebCore/rendering/RenderLayer.h
@@ -282,8 +282,8 @@ public:
     Scrollbar* horizontalScrollbar() const { return m_hBar.get(); }
     Scrollbar* verticalScrollbar() const { return m_vBar.get(); }
 
-    int verticalScrollbarWidth() const;
-    int horizontalScrollbarHeight() const;
+    int verticalScrollbarWidth(OverlayScrollbarSizeRelevancy relevancy = IgnoreOverlayScrollbarSize) const;
+    int horizontalScrollbarHeight(OverlayScrollbarSizeRelevancy relevancy = IgnoreOverlayScrollbarSize) const;
 
     bool hasOverflowControls() const;
 #if ENABLE(ANDROID_OVERFLOW_SCROLL)
@@ -295,7 +295,7 @@ public:
     bool hitTestOverflowControls(HitTestResult&, const IntPoint& localPoint);
     IntSize offsetFromResizeCorner(const IntPoint& absolutePoint) const;
 
-    void paintOverflowControls(GraphicsContext*, int tx, int ty, const IntRect& damageRect);
+    void paintOverflowControls(GraphicsContext*, int tx, int ty, const IntRect& damageRect, bool paintingOverlayControls = false);
     void paintScrollCorner(GraphicsContext*, int tx, int ty, const IntRect& damageRect);
     void paintResizer(GraphicsContext*, int tx, int ty, const IntRect& damageRect);
 
@@ -327,14 +327,13 @@ public:
     void updateLayerPosition();
     
     enum UpdateLayerPositionsFlag {
-        DoFullRepaint = 1,
-        CheckForRepaint = 1 << 1,
-        IsCompositingUpdateRoot = 1 << 2,
-        UpdateCompositingLayers = 1 << 3,
-        UpdatePagination = 1 << 4
+        CheckForRepaint = 1,
+        IsCompositingUpdateRoot = 1 << 1,
+        UpdateCompositingLayers = 1 << 2,
+        UpdatePagination = 1 << 3
     };
     typedef unsigned UpdateLayerPositionsFlags;
-    void updateLayerPositions(UpdateLayerPositionsFlags = DoFullRepaint | IsCompositingUpdateRoot | UpdateCompositingLayers, IntPoint* cachedOffset = 0);
+    void updateLayerPositions(UpdateLayerPositionsFlags = CheckForRepaint | IsCompositingUpdateRoot | UpdateCompositingLayers, IntPoint* cachedOffset = 0);
 
     void updateTransform();
 
@@ -409,6 +408,7 @@ public:
     // layers that intersect the point from front to back.
     void paint(GraphicsContext*, const IntRect& damageRect, PaintBehavior = PaintBehaviorNormal, RenderObject* paintingRoot = 0);
     bool hitTest(const HitTestRequest&, HitTestResult&);
+    void paintOverlayScrollbars(GraphicsContext*, const IntRect& damageRect, PaintBehavior, RenderObject* paintingRoot);
 
     // This method figures out our layerBounds in coordinates relative to
     // |rootLayer}.  It also computes our background and foreground clip rects
@@ -491,6 +491,9 @@ public:
 
     bool paintsWithTransform(PaintBehavior) const;
 
+    bool containsDirtyOverlayScrollbars() const { return m_containsDirtyOverlayScrollbars; }
+    void setContainsDirtyOverlayScrollbars(bool dirtyScrollbars) { m_containsDirtyOverlayScrollbars = dirtyScrollbars; }
+
 private:
     // The normal operator new is disallowed on all render objects.
     void* operator new(size_t) throw();
@@ -513,7 +516,8 @@ private:
         PaintLayerHaveTransparency = 1,
         PaintLayerAppliedTransform = 1 << 1,
         PaintLayerTemporaryClipRects = 1 << 2,
-        PaintLayerPaintingReflection = 1 << 3
+        PaintLayerPaintingReflection = 1 << 3,
+        PaintLayerPaintingOverlayScrollbars = 1 << 4
     };
     
     typedef unsigned PaintLayerFlags;
@@ -573,6 +577,10 @@ private:
     virtual IntSize contentsSize() const;
     virtual int visibleHeight() const;
     virtual int visibleWidth() const;
+    virtual IntPoint currentMousePosition() const;
+    virtual bool shouldSuspendScrollAnimations() const;
+
+    virtual void disconnectFromPage() { m_page = 0; }
 
     // NOTE: This should only be called by the overriden setScrollOffset from ScrollableArea.
     void scrollTo(int x, int y);
@@ -666,18 +674,6 @@ protected:
     int m_scrollX;
     int m_scrollY;
     
-    // There are 8 possible combinations of writing mode and direction.  Scroll origin (and its corresponding left/top overflow)
-    // will be non-zero in the x or y axis if there is any reversed direction or writing-mode.  The combinations are:
-    // writing-mode / direction     scrollOrigin.x() set    scrollOrigin.y() set
-    // horizontal-tb / ltr          NO                      NO
-    // horizontal-tb / rtl          YES                     NO
-    // horizontal-bt / ltr          NO                      YES
-    // horizontal-bt / rtl          YES                     YES
-    // vertical-lr / ltr            NO                      NO
-    // vertical-lr / rtl            NO                      YES
-    // vertical-rl / ltr            YES                     NO
-    // vertical-rl / rtl            YES                     YES
-    IntPoint m_scrollOrigin;
     int m_scrollLeftOverflow;
     int m_scrollTopOverflow;
     
@@ -741,6 +737,10 @@ protected:
     bool m_hasOverflowScroll : 1;
 #endif
 
+    bool m_containsDirtyOverlayScrollbars : 1;
+
+    IntPoint m_cachedOverlayScrollbarOffset;
+
     RenderMarquee* m_marquee; // Used by layers with overflow:marquee
     
     // Cached normal flow values for absolute positioned elements with static left/top values.
@@ -762,6 +762,8 @@ private:
 #if USE(ACCELERATED_COMPOSITING)
     OwnPtr<RenderLayerBacking> m_backing;
 #endif
+
+    Page* m_page;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderLayerBacking.cpp b/Source/WebCore/rendering/RenderLayerBacking.cpp
index bda34ee..ec3b6fd 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.cpp
+++ b/Source/WebCore/rendering/RenderLayerBacking.cpp
@@ -380,6 +380,7 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     
     IntSize oldOffsetFromRenderer = m_graphicsLayer->offsetFromRenderer();
     m_graphicsLayer->setOffsetFromRenderer(localCompositingBounds.location() - IntPoint());
+    
     // If the compositing layer offset changes, we need to repaint.
     if (oldOffsetFromRenderer != m_graphicsLayer->offsetFromRenderer())
         m_graphicsLayer->setNeedsDisplay();
@@ -449,10 +450,9 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
         FloatPoint foregroundPosition;
         FloatSize foregroundSize = newSize;
         IntSize foregroundOffset = m_graphicsLayer->offsetFromRenderer();
-        // If we have a clipping layer (which clips descendants), then the foreground layer is a child of it,
-        // so that it gets correctly sorted with children. In that case, position relative to the clipping layer.
         if (m_clippingLayer) {
-            foregroundPosition = FloatPoint() + (localCompositingBounds.location() - clippingBox.location());
+            // If we have a clipping layer (which clips descendants), then the foreground layer is a child of it,
+            // so that it gets correctly sorted with children. In that case, position relative to the clipping layer.
             foregroundSize = FloatSize(clippingBox.size());
             foregroundOffset = clippingBox.location() - IntPoint();
         }
@@ -930,18 +930,6 @@ IntRect RenderLayerBacking::contentsBox() const
     return contentsRect;
 }
 
-// Map the given point from coordinates in the GraphicsLayer to RenderLayer coordinates.
-FloatPoint RenderLayerBacking::graphicsLayerToContentsCoordinates(const GraphicsLayer* graphicsLayer, const FloatPoint& point)
-{
-    return point + FloatSize(graphicsLayer->offsetFromRenderer());
-}
-
-// Map the given point from coordinates in the RenderLayer to GraphicsLayer coordinates.
-FloatPoint RenderLayerBacking::contentsToGraphicsLayerCoordinates(const GraphicsLayer* graphicsLayer, const FloatPoint& point)
-{
-    return point - FloatSize(graphicsLayer->offsetFromRenderer());
-}
-
 bool RenderLayerBacking::paintingGoesToWindow() const
 {
     if (m_owningLayer->isRootLayer())
@@ -966,21 +954,21 @@ void RenderLayerBacking::setContentsNeedDisplay()
 void RenderLayerBacking::setContentsNeedDisplayInRect(const IntRect& r)
 {
     if (m_graphicsLayer && m_graphicsLayer->drawsContent()) {
-        FloatPoint dirtyOrigin = contentsToGraphicsLayerCoordinates(m_graphicsLayer.get(), FloatPoint(r.x(), r.y()));
-        FloatRect dirtyRect(dirtyOrigin, r.size());
-        FloatRect bounds(FloatPoint(), m_graphicsLayer->size());
-        if (bounds.intersects(dirtyRect))
-            m_graphicsLayer->setNeedsDisplayInRect(dirtyRect);
+        IntRect layerDirtyRect = r;
+        layerDirtyRect.move(-m_graphicsLayer->offsetFromRenderer());
+        m_graphicsLayer->setNeedsDisplayInRect(layerDirtyRect);
     }
 
     if (m_foregroundLayer && m_foregroundLayer->drawsContent()) {
-        // FIXME: do incremental repaint
-        m_foregroundLayer->setNeedsDisplay();
+        IntRect layerDirtyRect = r;
+        layerDirtyRect.move(-m_foregroundLayer->offsetFromRenderer());
+        m_foregroundLayer->setNeedsDisplayInRect(layerDirtyRect);
     }
 
     if (m_maskLayer && m_maskLayer->drawsContent()) {
-        // FIXME: do incremental repaint
-        m_maskLayer->setNeedsDisplay();
+        IntRect layerDirtyRect = r;
+        layerDirtyRect.move(-m_maskLayer->offsetFromRenderer());
+        m_maskLayer->setNeedsDisplayInRect(layerDirtyRect);
     }
 }
 
@@ -1123,10 +1111,11 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
 }
 
 // Up-call from compositing layer drawing callback.
-void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const IntRect& clip)
+void RenderLayerBacking::paintContents(const GraphicsLayer* graphicsLayer, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const IntRect& clip)
 {
     InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_owningLayer->renderer()->frame(), clip);
 
+<<<<<<< HEAD
     // We have to use the same root as for hit testing, because both methods
     // can compute and cache clipRects.
     IntRect enclosingBBox = compositedBounds();
@@ -1136,19 +1125,19 @@ void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& co
     if (m_owningLayer->hasOverflowParent())
         enclosingBBox.setSize(clip.size());
 #endif
+=======
+    IntSize offset = graphicsLayer->offsetFromRenderer();
+    context.translate(-offset);
+>>>>>>> webkit.org at r82507
 
     IntRect clipRect(clip);
-    
-    // Set up the coordinate space to be in the layer's rendering coordinates.
-    context.translate(-enclosingBBox.x(), -enclosingBBox.y());
-
-    // Offset the clip.
-    clipRect.move(enclosingBBox.x(), enclosingBBox.y());
+    clipRect.move(offset);
     
     // The dirtyRect is in the coords of the painting root.
-    IntRect dirtyRect = enclosingBBox;
+    IntRect dirtyRect = compositedBounds();
     dirtyRect.intersect(clipRect);
 
+    // We have to use the same root as for hit testing, because both methods can compute and cache clipRects.
     paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintBehaviorNormal, paintingPhase, renderer());
 
     InspectorInstrumentation::didPaint(cookie);
diff --git a/Source/WebCore/rendering/RenderLayerBacking.h b/Source/WebCore/rendering/RenderLayerBacking.h
index 726b777..8f0927d 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.h
+++ b/Source/WebCore/rendering/RenderLayerBacking.h
@@ -123,9 +123,6 @@ public:
     
     void updateAfterWidgetResize();
 
-    FloatPoint graphicsLayerToContentsCoordinates(const GraphicsLayer*, const FloatPoint&);
-    FloatPoint contentsToGraphicsLayerCoordinates(const GraphicsLayer*, const FloatPoint&);
-
     // GraphicsLayerClient interface
     virtual void notifyAnimationStarted(const GraphicsLayer*, double startTime);
     virtual void notifySyncRequired(const GraphicsLayer*);
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.cpp b/Source/WebCore/rendering/RenderLayerCompositor.cpp
index 4ab274f..6542ffd 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/Source/WebCore/rendering/RenderLayerCompositor.cpp
@@ -109,11 +109,22 @@ RenderLayerCompositor::RenderLayerCompositor(RenderView* renderView)
     , m_compositing(false)
     , m_compositingLayersNeedRebuild(false)
     , m_flushingLayers(false)
+    , m_forceCompositingMode(false)
     , m_rootLayerAttachment(RootLayerUnattached)
 #if PROFILE_LAYER_REBUILD
     , m_rootLayerUpdateCount(0)
 #endif // PROFILE_LAYER_REBUILD
 {
+    Settings* settings = m_renderView->document()->settings();
+
+    // Even when forcing compositing mode, ignore child frames, or this will trigger
+    // layer creation from the enclosing RenderIFrame.
+    ASSERT(m_renderView->document()->frame());
+    if (settings && settings->forceCompositingMode() && settings->acceleratedCompositingEnabled()
+        && !m_renderView->document()->frame()->tree()->parent()) {
+        m_forceCompositingMode = true;
+        enableCompositingMode();
+    }
 }
 
 RenderLayerCompositor::~RenderLayerCompositor()
@@ -439,7 +450,7 @@ IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* laye
     if (layer->renderer()->isRoot()) {
         // If the root layer becomes composited (e.g. because some descendant with negative z-index is composited),
         // then it has to be big enough to cover the viewport in order to display the background. This is akin
-        // to the code in RenderBox::paintRootBoxDecorations().
+        // to the code in RenderBox::paintRootBoxFillLayers().
         if (m_renderView->frameView()) {
             int rw = m_renderView->frameView()->contentsWidth();
             int rh = m_renderView->frameView()->contentsHeight();
@@ -770,7 +781,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
 
     // If we're back at the root, and no other layers need to be composited, and the root layer itself doesn't need
     // to be composited, then we can drop out of compositing mode altogether.
-    if (layer->isRootLayer() && !childState.m_subtreeIsCompositing && !requiresCompositingLayer(layer)) {
+    if (layer->isRootLayer() && !childState.m_subtreeIsCompositing && !requiresCompositingLayer(layer) && !m_forceCompositingMode) {
         enableCompositingMode(false);
         willBeComposited = false;
     }
@@ -939,7 +950,7 @@ void RenderLayerCompositor::frameViewDidScroll(const IntPoint& scrollPosition)
         m_scrollLayer->setPosition(FloatPoint(-scrollPosition.x(), -scrollPosition.y()));
 }
 
-String RenderLayerCompositor::layerTreeAsText()
+String RenderLayerCompositor::layerTreeAsText(bool showDebugInfo)
 {
     if (compositingLayerUpdatePending())
         updateCompositingLayers();
@@ -949,7 +960,7 @@ String RenderLayerCompositor::layerTreeAsText()
 
     // We skip dumping the scroll and clip layers to keep layerTreeAsText output
     // similar between platforms.
-    return m_rootPlatformLayer->layerTreeAsText();
+    return m_rootPlatformLayer->layerTreeAsText(showDebugInfo ? LayerTreeAsTextDebug : LayerTreeAsTextBehaviorNormal);
 }
 
 RenderLayerCompositor* RenderLayerCompositor::iframeContentsCompositor(RenderIFrame* renderer)
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.h b/Source/WebCore/rendering/RenderLayerCompositor.h
index 1cf9ea9..c3deb3f 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.h
+++ b/Source/WebCore/rendering/RenderLayerCompositor.h
@@ -175,7 +175,7 @@ public:
     void frameViewDidChangeSize(const IntPoint& contentsOffset = IntPoint());
     void frameViewDidScroll(const IntPoint& = IntPoint());
 
-    String layerTreeAsText();
+    String layerTreeAsText(bool showDebugInfo = false);
 
     // These are named to avoid conflicts with the functions in GraphicsLayerClient
     // These return the actual internal variables.
@@ -277,6 +277,7 @@ private:
     bool m_compositing;
     bool m_compositingLayersNeedRebuild;
     bool m_flushingLayers;
+    bool m_forceCompositingMode;
 
     RootLayerAttachment m_rootLayerAttachment;
 
diff --git a/Source/WebCore/rendering/RenderListBox.cpp b/Source/WebCore/rendering/RenderListBox.cpp
index 4457285..ab3a832 100644
--- a/Source/WebCore/rendering/RenderListBox.cpp
+++ b/Source/WebCore/rendering/RenderListBox.cpp
@@ -82,11 +82,17 @@ RenderListBox::RenderListBox(Element* element)
     , m_optionsWidth(0)
     , m_indexOffset(0)
 {
+    if (Page* page = frame()->page()) {
+        m_page = page;
+        m_page->addScrollableArea(this);
+    }
 }
 
 RenderListBox::~RenderListBox()
 {
     setHasVerticalScrollbar(false);
+    if (m_page)
+        m_page->removeScrollableArea(this);
 }
 
 void RenderListBox::updateFromElement()
@@ -316,6 +322,25 @@ void RenderListBox::paintScrollbar(PaintInfo& paintInfo, int tx, int ty)
     }
 }
 
+static IntSize itemOffsetForAlignment(TextRun textRun, RenderStyle* itemStyle, Font itemFont, IntRect itemBoudingBox)
+{
+    ETextAlign actualAlignment = itemStyle->textAlign();
+    // FIXME: Firefox doesn't respect JUSTIFY. Should we?
+    if (actualAlignment == TAAUTO || actualAlignment == JUSTIFY)
+      actualAlignment = itemStyle->isLeftToRightDirection() ? LEFT : RIGHT;
+
+    IntSize offset = IntSize(0, itemFont.fontMetrics().ascent());
+    if (actualAlignment == RIGHT || actualAlignment == WEBKIT_RIGHT) {
+        float textWidth = itemFont.width(textRun);
+        offset.setWidth(itemBoudingBox.width() - textWidth - optionsSpacingHorizontal);
+    } else if (actualAlignment == CENTER || actualAlignment == WEBKIT_CENTER) {
+        float textWidth = itemFont.width(textRun);
+        offset.setWidth((itemBoudingBox.width() - textWidth) / 2);
+    } else
+        offset.setWidth(optionsSpacingHorizontal);
+    return offset;
+}
+
 void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, int listIndex)
 {
     SelectElement* select = toSelectElement(static_cast<Element*>(node()));
@@ -323,19 +348,18 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, in
     Element* element = listItems[listIndex];
     OptionElement* optionElement = toOptionElement(element);
 
+    RenderStyle* itemStyle = element->renderStyle();
+    if (!itemStyle)
+        itemStyle = style();
+
+    if (itemStyle->visibility() == HIDDEN)
+        return;
+
     String itemText;
     if (optionElement)
         itemText = optionElement->textIndentedToRespectGroupLabel();
     else if (OptionGroupElement* optionGroupElement = toOptionGroupElement(element))
-        itemText = optionGroupElement->groupLabelText();      
-
-    // Determine where the item text should be placed
-    IntRect r = itemBoundingBoxRect(tx, ty, listIndex);
-    r.move(optionsSpacingHorizontal, style()->fontMetrics().ascent());
-
-    RenderStyle* itemStyle = element->renderStyle();
-    if (!itemStyle)
-        itemStyle = style();
+        itemText = optionGroupElement->groupLabelText();
     
     Color textColor = element->renderStyle() ? element->renderStyle()->visitedDependentColor(CSSPropertyColor) : style()->visitedDependentColor(CSSPropertyColor);
     if (optionElement && optionElement->selected()) {
@@ -349,7 +373,13 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, in
     ColorSpace colorSpace = itemStyle->colorSpace();
     paintInfo.context->setFillColor(textColor, colorSpace);
 
+    unsigned length = itemText.length();
+    const UChar* string = itemText.characters();
+    TextRun textRun(string, length, false, 0, 0, TextRun::AllowTrailingExpansion, !itemStyle->isLeftToRightDirection(), itemStyle->unicodeBidi() == Override);
     Font itemFont = style()->font();
+    IntRect r = itemBoundingBoxRect(tx, ty, listIndex);
+    r.move(itemOffsetForAlignment(textRun, itemStyle, itemFont, r));
+
     if (isOptionGroupElement(element)) {
         FontDescription d = itemFont.fontDescription();
         d.setWeight(d.bolderWeight());
@@ -357,10 +387,6 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, in
         itemFont.update(document()->styleSelector()->fontSelector());
     }
 
-    unsigned length = itemText.length();
-    const UChar* string = itemText.characters();
-    TextRun textRun(string, length, false, 0, 0, TextRun::AllowTrailingExpansion, !itemStyle->isLeftToRightDirection(), itemStyle->unicodeBidi() == Override);
-
     // Draw the item text
     if (itemStyle->visibility() != HIDDEN)
         paintInfo.context->drawBidiText(itemFont, textRun, r.location());
@@ -747,6 +773,14 @@ IntPoint RenderListBox::currentMousePosition() const
     return view->frameView()->currentMousePosition();
 }
 
+bool RenderListBox::shouldSuspendScrollAnimations() const
+{
+    RenderView* view = this->view();
+    if (!view)
+        return true;
+    return view->frameView()->shouldSuspendScrollAnimations();
+}
+
 PassRefPtr<Scrollbar> RenderListBox::createScrollbar()
 {
     RefPtr<Scrollbar> widget;
diff --git a/Source/WebCore/rendering/RenderListBox.h b/Source/WebCore/rendering/RenderListBox.h
index faeede1..0e2cfd6 100644
--- a/Source/WebCore/rendering/RenderListBox.h
+++ b/Source/WebCore/rendering/RenderListBox.h
@@ -112,6 +112,9 @@ private:
     virtual int visibleHeight() const;
     virtual int visibleWidth() const;
     virtual IntPoint currentMousePosition() const;
+    virtual bool shouldSuspendScrollAnimations() const;
+
+    virtual void disconnectFromPage() { m_page = 0; }
 
     // NOTE: This should only be called by the overriden setScrollOffset from ScrollableArea.
     void scrollTo(int newOffset);
@@ -138,6 +141,8 @@ private:
     int m_indexOffset;
 
     RefPtr<Scrollbar> m_vBar;
+
+    Page* m_page;
 };
 
 inline RenderListBox* toRenderListBox(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderMedia.cpp b/Source/WebCore/rendering/RenderMedia.cpp
index bbb5880..69d71ec 100644
--- a/Source/WebCore/rendering/RenderMedia.cpp
+++ b/Source/WebCore/rendering/RenderMedia.cpp
@@ -89,8 +89,6 @@ void RenderMedia::layout()
     // and this method will be called many times per second during playback, use a LayoutStateMaintainer:
     LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
 
-    m_controls->updateTimeDisplayVisibility();
-
     controlsRenderer->setLocation(borderLeft() + paddingLeft(), borderTop() + paddingTop());
     controlsRenderer->style()->setHeight(Length(newSize.height(), Fixed));
     controlsRenderer->style()->setWidth(Length(newSize.width(), Fixed));
diff --git a/Source/WebCore/rendering/RenderMenuList.cpp b/Source/WebCore/rendering/RenderMenuList.cpp
index 8c11959..f155614 100644
--- a/Source/WebCore/rendering/RenderMenuList.cpp
+++ b/Source/WebCore/rendering/RenderMenuList.cpp
@@ -110,6 +110,7 @@ void RenderMenuList::addChild(RenderObject* newChild, RenderObject* beforeChild)
 {
     createInnerBlock();
     m_innerBlock->addChild(newChild, beforeChild);
+    ASSERT(m_innerBlock == firstChild());
 }
 
 void RenderMenuList::removeChild(RenderObject* oldChild)
diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
index d06db14..7cc6f1f 100644
--- a/Source/WebCore/rendering/RenderObject.cpp
+++ b/Source/WebCore/rendering/RenderObject.cpp
@@ -194,6 +194,7 @@ RenderObject::RenderObject(Node* node)
     , m_needsPositionedMovementLayout(false)
     , m_normalChildNeedsLayout(false)
     , m_posChildNeedsLayout(false)
+    , m_needsSimplifiedNormalFlowLayout(false)
     , m_preferredLogicalWidthsDirty(false)
     , m_floating(false)
     , m_positioned(false)
@@ -204,6 +205,7 @@ RenderObject::RenderObject(Node* node)
     , m_isBox(false)
     , m_inline(true)
     , m_replaced(false)
+    , m_horizontalWritingMode(true)
     , m_isDragging(false)
     , m_hasLayer(false)
     , m_hasOverflowClip(false)
@@ -218,7 +220,6 @@ RenderObject::RenderObject(Node* node)
     , m_hasMarkupTruncation(false)
     , m_selectionState(SelectionNone)
     , m_hasColumns(false)
-    , m_cellWidthChanged(false)
 {
 #ifndef NDEBUG
     renderObjectCounter.increment();
@@ -904,7 +905,7 @@ IntRect RenderObject::borderInnerRect(const IntRect& borderRect, unsigned short
 }
 
 #if HAVE(PATH_BASED_BORDER_RADIUS_DRAWING)
-void RenderObject::drawBoxSideFromPath(GraphicsContext* graphicsContext, IntRect borderRect, Path borderPath, 
+void RenderObject::drawBoxSideFromPath(GraphicsContext* graphicsContext, const IntRect& borderRect, const Path& borderPath,
                                     float thickness, float drawThickness, BoxSide s, const RenderStyle* style, 
                                     Color c, EBorderStyle borderStyle)
 {
@@ -1051,7 +1052,7 @@ void RenderObject::drawBoxSideFromPath(GraphicsContext* graphicsContext, IntRect
     graphicsContext->drawRect(borderRect);
 }
 #else
-void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, int y, float thickness, IntSize radius,
+void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, int y, float thickness, const IntSize& radius,
                                      int angleStart, int angleSpan, BoxSide s, Color c,
                                      EBorderStyle style, bool firstCorner)
 {
@@ -1689,9 +1690,12 @@ StyleDifference RenderObject::adjustStyleDifference(StyleDifference diff, unsign
         // Text nodes share style with their parents but transforms don't apply to them,
         // hence the !isText() check.
         // FIXME: when transforms are taken into account for overflow, we will need to do a layout.
-        if (!isText() && (!hasLayer() || !toRenderBoxModelObject(this)->layer()->isComposited()))
-            diff = StyleDifferenceLayout;
-        else if (diff < StyleDifferenceRecompositeLayer)
+        if (!isText() && (!hasLayer() || !toRenderBoxModelObject(this)->layer()->isComposited())) {
+            if (!hasLayer())
+                diff = StyleDifferenceLayout; // FIXME: Do this for now since SimplifiedLayout cannot handle updating floating objects lists.
+            else if (diff < StyleDifferenceSimplifiedLayout)
+                diff = StyleDifferenceSimplifiedLayout;
+        } else if (diff < StyleDifferenceRecompositeLayer)
             diff = StyleDifferenceRecompositeLayer;
     }
 
@@ -1770,6 +1774,8 @@ void RenderObject::setStyle(PassRefPtr<RenderStyle> style)
             setNeedsLayoutAndPrefWidthsRecalc();
         else if (updatedDiff == StyleDifferenceLayoutPositionedMovementOnly)
             setNeedsPositionedMovementLayout();
+        else if (updatedDiff == StyleDifferenceSimplifiedLayout)
+            setNeedsSimplifiedNormalFlowLayout();
     }
     
     if (updatedDiff == StyleDifferenceRepaintLayer || updatedDiff == StyleDifferenceRepaint) {
@@ -1835,6 +1841,7 @@ void RenderObject::styleWillChange(StyleDifference diff, const RenderStyle* newS
             m_positioned = false;
             m_relPositioned = false;
         }
+        m_horizontalWritingMode = true;
         m_paintBackground = false;
         m_hasOverflowClip = false;
         m_hasTransform = false;
@@ -1882,7 +1889,7 @@ void RenderObject::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
     if (!m_parent)
         return;
     
-    if (diff == StyleDifferenceLayout) {
+    if (diff == StyleDifferenceLayout || diff == StyleDifferenceSimplifiedLayout) {
         RenderCounter::rendererStyleChanged(this, oldStyle, m_style.get());
 
         // If the object already needs layout, then setNeedsLayout won't do
@@ -1893,7 +1900,10 @@ void RenderObject::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
         if (m_needsLayout && oldStyle->position() != m_style->position())
             markContainingBlocksForLayout();
 
-        setNeedsLayoutAndPrefWidthsRecalc();
+        if (diff == StyleDifferenceLayout)
+            setNeedsLayoutAndPrefWidthsRecalc();
+        else
+            setNeedsSimplifiedNormalFlowLayout();
     } else if (diff == StyleDifferenceLayoutPositionedMovementOnly)
         setNeedsPositionedMovementLayout();
 
@@ -1939,7 +1949,7 @@ IntRect RenderObject::viewRect() const
     return view()->viewRect();
 }
 
-FloatPoint RenderObject::localToAbsolute(FloatPoint localPoint, bool fixed, bool useTransforms) const
+FloatPoint RenderObject::localToAbsolute(const FloatPoint& localPoint, bool fixed, bool useTransforms) const
 {
     TransformState transformState(TransformState::ApplyTransformDirection, localPoint);
     mapLocalToContainer(0, fixed, useTransforms, transformState);
@@ -1948,7 +1958,7 @@ FloatPoint RenderObject::localToAbsolute(FloatPoint localPoint, bool fixed, bool
     return transformState.lastPlanarPoint();
 }
 
-FloatPoint RenderObject::absoluteToLocal(FloatPoint containerPoint, bool fixed, bool useTransforms) const
+FloatPoint RenderObject::absoluteToLocal(const FloatPoint& containerPoint, bool fixed, bool useTransforms) const
 {
     TransformState transformState(TransformState::UnapplyInverseTransformDirection, containerPoint);
     mapAbsoluteToLocalPoint(fixed, useTransforms, transformState);
@@ -2613,11 +2623,11 @@ RenderBoxModelObject* RenderObject::offsetParent() const
     //     * The computed value of the position property of A is static and the ancestor
     //       is one of the following HTML elements: td, th, or table.
     //     * Our own extension: if there is a difference in the effective zoom
+
     bool skipTables = isPositioned() || isRelPositioned();
     float currZoom = style()->effectiveZoom();
     RenderObject* curr = parent();
-    while (curr && (!curr->node() ||
-                    (!curr->isPositioned() && !curr->isRelPositioned() && !curr->isBody()))) {
+    while (curr && (!curr->node() || (!curr->isPositioned() && !curr->isRelPositioned() && !curr->isBody()))) {
         Node* element = curr->node();
         if (!skipTables && element) {
             bool isTableElement = element->hasTagName(tableTag) ||
@@ -2647,14 +2657,14 @@ VisiblePosition RenderObject::createVisiblePosition(int offset, EAffinity affini
 {
     // If this is a non-anonymous renderer in an editable area, then it's simple.
     if (Node* node = this->node()) {
-        if (!node->isContentEditable()) {
+        if (!node->rendererIsEditable()) {
             // If it can be found, we prefer a visually equivalent position that is editable. 
             Position position(node, offset);
             Position candidate = position.downstream(CanCrossEditingBoundary);
-            if (candidate.deprecatedNode()->isContentEditable())
+            if (candidate.deprecatedNode()->rendererIsEditable())
                 return VisiblePosition(candidate, affinity);
             candidate = position.upstream(CanCrossEditingBoundary);
-            if (candidate.deprecatedNode()->isContentEditable())
+            if (candidate.deprecatedNode()->rendererIsEditable())
                 return VisiblePosition(candidate, affinity);
         }
         // FIXME: Eliminate legacy editing positions
diff --git a/Source/WebCore/rendering/RenderObject.h b/Source/WebCore/rendering/RenderObject.h
index 8b9fa38..41564dd 100644
--- a/Source/WebCore/rendering/RenderObject.h
+++ b/Source/WebCore/rendering/RenderObject.h
@@ -320,8 +320,6 @@ public:
     void setChildrenInline(bool b = true) { m_childrenInline = b; }
     bool hasColumns() const { return m_hasColumns; }
     void setHasColumns(bool b = true) { m_hasColumns = b; }
-    bool cellWidthChanged() const { return m_cellWidthChanged; }
-    void setCellWidthChanged(bool b = true) { m_cellWidthChanged = b; }
 
     virtual bool requiresForcedStyleRecalcPropagation() const { return false; }
 
@@ -388,7 +386,11 @@ public:
     void setIsAnonymous(bool b) { m_isAnonymous = b; }
     bool isAnonymousBlock() const
     {
-        return m_isAnonymous && style()->display() == BLOCK && style()->styleType() == NOPSEUDO && !isListMarker();
+        // This function is kept in sync with anonymous block creation conditions in
+        // RenderBlock::createAnonymousBlock(). This includes creating an anonymous
+        // RenderBlock having a BLOCK or BOX display. Other classes such as RenderTextFragment
+        // are not RenderBlocks and will return false. See https://bugs.webkit.org/show_bug.cgi?id=56709. 
+        return m_isAnonymous && (style()->display() == BLOCK || style()->display() == BOX) && style()->styleType() == NOPSEUDO && isRenderBlock() && !isListMarker();
     }
     bool isAnonymousColumnsBlock() const { return style()->specifiesColumns() && isAnonymousBlock(); }
     bool isAnonymousColumnSpanBlock() const { return style()->columnSpan() && isAnonymousBlock(); }
@@ -406,17 +408,19 @@ public:
     bool isRunIn() const { return style()->display() == RUN_IN; } // run-in object
     bool isDragging() const { return m_isDragging; }
     bool isReplaced() const { return m_replaced; } // a "replaced" element (see CSS)
-    
+    bool isHorizontalWritingMode() const { return m_horizontalWritingMode; }
+
     bool hasLayer() const { return m_hasLayer; }
     
     bool hasBoxDecorations() const { return m_paintBackground; }
     bool mustRepaintBackgroundOrBorder() const;
     bool hasBackground() const { return style()->hasBackground(); }
-    bool needsLayout() const { return m_needsLayout || m_normalChildNeedsLayout || m_posChildNeedsLayout || m_needsPositionedMovementLayout; }
+    bool needsLayout() const { return m_needsLayout || m_normalChildNeedsLayout || m_posChildNeedsLayout || m_needsSimplifiedNormalFlowLayout || m_needsPositionedMovementLayout; }
     bool selfNeedsLayout() const { return m_needsLayout; }
     bool needsPositionedMovementLayout() const { return m_needsPositionedMovementLayout; }
-    bool needsPositionedMovementLayoutOnly() const { return m_needsPositionedMovementLayout && !m_needsLayout && !m_normalChildNeedsLayout && !m_posChildNeedsLayout; }
+    bool needsPositionedMovementLayoutOnly() const { return m_needsPositionedMovementLayout && !m_needsLayout && !m_normalChildNeedsLayout && !m_posChildNeedsLayout && !m_needsSimplifiedNormalFlowLayout; }
     bool posChildNeedsLayout() const { return m_posChildNeedsLayout; }
+    bool needsSimplifiedNormalFlowLayout() const { return m_needsSimplifiedNormalFlowLayout; }
     bool normalChildNeedsLayout() const { return m_normalChildNeedsLayout; }
     
     bool preferredLogicalWidthsDirty() const { return m_preferredLogicalWidthsDirty; }
@@ -432,13 +436,13 @@ public:
     void drawLineForBoxSide(GraphicsContext*, int x1, int y1, int x2, int y2, BoxSide,
                             Color, EBorderStyle, int adjbw1, int adjbw2);
 #if HAVE(PATH_BASED_BORDER_RADIUS_DRAWING)
-    void drawBoxSideFromPath(GraphicsContext*, IntRect, Path, 
+    void drawBoxSideFromPath(GraphicsContext*, const IntRect&, const Path&,
                             float thickness, float drawThickness, BoxSide, const RenderStyle*, 
                             Color, EBorderStyle);
 #else
     // FIXME: This function should be removed when all ports implement GraphicsContext::clipConvexPolygon()!!
     // At that time, everyone can use RenderObject::drawBoxSideFromPath() instead. This should happen soon.
-    void drawArcForBoxSide(GraphicsContext*, int x, int y, float thickness, IntSize radius, int angleStart,
+    void drawArcForBoxSide(GraphicsContext*, int x, int y, float thickness, const IntSize& radius, int angleStart,
                            int angleSpan, BoxSide, Color, EBorderStyle, bool firstCorner);
 #endif
 
@@ -485,6 +489,7 @@ public:
     void setNeedsLayout(bool b, bool markParents = true);
     void setChildNeedsLayout(bool b, bool markParents = true);
     void setNeedsPositionedMovementLayout();
+    void setNeedsSimplifiedNormalFlowLayout();
     void setPreferredLogicalWidthsDirty(bool, bool markParents = true);
     void invalidateContainerPreferredLogicalWidths();
     
@@ -502,6 +507,7 @@ public:
     void setIsText() { m_isText = true; }
     void setIsBox() { m_isBox = true; }
     void setReplaced(bool b = true) { m_replaced = b; }
+    void setHorizontalWritingMode(bool b = true) { m_horizontalWritingMode = b; }
     void setHasOverflowClip(bool b = true) { m_hasOverflowClip = b; }
     void setHasLayer(bool b = true) { m_hasLayer = b; }
     void setHasTransform(bool b = true) { m_hasTransform = b; }
@@ -557,8 +563,8 @@ public:
 
     // Convert the given local point to absolute coordinates
     // FIXME: Temporary. If useTransforms is true, take transforms into account. Eventually localToAbsolute() will always be transform-aware.
-    FloatPoint localToAbsolute(FloatPoint localPoint = FloatPoint(), bool fixed = false, bool useTransforms = false) const;
-    FloatPoint absoluteToLocal(FloatPoint, bool fixed = false, bool useTransforms = false) const;
+    FloatPoint localToAbsolute(const FloatPoint& localPoint = FloatPoint(), bool fixed = false, bool useTransforms = false) const;
+    FloatPoint absoluteToLocal(const FloatPoint&, bool fixed = false, bool useTransforms = false) const;
 
     // Convert a local quad to absolute coordinates, taking transforms into account.
     FloatQuad localToAbsoluteQuad(const FloatQuad& quad, bool fixed = false) const
@@ -730,6 +736,8 @@ public:
     virtual bool isFlexingChildren() const { return false; }
     virtual bool isStretchingChildren() const { return false; }
 
+    virtual bool isCombineText() const { return false; }
+
     virtual int caretMinOffset() const;
     virtual int caretMaxOffset() const;
     virtual unsigned caretMaxRenderedOffset() const;
@@ -840,6 +848,7 @@ private:
     bool m_needsPositionedMovementLayout :1;
     bool m_normalChildNeedsLayout    : 1;
     bool m_posChildNeedsLayout       : 1;
+    bool m_needsSimplifiedNormalFlowLayout  : 1;
     bool m_preferredLogicalWidthsDirty           : 1;
     bool m_floating                  : 1;
 
@@ -853,6 +862,7 @@ private:
     bool m_isBox                     : 1;
     bool m_inline                    : 1;
     bool m_replaced                  : 1;
+    bool m_horizontalWritingMode : 1;
     bool m_isDragging                : 1;
 
     bool m_hasLayer                  : 1;
@@ -924,6 +934,7 @@ inline void RenderObject::setNeedsLayout(bool b, bool markParents)
     } else {
         m_everHadLayout = true;
         m_posChildNeedsLayout = false;
+        m_needsSimplifiedNormalFlowLayout = false;
         m_normalChildNeedsLayout = false;
         m_needsPositionedMovementLayout = false;
     }
@@ -939,6 +950,7 @@ inline void RenderObject::setChildNeedsLayout(bool b, bool markParents)
             markContainingBlocksForLayout();
     } else {
         m_posChildNeedsLayout = false;
+        m_needsSimplifiedNormalFlowLayout = false;
         m_normalChildNeedsLayout = false;
         m_needsPositionedMovementLayout = false;
     }
@@ -955,6 +967,17 @@ inline void RenderObject::setNeedsPositionedMovementLayout()
     }
 }
 
+inline void RenderObject::setNeedsSimplifiedNormalFlowLayout()
+{
+    bool alreadyNeededLayout = needsLayout();
+    m_needsSimplifiedNormalFlowLayout = true;
+    if (!alreadyNeededLayout) {
+        markContainingBlocksForLayout();
+        if (hasLayer())
+            setLayerNeedsFullRepaint();
+    }
+}
+
 inline bool objectIsRelayoutBoundary(const RenderObject *obj) 
 {
     // FIXME: In future it may be possible to broaden this condition in order to improve performance.
@@ -975,6 +998,8 @@ inline void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout, R
     RenderObject* o = container();
     RenderObject* last = this;
 
+    bool simplifiedNormalFlowLayout = needsSimplifiedNormalFlowLayout() && !selfNeedsLayout() && !normalChildNeedsLayout();
+
     while (o) {
         // Don't mark the outermost object of an unrooted subtree. That object will be 
         // marked when the subtree is added to the document.
@@ -982,17 +1007,15 @@ inline void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout, R
         if (!container && !o->isRenderView())
             return;
         if (!last->isText() && (last->style()->position() == FixedPosition || last->style()->position() == AbsolutePosition)) {
-            if (last->style()->top().isAuto() && last->style()->bottom().isAuto()) {
-                RenderObject* parent = last->parent();
-                if (!parent->normalChildNeedsLayout()) {
-                    parent->setChildNeedsLayout(true, false);
-                    if (parent != newRoot)
-                        parent->markContainingBlocksForLayout(scheduleRelayout, newRoot);
-                }
-            }
             if (o->m_posChildNeedsLayout)
                 return;
             o->m_posChildNeedsLayout = true;
+            simplifiedNormalFlowLayout = true;
+            ASSERT(!o->isSetNeedsLayoutForbidden());
+        } else if (simplifiedNormalFlowLayout) {
+            if (o->m_needsSimplifiedNormalFlowLayout)
+                return;
+            o->m_needsSimplifiedNormalFlowLayout = true;
             ASSERT(!o->isSetNeedsLayoutForbidden());
         } else {
             if (o->m_normalChildNeedsLayout)
diff --git a/Source/WebCore/rendering/RenderObjectChildList.cpp b/Source/WebCore/rendering/RenderObjectChildList.cpp
index 4df7180..617067a 100644
--- a/Source/WebCore/rendering/RenderObjectChildList.cpp
+++ b/Source/WebCore/rendering/RenderObjectChildList.cpp
@@ -262,31 +262,6 @@ static RenderObject* findBeforeAfterParent(RenderObject* object)
     return beforeAfterParent;
 }
 
-static void invalidateCountersInContainer(RenderObject* container, const AtomicString& identifier)
-{
-    if (!container)
-        return;
-    container = findBeforeAfterParent(container);
-    if (!container)
-        return;
-    // Sometimes the counter is attached directly on the container.
-    if (container->isCounter()) {
-        toRenderCounter(container)->invalidate(identifier);
-        return;
-    }
-    for (RenderObject* content = container->firstChild(); content; content = content->nextSibling()) {
-        if (content->isCounter())
-            toRenderCounter(content)->invalidate(identifier);
-    }
-}
-
-void RenderObjectChildList::invalidateCounters(const RenderObject* owner, const AtomicString& identifier)
-{
-    ASSERT(!owner->documentBeingDestroyed());
-    invalidateCountersInContainer(beforePseudoElementRenderer(owner), identifier);
-    invalidateCountersInContainer(afterPseudoElementRenderer(owner), identifier);
-}
-
 RenderObject* RenderObjectChildList::beforePseudoElementRenderer(const RenderObject* owner) const
 {
     // An anonymous (generated) inline run-in that has PseudoId BEFORE must come from a grandparent.
diff --git a/Source/WebCore/rendering/RenderObjectChildList.h b/Source/WebCore/rendering/RenderObjectChildList.h
index 087adfb..c8fc978 100644
--- a/Source/WebCore/rendering/RenderObjectChildList.h
+++ b/Source/WebCore/rendering/RenderObjectChildList.h
@@ -58,7 +58,6 @@ public:
     void updateBeforeAfterContent(RenderObject* owner, PseudoId type, const RenderObject* styledObject = 0);
     RenderObject* beforePseudoElementRenderer(const RenderObject* owner) const;
     RenderObject* afterPseudoElementRenderer(const RenderObject* owner) const;
-    void invalidateCounters(const RenderObject* owner, const AtomicString& identifier);
 
 private:
     RenderObject* m_firstChild;
diff --git a/Source/WebCore/rendering/RenderRubyRun.cpp b/Source/WebCore/rendering/RenderRubyRun.cpp
index 016c2a1..3504ccf 100644
--- a/Source/WebCore/rendering/RenderRubyRun.cpp
+++ b/Source/WebCore/rendering/RenderRubyRun.cpp
@@ -194,8 +194,7 @@ void RenderRubyRun::removeChild(RenderObject* child)
 RenderRubyBase* RenderRubyRun::createRubyBase() const
 {
     RenderRubyBase* rb = new (renderArena()) RenderRubyBase(document() /* anonymous */);
-    RefPtr<RenderStyle> newStyle = RenderStyle::create();
-    newStyle->inheritFrom(style());
+    RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(style());
     newStyle->setDisplay(BLOCK);
     newStyle->setTextAlign(CENTER); // FIXME: use WEBKIT_CENTER?
     rb->setStyle(newStyle.release());
@@ -206,8 +205,7 @@ RenderRubyRun* RenderRubyRun::staticCreateRubyRun(const RenderObject* parentRuby
 {
     ASSERT(parentRuby && parentRuby->isRuby());
     RenderRubyRun* rr = new (parentRuby->renderArena()) RenderRubyRun(parentRuby->document() /* anonymous */);
-    RefPtr<RenderStyle> newStyle = RenderStyle::create();
-    newStyle->inheritFrom(parentRuby->style());
+    RefPtr<RenderStyle> newStyle = RenderStyle::createAnonymousStyle(parentRuby->style());
     newStyle->setDisplay(INLINE_BLOCK);
     rr->setStyle(newStyle.release());
     return rr;
diff --git a/Source/WebCore/rendering/RenderSlider.cpp b/Source/WebCore/rendering/RenderSlider.cpp
index 49da396..1661b7a 100644
--- a/Source/WebCore/rendering/RenderSlider.cpp
+++ b/Source/WebCore/rendering/RenderSlider.cpp
@@ -156,7 +156,7 @@ void RenderSlider::layout()
         if (oldSize != size())
             thumb->setChildNeedsLayout(true, false);
 
-        LayoutStateMaintainer statePusher(view(), this, size(), style()->isFlippedBlocksWritingMode());
+        LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), style()->isFlippedBlocksWritingMode());
 
         IntRect oldThumbRect = thumb->frameRect();
 
diff --git a/Source/WebCore/rendering/RenderSummary.cpp b/Source/WebCore/rendering/RenderSummary.cpp
index 8fccf66..cfde231 100644
--- a/Source/WebCore/rendering/RenderSummary.cpp
+++ b/Source/WebCore/rendering/RenderSummary.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,11 +21,41 @@
 #include "config.h"
 #include "RenderSummary.h"
 
+#include "RenderDetails.h"
+
 namespace WebCore {
 
-RenderSummary::RenderSummary(Node* element)
-    : RenderBlock(element)
+RenderSummary::RenderSummary(Node* node)
+    : RenderBlock(node)
+{
+}
+
+void RenderSummary::destroy()
+{
+    RenderDetails* details = parentDetails();
+    if (details)
+        details->summaryDestroyed(this);
+
+    RenderBlock::destroy();
+}
+
+RenderDetails* RenderSummary::parentDetails()
 {
+    RenderObject* obj = parent();
+    while (obj && !obj->isDetails())
+        obj = obj->parent();
+
+    return static_cast<RenderDetails*>(obj);
+}
+
+void RenderSummary::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderBlock::styleDidChange(diff, oldStyle);
+
+
+    // Ensure that if we ended up being inline that we set our replaced flag
+    // so that we're treated like an inline-block.
+    setReplaced(isInline());
 }
 
 }
diff --git a/Source/WebCore/rendering/RenderSummary.h b/Source/WebCore/rendering/RenderSummary.h
index afc18fa..94850df 100644
--- a/Source/WebCore/rendering/RenderSummary.h
+++ b/Source/WebCore/rendering/RenderSummary.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,13 +25,20 @@
 
 namespace WebCore {
 
+class RenderDetails;
+
 class RenderSummary : public RenderBlock {
 public:
     explicit RenderSummary(Node*);
 
+    virtual void destroy();
+
 private:
     virtual const char* renderName() const { return "RenderSummary"; }
     virtual bool isSummary() const { return true; }
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
+
+    RenderDetails* parentDetails();
 };
 
 inline RenderSummary* toRenderSummary(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderTable.cpp b/Source/WebCore/rendering/RenderTable.cpp
index 69c073c..187ffd7 100644
--- a/Source/WebCore/rendering/RenderTable.cpp
+++ b/Source/WebCore/rendering/RenderTable.cpp
@@ -277,7 +277,7 @@ void RenderTable::layout()
 {
     ASSERT(needsLayout());
 
-    if (layoutOnlyPositionedObjects())
+    if (simplifiedLayout())
         return;
 
     recalcSectionsIfNeeded();
@@ -510,11 +510,14 @@ void RenderTable::paint(PaintInfo& paintInfo, int tx, int ty)
 
     PaintPhase paintPhase = paintInfo.phase;
 
-    int os = 2 * maximalOutlineSize(paintPhase);
-    if (ty + minYVisualOverflow() >= paintInfo.rect.maxY() + os || ty + maxYVisualOverflow() <= paintInfo.rect.y() - os)
-        return;
-    if (tx + minXVisualOverflow() >= paintInfo.rect.maxX() + os || tx + maxXVisualOverflow() <= paintInfo.rect.x() - os)
-        return;
+    if (!isRoot()) {
+        IntRect overflowBox = visualOverflowRect();
+        flipForWritingMode(overflowBox);
+        overflowBox.inflate(maximalOutlineSize(paintInfo.phase));
+        overflowBox.move(tx, ty);
+        if (!overflowBox.intersects(paintInfo.rect))
+            return;
+    }
 
     bool pushedClip = pushContentsClip(paintInfo, tx, ty);    
     paintObject(paintInfo, tx, ty);
@@ -609,7 +612,13 @@ void RenderTable::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 
     paintBoxShadow(paintInfo.context, rect.x(), rect.y(), rect.width(), rect.height(), style(), Normal);
     
-    paintFillLayers(paintInfo, style()->visitedDependentColor(CSSPropertyBackgroundColor), style()->backgroundLayers(), rect.x(), rect.y(), rect.width(), rect.height());
+    if (isRoot())
+        paintRootBoxFillLayers(paintInfo);
+    else if (!isBody() || document()->documentElement()->renderer()->hasBackground())
+        // The <body> only paints its background if the root element has defined a background
+        // independent of the body.
+        paintFillLayers(paintInfo, style()->visitedDependentColor(CSSPropertyBackgroundColor), style()->backgroundLayers(), rect.x(), rect.y(), rect.width(), rect.height());
+
     paintBoxShadow(paintInfo.context, rect.x(), rect.y(), rect.width(), rect.height(), style(), Inset);
 
     if (style()->hasBorder() && !collapseBorders())
@@ -1199,9 +1208,9 @@ int RenderTable::firstLineBoxBaseline() const
     return firstNonEmptySection->logicalTop() + firstNonEmptySection->firstLineBoxBaseline();
 }
 
-IntRect RenderTable::overflowClipRect(int tx, int ty)
+IntRect RenderTable::overflowClipRect(int tx, int ty, OverlayScrollbarSizeRelevancy relevancy)
 {
-    IntRect rect = RenderBlock::overflowClipRect(tx, ty);
+    IntRect rect = RenderBlock::overflowClipRect(tx, ty, relevancy);
     
     // If we have a caption, expand the clip to include the caption.
     // FIXME: Technically this is wrong, but it's virtually impossible to fix this
diff --git a/Source/WebCore/rendering/RenderTable.h b/Source/WebCore/rendering/RenderTable.h
index 67a311c..d781e95 100644
--- a/Source/WebCore/rendering/RenderTable.h
+++ b/Source/WebCore/rendering/RenderTable.h
@@ -236,7 +236,7 @@ private:
 
     virtual void computeLogicalWidth();
 
-    virtual IntRect overflowClipRect(int tx, int ty);
+    virtual IntRect overflowClipRect(int tx, int ty, OverlayScrollbarSizeRelevancy relevancy = IgnoreOverlayScrollbarSize);
 
     virtual void addOverflowFromChildren();
 
diff --git a/Source/WebCore/rendering/RenderTableCell.cpp b/Source/WebCore/rendering/RenderTableCell.cpp
index 2293bac..c9d8837 100644
--- a/Source/WebCore/rendering/RenderTableCell.cpp
+++ b/Source/WebCore/rendering/RenderTableCell.cpp
@@ -52,6 +52,7 @@ RenderTableCell::RenderTableCell(Node* node)
     , m_column(-1)
     , m_rowSpan(1)
     , m_columnSpan(1)
+    , m_cellWidthChanged(false)
     , m_intrinsicPaddingBefore(0)
     , m_intrinsicPaddingAfter(0)
 {
@@ -174,7 +175,7 @@ void RenderTableCell::layout()
 int RenderTableCell::paddingTop(bool includeIntrinsicPadding) const
 {
     int result = RenderBlock::paddingTop();
-    if (!includeIntrinsicPadding || !style()->isHorizontalWritingMode())
+    if (!includeIntrinsicPadding || !isHorizontalWritingMode())
         return result;
     return result + (style()->writingMode() == TopToBottomWritingMode ? intrinsicPaddingBefore() : intrinsicPaddingAfter());
 }
@@ -182,7 +183,7 @@ int RenderTableCell::paddingTop(bool includeIntrinsicPadding) const
 int RenderTableCell::paddingBottom(bool includeIntrinsicPadding) const
 {
     int result = RenderBlock::paddingBottom();
-    if (!includeIntrinsicPadding || !style()->isHorizontalWritingMode())
+    if (!includeIntrinsicPadding || !isHorizontalWritingMode())
         return result;
     return result + (style()->writingMode() == TopToBottomWritingMode ? intrinsicPaddingAfter() : intrinsicPaddingBefore());
 }
@@ -190,7 +191,7 @@ int RenderTableCell::paddingBottom(bool includeIntrinsicPadding) const
 int RenderTableCell::paddingLeft(bool includeIntrinsicPadding) const
 {
     int result = RenderBlock::paddingLeft();
-    if (!includeIntrinsicPadding || style()->isHorizontalWritingMode())
+    if (!includeIntrinsicPadding || isHorizontalWritingMode())
         return result;
     return result + (style()->writingMode() == LeftToRightWritingMode ? intrinsicPaddingBefore() : intrinsicPaddingAfter());
     
@@ -199,7 +200,7 @@ int RenderTableCell::paddingLeft(bool includeIntrinsicPadding) const
 int RenderTableCell::paddingRight(bool includeIntrinsicPadding) const
 {   
     int result = RenderBlock::paddingRight();
-    if (!includeIntrinsicPadding || style()->isHorizontalWritingMode())
+    if (!includeIntrinsicPadding || isHorizontalWritingMode())
         return result;
     return result + (style()->writingMode() == LeftToRightWritingMode ? intrinsicPaddingAfter() : intrinsicPaddingBefore());
 }
@@ -225,6 +226,12 @@ void RenderTableCell::setOverrideSize(int size)
     clearIntrinsicPadding();
     RenderBlock::setOverrideSize(size);
 }
+    
+void RenderTableCell::setOverrideSizeFromRowHeight(int rowHeight)
+{
+    clearIntrinsicPadding();
+    RenderBlock::setOverrideSize(max(0, rowHeight - borderBefore() - paddingBefore() - borderAfter() - paddingAfter()));
+}
 
 IntSize RenderTableCell::offsetFromContainer(RenderObject* o, const IntPoint& point) const
 {
@@ -1049,8 +1056,8 @@ void RenderTableCell::scrollbarsChanged(bool horizontalScrollbarChanged, bool ve
         return; // Not sure if we should be doing something when a scrollbar goes away or not.
     
     // We only care if the scrollbar that affects our intrinsic padding has been added.
-    if ((style()->isHorizontalWritingMode() && !horizontalScrollbarChanged) ||
-        (!style()->isHorizontalWritingMode() && !verticalScrollbarChanged))
+    if ((isHorizontalWritingMode() && !horizontalScrollbarChanged) ||
+        (!isHorizontalWritingMode() && !verticalScrollbarChanged))
         return;
 
     // Shrink our intrinsic padding as much as possible to accommodate the scrollbar.
diff --git a/Source/WebCore/rendering/RenderTableCell.h b/Source/WebCore/rendering/RenderTableCell.h
index cfdb739..9884999 100644
--- a/Source/WebCore/rendering/RenderTableCell.h
+++ b/Source/WebCore/rendering/RenderTableCell.h
@@ -120,11 +120,15 @@ public:
     virtual int paddingAfter(bool includeIntrinsicPadding = true) const;
 
     virtual void setOverrideSize(int);
+    void setOverrideSizeFromRowHeight(int);
 
     bool hasVisualOverflow() const { return m_overflow && !borderBoxRect().contains(m_overflow->visualOverflowRect()); }
 
     virtual void scrollbarsChanged(bool horizontalScrollbarChanged, bool verticalScrollbarChanged);
 
+    bool cellWidthChanged() const { return m_cellWidthChanged; }
+    void setCellWidthChanged(bool b = true) { m_cellWidthChanged = b; }
+
 protected:
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
@@ -136,8 +140,6 @@ private:
 
     virtual void destroy();
 
-    virtual bool requiresLayer() const { return isPositioned() || isTransparent() || hasOverflowClip() || hasTransform() || hasMask() || hasReflection(); }
-
     virtual void computeLogicalWidth();
 
     virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
@@ -152,7 +154,8 @@ private:
     int m_row;
     int m_column;
     int m_rowSpan;
-    int m_columnSpan;
+    int m_columnSpan : 31;
+    bool m_cellWidthChanged : 1;
     int m_intrinsicPaddingBefore;
     int m_intrinsicPaddingAfter;
 };
diff --git a/Source/WebCore/rendering/RenderTableRow.cpp b/Source/WebCore/rendering/RenderTableRow.cpp
index 7300c19..a29f218 100644
--- a/Source/WebCore/rendering/RenderTableRow.cpp
+++ b/Source/WebCore/rendering/RenderTableRow.cpp
@@ -63,6 +63,17 @@ void RenderTableRow::styleWillChange(StyleDifference diff, const RenderStyle* ne
     RenderBox::styleWillChange(diff, newStyle);
 }
 
+void RenderTableRow::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderBox::styleDidChange(diff, oldStyle);
+
+    // Update pseudos for :before and :after now.
+    if (!isAnonymous() && document()->usesBeforeAfterRules()) {
+        children()->updateBeforeAfterContent(this, BEFORE);
+        children()->updateBeforeAfterContent(this, AFTER);
+    }
+}
+
 void RenderTableRow::addChild(RenderObject* child, RenderObject* beforeChild)
 {
     // Make sure we don't append things after :after-generated content if we have it.
diff --git a/Source/WebCore/rendering/RenderTableRow.h b/Source/WebCore/rendering/RenderTableRow.h
index 20aa424..2af8dcb 100644
--- a/Source/WebCore/rendering/RenderTableRow.h
+++ b/Source/WebCore/rendering/RenderTableRow.h
@@ -62,6 +62,7 @@ private:
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
+    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     RenderObjectChildList m_children;
 };
diff --git a/Source/WebCore/rendering/RenderTableSection.cpp b/Source/WebCore/rendering/RenderTableSection.cpp
index 3d46ece..7c0a768 100644
--- a/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/Source/WebCore/rendering/RenderTableSection.cpp
@@ -203,7 +203,7 @@ void RenderTableSection::addCell(RenderTableCell* cell, RenderTableRow* row)
             switch (logicalHeight.type()) {
                 case Percent:
                     if (!(cRowLogicalHeight.isPercent()) ||
-                        (cRowLogicalHeight.isPercent() && cRowLogicalHeight.rawValue() < logicalHeight.rawValue()))
+                        (cRowLogicalHeight.isPercent() && cRowLogicalHeight.percent() < logicalHeight.percent()))
                         m_grid[m_cRow].logicalHeight = logicalHeight;
                         break;
                 case Fixed:
@@ -521,22 +521,22 @@ int RenderTableSection::layoutRows(int toAdd)
             if (m_grid[r].logicalHeight.isAuto())
                 numAuto++;
             else if (m_grid[r].logicalHeight.isPercent())
-                totalPercent += m_grid[r].logicalHeight.rawValue();
+                totalPercent += m_grid[r].logicalHeight.percent();
         }
         if (totalPercent) {
             // try to satisfy percent
             int add = 0;
-            totalPercent = min(totalPercent, 100 * percentScaleFactor);
+            totalPercent = min(totalPercent, 100);
             int rh = m_rowPos[1] - m_rowPos[0];
             for (int r = 0; r < totalRows; r++) {
                 if (totalPercent > 0 && m_grid[r].logicalHeight.isPercent()) {
-                    int toAdd = min(dh, (totalHeight * m_grid[r].logicalHeight.rawValue() / (100 * percentScaleFactor)) - rh);
+                    int toAdd = min(dh, static_cast<int>((totalHeight * m_grid[r].logicalHeight.percent() / 100) - rh));
                     // If toAdd is negative, then we don't want to shrink the row (this bug
                     // affected Outlook Web Access).
                     toAdd = max(0, toAdd);
                     add += toAdd;
                     dh -= toAdd;
-                    totalPercent -= m_grid[r].logicalHeight.rawValue();
+                    totalPercent -= m_grid[r].logicalHeight.percent();
                 }
                 if (r < totalRows - 1)
                     rh = m_rowPos[r + 2] - m_rowPos[r + 1];
@@ -647,9 +647,7 @@ int RenderTableSection::layoutRows(int toAdd)
                 // Alignment within a cell is based off the calculated
                 // height, which becomes irrelevant once the cell has
                 // been resized based off its percentage.
-                cell->setOverrideSize(max(0, 
-                                           rHeight - cell->borderBefore() - cell->paddingBefore() - 
-                                                     cell->borderAfter() - cell->paddingAfter()));
+                cell->setOverrideSizeFromRowHeight(rHeight);
                 cell->layoutIfNeeded();
 
                 // If the baseline moved, we may have to update the data for our row. Find out the new baseline.
diff --git a/Source/WebCore/rendering/RenderText.cpp b/Source/WebCore/rendering/RenderText.cpp
index 3e696d3..e660875 100644
--- a/Source/WebCore/rendering/RenderText.cpp
+++ b/Source/WebCore/rendering/RenderText.cpp
@@ -551,6 +551,12 @@ IntRect RenderText::localCaretRect(InlineBox* inlineBox, int caretOffset, int* e
     case CENTER:
     case WEBKIT_CENTER:
         break;
+    case TASTART:
+        rightAligned = !cbStyle->isLeftToRightDirection();
+        break;
+    case TAEND:
+        rightAligned = cbStyle->isLeftToRightDirection();
+        break;
     }
 
     if (rightAligned) {
@@ -566,13 +572,13 @@ IntRect RenderText::localCaretRect(InlineBox* inlineBox, int caretOffset, int* e
 
 ALWAYS_INLINE float RenderText::widthFromCache(const Font& f, int start, int len, float xPos, HashSet<const SimpleFontData*>* fallbackFonts, GlyphOverflow* glyphOverflow) const
 {
-    if (style()->hasTextCombine()) {
+    if (style()->hasTextCombine() && isCombineText()) {
         const RenderCombineText* combineText = toRenderCombineText(this);
         if (combineText->isCombined())
             return combineText->combinedTextWidth(f);
     }
 
-    if (f.isFixedPitch() && !f.isSmallCaps() && m_isAllASCII) {
+    if (f.isFixedPitch() && !f.isSmallCaps() && m_isAllASCII && (!glyphOverflow || !glyphOverflow->computeBounds)) {
         float monospaceCharacterWidth = f.spaceWidth();
         float tabWidth = allowTabs() ? monospaceCharacterWidth * 8 : 0;
         float w = 0;
@@ -1247,7 +1253,7 @@ float RenderText::width(unsigned from, unsigned len, const Font& f, float xPos,
 
     float w;
     if (&f == &style()->font()) {
-        if (!style()->preserveNewline() && !from && len == textLength()) {
+        if (!style()->preserveNewline() && !from && len == textLength() && (!glyphOverflow || !glyphOverflow->computeBounds)) {
             if (fallbackFonts) {
                 ASSERT(glyphOverflow);
                 if (preferredLogicalWidthsDirty() || !m_knownToHaveNoOverflowAndNoFallbackFonts) {
@@ -1404,6 +1410,8 @@ int RenderText::previousOffset(int current) const
     return result;
 }
 
+#if PLATFORM(MAC)
+
 #define HANGUL_CHOSEONG_START (0x1100)
 #define HANGUL_CHOSEONG_END (0x115F)
 #define HANGUL_JUNGSEONG_START (0x1160)
@@ -1428,6 +1436,14 @@ inline bool isHangulLVT(UChar32 character)
     return (character - HANGUL_SYLLABLE_START) % HANGUL_JONGSEONG_COUNT;
 }
 
+inline bool isMark(UChar32 c)
+{
+    int8_t charType = u_charType(c);
+    return charType == U_NON_SPACING_MARK || charType == U_ENCLOSING_MARK || charType == U_COMBINING_SPACING_MARK;
+}
+
+#endif
+
 int RenderText::previousOffsetForBackwardDeletion(int current) const
 {
 #if PLATFORM(MAC)
@@ -1446,7 +1462,7 @@ int RenderText::previousOffsetForBackwardDeletion(int current) const
         if ((character >= 0x0530) && (character < 0x1950))
             break;
 
-        if (u_isbase(character) && (character != 0xFF9E) && (character != 0xFF9F))
+        if (!isMark(character) && (character != 0xFF9E) && (character != 0xFF9F))
             break;
     }
 
diff --git a/Source/WebCore/rendering/RenderText.h b/Source/WebCore/rendering/RenderText.h
index b88590c..7fa3518 100644
--- a/Source/WebCore/rendering/RenderText.h
+++ b/Source/WebCore/rendering/RenderText.h
@@ -125,6 +125,8 @@ public:
     virtual void computePreferredLogicalWidths(float leadWidth);
     bool isAllCollapsibleWhitespace();
     
+    bool knownToHaveNoOverflowAndNoFallbackFonts() const { return m_knownToHaveNoOverflowAndNoFallbackFonts; }
+
 protected:
     virtual void styleWillChange(StyleDifference, const RenderStyle*) { }
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
diff --git a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
index 8b98335..b9697ff 100644
--- a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -1111,7 +1111,7 @@ PassRefPtr<Scrollbar> RenderTextControlSingleLine::createScrollbar(ScrollableAre
 
 InputElement* RenderTextControlSingleLine::inputElement() const
 {
-    return toInputElement(static_cast<Element*>(node()));
+    return node()->toInputElement();
 }
 
 int RenderTextControlSingleLine::textBlockInsetLeft() const
diff --git a/Source/WebCore/rendering/RenderTheme.cpp b/Source/WebCore/rendering/RenderTheme.cpp
index b68429c..f254c99 100644
--- a/Source/WebCore/rendering/RenderTheme.cpp
+++ b/Source/WebCore/rendering/RenderTheme.cpp
@@ -779,10 +779,10 @@ bool RenderTheme::isActive(const RenderObject* o) const
 
 bool RenderTheme::isChecked(const RenderObject* o) const
 {
-    if (!o->node() || !o->node()->isElementNode())
+    if (!o->node())
         return false;
 
-    InputElement* inputElement = toInputElement(static_cast<Element*>(o->node()));
+    InputElement* inputElement = o->node()->toInputElement();
     if (!inputElement)
         return false;
 
@@ -791,10 +791,10 @@ bool RenderTheme::isChecked(const RenderObject* o) const
 
 bool RenderTheme::isIndeterminate(const RenderObject* o) const
 {
-    if (!o->node() || !o->node()->isElementNode())
+    if (!o->node())
         return false;
 
-    InputElement* inputElement = toInputElement(static_cast<Element*>(o->node()));
+    InputElement* inputElement = o->node()->toInputElement();
     if (!inputElement)
         return false;
 
diff --git a/Source/WebCore/rendering/RenderTheme.h b/Source/WebCore/rendering/RenderTheme.h
index 5021712..53c23e3 100644
--- a/Source/WebCore/rendering/RenderTheme.h
+++ b/Source/WebCore/rendering/RenderTheme.h
@@ -88,6 +88,9 @@ public:
     virtual String extraQuirksStyleSheet() { return String(); }
 #if ENABLE(VIDEO)
     virtual String extraMediaControlsStyleSheet() { return String(); };
+#if ENABLE(FULLSCREEN_API)
+    virtual String extraFullScreenStyleSheet() { return String(); };
+#endif
 #endif
 
     // A method to obtain the baseline position for a "leaf" control.  This will only be used if a baseline
diff --git a/Source/WebCore/rendering/RenderThemeChromiumWin.cpp b/Source/WebCore/rendering/RenderThemeChromiumWin.cpp
index 6f3be00..53ec9cb 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumWin.cpp
+++ b/Source/WebCore/rendering/RenderThemeChromiumWin.cpp
@@ -43,8 +43,8 @@
 #include "RenderProgress.h"
 #include "RenderSlider.h"
 #include "ScrollbarTheme.h"
+#include "SystemInfo.h"
 #include "TransparencyWin.h"
-#include "WindowsVersion.h"
 
 // FIXME: This dependency should eventually be removed.
 #include <skia/ext/skia_utils_win.h>
@@ -141,8 +141,8 @@ bool ThemePainter::s_hasInstance = false;
 
 static void getNonClientMetrics(NONCLIENTMETRICS* metrics)
 {
-    static UINT size = isVistaOrNewer() ?
-        sizeof(NONCLIENTMETRICS) : NONCLIENTMETRICS_SIZE_PRE_VISTA;
+    static UINT size = (windowsVersion() >= WindowsVista) ?
+        (sizeof NONCLIENTMETRICS) : NONCLIENTMETRICS_SIZE_PRE_VISTA;
     metrics->cbSize = size;
     bool success = !!SystemParametersInfo(SPI_GETNONCLIENTMETRICS, size, metrics, 0);
     ASSERT(success);
diff --git a/Source/WebCore/rendering/RenderThemeMac.h b/Source/WebCore/rendering/RenderThemeMac.h
index d951ff6..d64944b 100644
--- a/Source/WebCore/rendering/RenderThemeMac.h
+++ b/Source/WebCore/rendering/RenderThemeMac.h
@@ -162,6 +162,9 @@ protected:
 
     // Media controls
     virtual String extraMediaControlsStyleSheet();
+#if ENABLE(FULLSCREEN_API)
+    virtual String extraFullScreenStyleSheet();
+#endif
 
     virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
     virtual bool usesMediaControlStatusDisplay();
diff --git a/Source/WebCore/rendering/RenderThemeMac.mm b/Source/WebCore/rendering/RenderThemeMac.mm
index f5611dc..0e23c89 100644
--- a/Source/WebCore/rendering/RenderThemeMac.mm
+++ b/Source/WebCore/rendering/RenderThemeMac.mm
@@ -1961,20 +1961,45 @@ String RenderThemeMac::extraMediaControlsStyleSheet()
 #endif
 }
 
+#if ENABLE(FULLSCREEN_API)
+String RenderThemeMac::extraFullScreenStyleSheet()
+{
+#if PLATFORM(MAC)
+    if (mediaControllerTheme() == MediaControllerThemeQuickTime)
+        return String(fullscreenQuickTimeUserAgentStyleSheet, sizeof(fullscreenQuickTimeUserAgentStyleSheet));
+    
+    return String();
+#else
+    ASSERT_NOT_REACHED();
+    return String();
+#endif
+}
+#endif
+
 bool RenderThemeMac::shouldRenderMediaControlPart(ControlPart part, Element* element)
 {
+    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(element);
     switch (part) {
     case MediaVolumeSliderContainerPart:
     case MediaVolumeSliderPart:
     case MediaVolumeSliderMuteButtonPart:
     case MediaVolumeSliderThumbPart: {
-        HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(element);
         return mediaControllerTheme() == MediaControllerThemeQuickTime && mediaElement->hasAudio();
     }
     case MediaToggleClosedCaptionsButtonPart:
         // We rely on QTKit to render captions so don't enable the button unless it will be able to do so.
         if (!element->hasTagName(videoTag))
             return false;
+        break;
+    case MediaRewindButtonPart:
+        if (mediaElement->isFullscreen())
+            return mediaElement->movieLoadType() == MediaPlayer::LiveStream 
+                || mediaElement->movieLoadType() == MediaPlayer::StoredStream;
+    case MediaSeekForwardButtonPart:
+    case MediaSeekBackButtonPart:
+        if (mediaElement->isFullscreen())
+            return mediaElement->movieLoadType() != MediaPlayer::StoredStream 
+                && mediaElement->movieLoadType() != MediaPlayer::LiveStream;
     default:
         break;
     }
diff --git a/Source/WebCore/rendering/RenderThemeWin.cpp b/Source/WebCore/rendering/RenderThemeWin.cpp
index d5e4155..af100b7 100644
--- a/Source/WebCore/rendering/RenderThemeWin.cpp
+++ b/Source/WebCore/rendering/RenderThemeWin.cpp
@@ -569,15 +569,17 @@ ThemeData RenderThemeWin::getThemeData(RenderObject* o, ControlSubPart subPart)
             result.m_state = determineState(o);
             break;
         case MenulistPart:
-        case MenulistButtonPart:
-            result.m_part = isRunningOnVistaOrLater() ? CP_DROPDOWNBUTTONRIGHT : CP_DROPDOWNBUTTON;
-            if (isRunningOnVistaOrLater() && documentIsInApplicationChromeMode(o->document())) {
+        case MenulistButtonPart: {
+            const bool isVistaOrLater = (windowsVersion() >= WindowsVista);
+            result.m_part = isVistaOrLater ? CP_DROPDOWNBUTTONRIGHT : CP_DROPDOWNBUTTON;
+            if (isVistaOrLater && documentIsInApplicationChromeMode(o->document())) {
                 // The "readonly" look we use in application chrome mode
                 // only uses a "normal" look for the drop down button.
                 result.m_state = TS_NORMAL;
             } else
                 result.m_state = determineState(o);
             break;
+        }
         case RadioPart:
             result.m_part = BP_RADIO;
             result.m_state = determineState(o);
@@ -585,7 +587,7 @@ ThemeData RenderThemeWin::getThemeData(RenderObject* o, ControlSubPart subPart)
         case SearchFieldPart:
         case TextFieldPart:
         case TextAreaPart:
-            result.m_part = isRunningOnVistaOrLater() ? EP_EDITBORDER_NOSCROLL : TFP_TEXTFIELD;
+            result.m_part = (windowsVersion() >= WindowsVista) ? EP_EDITBORDER_NOSCROLL : TFP_TEXTFIELD;
             result.m_state = determineState(o);
             break;
         case SliderHorizontalPart:
@@ -728,7 +730,7 @@ bool RenderThemeWin::paintMenuList(RenderObject* o, const PaintInfo& i, const In
 {
     HANDLE theme;
     int part;
-    if (haveTheme && isRunningOnVistaOrLater()) {
+    if (haveTheme && (windowsVersion() >= WindowsVista)) {
         theme = menuListTheme();
         if (documentIsInApplicationChromeMode(o->document()))
             part = CP_READONLY;
@@ -792,7 +794,7 @@ bool RenderThemeWin::paintMenuListButton(RenderObject* o, const PaintInfo& i, co
         buttonRect.setX(buttonRect.maxX() - dropDownButtonWidth);
     buttonRect.setWidth(dropDownButtonWidth);
 
-    if (isRunningOnVistaOrLater()) {
+    if ((windowsVersion() >= WindowsVista)) {
         // Outset the top, right, and bottom borders of the button so that they coincide with the <select>'s border.
         buttonRect.setY(buttonRect.y() - vistaMenuListButtonOutset);
         buttonRect.setHeight(buttonRect.height() + 2 * vistaMenuListButtonOutset);
diff --git a/Source/WebCore/rendering/RenderTreeAsText.cpp b/Source/WebCore/rendering/RenderTreeAsText.cpp
index cad5830..8857391 100644
--- a/Source/WebCore/rendering/RenderTreeAsText.cpp
+++ b/Source/WebCore/rendering/RenderTreeAsText.cpp
@@ -35,6 +35,7 @@
 #include "InlineTextBox.h"
 #include "PrintContext.h"
 #include "RenderBR.h"
+#include "RenderDetailsMarker.h"
 #include "RenderFileUploadControl.h"
 #include "RenderInline.h"
 #include "RenderLayer.h"
@@ -45,6 +46,7 @@
 #include "RenderView.h"
 #include "RenderWidget.h"
 #include "SelectionController.h"
+#include <wtf/HexNumber.h>
 #include <wtf/UnusedParam.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/CharacterNames.h>
@@ -209,11 +211,11 @@ String quoteAndEscapeNonPrintables(const String& s)
             if (c >= 0x20 && c < 0x7F)
                 result.append(c);
             else {
-                unsigned u = c;
-                String hex = String::format("\\x{%X}", u);
-                unsigned len = hex.length();
-                for (unsigned i = 0; i < len; ++i)
-                    result.append(hex[i]);
+                result.append('\\');
+                result.append('x');
+                result.append('{');
+                appendUnsignedAsHex(c, result); 
+                result.append('}');
             }
         }
     }
@@ -372,6 +374,24 @@ void RenderTreeAsText::writeRenderObject(TextStream& ts, const RenderObject& o,
         ts << " [r=" << c.row() << " c=" << c.col() << " rs=" << c.rowSpan() << " cs=" << c.colSpan() << "]";
     }
 
+    if (o.isDetailsMarker()) {
+        ts << ": ";
+        switch (toRenderDetailsMarker(&o)->orientation()) {
+        case RenderDetailsMarker::Left:
+            ts << "left";
+            break;
+        case RenderDetailsMarker::Right:
+            ts << "right";
+            break;
+        case RenderDetailsMarker::Up:
+            ts << "up";
+            break;
+        case RenderDetailsMarker::Down:
+            ts << "down";
+            break;
+        }
+    }
+
     if (o.isListMarker()) {
         String text = toRenderListMarker(&o)->text();
         if (!text.isEmpty()) {
@@ -487,8 +507,10 @@ static void writeTextRun(TextStream& ts, const RenderText& o, const InlineTextBo
             ts << " override";
     }
     ts << ": "
-        << quoteAndEscapeNonPrintables(String(o.text()).substring(run.start(), run.len()))
-        << "\n";
+        << quoteAndEscapeNonPrintables(String(o.text()).substring(run.start(), run.len()));
+    if (run.hasHyphen())
+        ts << " + hyphen string " << quoteAndEscapeNonPrintables(o.style()->hyphenString());
+    ts << "\n";
 }
 
 void write(TextStream& ts, const RenderObject& o, int indent, RenderAsTextBehavior behavior)
diff --git a/Source/WebCore/rendering/RenderVideo.cpp b/Source/WebCore/rendering/RenderVideo.cpp
index 1ae736b..3a96ef8 100644
--- a/Source/WebCore/rendering/RenderVideo.cpp
+++ b/Source/WebCore/rendering/RenderVideo.cpp
@@ -202,6 +202,8 @@ void RenderVideo::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
 
     if (displayingPoster)
         paintIntoRect(paintInfo.context, rect);
+    else if (document()->view() && document()->view()->paintBehavior() & PaintBehaviorFlattenCompositingLayers)
+        mediaPlayer->paintCurrentFrameInContext(paintInfo.context, rect);
     else
         mediaPlayer->paint(paintInfo.context, rect);
 }
diff --git a/Source/WebCore/rendering/RenderWidget.cpp b/Source/WebCore/rendering/RenderWidget.cpp
index 13b572d..33f6436 100644
--- a/Source/WebCore/rendering/RenderWidget.cpp
+++ b/Source/WebCore/rendering/RenderWidget.cpp
@@ -136,7 +136,7 @@ void RenderWidget::destroy()
     if (hasOverrideSize())
         setOverrideSize(-1);
 
-    if (style() && (style()->height().isPercent() || style()->minHeight().isPercent() || style()->maxHeight().isPercent()))
+    if (style() && (style()->logicalHeight().isPercent() || style()->logicalMinHeight().isPercent() || style()->logicalMaxHeight().isPercent()))
         RenderBlock::removePercentHeightDescendant(this);
 
     if (hasLayer()) {
diff --git a/Source/WebCore/rendering/RootInlineBox.cpp b/Source/WebCore/rendering/RootInlineBox.cpp
index 8617252..c6f1bd8 100644
--- a/Source/WebCore/rendering/RootInlineBox.cpp
+++ b/Source/WebCore/rendering/RootInlineBox.cpp
@@ -28,10 +28,12 @@
 #include "Frame.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
+#include "InlineTextBox.h"
 #include "Page.h"
 #include "PaintInfo.h"
 #include "RenderArena.h"
 #include "RenderBlock.h"
+#include "VerticalPositionCache.h"
 
 using namespace std;
 
@@ -52,7 +54,7 @@ RootInlineBox::RootInlineBox(RenderBlock* block)
     , m_hasAnnotationsBefore(false)
     , m_hasAnnotationsAfter(false)
 {
-    setIsHorizontal(block->style()->isHorizontalWritingMode());
+    setIsHorizontal(block->isHorizontalWritingMode());
 }
 
 
@@ -238,7 +240,7 @@ int RootInlineBox::alignBoxesInBlockDirection(int heightOfBlock, GlyphOverflowAn
 
     m_baselineType = requiresIdeographicBaseline(textBoxDataMap) ? IdeographicBaseline : AlphabeticBaseline;
 
-    computeLogicalBoxHeights(maxPositionTop, maxPositionBottom, maxAscent, maxDescent, setMaxAscent, setMaxDescent, noQuirksMode,
+    computeLogicalBoxHeights(this, maxPositionTop, maxPositionBottom, maxAscent, maxDescent, setMaxAscent, setMaxDescent, noQuirksMode,
                              textBoxDataMap, baselineType(), verticalPositionCache);
 
     if (maxAscent + maxDescent < max(maxPositionTop, maxPositionBottom))
@@ -335,7 +337,7 @@ GapRects RootInlineBox::lineSelectionGap(RenderBlock* rootBlock, const IntPoint&
         for (InlineBox* box = firstBox->nextLeafChild(); box; box = box->nextLeafChild()) {
             if (box->selectionState() != RenderObject::SelectionNone) {
                 IntRect logicalRect(lastLogicalLeft, selTop, box->logicalLeft() - lastLogicalLeft, selHeight);
-                logicalRect.move(renderer()->style()->isHorizontalWritingMode() ? offsetFromRootBlock : IntSize(offsetFromRootBlock.height(), offsetFromRootBlock.width()));
+                logicalRect.move(renderer()->isHorizontalWritingMode() ? offsetFromRootBlock : IntSize(offsetFromRootBlock.height(), offsetFromRootBlock.width()));
                 IntRect gapRect = rootBlock->logicalRectToPhysicalRect(rootBlockPhysicalPosition, logicalRect);
                 if (isPreviousBoxSelected && gapRect.width() > 0 && gapRect.height() > 0) {
                     if (paintInfo && box->parent()->renderer()->style()->visibility() == VISIBLE)
@@ -354,13 +356,6 @@ GapRects RootInlineBox::lineSelectionGap(RenderBlock* rootBlock, const IntPoint&
     return result;
 }
 
-void RootInlineBox::setHasSelectedChildren(bool b)
-{
-    if (m_hasSelectedChildren == b)
-        return;
-    m_hasSelectedChildren = b;
-}
-
 RenderObject::SelectionState RootInlineBox::selectionState()
 {
     // Walk over all of the selected boxes.
@@ -460,7 +455,7 @@ RenderBlock* RootInlineBox::block() const
 
 static bool isEditableLeaf(InlineBox* leaf)
 {
-    return leaf && leaf->renderer() && leaf->renderer()->node() && leaf->renderer()->node()->isContentEditable();
+    return leaf && leaf->renderer() && leaf->renderer()->node() && leaf->renderer()->node()->rendererIsEditable();
 }
 
 InlineBox* RootInlineBox::closestLeafChildForLogicalLeftPosition(int leftPosition, bool onlyEditableLeaves)
@@ -553,4 +548,269 @@ IntRect RootInlineBox::paddedLayoutOverflowRect(int endPadding) const
     return lineLayoutOverflow;
 }
 
+static void setAscentAndDescent(int& ascent, int& descent, int newAscent, int newDescent, bool& ascentDescentSet)
+{
+    if (!ascentDescentSet) {
+        ascentDescentSet = true;
+        ascent = newAscent;
+        descent = newDescent;
+    } else {
+        ascent = max(ascent, newAscent);
+        descent = max(descent, newDescent);
+    }
+}
+
+void RootInlineBox::ascentAndDescentForBox(InlineBox* box, GlyphOverflowAndFallbackFontsMap& textBoxDataMap, int& ascent, int& descent,
+                                           bool& affectsAscent, bool& affectsDescent) const
+{
+    bool ascentDescentSet = false;
+
+    // Replaced boxes will return 0 for the line-height if line-box-contain says they are
+    // not to be included.
+    if (box->renderer()->isReplaced()) {
+        if (renderer()->style(m_firstLine)->lineBoxContain() & LineBoxContainReplaced) {
+            ascent = box->baselinePosition(baselineType());
+            descent = box->lineHeight() - ascent;
+            
+            // Replaced elements always affect both the ascent and descent.
+            affectsAscent = true;
+            affectsDescent = true;
+        }
+        return;
+    }
+
+    Vector<const SimpleFontData*>* usedFonts = 0;
+    GlyphOverflow* glyphOverflow = 0;
+    if (box->isText()) {
+        GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.find(static_cast<InlineTextBox*>(box));
+        usedFonts = it == textBoxDataMap.end() ? 0 : &it->second.first;
+        glyphOverflow = it == textBoxDataMap.end() ? 0 : &it->second.second;
+    }
+        
+    bool includeLeading = includeLeadingForBox(box);
+    bool includeFont = includeFontForBox(box);
+    
+    bool setUsedFont = false;
+    bool setUsedFontWithLeading = false;
+
+    if (usedFonts && !usedFonts->isEmpty() && (includeFont || (box->renderer()->style(m_firstLine)->lineHeight().isNegative() && includeLeading))) {
+        usedFonts->append(box->renderer()->style(m_firstLine)->font().primaryFont());
+        for (size_t i = 0; i < usedFonts->size(); ++i) {
+            const FontMetrics& fontMetrics = usedFonts->at(i)->fontMetrics();
+            int usedFontAscent = fontMetrics.ascent(baselineType());
+            int usedFontDescent = fontMetrics.descent(baselineType());
+            int halfLeading = (fontMetrics.lineSpacing() - fontMetrics.height()) / 2;
+            int usedFontAscentAndLeading = usedFontAscent + halfLeading;
+            int usedFontDescentAndLeading = fontMetrics.lineSpacing() - usedFontAscentAndLeading;
+            if (includeFont) {
+                setAscentAndDescent(ascent, descent, usedFontAscent, usedFontDescent, ascentDescentSet);
+                setUsedFont = true;
+            }
+            if (includeLeading) {
+                setAscentAndDescent(ascent, descent, usedFontAscentAndLeading, usedFontDescentAndLeading, ascentDescentSet);
+                setUsedFontWithLeading = true;
+            }
+            if (!affectsAscent)
+                affectsAscent = usedFontAscent - box->logicalTop() > 0;
+            if (!affectsDescent)
+                affectsDescent = usedFontDescent + box->logicalTop() > 0;
+        }
+    }
+
+    // If leading is included for the box, then we compute that box.
+    if (includeLeading && !setUsedFontWithLeading) {
+        int ascentWithLeading = box->baselinePosition(baselineType());
+        int descentWithLeading = box->lineHeight() - ascentWithLeading;
+        setAscentAndDescent(ascent, descent, ascentWithLeading, descentWithLeading, ascentDescentSet);
+        
+        // Examine the font box for inline flows and text boxes to see if any part of it is above the baseline.
+        // If the top of our font box relative to the root box baseline is above the root box baseline, then
+        // we are contributing to the maxAscent value. Descent is similar. If any part of our font box is below
+        // the root box's baseline, then we contribute to the maxDescent value.
+        affectsAscent = ascentWithLeading - box->logicalTop() > 0;
+        affectsDescent = descentWithLeading + box->logicalTop() > 0; 
+    }
+    
+    if (includeFontForBox(box) && !setUsedFont) {
+        int fontAscent = box->renderer()->style(m_firstLine)->fontMetrics().ascent();
+        int fontDescent = box->renderer()->style(m_firstLine)->fontMetrics().descent();
+        setAscentAndDescent(ascent, descent, fontAscent, fontDescent, ascentDescentSet);
+        affectsAscent = fontAscent - box->logicalTop() > 0;
+        affectsDescent = fontDescent + box->logicalTop() > 0; 
+    }
+
+    if (includeGlyphsForBox(box) && glyphOverflow && glyphOverflow->computeBounds) {
+        setAscentAndDescent(ascent, descent, glyphOverflow->top, glyphOverflow->bottom, ascentDescentSet);
+        affectsAscent = glyphOverflow->top - box->logicalTop() > 0;
+        affectsDescent = glyphOverflow->bottom + box->logicalTop() > 0; 
+        glyphOverflow->top = min(glyphOverflow->top, max(0, glyphOverflow->top - box->renderer()->style(m_firstLine)->fontMetrics().ascent()));
+        glyphOverflow->bottom = min(glyphOverflow->bottom, max(0, glyphOverflow->bottom - box->renderer()->style(m_firstLine)->fontMetrics().descent()));
+    }
+
+    if (includeMarginForBox(box)) {
+        int ascentWithMargin = box->renderer()->style(m_firstLine)->fontMetrics().ascent();
+        int descentWithMargin = box->renderer()->style(m_firstLine)->fontMetrics().descent();
+        if (box->parent() && !box->renderer()->isText()) {
+            ascentWithMargin += box->boxModelObject()->borderBefore() + box->boxModelObject()->paddingBefore() + box->boxModelObject()->marginBefore();
+            descentWithMargin += box->boxModelObject()->borderAfter() + box->boxModelObject()->paddingAfter() + box->boxModelObject()->marginAfter();
+        }
+        setAscentAndDescent(ascent, descent, ascentWithMargin, descentWithMargin, ascentDescentSet);
+        
+        // Treat like a replaced element, since we're using the margin box.
+        affectsAscent = true;
+        affectsDescent = true;
+    }
+}
+
+int RootInlineBox::verticalPositionForBox(InlineBox* box, VerticalPositionCache& verticalPositionCache)
+{
+    if (box->renderer()->isText())
+        return box->parent()->logicalTop();
+    
+    RenderBoxModelObject* renderer = box->boxModelObject();
+    ASSERT(renderer->isInline());
+    if (!renderer->isInline())
+        return 0;
+
+    // This method determines the vertical position for inline elements.
+    bool firstLine = m_firstLine;
+    if (firstLine && !renderer->document()->usesFirstLineRules())
+        firstLine = false;
+
+    // Check the cache.
+    bool isRenderInline = renderer->isRenderInline();
+    if (isRenderInline && !firstLine) {
+        int verticalPosition = verticalPositionCache.get(renderer, baselineType());
+        if (verticalPosition != PositionUndefined)
+            return verticalPosition;
+    }
+
+    int verticalPosition = 0;
+    EVerticalAlign verticalAlign = renderer->style()->verticalAlign();
+    if (verticalAlign == TOP || verticalAlign == BOTTOM)
+        return 0;
+   
+    RenderObject* parent = renderer->parent();
+    if (parent->isRenderInline() && parent->style()->verticalAlign() != TOP && parent->style()->verticalAlign() != BOTTOM)
+        verticalPosition = box->parent()->logicalTop();
+    
+    if (verticalAlign != BASELINE) {
+        const Font& font = parent->style(firstLine)->font();
+        const FontMetrics& fontMetrics = font.fontMetrics();
+        int fontSize = font.pixelSize();
+
+        LineDirectionMode lineDirection = parent->isHorizontalWritingMode() ? HorizontalLine : VerticalLine;
+
+        if (verticalAlign == SUB)
+            verticalPosition += fontSize / 5 + 1;
+        else if (verticalAlign == SUPER)
+            verticalPosition -= fontSize / 3 + 1;
+        else if (verticalAlign == TEXT_TOP)
+            verticalPosition += renderer->baselinePosition(baselineType(), firstLine, lineDirection) - fontMetrics.ascent(baselineType());
+        else if (verticalAlign == MIDDLE)
+            verticalPosition += -static_cast<int>(fontMetrics.xHeight() / 2) - renderer->lineHeight(firstLine, lineDirection) / 2 + renderer->baselinePosition(baselineType(), firstLine, lineDirection);
+        else if (verticalAlign == TEXT_BOTTOM) {
+            verticalPosition += fontMetrics.descent(baselineType());
+            // lineHeight - baselinePosition is always 0 for replaced elements (except inline blocks), so don't bother wasting time in that case.
+            if (!renderer->isReplaced() || renderer->isInlineBlockOrInlineTable())
+                verticalPosition -= (renderer->lineHeight(firstLine, lineDirection) - renderer->baselinePosition(baselineType(), firstLine, lineDirection));
+        } else if (verticalAlign == BASELINE_MIDDLE)
+            verticalPosition += -renderer->lineHeight(firstLine, lineDirection) / 2 + renderer->baselinePosition(baselineType(), firstLine, lineDirection);
+        else if (verticalAlign == LENGTH)
+            verticalPosition -= renderer->style()->verticalAlignLength().calcValue(renderer->lineHeight(firstLine, lineDirection));
+    }
+
+    // Store the cached value.
+    if (isRenderInline && !firstLine)
+        verticalPositionCache.set(renderer, baselineType(), verticalPosition);
+
+    return verticalPosition;
+}
+
+bool RootInlineBox::includeLeadingForBox(InlineBox* box) const
+{
+    if (box->renderer()->isReplaced() || (box->renderer()->isText() && !box->isText()))
+        return false;
+
+    LineBoxContain lineBoxContain = renderer()->style()->lineBoxContain();
+    return (lineBoxContain & LineBoxContainInline) || (box == this && (lineBoxContain & LineBoxContainBlock));
+}
+
+bool RootInlineBox::includeFontForBox(InlineBox* box) const
+{
+    if (box->renderer()->isReplaced() || (box->renderer()->isText() && !box->isText()))
+        return false;
+    
+    if (!box->isText() && box->isInlineFlowBox() && !static_cast<InlineFlowBox*>(box)->hasTextChildren())
+        return false;
+
+    // For now map "glyphs" to "font" in vertical text mode until the bounds returned by glyphs aren't garbage.
+    LineBoxContain lineBoxContain = renderer()->style()->lineBoxContain();
+    return (lineBoxContain & LineBoxContainFont) || (!isHorizontal() && (lineBoxContain & LineBoxContainGlyphs));
+}
+
+bool RootInlineBox::includeGlyphsForBox(InlineBox* box) const
+{
+    if (box->renderer()->isReplaced() || (box->renderer()->isText() && !box->isText()))
+        return false;
+    
+    if (!box->isText() && box->isInlineFlowBox() && !static_cast<InlineFlowBox*>(box)->hasTextChildren())
+        return false;
+
+    // FIXME: We can't fit to glyphs yet for vertical text, since the bounds returned are garbage.
+    LineBoxContain lineBoxContain = renderer()->style()->lineBoxContain();
+    return isHorizontal() && (lineBoxContain & LineBoxContainGlyphs);
+}
+
+bool RootInlineBox::includeMarginForBox(InlineBox* box) const
+{
+    if (box->renderer()->isReplaced() || (box->renderer()->isText() && !box->isText()))
+        return false;
+
+    LineBoxContain lineBoxContain = renderer()->style()->lineBoxContain();
+    return lineBoxContain & LineBoxContainInlineBox;
+}
+
+
+bool RootInlineBox::fitsToGlyphs() const
+{
+    // FIXME: We can't fit to glyphs yet for vertical text, since the bounds returned are garbage.
+    LineBoxContain lineBoxContain = renderer()->style()->lineBoxContain();
+    return isHorizontal() && (lineBoxContain & LineBoxContainGlyphs);
+}
+
+bool RootInlineBox::includesRootLineBoxFontOrLeading() const
+{
+    LineBoxContain lineBoxContain = renderer()->style()->lineBoxContain();
+    return (lineBoxContain & LineBoxContainBlock) || (lineBoxContain & LineBoxContainInline) || (lineBoxContain & LineBoxContainFont);
+}
+
+Node* RootInlineBox::getLogicalStartBoxWithNode(InlineBox*& startBox)
+{
+    Vector<InlineBox*> leafBoxesInLogicalOrder;
+    collectLeafBoxesInLogicalOrder(leafBoxesInLogicalOrder);
+    for (size_t i = 0; i < leafBoxesInLogicalOrder.size(); ++i) {
+        if (leafBoxesInLogicalOrder[i]->renderer()->node()) {
+            startBox = leafBoxesInLogicalOrder[i];
+            return startBox->renderer()->node();
+        }
+    }
+    startBox = 0;
+    return 0;
+}
+    
+Node* RootInlineBox::getLogicalEndBoxWithNode(InlineBox*& endBox)
+{
+    Vector<InlineBox*> leafBoxesInLogicalOrder;
+    collectLeafBoxesInLogicalOrder(leafBoxesInLogicalOrder);
+    for (size_t i = leafBoxesInLogicalOrder.size(); i > 0; --i) { 
+        if (leafBoxesInLogicalOrder[i - 1]->renderer()->node()) {
+            endBox = leafBoxesInLogicalOrder[i - 1];
+            return endBox->renderer()->node();
+        }
+    }
+    endBox = 0;
+    return 0;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RootInlineBox.h b/Source/WebCore/rendering/RootInlineBox.h
index 1a9f0a8..0ff5704 100644
--- a/Source/WebCore/rendering/RootInlineBox.h
+++ b/Source/WebCore/rendering/RootInlineBox.h
@@ -99,8 +99,8 @@ public:
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int);
 
-    bool hasSelectedChildren() const { return m_hasSelectedChildren; }
-    void setHasSelectedChildren(bool);
+    bool hasSelectedChildren() const { return m_hasSelectedChildrenOrCanHaveLeadingExpansion; }
+    void setHasSelectedChildren(bool hasSelectedChildren) { m_hasSelectedChildrenOrCanHaveLeadingExpansion = hasSelectedChildren; }
 
     virtual RenderObject::SelectionState selectionState();
     InlineBox* firstSelectedBox();
@@ -133,6 +133,17 @@ public:
 
     IntRect paddedLayoutOverflowRect(int endPadding) const;
 
+    void ascentAndDescentForBox(InlineBox*, GlyphOverflowAndFallbackFontsMap&, int& ascent, int& descent, bool& affectsAscent, bool& affectsDescent) const;
+    int verticalPositionForBox(InlineBox*, VerticalPositionCache&);
+    bool includeLeadingForBox(InlineBox*) const;
+    bool includeFontForBox(InlineBox*) const;
+    bool includeGlyphsForBox(InlineBox*) const;
+    bool includeMarginForBox(InlineBox*) const;
+    bool fitsToGlyphs() const;
+    bool includesRootLineBoxFontOrLeading() const;
+
+    Node* getLogicalStartBoxWithNode(InlineBox*&);
+    Node* getLogicalEndBoxWithNode(InlineBox*&);
 private:
     bool hasEllipsisBox() const { return m_hasEllipsisBoxOrHyphen; }
     void setHasEllipsisBox(bool hasEllipsisBox) { m_hasEllipsisBoxOrHyphen = hasEllipsisBox; }
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp b/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
index 075f6ba..51046f8 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLRoot.cpp
@@ -229,7 +229,10 @@ void RenderMathMLRoot::layout()
     }
     
     // Positioning of the index
-    RenderBoxModelObject* indexBox = toRenderBoxModelObject(firstChild()->firstChild());
+    RenderObject* possibleIndex = firstChild()->firstChild();
+    while (possibleIndex && !possibleIndex->isBoxModelObject())
+        possibleIndex = possibleIndex->nextSibling();
+    RenderBoxModelObject* indexBox = toRenderBoxModelObject(possibleIndex);
     if (!indexBox)
         return;
     
diff --git a/Source/WebCore/rendering/style/BorderData.h b/Source/WebCore/rendering/style/BorderData.h
index 0e50edb..26f089f 100644
--- a/Source/WebCore/rendering/style/BorderData.h
+++ b/Source/WebCore/rendering/style/BorderData.h
@@ -49,13 +49,13 @@ public:
 
     bool hasBorderRadius() const
     {
-        if (m_topLeft.width().rawValue() > 0)
+        if (!m_topLeft.width().isZero())
             return true;
-        if (m_topRight.width().rawValue() > 0)
+        if (!m_topRight.width().isZero())
             return true;
-        if (m_bottomLeft.width().rawValue() > 0)
+        if (!m_bottomLeft.width().isZero())
             return true;
-        if (m_bottomRight.width().rawValue() > 0)
+        if (!m_bottomRight.width().isZero())
             return true;
         return false;
     }
diff --git a/Source/WebCore/rendering/style/FillLayer.cpp b/Source/WebCore/rendering/style/FillLayer.cpp
index 59f3bb2..c957cfe 100644
--- a/Source/WebCore/rendering/style/FillLayer.cpp
+++ b/Source/WebCore/rendering/style/FillLayer.cpp
@@ -129,17 +129,6 @@ bool FillLayer::operator==(const FillLayer& o) const
 void FillLayer::fillUnsetProperties()
 {
     FillLayer* curr;
-    for (curr = this; curr && curr->isImageSet(); curr = curr->next()) { }
-    if (curr && curr != this) {
-        // We need to fill in the remaining values with the pattern specified.
-        for (FillLayer* pattern = this; curr; curr = curr->next()) {
-            curr->m_image = pattern->m_image;
-            pattern = pattern->next();
-            if (pattern == curr || !pattern)
-                pattern = this;
-        }
-    }
-    
     for (curr = this; curr && curr->isXPositionSet(); curr = curr->next()) { }
     if (curr && curr != this) {
         // We need to fill in the remaining values with the pattern specified.
@@ -246,12 +235,7 @@ void FillLayer::cullEmptyLayers()
     FillLayer* next;
     for (FillLayer* p = this; p; p = next) {
         next = p->m_next;
-        if (next && !next->isImageSet() &&
-            !next->isXPositionSet() && !next->isYPositionSet() &&
-            !next->isAttachmentSet() && !next->isClipSet() &&
-            !next->isCompositeSet() && !next->isOriginSet() &&
-            !next->isRepeatXSet() && !next->isRepeatYSet()
-            && !next->isSizeSet()) {
+        if (next && !next->isImageSet()) {
             delete next;
             p->m_next = 0;
             break;
diff --git a/Source/WebCore/rendering/style/RenderStyle.cpp b/Source/WebCore/rendering/style/RenderStyle.cpp
index 122b762..34e972d 100644
--- a/Source/WebCore/rendering/style/RenderStyle.cpp
+++ b/Source/WebCore/rendering/style/RenderStyle.cpp
@@ -56,6 +56,14 @@ PassRefPtr<RenderStyle> RenderStyle::createDefaultStyle()
     return adoptRef(new RenderStyle(true));
 }
 
+PassRefPtr<RenderStyle> RenderStyle::createAnonymousStyle(const RenderStyle* parentStyle)
+{
+    RefPtr<RenderStyle> newStyle = RenderStyle::create();
+    newStyle->inheritFrom(parentStyle);
+    newStyle->inheritUnicodeBidiFrom(parentStyle);
+    return newStyle;
+}
+
 PassRefPtr<RenderStyle> RenderStyle::clone(const RenderStyle* other)
 {
     return adoptRef(new RenderStyle(*other));
@@ -295,21 +303,6 @@ static bool positionedObjectMoved(const LengthBox& a, const LengthBox& b)
     return true;
 }
 
-/*
-  compares two styles. The result gives an idea of the action that
-  needs to be taken when replacing the old style with a new one.
-
-  CbLayout: The containing block of the object needs a relayout.
-  Layout: the RenderObject needs a relayout after the style change
-  Visible: The change is visible, but no relayout is needed
-  NonVisible: The object does need neither repaint nor relayout after
-       the change.
-
-  ### TODO:
-  A lot can be optimised here based on the display type, lots of
-  optimisations are unimplemented, and currently result in the
-  worst case result causing a relayout of the containing block.
-*/
 StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedContextSensitiveProperties) const
 {
     changedContextSensitiveProperties = ContextSensitivePropertyNone;
@@ -411,7 +404,8 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
             rareInheritedData->locale != other->rareInheritedData->locale ||
             rareInheritedData->textEmphasisMark != other->rareInheritedData->textEmphasisMark ||
             rareInheritedData->textEmphasisPosition != other->rareInheritedData->textEmphasisPosition ||
-            rareInheritedData->textEmphasisCustomMark != other->rareInheritedData->textEmphasisCustomMark)
+            rareInheritedData->textEmphasisCustomMark != other->rareInheritedData->textEmphasisCustomMark ||
+            rareInheritedData->m_lineBoxContain != other->rareInheritedData->m_lineBoxContain)
             return StyleDifferenceLayout;
 
         if (!rareInheritedData->shadowDataEquivalent(*other->rareInheritedData.get()))
@@ -499,15 +493,19 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
         rareNonInheritedData->m_counterReset != other->rareNonInheritedData->m_counterReset)
         return StyleDifferenceLayout;
 
+    if ((visibility() == COLLAPSE) != (other->visibility() == COLLAPSE))
+        return StyleDifferenceLayout;
+
     if ((rareNonInheritedData->opacity == 1 && other->rareNonInheritedData->opacity < 1) ||
         (rareNonInheritedData->opacity < 1 && other->rareNonInheritedData->opacity == 1)) {
-        // FIXME: We should add an optimized form of layout that just recomputes visual overflow.
+        // FIXME: We would like to use SimplifiedLayout here, but we can't quite do that yet.
+        // We need to make sure SimplifiedLayout can operate correctly on RenderInlines (we will need
+        // to add a selfNeedsSimplifiedLayout bit in order to not get confused and taint every line).
+        // In addition we need to solve the floating object issue when layers come and go. Right now
+        // a full layout is necessary to keep floating object lists sane.
         return StyleDifferenceLayout;
     }
 
-    if ((visibility() == COLLAPSE) != (other->visibility() == COLLAPSE))
-        return StyleDifferenceLayout;
-                    
 #if ENABLE(SVG)
     // SVGRenderStyle::diff() might have returned StyleDifferenceRepaint, eg. if fill changes.
     // If eg. the font-size changed at the same time, we're not allowed to return StyleDifferenceRepaint,
@@ -525,13 +523,10 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
             if (position() == AbsolutePosition && positionedObjectMoved(surround->offset, other->surround->offset))
                 return StyleDifferenceLayoutPositionedMovementOnly;
 
-            // FIXME: We will need to do a bit of work in RenderObject/Box::setStyle before we
-            // can stop doing a layout when relative positioned objects move.  In particular, we'll need
-            // to update scrolling positions and figure out how to do a repaint properly of the updated layer.
-            //if (other->position() == RelativePosition)
-            //    return RepaintLayer;
-            //else
-                return StyleDifferenceLayout;
+            // FIXME: We would like to use SimplifiedLayout for relative positioning, but we can't quite do that yet.
+            // We need to make sure SimplifiedLayout can operate correctly on RenderInlines (we will need
+            // to add a selfNeedsSimplifiedLayout bit in order to not get confused and taint every line).
+            return StyleDifferenceLayout;
         } else if (m_box->zIndex() != other->m_box->zIndex() || m_box->hasAutoZIndex() != other->m_box->hasAutoZIndex() ||
                  visual->clip != other->visual->clip || visual->hasClip != other->visual->hasClip)
             return StyleDifferenceRepaintLayer;
diff --git a/Source/WebCore/rendering/style/RenderStyle.h b/Source/WebCore/rendering/style/RenderStyle.h
index 79ed6e4..859348f 100644
--- a/Source/WebCore/rendering/style/RenderStyle.h
+++ b/Source/WebCore/rendering/style/RenderStyle.h
@@ -27,6 +27,7 @@
 
 #include "AnimationList.h"
 #include "BorderValue.h"
+#include "CSSLineBoxContainValue.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSPropertyNames.h"
 #include "Color.h"
@@ -58,6 +59,7 @@
 #include "StyleTransformData.h"
 #include "StyleVisualData.h"
 #include "TextDirection.h"
+#include "TextOrientation.h"
 #include "ThemeTypes.h"
 #include "TransformOperations.h"
 #include <wtf/Forward.h>
@@ -106,6 +108,7 @@ class RenderStyle: public RefCounted<RenderStyle> {
     friend class AnimationBase; // Used by CSS animations. We can't allow them to animate based off visited colors.
     friend class ApplyStyleCommand; // Editing has to only reveal unvisited info.
     friend class EditingStyle; // Editing has to only reveal unvisited info.
+    friend class CSSStyleApplyProperty; // Sets members directly.
     friend class CSSStyleSelector; // Sets members directly.
     friend class CSSComputedStyleDeclaration; // Ignores visited styles, so needs to be able to see unvisited info.
     friend class PropertyWrapperMaybeInvalidColor; // Used by CSS animations. We can't allow them to animate based off visited colors.
@@ -184,7 +187,7 @@ protected:
         unsigned _list_style_type : 7; // EListStyleType
         unsigned _list_style_position : 1; // EListStylePosition
         unsigned _visibility : 2; // EVisibility
-        unsigned _text_align : 3; // ETextAlign
+        unsigned _text_align : 4; // ETextAlign
         unsigned _text_transform : 2; // ETextTransform
         unsigned _text_decorations : 4;
         unsigned _cursor_style : 6; // ECursor
@@ -310,6 +313,7 @@ private:
 public:
     static PassRefPtr<RenderStyle> create();
     static PassRefPtr<RenderStyle> createDefaultStyle();
+    static PassRefPtr<RenderStyle> createAnonymousStyle(const RenderStyle* parentStyle);
     static PassRefPtr<RenderStyle> clone(const RenderStyle*);
 
     ~RenderStyle();
@@ -770,6 +774,7 @@ public:
     bool isRunningAcceleratedAnimation() const { return rareNonInheritedData->m_runningAcceleratedAnimation; }
 #endif
 
+    LineBoxContain lineBoxContain() const { return rareInheritedData->m_lineBoxContain; }
     const LineClampValue& lineClamp() const { return rareNonInheritedData->lineClamp; }
     bool textSizeAdjust() const { return rareInheritedData->textSizeAdjust; }
     ETextSecurity textSecurity() const { return static_cast<ETextSecurity>(rareInheritedData->textSecurity); }
@@ -1130,6 +1135,7 @@ public:
     void setIsRunningAcceleratedAnimation(bool b = true) { SET_VAR(rareNonInheritedData, m_runningAcceleratedAnimation, b); }
 #endif
 
+    void setLineBoxContain(LineBoxContain c) { SET_VAR(rareInheritedData, m_lineBoxContain, c); }
     void setLineClamp(LineClampValue c) { SET_VAR(rareNonInheritedData, lineClamp, c); }
     void setTextSizeAdjust(bool b) { SET_VAR(rareInheritedData, textSizeAdjust, b); }
     void setTextSecurity(ETextSecurity aTextSecurity) { SET_VAR(rareInheritedData, textSecurity, aTextSecurity); }
@@ -1246,6 +1252,7 @@ public:
     static TextDirection initialDirection() { return LTR; }
     static WritingMode initialWritingMode() { return TopToBottomWritingMode; }
     static TextCombine initialTextCombine() { return TextCombineNone; }
+    static TextOrientation initialTextOrientation() { return TextOrientationVerticalRight; }
     static EDisplay initialDisplay() { return INLINE; }
     static EEmptyCell initialEmptyCells() { return SHOW; }
     static EFloat initialFloating() { return FNONE; }
@@ -1339,6 +1346,7 @@ public:
     static TextEmphasisMark initialTextEmphasisMark() { return TextEmphasisMarkNone; }
     static const AtomicString& initialTextEmphasisCustomMark() { return nullAtom; }
     static TextEmphasisPosition initialTextEmphasisPosition() { return TextEmphasisPositionOver; }
+    static LineBoxContain initialLineBoxContain() { return LineBoxContainBlock | LineBoxContainInline | LineBoxContainReplaced; }
 
     // Keep these at the end.
     static LineClampValue initialLineClamp() { return LineClampValue(); }
@@ -1365,6 +1373,7 @@ public:
 #endif
 
 private:
+    void inheritUnicodeBidiFrom(const RenderStyle* parent) { noninherited_flags._unicodeBidi = parent->noninherited_flags._unicodeBidi; }
     void getShadowExtent(const ShadowData*, int& top, int& right, int& bottom, int& left) const;
     void getShadowHorizontalExtent(const ShadowData*, int& left, int& right) const;
     void getShadowVerticalExtent(const ShadowData*, int& top, int& bottom) const;
diff --git a/Source/WebCore/rendering/style/RenderStyleConstants.h b/Source/WebCore/rendering/style/RenderStyleConstants.h
index 3c62dbe..08f2c15 100644
--- a/Source/WebCore/rendering/style/RenderStyleConstants.h
+++ b/Source/WebCore/rendering/style/RenderStyleConstants.h
@@ -51,6 +51,7 @@ enum StyleDifference {
     StyleDifferenceRepaint,
     StyleDifferenceRepaintLayer,
     StyleDifferenceLayoutPositionedMovementOnly,
+    StyleDifferenceSimplifiedLayout,
     StyleDifferenceLayout
 };
 
@@ -120,7 +121,7 @@ enum ETableLayout {
 };
 
 enum EUnicodeBidi {
-    UBNormal, Embed, Override
+    UBNormal, Embed, Override, Isolate
 };
 
 // CSS Text Layout Module Level 3: Vertical writing support
@@ -318,7 +319,7 @@ enum EWhiteSpace {
 };
 
 enum ETextAlign {
-    TAAUTO, LEFT, RIGHT, CENTER, JUSTIFY, WEBKIT_LEFT, WEBKIT_RIGHT, WEBKIT_CENTER
+    TAAUTO, LEFT, RIGHT, CENTER, JUSTIFY, WEBKIT_LEFT, WEBKIT_RIGHT, WEBKIT_CENTER, TASTART, TAEND,
 };
 
 enum ETextTransform {
diff --git a/Source/WebCore/rendering/style/StyleRareInheritedData.cpp b/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
index 2798fd1..2253d1c 100644
--- a/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
+++ b/Source/WebCore/rendering/style/StyleRareInheritedData.cpp
@@ -66,6 +66,7 @@ StyleRareInheritedData::StyleRareInheritedData()
     , textEmphasisFill(TextEmphasisFillFilled)
     , textEmphasisMark(TextEmphasisMarkNone)
     , textEmphasisPosition(TextEmphasisPositionOver)
+    , m_lineBoxContain(RenderStyle::initialLineBoxContain())
     , hyphenationLimitBefore(-1)
     , hyphenationLimitAfter(-1)
 {
@@ -113,6 +114,7 @@ StyleRareInheritedData::StyleRareInheritedData(const StyleRareInheritedData& o)
     , textEmphasisFill(o.textEmphasisFill)
     , textEmphasisMark(o.textEmphasisMark)
     , textEmphasisPosition(o.textEmphasisPosition)
+    , m_lineBoxContain(o.m_lineBoxContain)
     , hyphenationString(o.hyphenationString)
     , hyphenationLimitBefore(o.hyphenationLimitBefore)
     , hyphenationLimitAfter(o.hyphenationLimitAfter)
@@ -179,6 +181,7 @@ bool StyleRareInheritedData::operator==(const StyleRareInheritedData& o) const
         && textEmphasisFill == o.textEmphasisFill
         && textEmphasisMark == o.textEmphasisMark
         && textEmphasisPosition == o.textEmphasisPosition
+        && m_lineBoxContain == o.m_lineBoxContain
         && hyphenationString == o.hyphenationString
         && locale == o.locale
         && textEmphasisCustomMark == o.textEmphasisCustomMark
diff --git a/Source/WebCore/rendering/style/StyleRareInheritedData.h b/Source/WebCore/rendering/style/StyleRareInheritedData.h
index d4f233c..39cfe3c 100644
--- a/Source/WebCore/rendering/style/StyleRareInheritedData.h
+++ b/Source/WebCore/rendering/style/StyleRareInheritedData.h
@@ -99,6 +99,7 @@ public:
     unsigned textEmphasisFill : 1; // TextEmphasisFill
     unsigned textEmphasisMark : 3; // TextEmphasisMark
     unsigned textEmphasisPosition : 1; // TextEmphasisPosition
+    unsigned m_lineBoxContain: 7; // LineBoxContain
 
     AtomicString hyphenationString;
     short hyphenationLimitBefore;
diff --git a/Source/WebCore/rendering/style/StyleRareNonInheritedData.h b/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
index 89437f6..268a123 100644
--- a/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
+++ b/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
@@ -107,7 +107,7 @@ public:
     
     short m_counterIncrement;
     short m_counterReset;
-    
+
 #if USE(ACCELERATED_COMPOSITING)
     bool m_runningAcceleratedAnimation : 1;
 #endif
diff --git a/Source/WebCore/rendering/svg/RenderSVGAllInOne.cpp b/Source/WebCore/rendering/svg/RenderSVGAllInOne.cpp
index 835bce8..9f3d8a5 100644
--- a/Source/WebCore/rendering/svg/RenderSVGAllInOne.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGAllInOne.cpp
@@ -34,6 +34,7 @@
 #include "RenderSVGInline.cpp"
 #include "RenderSVGInlineText.cpp"
 #include "RenderSVGModelObject.cpp"
+#include "RenderSVGPath.cpp"
 #include "RenderSVGResource.cpp"
 #include "RenderSVGResourceClipper.cpp"
 #include "RenderSVGResourceContainer.cpp"
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.cpp b/Source/WebCore/rendering/svg/RenderSVGText.cpp
index 56d9306..8ca3d58 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGText.cpp
@@ -51,6 +51,7 @@ namespace WebCore {
 
 RenderSVGText::RenderSVGText(SVGTextElement* node) 
     : RenderSVGBlock(node)
+    , m_needsReordering(false)
     , m_needsPositioningValuesUpdate(true)
     , m_needsTransformUpdate(true)
 {
@@ -127,6 +128,7 @@ void RenderSVGText::layout()
         // Perform SVG text layout phase one (see SVGTextLayoutAttributesBuilder for details).
         SVGTextLayoutAttributesBuilder layoutAttributesBuilder;
         layoutAttributesBuilder.buildLayoutAttributesForTextSubtree(this);
+        m_needsReordering = true;
         m_needsPositioningValuesUpdate = false;
         updateCachedBoundariesInParents = true;
     }
@@ -134,7 +136,7 @@ void RenderSVGText::layout()
     // Reduced version of RenderBlock::layoutBlock(), which only takes care of SVG text.
     // All if branches that could cause early exit in RenderBlocks layoutBlock() method are turned into assertions.
     ASSERT(!isInline());
-    ASSERT(!layoutOnlyPositionedObjects());
+    ASSERT(!simplifiedLayout());
     ASSERT(!scrollsOverflow());
     ASSERT(!hasControlClip());
     ASSERT(!hasColumns());
@@ -150,6 +152,9 @@ void RenderSVGText::layout()
     ASSERT(childrenInline());
     forceLayoutInlineChildren();
 
+    if (m_needsReordering)
+        m_needsReordering = false;
+
     if (!updateCachedBoundariesInParents)
         updateCachedBoundariesInParents = oldBoundaries != objectBoundingBox();
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGText.h b/Source/WebCore/rendering/svg/RenderSVGText.h
index 188d5fc..93fc5f8 100644
--- a/Source/WebCore/rendering/svg/RenderSVGText.h
+++ b/Source/WebCore/rendering/svg/RenderSVGText.h
@@ -26,6 +26,7 @@
 
 #include "AffineTransform.h"
 #include "RenderSVGBlock.h"
+#include "SVGTextLayoutAttributes.h"
 
 namespace WebCore {
 
@@ -33,7 +34,7 @@ class SVGTextElement;
 
 class RenderSVGText : public RenderSVGBlock {
 public:
-    RenderSVGText(SVGTextElement* node);
+    RenderSVGText(SVGTextElement*);
 
     void setNeedsPositioningValuesUpdate() { m_needsPositioningValuesUpdate = true; }
     virtual void setNeedsTransformUpdate() { m_needsTransformUpdate = true; }
@@ -42,6 +43,9 @@ public:
     static RenderSVGText* locateRenderSVGTextAncestor(RenderObject*);
     static const RenderSVGText* locateRenderSVGTextAncestor(const RenderObject*);
 
+    Vector<SVGTextLayoutAttributes>& layoutAttributes() { return m_layoutAttributes; }
+    bool needsReordering() const { return m_needsReordering; }
+
 private:
     virtual const char* renderName() const { return "RenderSVGText"; }
     virtual bool isSVGText() const { return true; }
@@ -71,9 +75,11 @@ private:
     virtual RenderBlock* firstLineBlock() const;
     virtual void updateFirstLetter();
 
+    bool m_needsReordering : 1;
     bool m_needsPositioningValuesUpdate : 1;
     bool m_needsTransformUpdate : 1;
     AffineTransform m_localTransform;
+    Vector<SVGTextLayoutAttributes> m_layoutAttributes;
 };
 
 inline RenderSVGText* toRenderSVGText(RenderObject* object)
diff --git a/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp b/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
index 05e1357..17bbfaa 100644
--- a/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
+++ b/Source/WebCore/rendering/svg/SVGInlineTextBox.cpp
@@ -73,7 +73,7 @@ int SVGInlineTextBox::offsetForPositionInFragment(const SVGTextFragment& fragmen
     if (!fragment.transform.isIdentity())
         textRun.setHorizontalGlyphStretch(narrowPrecisionToFloat(fragment.transform.xScale()));
 
-    return fragment.positionListOffset - start() + textRenderer->scaledFont().offsetForPosition(textRun, position * scalingFactor, includePartialGlyphs);
+    return fragment.characterOffset - start() + textRenderer->scaledFont().offsetForPosition(textRun, position * scalingFactor, includePartialGlyphs);
 }
 
 float SVGInlineTextBox::positionForOffset(int) const
@@ -402,7 +402,7 @@ TextRun SVGInlineTextBox::constructTextRun(RenderStyle* style, const SVGTextFrag
     RenderText* text = textRenderer();
     ASSERT(text);
 
-    TextRun run(text->characters() + fragment.positionListOffset
+    TextRun run(text->characters() + fragment.characterOffset
                 , fragment.length
                 , false /* allowTabs */
                 , 0 /* xPos, only relevant with allowTabs=true */
@@ -425,7 +425,7 @@ bool SVGInlineTextBox::mapStartEndPositionsIntoFragmentCoordinates(const SVGText
     if (startPosition >= endPosition)
         return false;
 
-    int offset = static_cast<int>(fragment.positionListOffset) - start();
+    int offset = static_cast<int>(fragment.characterOffset) - start();
     int length = static_cast<int>(fragment.length);
 
     if (startPosition >= offset + length || endPosition <= offset)
diff --git a/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp b/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp
index 0f94fdd..a099f87 100644
--- a/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp
+++ b/Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp
@@ -464,8 +464,8 @@ static inline void writeSVGInlineTextBox(TextStream& ts, SVGInlineTextBox* textB
         SVGTextFragment& fragment = fragments.at(i);
         writeIndent(ts, indent + 1);
 
-        unsigned startOffset = fragment.positionListOffset;
-        unsigned endOffset = fragment.positionListOffset + fragment.length;
+        unsigned startOffset = fragment.characterOffset;
+        unsigned endOffset = fragment.characterOffset + fragment.length;
 
         // FIXME: Remove this hack, once the new text layout engine is completly landed. We want to preserve the old layout test results for now.
         ts << "chunk 1 ";
@@ -500,7 +500,7 @@ static inline void writeSVGInlineTextBox(TextStream& ts, SVGInlineTextBox* textB
                 ts << " override";
         }
 
-        ts << ": " << quoteAndEscapeNonPrintables(text.substring(fragment.positionListOffset, fragment.length)) << "\n";
+        ts << ": " << quoteAndEscapeNonPrintables(text.substring(fragment.characterOffset, fragment.length)) << "\n";
     }
 }
 
diff --git a/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp b/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
index c2289d6..ddbd3ea 100644
--- a/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
+++ b/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
@@ -25,8 +25,8 @@
 
 #if ENABLE(SVG)
 #include "GraphicsContext.h"
-#include "RenderBlock.h"
 #include "RenderSVGInlineText.h"
+#include "RenderSVGText.h"
 #include "SVGInlineFlowBox.h"
 #include "SVGInlineTextBox.h"
 #include "SVGNames.h"
@@ -73,8 +73,15 @@ void SVGRootInlineBox::paint(PaintInfo& paintInfo, int, int)
 
 void SVGRootInlineBox::computePerCharacterLayoutInformation()
 {
+    RenderSVGText* parentBlock = toRenderSVGText(block());
+    ASSERT(parentBlock);
+
+    Vector<SVGTextLayoutAttributes>& attributes = parentBlock->layoutAttributes();
+    if (parentBlock->needsReordering())
+        reorderValueLists(attributes);
+
     // Perform SVG text layout phase two (see SVGTextLayoutEngine for details).
-    SVGTextLayoutEngine characterLayout;
+    SVGTextLayoutEngine characterLayout(attributes);
     layoutCharactersInTextBoxes(this, characterLayout);
 
     // Perform SVG text layout phase three (see SVGTextChunkBuilder for details).
@@ -108,8 +115,12 @@ void SVGRootInlineBox::layoutCharactersInTextBoxes(InlineFlowBox* start, SVGText
             if (isTextPath) {
                 // Build text chunks for all <textPath> children, using the line layout algorithm.
                 // This is needeed as text-anchor is just an additional startOffset for text paths.
-                SVGTextLayoutEngine lineLayout;
+                RenderSVGText* parentBlock = toRenderSVGText(block());
+                ASSERT(parentBlock);
+
+                SVGTextLayoutEngine lineLayout(parentBlock->layoutAttributes());
                 layoutCharactersInTextBoxes(flowBox, lineLayout);
+
                 characterLayout.beginTextPathLayout(child->renderer(), lineLayout);
             }
 
@@ -215,6 +226,91 @@ InlineBox* SVGRootInlineBox::closestLeafChildForPosition(const IntPoint& point)
 
     return closestLeaf ? closestLeaf : lastLeaf;
 }
+ 
+static inline void swapItemsInVector(Vector<float>& firstVector, Vector<float>& lastVector, unsigned first, unsigned last)
+{
+    float temp = firstVector.at(first);
+    firstVector.at(first) = lastVector.at(last);
+    lastVector.at(last) = temp;
+}
+
+static inline void swapItemsInLayoutAttributes(SVGTextLayoutAttributes& firstAttributes, SVGTextLayoutAttributes& lastAttributes, unsigned firstPosition, unsigned lastPosition)
+{
+    swapItemsInVector(firstAttributes.xValues(), lastAttributes.xValues(), firstPosition, lastPosition);
+    swapItemsInVector(firstAttributes.yValues(), lastAttributes.yValues(), firstPosition, lastPosition);
+    swapItemsInVector(firstAttributes.dxValues(), lastAttributes.dxValues(), firstPosition, lastPosition);
+    swapItemsInVector(firstAttributes.dyValues(), lastAttributes.dyValues(), firstPosition, lastPosition);
+    swapItemsInVector(firstAttributes.rotateValues(), lastAttributes.rotateValues(), firstPosition, lastPosition);
+}
+
+static inline void findFirstAndLastAttributesInVector(Vector<SVGTextLayoutAttributes>& attributes, RenderSVGInlineText* firstContext, RenderSVGInlineText* lastContext,
+                                                      SVGTextLayoutAttributes*& first, SVGTextLayoutAttributes*& last)
+{
+    first = 0;
+    last = 0;
+
+    unsigned attributesSize = attributes.size();
+    for (unsigned i = 0; i < attributesSize; ++i) {
+        SVGTextLayoutAttributes& current = attributes.at(i);
+        if (!first && firstContext == current.context())
+            first = &current;
+        if (!last && lastContext == current.context())
+            last = &current;
+        if (first && last)
+            break;
+    }
+
+    ASSERT(first);
+    ASSERT(last);
+}
+
+static inline void reverseInlineBoxRangeAndValueListsIfNeeded(void* userData, Vector<InlineBox*>::iterator first, Vector<InlineBox*>::iterator last)
+{
+    ASSERT(userData);
+    Vector<SVGTextLayoutAttributes>& attributes = *reinterpret_cast<Vector<SVGTextLayoutAttributes>*>(userData);
+
+    // This is a copy of std::reverse(first, last). It additionally assure that the value lists within the InlineBoxes are reordered as well.
+    while (true)  {
+        if (first == last || first == --last)
+            return;
+
+        ASSERT((*first)->isSVGInlineTextBox());
+        ASSERT((*last)->isSVGInlineTextBox());
+
+        SVGInlineTextBox* firstTextBox = static_cast<SVGInlineTextBox*>(*first);
+        SVGInlineTextBox* lastTextBox = static_cast<SVGInlineTextBox*>(*last);
+
+        // Reordering is only necessary for BiDi text that is _absolutely_ positioned.
+        if (firstTextBox->len() == 1 && firstTextBox->len() == lastTextBox->len()) {
+            RenderSVGInlineText* firstContext = toRenderSVGInlineText(firstTextBox->textRenderer());
+            RenderSVGInlineText* lastContext = toRenderSVGInlineText(lastTextBox->textRenderer());
+
+            SVGTextLayoutAttributes* firstAttributes = 0;
+            SVGTextLayoutAttributes* lastAttributes = 0;
+            findFirstAndLastAttributesInVector(attributes, firstContext, lastContext, firstAttributes, lastAttributes);
+
+            unsigned firstBoxPosition = firstTextBox->start();
+            unsigned firstBoxEnd = firstTextBox->end();
+
+            unsigned lastBoxPosition = lastTextBox->start();
+            unsigned lastBoxEnd = lastTextBox->end();
+            for (; firstBoxPosition <= firstBoxEnd && lastBoxPosition <= lastBoxEnd; ++lastBoxPosition, ++firstBoxPosition)
+                swapItemsInLayoutAttributes(*firstAttributes, *lastAttributes, firstBoxPosition, lastBoxPosition);
+        }
+
+        InlineBox* temp = *first;
+        *first = *last;
+        *last = temp;
+
+        ++first;
+    }
+}
+
+void SVGRootInlineBox::reorderValueLists(Vector<SVGTextLayoutAttributes>& attributes)
+{
+    Vector<InlineBox*> leafBoxesInLogicalOrder;
+    collectLeafBoxesInLogicalOrder(leafBoxesInLogicalOrder, reverseInlineBoxRangeAndValueListsIfNeeded, &attributes);
+}
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/rendering/svg/SVGRootInlineBox.h b/Source/WebCore/rendering/svg/SVGRootInlineBox.h
index 2e073c9..39612e7 100644
--- a/Source/WebCore/rendering/svg/SVGRootInlineBox.h
+++ b/Source/WebCore/rendering/svg/SVGRootInlineBox.h
@@ -55,6 +55,7 @@ public:
     InlineBox* closestLeafChildForPosition(const IntPoint&);
 
 private:
+    void reorderValueLists(Vector<SVGTextLayoutAttributes>&);
     void layoutCharactersInTextBoxes(InlineFlowBox*, SVGTextLayoutEngine&);
     void layoutChildBoxes(InlineFlowBox*);
     void layoutRootBox();
diff --git a/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp b/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp
index 2d84c48..9ccdef0 100644
--- a/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp
+++ b/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp
@@ -47,6 +47,10 @@ FloatSize SVGShadowTreeContainerElement::containerTranslation() const
     return FloatSize(m_xOffset.value(this), m_yOffset.value(this));
 }
 
+PassRefPtr<Element> SVGShadowTreeContainerElement::cloneElementWithoutAttributesAndChildren() const
+{
+    return adoptRef(new SVGShadowTreeContainerElement(document()));
+}
 // SVGShadowTreeRootElement
 
 inline SVGShadowTreeRootElement::SVGShadowTreeRootElement(Document* document, SVGUseElement* shadowParent)
diff --git a/Source/WebCore/rendering/svg/SVGShadowTreeElements.h b/Source/WebCore/rendering/svg/SVGShadowTreeElements.h
index 3406f95..2952e35 100644
--- a/Source/WebCore/rendering/svg/SVGShadowTreeElements.h
+++ b/Source/WebCore/rendering/svg/SVGShadowTreeElements.h
@@ -44,6 +44,7 @@ protected:
     SVGShadowTreeContainerElement(Document*);
 
 private:
+    virtual PassRefPtr<Element> cloneElementWithoutAttributesAndChildren() const;
     virtual bool isShadowTreeContainerElement() const { return true; }
 
     SVGLength m_xOffset;
diff --git a/Source/WebCore/rendering/svg/SVGTextChunk.cpp b/Source/WebCore/rendering/svg/SVGTextChunk.cpp
index 5dea6ad..49407e5 100644
--- a/Source/WebCore/rendering/svg/SVGTextChunk.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextChunk.cpp
@@ -27,10 +27,8 @@
 
 namespace WebCore {
 
-SVGTextChunk::SVGTextChunk(bool isVerticalText, ETextAnchor textAnchor, SVGTextContentElement::SVGLengthAdjustType lengthAdjust, float desiredTextLength)
-    : m_isVerticalText(isVerticalText)
-    , m_textAnchor(textAnchor)
-    , m_lengthAdjust(lengthAdjust)
+SVGTextChunk::SVGTextChunk(unsigned chunkStyle, float desiredTextLength)
+    : m_chunkStyle(chunkStyle)
     , m_desiredTextLength(desiredTextLength)
 {
 }
@@ -52,7 +50,7 @@ void SVGTextChunk::calculateLength(float& length, unsigned& characters) const
             SVGTextFragment& fragment = fragments.at(i);
             characters += fragment.length;
 
-            if (m_isVerticalText)
+            if (m_chunkStyle & VerticalText)
                 length += fragment.height;
             else
                 length += fragment.width;
@@ -63,7 +61,7 @@ void SVGTextChunk::calculateLength(float& length, unsigned& characters) const
             }
 
             // Resepect gap between chunks.
-            if (m_isVerticalText)
+            if (m_chunkStyle & VerticalText)
                  length += fragment.y - (lastFragment->y + lastFragment->height);
             else
                  length += fragment.x - (lastFragment->x + lastFragment->width);
@@ -75,17 +73,11 @@ void SVGTextChunk::calculateLength(float& length, unsigned& characters) const
 
 float SVGTextChunk::calculateTextAnchorShift(float length) const
 {
-    switch (m_textAnchor) {
-    case TA_START:
-        return 0;
-    case TA_MIDDLE:
+    if (m_chunkStyle & MiddleAnchor)
         return -length / 2;
-    case TA_END:
-        return -length;
-    };
-
-    ASSERT_NOT_REACHED();
-    return 0;
+    if (m_chunkStyle & EndAnchor)
+        return m_chunkStyle & RightToLeftText ? 0 : -length;
+    return m_chunkStyle & RightToLeftText ? -length : 0;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/svg/SVGTextChunk.h b/Source/WebCore/rendering/svg/SVGTextChunk.h
index ebe6d81..9618d9f 100644
--- a/Source/WebCore/rendering/svg/SVGTextChunk.h
+++ b/Source/WebCore/rendering/svg/SVGTextChunk.h
@@ -31,34 +31,37 @@ class SVGInlineTextBox;
 // A SVGTextChunk describes a range of SVGTextFragments, see the SVG spec definition of a "text chunk".
 class SVGTextChunk {
 public:
-    SVGTextChunk(bool isVerticalText, ETextAnchor, SVGTextContentElement::SVGLengthAdjustType, float desiredTextLength);
+    enum ChunkStyle {
+        DefaultStyle = 1 << 0,
+        MiddleAnchor = 1 << 1,
+        EndAnchor = 1 << 2,
+        RightToLeftText = 1 << 3,
+        VerticalText = 1 << 4,
+        LengthAdjustSpacing = 1 << 5,
+        LengthAdjustSpacingAndGlyphs = 1 << 6
+    };
+
+    SVGTextChunk(unsigned chunkStyle, float desiredTextLength);
 
     void calculateLength(float& length, unsigned& characters) const;
     float calculateTextAnchorShift(float length) const;
 
-    bool isVerticalText() const { return m_isVerticalText; }
-    ETextAnchor textAnchor() const { return m_textAnchor; }
-    SVGTextContentElement::SVGLengthAdjustType lengthAdjust() const { return m_lengthAdjust; }
+    bool isVerticalText() const { return m_chunkStyle & VerticalText; }
     float desiredTextLength() const { return m_desiredTextLength; }
 
     Vector<SVGInlineTextBox*>& boxes() { return m_boxes; }
     const Vector<SVGInlineTextBox*>& boxes() const { return m_boxes; }
 
-    bool hasDesiredTextLength() const { return m_lengthAdjust != SVGTextContentElement::LENGTHADJUST_UNKNOWN && m_desiredTextLength > 0; } 
-    bool hasTextAnchor() const { return m_textAnchor != TA_START; }
+    bool hasDesiredTextLength() const { return m_desiredTextLength > 0 && ((m_chunkStyle & LengthAdjustSpacing) || (m_chunkStyle & LengthAdjustSpacingAndGlyphs)); }
+    bool hasTextAnchor() const {  return m_chunkStyle & RightToLeftText ? !(m_chunkStyle & EndAnchor) : (m_chunkStyle & MiddleAnchor) || (m_chunkStyle & EndAnchor); }
+    bool hasLengthAdjustSpacing() const { return m_chunkStyle & LengthAdjustSpacing; }
+    bool hasLengthAdjustSpacingAndGlyphs() const { return m_chunkStyle & LengthAdjustSpacingAndGlyphs; }
 
 private:
     // Contains all SVGInlineTextBoxes this chunk spans.
     Vector<SVGInlineTextBox*> m_boxes;
 
-    // writing-mode specific property.
-    bool m_isVerticalText;
-
-    // text-anchor specific properties.
-    ETextAnchor m_textAnchor;
-
-    // textLength/lengthAdjust specific properties.
-    SVGTextContentElement::SVGLengthAdjustType m_lengthAdjust;
+    unsigned m_chunkStyle;
     float m_desiredTextLength;
 };
 
diff --git a/Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp b/Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp
index bbbae6c..47311bd 100644
--- a/Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextChunkBuilder.cpp
@@ -101,15 +101,47 @@ void SVGTextChunkBuilder::addTextChunk(Vector<SVGInlineTextBox*>& lineLayoutBoxe
     const SVGRenderStyle* svgStyle = style->svgStyle();
     ASSERT(svgStyle);
 
-    SVGTextContentElement::SVGLengthAdjustType lengthAdjust = SVGTextContentElement::LENGTHADJUST_UNKNOWN;
+    // Build chunk style flags.
+    unsigned chunkStyle = SVGTextChunk::DefaultStyle;
+
+    // Handle 'direction' property.
+    if (!style->isLeftToRightDirection())
+        chunkStyle |= SVGTextChunk::RightToLeftText;
+
+    // Handle 'writing-mode' property.
+    if (svgStyle->isVerticalWritingMode())
+        chunkStyle |= SVGTextChunk::VerticalText;
+
+    // Handle 'text-anchor' property.
+    switch (svgStyle->textAnchor()) {
+    case TA_START:
+        break;
+    case TA_MIDDLE:
+        chunkStyle |= SVGTextChunk::MiddleAnchor;
+        break;
+    case TA_END:
+        chunkStyle |= SVGTextChunk::EndAnchor;
+        break;
+    };
+
+    // Handle 'lengthAdjust' property.
     float desiredTextLength = 0;
-
     if (SVGTextContentElement* textContentElement = SVGTextContentElement::elementFromRenderer(textRenderer->parent())) {
-        lengthAdjust = static_cast<SVGTextContentElement::SVGLengthAdjustType>(textContentElement->lengthAdjust());
         desiredTextLength = textContentElement->textLength().value(textContentElement);
+
+        switch (static_cast<SVGTextContentElement::SVGLengthAdjustType>(textContentElement->lengthAdjust())) {
+        case SVGTextContentElement::LENGTHADJUST_UNKNOWN:
+            break;
+        case SVGTextContentElement::LENGTHADJUST_SPACING:
+            chunkStyle |= SVGTextChunk::LengthAdjustSpacing;
+            break;
+        case SVGTextContentElement::LENGTHADJUST_SPACINGANDGLYPHS:
+            chunkStyle |= SVGTextChunk::LengthAdjustSpacingAndGlyphs;
+            break;
+        };
     }
 
-    SVGTextChunk chunk(svgStyle->isVerticalWritingMode(), svgStyle->textAnchor(), lengthAdjust, desiredTextLength);
+    SVGTextChunk chunk(chunkStyle, desiredTextLength);
 
     Vector<SVGInlineTextBox*>& boxes = chunk.boxes();
     for (unsigned i = boxStart; i < boxStart + boxCount; ++i)
@@ -137,7 +169,7 @@ void SVGTextChunkBuilder::processTextChunk(const SVGTextChunk& chunk)
 
     bool isVerticalText = chunk.isVerticalText();
     if (processTextLength) {
-        if (chunk.lengthAdjust() == SVGTextContentElement::LENGTHADJUST_SPACING) {
+        if (chunk.hasLengthAdjustSpacing()) {
             float textLengthShift = (chunk.desiredTextLength() - chunkLength) / chunkCharacters;
             unsigned atCharacter = 0;
             for (unsigned boxPosition = 0; boxPosition < boxCount; ++boxPosition) {
@@ -147,7 +179,7 @@ void SVGTextChunkBuilder::processTextChunk(const SVGTextChunk& chunk)
                 processTextLengthSpacingCorrection(isVerticalText, textLengthShift, fragments, atCharacter);
             }
         } else {
-            ASSERT(chunk.lengthAdjust() == SVGTextContentElement::LENGTHADJUST_SPACINGANDGLYPHS);
+            ASSERT(chunk.hasLengthAdjustSpacingAndGlyphs());
             float scale = chunk.desiredTextLength() / chunkLength;
             AffineTransform spacingAndGlyphsTransform;
 
@@ -172,7 +204,7 @@ void SVGTextChunkBuilder::processTextChunk(const SVGTextChunk& chunk)
         return;
 
     // If we previously applied a lengthAdjust="spacing" correction, we have to recalculate the chunk length, to be able to apply the text-anchor shift.
-    if (processTextLength && chunk.lengthAdjust() == SVGTextContentElement::LENGTHADJUST_SPACING) {
+    if (processTextLength && chunk.hasLengthAdjustSpacing()) {
         chunkLength = 0;
         chunkCharacters = 0;
         chunk.calculateLength(chunkLength, chunkCharacters);
diff --git a/Source/WebCore/rendering/svg/SVGTextFragment.h b/Source/WebCore/rendering/svg/SVGTextFragment.h
index 2e520da..b5b3c57 100644
--- a/Source/WebCore/rendering/svg/SVGTextFragment.h
+++ b/Source/WebCore/rendering/svg/SVGTextFragment.h
@@ -28,7 +28,8 @@ namespace WebCore {
 // A SVGTextFragment describes a text fragment of a RenderSVGInlineText which can be rendered at once.
 struct SVGTextFragment {
     SVGTextFragment()
-        : positionListOffset(0)
+        : characterOffset(0)
+        , metricsListOffset(0)
         , length(0)
         , x(0)
         , y(0)
@@ -37,8 +38,9 @@ struct SVGTextFragment {
     {
     }
 
-    // The first rendered character starts at RenderSVGInlineText::characters() + positionListOffset.
-    unsigned positionListOffset;
+    // The first rendered character starts at RenderSVGInlineText::characters() + characterOffset.
+    unsigned characterOffset;
+    unsigned metricsListOffset;
     unsigned length;
 
     float x;
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp b/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp
index 3037b77..4c227b4 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp
@@ -27,7 +27,8 @@
 
 namespace WebCore {
 
-SVGTextLayoutAttributes::SVGTextLayoutAttributes()
+SVGTextLayoutAttributes::SVGTextLayoutAttributes(RenderSVGInlineText* context)
+    : m_context(context)
 {
 }
 
@@ -65,6 +66,8 @@ static inline void dumpLayoutVector(const Vector<float>& values)
 
 void SVGTextLayoutAttributes::dump() const
 {
+    fprintf(stderr, "context: %p\n", m_context);
+
     fprintf(stderr, "x values: ");
     dumpLayoutVector(m_xValues);
     fprintf(stderr, "\n");
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.h b/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.h
index d08d5b7..fc6bd10 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.h
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutAttributes.h
@@ -27,15 +27,19 @@
 
 namespace WebCore {
 
+class RenderSVGInlineText;
+
 class SVGTextLayoutAttributes {
 public:
-    SVGTextLayoutAttributes();
+    SVGTextLayoutAttributes(RenderSVGInlineText* context = 0);
 
     void reserveCapacity(unsigned length);
     void dump() const;
 
     static float emptyValue();
 
+    RenderSVGInlineText* context() const { return m_context; }
+
     Vector<float>& xValues() { return m_xValues; }
     const Vector<float>& xValues() const { return m_xValues; }
 
@@ -55,6 +59,7 @@ public:
     const Vector<SVGTextMetrics>& textMetricsValues() const { return m_textMetricsValues; }
 
 private:
+    RenderSVGInlineText* m_context;
     Vector<float> m_xValues;
     Vector<float> m_yValues;
     Vector<float> m_dxValues;
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
index 3122912..86be424 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
@@ -52,9 +52,11 @@ void SVGTextLayoutAttributesBuilder::buildLayoutAttributesForTextSubtree(RenderS
     buildOutermostLayoutScope(textRoot, atCharacter);
 
     // Propagate layout attributes to each RenderSVGInlineText object.
+    Vector<SVGTextLayoutAttributes>& allAttributes = textRoot->layoutAttributes();
+    allAttributes.clear();
     atCharacter = 0;
     lastCharacter = '\0';
-    propagateLayoutAttributes(textRoot, atCharacter, lastCharacter);
+    propagateLayoutAttributes(textRoot, allAttributes, atCharacter, lastCharacter);
 }
 
 static inline void extractFloatValuesFromSVGLengthList(SVGElement* lengthContext, const SVGLengthList& list, Vector<float>& floatValues, unsigned textContentLength)
@@ -186,7 +188,7 @@ void SVGTextLayoutAttributesBuilder::buildOutermostLayoutScope(RenderSVGText* te
     m_scopes.prepend(scope);
 }
 
-void SVGTextLayoutAttributesBuilder::propagateLayoutAttributes(RenderObject* start, unsigned& atCharacter, UChar& lastCharacter) const
+void SVGTextLayoutAttributesBuilder::propagateLayoutAttributes(RenderObject* start, Vector<SVGTextLayoutAttributes>& allAttributes, unsigned& atCharacter, UChar& lastCharacter) const
 {
     for (RenderObject* child = start->firstChild(); child; child = child->nextSibling()) { 
         if (child->isSVGInlineText()) {
@@ -195,16 +197,29 @@ void SVGTextLayoutAttributesBuilder::propagateLayoutAttributes(RenderObject* sta
             unsigned textLength = text->textLength();
             bool preserveWhiteSpace = shouldPreserveAllWhiteSpace(text->style());
 
-            SVGTextLayoutAttributes attributes;
+            SVGTextLayoutAttributes attributes(text);
             attributes.reserveCapacity(textLength);
     
             unsigned valueListPosition = atCharacter;
             unsigned metricsLength = 1;
+            SVGTextMetrics lastMetrics = SVGTextMetrics::emptyMetrics();
+
             for (unsigned textPosition = 0; textPosition < textLength; textPosition += metricsLength) {
                 const UChar& currentCharacter = characters[textPosition];
 
-                SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(text, textPosition, 1);
-                metricsLength = metrics.length();
+                SVGTextMetrics startToCurrentMetrics = SVGTextMetrics::measureCharacterRange(text, 0, textPosition + 1);
+                SVGTextMetrics currentMetrics = SVGTextMetrics::measureCharacterRange(text, textPosition, 1);
+
+                // Frequent case for Arabic text: when measuring a single character the arabic isolated form is taken
+                // when rendering the glyph "in context" (with it's surrounding characters) it changes due to shaping.
+                // So whenever runWidthAdvance != currentMetrics.width(), we are processing a text run whose length is
+                // not equal to the sum of the individual lengths of the glyphs, when measuring them isolated.
+                float runWidthAdvance = startToCurrentMetrics.width() - lastMetrics.width();
+                if (runWidthAdvance != currentMetrics.width())
+                    currentMetrics.setWidth(runWidthAdvance);
+
+                lastMetrics = startToCurrentMetrics;
+                metricsLength = currentMetrics.length();
 
                 if (!preserveWhiteSpace && characterIsSpace(currentCharacter) && characterIsSpaceOrNull(lastCharacter)) {
                     assignEmptyLayoutAttributesForCharacter(attributes);
@@ -212,7 +227,7 @@ void SVGTextLayoutAttributesBuilder::propagateLayoutAttributes(RenderObject* sta
                     continue;
                 }
 
-                assignLayoutAttributesForCharacter(attributes, metrics, valueListPosition);
+                assignLayoutAttributesForCharacter(attributes, currentMetrics, valueListPosition);
 
                 if (metricsLength > 1) {
                     for (unsigned i = 0; i < metricsLength - 1; ++i)
@@ -225,10 +240,12 @@ void SVGTextLayoutAttributesBuilder::propagateLayoutAttributes(RenderObject* sta
 
 #if DUMP_TEXT_LAYOUT_ATTRIBUTES > 0
             fprintf(stderr, "\nDumping layout attributes for RenderSVGInlineText, renderer=%p, node=%p (atCharacter: %i)\n", text, text->node(), atCharacter);
+            fprintf(stderr, "BiDi properties: unicode-bidi=%i, block direction=%i\n", text->style()->unicodeBidi(), text->style()->direction());
             attributes.dump();
 #endif
 
             text->storeLayoutAttributes(attributes);
+            allAttributes.append(attributes);
             atCharacter = valueListPosition;
             continue;
         }
@@ -236,7 +253,7 @@ void SVGTextLayoutAttributesBuilder::propagateLayoutAttributes(RenderObject* sta
         if (!child->isSVGInline())
             continue;
 
-        propagateLayoutAttributes(child, atCharacter, lastCharacter);
+        propagateLayoutAttributes(child, allAttributes, atCharacter, lastCharacter);
     }
 }
 
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h
index c68185b..b368c51 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h
@@ -60,7 +60,7 @@ private:
     void buildLayoutScope(LayoutScope&, RenderObject*, unsigned textContentStart, unsigned textContentLength) const;
     void buildLayoutScopes(RenderObject*, unsigned& atCharacter, UChar& lastCharacter);
     void buildOutermostLayoutScope(RenderSVGText*, unsigned textLength);
-    void propagateLayoutAttributes(RenderObject*, unsigned& atCharacter, UChar& lastCharacter) const;
+    void propagateLayoutAttributes(RenderObject*, Vector<SVGTextLayoutAttributes>& allAttributes, unsigned& atCharacter, UChar& lastCharacter) const;
 
     enum LayoutValueType {
         XValueAttribute,
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp b/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp
index c25ed79..71db2ea 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutEngine.cpp
@@ -34,8 +34,13 @@
 
 namespace WebCore {
 
-SVGTextLayoutEngine::SVGTextLayoutEngine()
-    : m_x(0)
+SVGTextLayoutEngine::SVGTextLayoutEngine(Vector<SVGTextLayoutAttributes>& layoutAttributes)
+    : m_layoutAttributes(layoutAttributes)
+    , m_logicalCharacterOffset(0)
+    , m_logicalMetricsListOffset(0)
+    , m_visualCharacterOffset(0)
+    , m_visualMetricsListOffset(0)
+    , m_x(0)
     , m_y(0)
     , m_dx(0)
     , m_dy(0)
@@ -46,6 +51,7 @@ SVGTextLayoutEngine::SVGTextLayoutEngine()
     , m_textPathSpacing(0)
     , m_textPathScaling(1)
 {
+    ASSERT(!m_layoutAttributes.isEmpty());
 }
 
 void SVGTextLayoutEngine::updateCharacerPositionIfNeeded(float& x, float& y)
@@ -77,7 +83,7 @@ void SVGTextLayoutEngine::updateCurrentTextPosition(float x, float y, float glyp
     }
 }
 
-void SVGTextLayoutEngine::updateRelativePositionAdjustmentsIfNeeded(Vector<float>& dxValues, Vector<float>& dyValues, unsigned positionListOffset)
+void SVGTextLayoutEngine::updateRelativePositionAdjustmentsIfNeeded(Vector<float>& dxValues, Vector<float>& dyValues)
 {
     // Update relative positioning information.
     if (dxValues.isEmpty() && dyValues.isEmpty())
@@ -85,14 +91,14 @@ void SVGTextLayoutEngine::updateRelativePositionAdjustmentsIfNeeded(Vector<float
 
     float dx = 0;
     if (!dxValues.isEmpty()) {
-        float& dxCurrent = dxValues.at(positionListOffset);
+        float& dxCurrent = dxValues.at(m_logicalCharacterOffset);
         if (dxCurrent != SVGTextLayoutAttributes::emptyValue())
             dx = dxCurrent;
     }
 
     float dy = 0;
     if (!dyValues.isEmpty()) {
-        float& dyCurrent = dyValues.at(positionListOffset);
+        float& dyCurrent = dyValues.at(m_logicalCharacterOffset);
         if (dyCurrent != SVGTextLayoutAttributes::emptyValue())
             dy = dyCurrent;
     }
@@ -113,23 +119,31 @@ void SVGTextLayoutEngine::updateRelativePositionAdjustmentsIfNeeded(Vector<float
     m_dy = dy;
 }
 
-void SVGTextLayoutEngine::recordTextFragment(SVGInlineTextBox* textBox, RenderSVGInlineText* text, unsigned positionListOffset, const SVGTextMetrics& lastCharacterMetrics)
+void SVGTextLayoutEngine::recordTextFragment(SVGInlineTextBox* textBox, Vector<SVGTextMetrics>& textMetricsValues)
 {
     ASSERT(!m_currentTextFragment.length);
+    ASSERT(m_visualMetricsListOffset > 0);
 
     // Figure out length of fragment.
-    m_currentTextFragment.length = positionListOffset - m_currentTextFragment.positionListOffset;
+    m_currentTextFragment.length = m_visualCharacterOffset - m_currentTextFragment.characterOffset;
 
     // Figure out fragment metrics.
-    if (m_currentTextFragment.length == 1) {
-        // Fast path, can rely on already computed per-character metrics.
-        m_currentTextFragment.width = lastCharacterMetrics.width();
-        m_currentTextFragment.height = lastCharacterMetrics.height();
-    } else {
-        // Need to measure the whole range (range metrics != sum of character metrics)
-        SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(text, m_currentTextFragment.positionListOffset, m_currentTextFragment.length);
-        m_currentTextFragment.width = metrics.width();
-        m_currentTextFragment.height = metrics.height();
+    SVGTextMetrics& lastCharacterMetrics = textMetricsValues.at(m_visualMetricsListOffset - 1);
+    m_currentTextFragment.width = lastCharacterMetrics.width();
+    m_currentTextFragment.height = lastCharacterMetrics.height();
+
+    if (m_currentTextFragment.length > 1) {
+        // SVGTextLayoutAttributesBuilder assures that the length of the range is equal to the sum of the individual lengths of the glyphs.
+        float length = 0;
+        if (m_isVerticalText) {
+            for (unsigned i = m_currentTextFragment.metricsListOffset; i < m_visualMetricsListOffset; ++i)
+                length += textMetricsValues.at(i).height();
+            m_currentTextFragment.height = length;
+        } else {
+            for (unsigned i = m_currentTextFragment.metricsListOffset; i < m_visualMetricsListOffset; ++i)
+                length += textMetricsValues.at(i).width();
+            m_currentTextFragment.width = length;
+        }
     }
 
     textBox->textFragments().append(m_currentTextFragment);
@@ -281,7 +295,7 @@ void SVGTextLayoutEngine::finalizeTransformMatrices(Vector<SVGInlineTextBox*>& b
         SVGInlineTextBox* textBox = boxes.at(boxPosition);
         Vector<SVGTextFragment>& fragments = textBox->textFragments();
         fprintf(stderr, "-> Box %i: Dumping text fragments for SVGInlineTextBox, textBox=%p, textRenderer=%p\n", boxPosition, textBox, textBox->textRenderer());
-        fprintf(stderr, "        textBox properties, start=%i, len=%i\n", textBox->start(), textBox->len());
+        fprintf(stderr, "        textBox properties, start=%i, len=%i, box direction=%i\n", textBox->start(), textBox->len(), textBox->direction());
         fprintf(stderr, "   textRenderer properties, textLength=%i\n", textBox->textRenderer()->textLength());
 
         const UChar* characters = textBox->textRenderer()->characters();
@@ -289,9 +303,9 @@ void SVGTextLayoutEngine::finalizeTransformMatrices(Vector<SVGInlineTextBox*>& b
         unsigned fragmentCount = fragments.size();
         for (unsigned i = 0; i < fragmentCount; ++i) {
             SVGTextFragment& fragment = fragments.at(i);
-            String fragmentString(characters + fragment.positionListOffset, fragment.length);
-            fprintf(stderr, "    -> Fragment %i, x=%lf, y=%lf, width=%lf, height=%lf, positionListOffset=%i, length=%i, characters='%s'\n"
-                          , i, fragment.x, fragment.y, fragment.width, fragment.height, fragment.positionListOffset, fragment.length, fragmentString.utf8().data());
+            String fragmentString(characters + fragment.characterOffset, fragment.length);
+            fprintf(stderr, "    -> Fragment %i, x=%lf, y=%lf, width=%lf, height=%lf, characterOffset=%i, length=%i, characters='%s'\n"
+                          , i, fragment.x, fragment.y, fragment.width, fragment.height, fragment.characterOffset, fragment.length, fragmentString.utf8().data());
         }
     }
 #endif
@@ -328,6 +342,97 @@ void SVGTextLayoutEngine::finalizeTransformMatrices(Vector<SVGInlineTextBox*>& b
     boxes.clear();
 }
 
+bool SVGTextLayoutEngine::currentLogicalCharacterAttributes(SVGTextLayoutAttributes& logicalAttributes)
+{
+    logicalAttributes = m_layoutAttributes.first();
+    if (m_logicalCharacterOffset != logicalAttributes.xValues().size())
+        return true;
+
+    m_layoutAttributes.remove(0);
+    if (m_layoutAttributes.isEmpty())
+        return false;
+
+    logicalAttributes = m_layoutAttributes.first();
+    m_logicalMetricsListOffset = 0;
+    m_logicalCharacterOffset = 0;
+    return true;
+}
+
+bool SVGTextLayoutEngine::currentLogicalCharacterMetrics(SVGTextLayoutAttributes& logicalAttributes, SVGTextMetrics& logicalMetrics)
+{
+    logicalMetrics = SVGTextMetrics::emptyMetrics();
+
+    Vector<SVGTextMetrics>& textMetricsValues = logicalAttributes.textMetricsValues();
+    unsigned textMetricsSize = textMetricsValues.size();
+    while (true) {
+        if (m_logicalMetricsListOffset == textMetricsSize) {
+            if (!currentLogicalCharacterAttributes(logicalAttributes))
+                return false;
+
+            textMetricsValues = logicalAttributes.textMetricsValues();
+            textMetricsSize = textMetricsValues.size();
+            continue;
+        }
+
+        logicalMetrics = textMetricsValues.at(m_logicalMetricsListOffset);
+        if (logicalMetrics == SVGTextMetrics::emptyMetrics() || (!logicalMetrics.width() && !logicalMetrics.height())) {
+            advanceToNextLogicalCharacter(logicalMetrics);
+            continue;
+        }
+
+        // Stop if we found the next valid logical text metrics object.
+        return true;
+    }
+
+    ASSERT_NOT_REACHED();
+    return true;
+}
+
+bool SVGTextLayoutEngine::currentVisualCharacterMetrics(SVGInlineTextBox* textBox, RenderSVGInlineText* text, SVGTextMetrics& metrics)
+{
+    SVGTextLayoutAttributes& attributes = text->layoutAttributes();
+    Vector<SVGTextMetrics>& textMetricsValues = attributes.textMetricsValues();
+    ASSERT(!textMetricsValues.isEmpty());
+
+    unsigned textMetricsSize = textMetricsValues.size();
+    unsigned boxStart = textBox->start();
+    unsigned boxLength = textBox->len();
+
+    if (m_visualMetricsListOffset == textMetricsSize)
+        return false;
+
+    while (m_visualMetricsListOffset < textMetricsSize) {
+        SVGTextMetrics& visualMetrics = textMetricsValues.at(m_visualMetricsListOffset);
+
+        // Advance to text box start location.
+        if (m_visualCharacterOffset < boxStart) {
+            advanceToNextVisualCharacter(visualMetrics);
+            continue;
+        }
+
+        // Stop if we've finished processing this text box.
+        if (m_visualCharacterOffset >= boxStart + boxLength)
+            return false;
+
+        metrics = visualMetrics;
+        return true;
+    }
+
+    return false;
+}
+
+void SVGTextLayoutEngine::advanceToNextLogicalCharacter(const SVGTextMetrics& logicalMetrics)
+{
+    ++m_logicalMetricsListOffset;
+    m_logicalCharacterOffset += logicalMetrics.length();
+}
+
+void SVGTextLayoutEngine::advanceToNextVisualCharacter(const SVGTextMetrics& visualMetrics)
+{
+    ++m_visualMetricsListOffset;
+    m_visualCharacterOffset += visualMetrics.length();
+}
+
 void SVGTextLayoutEngine::layoutTextOnLineOrPath(SVGInlineTextBox* textBox, RenderSVGInlineText* text, const RenderStyle* style)
 {
     SVGElement* lengthContext = static_cast<SVGElement*>(text->parent()->node());
@@ -338,26 +443,10 @@ void SVGTextLayoutEngine::layoutTextOnLineOrPath(SVGInlineTextBox* textBox, Rend
     const SVGRenderStyle* svgStyle = style->svgStyle();
     ASSERT(svgStyle);
 
-    SVGTextLayoutAttributes& attributes = text->layoutAttributes();
-    Vector<float>& xValues = attributes.xValues();
-    Vector<float>& yValues = attributes.yValues();
-    Vector<float>& dxValues = attributes.dxValues();
-    Vector<float>& dyValues = attributes.dyValues();
-    Vector<float>& rotateValues = attributes.rotateValues();
-    Vector<SVGTextMetrics>& textMetricsValues = attributes.textMetricsValues();
-
-    unsigned boxStart = textBox->start();
-    unsigned boxLength = textBox->len();
-    unsigned textMetricsSize = textMetricsValues.size();
-    ASSERT(textMetricsSize <= xValues.size());
-    ASSERT(textMetricsSize <= yValues.size());
-    ASSERT(xValues.size() == yValues.size());
+    m_visualMetricsListOffset = 0;
+    m_visualCharacterOffset = 0;
 
-    if (boxLength > textMetricsSize)
-        textMetricsSize = boxLength; 
-
-    unsigned positionListOffset = 0;
-    unsigned metricsListOffset = 0;
+    Vector<SVGTextMetrics>& textMetricsValues = text->layoutAttributes().textMetricsValues();
     const UChar* characters = text->characters();
 
     const Font& font = style->font();
@@ -372,56 +461,63 @@ void SVGTextLayoutEngine::layoutTextOnLineOrPath(SVGInlineTextBox* textBox, Rend
     baselineShift -= baselineLayout.calculateAlignmentBaselineShift(m_isVerticalText, text);
 
     // Main layout algorithm.
-    unsigned positionListSize = xValues.size();
-    for (; metricsListOffset < textMetricsSize && positionListOffset < positionListSize; ++metricsListOffset) {
-        SVGTextMetrics& metrics = textMetricsValues.at(metricsListOffset);
-        // Advance to text box start location.
-        if (positionListOffset < boxStart) {
-            positionListOffset += metrics.length();
+    while (true) {
+        // Find the start of the current text box in this list, respecting ligatures.
+        SVGTextMetrics visualMetrics = SVGTextMetrics::emptyMetrics();
+        if (!currentVisualCharacterMetrics(textBox, text, visualMetrics))
+            break;
+
+        if (visualMetrics == SVGTextMetrics::emptyMetrics()) {
+            advanceToNextVisualCharacter(visualMetrics);
             continue;
         }
 
-        // Stop if we've finished processing this text box.
-        if (positionListOffset >= boxStart + boxLength)
+        SVGTextLayoutAttributes logicalAttributes;
+        if (!currentLogicalCharacterAttributes(logicalAttributes))
             break;
- 
-        float x = xValues.at(positionListOffset);
-        float y = yValues.at(positionListOffset);
 
-        // When we've advanced to the box start offset, determine using the original x/y values,
-        // wheter this character starts a new text chunk, before doing any further processing.
-        if (positionListOffset == boxStart)
-            textBox->setStartsNewTextChunk(text->characterStartsNewTextChunk(boxStart));
+        SVGTextMetrics logicalMetrics = SVGTextMetrics::emptyMetrics();
+        if (!currentLogicalCharacterMetrics(logicalAttributes, logicalMetrics))
+            break;
 
-        if (metrics == SVGTextMetrics::emptyMetrics()) {
-            positionListOffset += metrics.length();
-            continue;
-        }
+        Vector<float>& xValues = logicalAttributes.xValues();
+        Vector<float>& yValues = logicalAttributes.yValues();
+        Vector<float>& dxValues = logicalAttributes.dxValues();
+        Vector<float>& dyValues = logicalAttributes.dyValues();
+        Vector<float>& rotateValues = logicalAttributes.rotateValues();
+
+        float x = xValues.at(m_logicalCharacterOffset);
+        float y = yValues.at(m_logicalCharacterOffset);
+
+        // When we've advanced to the box start offset, determine using the original x/y values,
+        // whether this character starts a new text chunk, before doing any further processing.
+        if (m_visualCharacterOffset == textBox->start())
+            textBox->setStartsNewTextChunk(logicalAttributes.context()->characterStartsNewTextChunk(m_logicalCharacterOffset));
 
-        const UChar* currentCharacter = characters + positionListOffset;
         float angle = 0;
         if (!rotateValues.isEmpty()) {
-            float newAngle = rotateValues.at(positionListOffset);
+            float newAngle = rotateValues.at(m_logicalCharacterOffset);
             if (newAngle != SVGTextLayoutAttributes::emptyValue())
                 angle = newAngle;
         }
 
         // Calculate glyph orientation angle.
+        const UChar* currentCharacter = characters + m_visualCharacterOffset;
         float orientationAngle = baselineLayout.calculateGlyphOrientationAngle(m_isVerticalText, svgStyle, *currentCharacter);
 
         // Calculate glyph advance & x/y orientation shifts.
         float xOrientationShift = 0;
         float yOrientationShift = 0;
-        float glyphAdvance = baselineLayout.calculateGlyphAdvanceAndOrientation(m_isVerticalText, metrics, orientationAngle, xOrientationShift, yOrientationShift);
+        float glyphAdvance = baselineLayout.calculateGlyphAdvanceAndOrientation(m_isVerticalText, visualMetrics, orientationAngle, xOrientationShift, yOrientationShift);
 
         // Assign current text position to x/y values, if needed.
         updateCharacerPositionIfNeeded(x, y);
 
         // Apply dx/dy value adjustments to current text position, if needed.
-        updateRelativePositionAdjustmentsIfNeeded(dxValues, dyValues, positionListOffset);
+        updateRelativePositionAdjustmentsIfNeeded(dxValues, dyValues);
 
         // Calculate SVG Fonts kerning, if needed.
-        float kerning = spacingLayout.calculateSVGKerning(m_isVerticalText, metrics.glyph());
+        float kerning = spacingLayout.calculateSVGKerning(m_isVerticalText, visualMetrics.glyph());
 
         // Calculate CSS 'kerning', 'letter-spacing' and 'word-spacing' for next character, if needed.
         float spacing = spacingLayout.calculateCSSKerningAndSpacing(svgStyle, lengthContext, currentCharacter);
@@ -461,7 +557,8 @@ void SVGTextLayoutEngine::layoutTextOnLineOrPath(SVGInlineTextBox* textBox, Rend
 
             // Skip character, if we're before the path.
             if (textPathOffset < 0) {
-                positionListOffset += metrics.length();
+                advanceToNextLogicalCharacter(logicalMetrics);
+                advanceToNextVisualCharacter(visualMetrics);
                 continue;
             }
 
@@ -513,16 +610,17 @@ void SVGTextLayoutEngine::layoutTextOnLineOrPath(SVGInlineTextBox* textBox, Rend
         // If we already started a fragment, close it now.
         if (didStartTextFragment && shouldStartNewFragment) {
             applySpacingToNextCharacter = false;
-            recordTextFragment(textBox, text, positionListOffset, textMetricsValues.at(metricsListOffset - 1));
+            recordTextFragment(textBox, textMetricsValues);
         }
 
         // Eventually start a new fragment, if not yet done.
         if (!didStartTextFragment || shouldStartNewFragment) {
-            ASSERT(!m_currentTextFragment.positionListOffset);
+            ASSERT(!m_currentTextFragment.characterOffset);
             ASSERT(!m_currentTextFragment.length);
 
             didStartTextFragment = true;
-            m_currentTextFragment.positionListOffset = positionListOffset;
+            m_currentTextFragment.characterOffset = m_visualCharacterOffset;
+            m_currentTextFragment.metricsListOffset = m_visualMetricsListOffset;
             m_currentTextFragment.x = x;
             m_currentTextFragment.y = y;
 
@@ -563,7 +661,8 @@ void SVGTextLayoutEngine::layoutTextOnLineOrPath(SVGInlineTextBox* textBox, Rend
             updateCurrentTextPosition(xNew, yNew, glyphAdvance + spacing);
         }
 
-        positionListOffset += metrics.length();
+        advanceToNextLogicalCharacter(logicalMetrics);
+        advanceToNextVisualCharacter(visualMetrics);
         lastAngle = angle;
     }
 
@@ -571,7 +670,7 @@ void SVGTextLayoutEngine::layoutTextOnLineOrPath(SVGInlineTextBox* textBox, Rend
         return;
 
     // Close last open fragment, if needed.
-    recordTextFragment(textBox, text, positionListOffset, textMetricsValues.at(metricsListOffset - 1));
+    recordTextFragment(textBox, textMetricsValues);
 }
 
 }
diff --git a/Source/WebCore/rendering/svg/SVGTextLayoutEngine.h b/Source/WebCore/rendering/svg/SVGTextLayoutEngine.h
index 631e4cd..22dd59b 100644
--- a/Source/WebCore/rendering/svg/SVGTextLayoutEngine.h
+++ b/Source/WebCore/rendering/svg/SVGTextLayoutEngine.h
@@ -24,6 +24,7 @@
 #include "Path.h"
 #include "SVGTextChunkBuilder.h"
 #include "SVGTextFragment.h"
+#include "SVGTextLayoutAttributes.h"
 #include "SVGTextMetrics.h"
 #include <wtf/Vector.h>
 
@@ -47,7 +48,7 @@ class SVGRenderStyle;
 class SVGTextLayoutEngine {
     WTF_MAKE_NONCOPYABLE(SVGTextLayoutEngine);
 public:
-    SVGTextLayoutEngine();
+    SVGTextLayoutEngine(Vector<SVGTextLayoutAttributes>&);
     SVGTextChunkBuilder& chunkLayoutBuilder() { return m_chunkLayoutBuilder; }
 
     void beginTextPathLayout(RenderObject*, SVGTextLayoutEngine& lineLayout);
@@ -59,20 +60,32 @@ public:
 private:
     void updateCharacerPositionIfNeeded(float& x, float& y);
     void updateCurrentTextPosition(float x, float y, float glyphAdvance);
-    void updateRelativePositionAdjustmentsIfNeeded(Vector<float>& dxValues, Vector<float>& dyValues, unsigned valueListPosition);
+    void updateRelativePositionAdjustmentsIfNeeded(Vector<float>& dxValues, Vector<float>& dyValues);
 
-    void recordTextFragment(SVGInlineTextBox*, RenderSVGInlineText*, unsigned positionListOffset, const SVGTextMetrics& lastCharacterMetrics);
+    void recordTextFragment(SVGInlineTextBox*, Vector<SVGTextMetrics>& textMetricValues);
     bool parentDefinesTextLength(RenderObject*) const;
 
     void layoutTextOnLineOrPath(SVGInlineTextBox*, RenderSVGInlineText*, const RenderStyle*);
     void finalizeTransformMatrices(Vector<SVGInlineTextBox*>&);
 
+    bool currentLogicalCharacterAttributes(SVGTextLayoutAttributes&);
+    bool currentLogicalCharacterMetrics(SVGTextLayoutAttributes&, SVGTextMetrics&);
+    bool currentVisualCharacterMetrics(SVGInlineTextBox*, RenderSVGInlineText*, SVGTextMetrics&);
+
+    void advanceToNextLogicalCharacter(const SVGTextMetrics&);
+    void advanceToNextVisualCharacter(const SVGTextMetrics&);
+
 private:
+    Vector<SVGTextLayoutAttributes> m_layoutAttributes;
     Vector<SVGInlineTextBox*> m_lineLayoutBoxes;
     Vector<SVGInlineTextBox*> m_pathLayoutBoxes;
     SVGTextChunkBuilder m_chunkLayoutBuilder;
 
     SVGTextFragment m_currentTextFragment;
+    unsigned m_logicalCharacterOffset;
+    unsigned m_logicalMetricsListOffset;
+    unsigned m_visualCharacterOffset;
+    unsigned m_visualMetricsListOffset;
     float m_x;
     float m_y;
     float m_dx;
diff --git a/Source/WebCore/rendering/svg/SVGTextMetrics.cpp b/Source/WebCore/rendering/svg/SVGTextMetrics.cpp
index d75bdb3..042bc22 100644
--- a/Source/WebCore/rendering/svg/SVGTextMetrics.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextMetrics.cpp
@@ -74,7 +74,17 @@ SVGTextMetrics SVGTextMetrics::emptyMetrics()
 
 static TextRun constructTextRun(RenderSVGInlineText* text, const UChar* characters, unsigned position, unsigned length)
 {
-    TextRun run(characters + position, length);
+    RenderStyle* style = text->style();
+    ASSERT(style);
+
+    TextRun run(characters + position
+                , length
+                , false /* allowTabs */
+                , 0 /* xPos, only relevant with allowTabs=true */
+                , 0 /* padding, only relevant for justified text, not relevant for SVG */
+                , TextRun::AllowTrailingExpansion
+                , !style->isLeftToRightDirection()
+                , style->unicodeBidi() == Override /* directionalOverride */);
 
 #if ENABLE(SVG_FONTS)
     run.setReferencingRenderObject(text);
@@ -92,22 +102,6 @@ SVGTextMetrics SVGTextMetrics::measureCharacterRange(RenderSVGInlineText* text,
     return SVGTextMetrics(text, run, position, text->textLength());
 }
 
-void SVGTextMetrics::measureAllCharactersIndividually(RenderSVGInlineText* text, Vector<SVGTextMetrics>& allMetrics)
-{
-    ASSERT(text);
-    const UChar* characters = text->characters();
-    unsigned length = text->textLength();
-
-    TextRun run(constructTextRun(text, 0, 0, 0));
-    for (unsigned position = 0; position < length; ) {
-        run.setText(characters + position, 1);
-
-        SVGTextMetrics metrics(text, run, position, text->textLength());
-        allMetrics.append(metrics);
-        position += metrics.length();
-    }
-}
-
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/rendering/svg/SVGTextMetrics.h b/Source/WebCore/rendering/svg/SVGTextMetrics.h
index 7ef0f7d..cb016b6 100644
--- a/Source/WebCore/rendering/svg/SVGTextMetrics.h
+++ b/Source/WebCore/rendering/svg/SVGTextMetrics.h
@@ -32,7 +32,6 @@ class SVGTextMetrics {
 public:
     static SVGTextMetrics emptyMetrics();
     static SVGTextMetrics measureCharacterRange(RenderSVGInlineText*, unsigned position, unsigned length);
-    static void measureAllCharactersIndividually(RenderSVGInlineText*, Vector<SVGTextMetrics>&);
 
     bool operator==(const SVGTextMetrics&);
 
@@ -62,6 +61,10 @@ public:
     const Glyph& glyph() const { return m_glyph; }
 
 private:
+    friend class SVGTextLayoutAttributesBuilder;
+    void setWidth(float width) { m_width = width; }
+
+private:
     SVGTextMetrics();
     SVGTextMetrics(RenderSVGInlineText*, const TextRun&, unsigned position, unsigned textLength);
 
diff --git a/Source/WebCore/rendering/svg/SVGTextQuery.cpp b/Source/WebCore/rendering/svg/SVGTextQuery.cpp
index 1a4cdab..5f3523e 100644
--- a/Source/WebCore/rendering/svg/SVGTextQuery.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextQuery.cpp
@@ -313,7 +313,7 @@ bool SVGTextQuery::subStringLengthCallback(Data* queryData, const SVGTextFragmen
     if (!mapStartEndPositionsIntoFragmentCoordinates(queryData, fragment, startPosition, endPosition))
         return false;
 
-    SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.positionListOffset + startPosition, endPosition - startPosition);
+    SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.characterOffset + startPosition, endPosition - startPosition);
     float fragmentLength = queryData->isVerticalText ? metrics.height() : metrics.width();
 
     data->subStringLength += mapLengthThroughFragmentTransformation(fragment, queryData->isVerticalText, fragmentLength);
@@ -353,7 +353,7 @@ bool SVGTextQuery::startPositionOfCharacterCallback(Data* queryData, const SVGTe
     data->startPosition = FloatPoint(fragment.x, fragment.y);
 
     if (startPosition) {
-        SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.positionListOffset, startPosition);
+        SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.characterOffset, startPosition);
         if (queryData->isVerticalText)
             data->startPosition.move(0, metrics.height());
         else
@@ -399,7 +399,7 @@ bool SVGTextQuery::endPositionOfCharacterCallback(Data* queryData, const SVGText
 
     data->endPosition = FloatPoint(fragment.x, fragment.y);
 
-    SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.positionListOffset, startPosition + 1);
+    SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.characterOffset, startPosition + 1);
     if (queryData->isVerticalText)
         data->endPosition.move(0, metrics.height());
     else
@@ -478,14 +478,14 @@ static inline void calculateGlyphBoundaries(SVGTextQuery::Data* queryData, const
     extent.setLocation(FloatPoint(fragment.x, fragment.y - queryData->textRenderer->scaledFont().fontMetrics().floatAscent() / scalingFactor));
 
     if (startPosition) {
-        SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.positionListOffset, startPosition);
+        SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.characterOffset, startPosition);
         if (queryData->isVerticalText)
             extent.move(0, metrics.height());
         else
             extent.move(metrics.width(), 0);
     }
 
-    SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.positionListOffset + startPosition, 1);
+    SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.characterOffset + startPosition, 1);
     extent.setSize(FloatSize(metrics.width(), metrics.height()));
 
     if (fragment.transform.isIdentity())
diff --git a/Source/WebCore/storage/AbstractDatabase.h b/Source/WebCore/storage/AbstractDatabase.h
index bd5d0db..9279adc 100644
--- a/Source/WebCore/storage/AbstractDatabase.h
+++ b/Source/WebCore/storage/AbstractDatabase.h
@@ -35,7 +35,7 @@
 #include "PlatformString.h"
 #include "SQLiteDatabase.h"
 #include <wtf/Forward.h>
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 #ifndef NDEBUG
 #include "SecurityOrigin.h"
 #endif
@@ -46,7 +46,7 @@ class DatabaseAuthorizer;
 class ScriptExecutionContext;
 class SecurityOrigin;
 
-class AbstractDatabase : public ThreadSafeShared<AbstractDatabase> {
+class AbstractDatabase : public ThreadSafeRefCounted<AbstractDatabase> {
 public:
     static bool isAvailable();
     static void setIsAvailable(bool available);
diff --git a/Source/WebCore/storage/DatabaseAuthorizer.h b/Source/WebCore/storage/DatabaseAuthorizer.h
index da7761d..939b409 100644
--- a/Source/WebCore/storage/DatabaseAuthorizer.h
+++ b/Source/WebCore/storage/DatabaseAuthorizer.h
@@ -31,7 +31,7 @@
 #include "PlatformString.h"
 #include <wtf/Forward.h>
 #include <wtf/HashSet.h>
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 #include <wtf/text/StringHash.h>
 
 namespace WebCore {
@@ -40,7 +40,7 @@ extern const int SQLAuthAllow;
 extern const int SQLAuthIgnore;
 extern const int SQLAuthDeny;
 
-class DatabaseAuthorizer : public ThreadSafeShared<DatabaseAuthorizer> {
+class DatabaseAuthorizer : public ThreadSafeRefCounted<DatabaseAuthorizer> {
 public:
 
     enum Permissions {
diff --git a/Source/WebCore/storage/DatabaseCallback.h b/Source/WebCore/storage/DatabaseCallback.h
index 8ad56ed..586416a 100644
--- a/Source/WebCore/storage/DatabaseCallback.h
+++ b/Source/WebCore/storage/DatabaseCallback.h
@@ -33,14 +33,14 @@
 
 #if ENABLE(DATABASE)
 
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
 class Database;
 class DatabaseSync;
 
-class DatabaseCallback : public ThreadSafeShared<DatabaseCallback> {
+class DatabaseCallback : public ThreadSafeRefCounted<DatabaseCallback> {
 public:
     virtual ~DatabaseCallback() { }
     virtual bool handleEvent(Database*) = 0;
diff --git a/Source/WebCore/storage/DatabaseThread.h b/Source/WebCore/storage/DatabaseThread.h
index c81e376..ee1702c 100644
--- a/Source/WebCore/storage/DatabaseThread.h
+++ b/Source/WebCore/storage/DatabaseThread.h
@@ -48,7 +48,7 @@ class Document;
 class SQLTransactionClient;
 class SQLTransactionCoordinator;
 
-class DatabaseThread : public ThreadSafeShared<DatabaseThread> {
+class DatabaseThread : public ThreadSafeRefCounted<DatabaseThread> {
 public:
     static PassRefPtr<DatabaseThread> create() { return adoptRef(new DatabaseThread); }
     ~DatabaseThread();
diff --git a/Source/WebCore/storage/IDBBackingStore.h b/Source/WebCore/storage/IDBBackingStore.h
index e75fee1..29523a2 100644
--- a/Source/WebCore/storage/IDBBackingStore.h
+++ b/Source/WebCore/storage/IDBBackingStore.h
@@ -44,37 +44,36 @@ class SecurityOrigin;
 
 class IDBBackingStore : public RefCounted<IDBBackingStore> {
 public:
-    static PassRefPtr<IDBBackingStore> open(SecurityOrigin*, const String& pathBase, int64_t maximumSize, const String& fileIdentifier, IDBFactoryBackendImpl*);
-    ~IDBBackingStore();
-
-    bool extractIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId);
-    bool setIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId, bool invalidRowId);
-
-    void getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags);
-    bool createObjectStore(const String& name, const String& keyPath, bool autoIncrement, int64_t databaseId, int64_t& assignedObjectStoreId);
-    void deleteObjectStore(int64_t objectStoreId);
-    String getObjectStoreRecord(int64_t objectStoreId, const IDBKey&);
-    bool putObjectStoreRecord(int64_t objectStoreId, const IDBKey&, const String& value, int64_t& rowId, bool invalidRowId);
-    void clearObjectStore(int64_t objectStoreId);
-    void deleteObjectStoreRecord(int64_t objectStoreId, int64_t objectStoreDataId);
-    double nextAutoIncrementNumber(int64_t objectStoreId);
-    bool keyExistsInObjectStore(int64_t objectStoreId, const IDBKey&, int64_t& foundObjectStoreDataId);
+    virtual ~IDBBackingStore() {};
+
+    virtual bool extractIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId) = 0;
+    virtual bool setIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId, bool invalidRowId) = 0;
+
+    virtual void getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags) = 0;
+    virtual bool createObjectStore(const String& name, const String& keyPath, bool autoIncrement, int64_t databaseId, int64_t& assignedObjectStoreId) = 0;
+    virtual void deleteObjectStore(int64_t objectStoreId) = 0;
+    virtual String getObjectStoreRecord(int64_t objectStoreId, const IDBKey&) = 0;
+    virtual bool putObjectStoreRecord(int64_t objectStoreId, const IDBKey&, const String& value, int64_t& rowId, bool invalidRowId) = 0;
+    virtual void clearObjectStore(int64_t objectStoreId) = 0;
+    virtual void deleteObjectStoreRecord(int64_t objectStoreId, int64_t objectStoreDataId) = 0;
+    virtual double nextAutoIncrementNumber(int64_t objectStoreId) = 0;
+    virtual bool keyExistsInObjectStore(int64_t objectStoreId, const IDBKey&, int64_t& foundObjectStoreDataId) = 0;
 
     class ObjectStoreRecordCallback {
     public:
          virtual bool callback(int64_t objectStoreDataId, const String& value) = 0;
          virtual ~ObjectStoreRecordCallback() {};
     };
-    bool forEachObjectStoreRecord(int64_t objectStoreId, ObjectStoreRecordCallback&);
+    virtual bool forEachObjectStoreRecord(int64_t objectStoreId, ObjectStoreRecordCallback&) = 0;
 
-    void getIndexes(int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags);
-    bool createIndex(int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId);
-    void deleteIndex(int64_t indexId);
-    bool putIndexDataForRecord(int64_t indexId, const IDBKey&, int64_t objectStoreDataId);
-    bool deleteIndexDataForRecord(int64_t objectStoreDataId);
-    String getObjectViaIndex(int64_t indexId, const IDBKey&);
-    PassRefPtr<IDBKey> getPrimaryKeyViaIndex(int64_t indexId, const IDBKey&);
-    bool keyExistsInIndex(int64_t indexId, const IDBKey&);
+    virtual void getIndexes(int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags) = 0;
+    virtual bool createIndex(int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId) = 0;
+    virtual void deleteIndex(int64_t indexId) = 0;
+    virtual bool putIndexDataForRecord(int64_t indexId, const IDBKey&, int64_t objectStoreDataId) = 0;
+    virtual bool deleteIndexDataForRecord(int64_t objectStoreDataId) = 0;
+    virtual String getObjectViaIndex(int64_t indexId, const IDBKey&) = 0;
+    virtual PassRefPtr<IDBKey> getPrimaryKeyViaIndex(int64_t indexId, const IDBKey&) = 0;
+    virtual bool keyExistsInIndex(int64_t indexId, const IDBKey&) = 0;
 
     class Cursor : public RefCounted<Cursor> {
     public:
@@ -87,9 +86,9 @@ public:
         virtual ~Cursor() {};
     };
 
-    PassRefPtr<Cursor> openObjectStoreCursor(int64_t objectStoreId, const IDBKeyRange*, IDBCursor::Direction);
-    PassRefPtr<Cursor> openIndexKeyCursor(int64_t indexId, const IDBKeyRange*, IDBCursor::Direction);
-    PassRefPtr<Cursor> openIndexCursor(int64_t indexId, const IDBKeyRange*, IDBCursor::Direction);
+    virtual PassRefPtr<Cursor> openObjectStoreCursor(int64_t objectStoreId, const IDBKeyRange*, IDBCursor::Direction) = 0;
+    virtual PassRefPtr<Cursor> openIndexKeyCursor(int64_t indexId, const IDBKeyRange*, IDBCursor::Direction) = 0;
+    virtual PassRefPtr<Cursor> openIndexCursor(int64_t indexId, const IDBKeyRange*, IDBCursor::Direction) = 0;
 
     class Transaction : public RefCounted<Transaction> {
     public:
@@ -97,14 +96,7 @@ public:
         virtual void commit() = 0;
         virtual void rollback() = 0;
     };
-    PassRefPtr<Transaction> createTransaction();
-
-private:
-    IDBBackingStore(String identifier, IDBFactoryBackendImpl* factory);
-
-    SQLiteDatabase m_db;
-    String m_identifier;
-    RefPtr<IDBFactoryBackendImpl> m_factory;
+    virtual PassRefPtr<Transaction> createTransaction() = 0;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBCallbacks.h b/Source/WebCore/storage/IDBCallbacks.h
index f4e1b98..ddc6e60 100644
--- a/Source/WebCore/storage/IDBCallbacks.h
+++ b/Source/WebCore/storage/IDBCallbacks.h
@@ -32,7 +32,6 @@
 #include "IDBCursorBackendInterface.h"
 #include "IDBDatabaseBackendInterface.h"
 #include "IDBDatabaseError.h"
-#include "IDBIndexBackendInterface.h"
 #include "IDBKey.h"
 #include "IDBObjectStoreBackendInterface.h"
 #include "IDBTransactionBackendInterface.h"
@@ -44,14 +43,13 @@
 namespace WebCore {
 
 // FIXME: All child classes need to be made threadsafe.
-class IDBCallbacks : public ThreadSafeShared<IDBCallbacks> {
+class IDBCallbacks : public ThreadSafeRefCounted<IDBCallbacks> {
 public:
     virtual ~IDBCallbacks() { }
 
     virtual void onError(PassRefPtr<IDBDatabaseError>) = 0;
     virtual void onSuccess(PassRefPtr<IDBCursorBackendInterface>) = 0;
     virtual void onSuccess(PassRefPtr<IDBDatabaseBackendInterface>) = 0;
-    virtual void onSuccess(PassRefPtr<IDBIndexBackendInterface>) = 0;
     virtual void onSuccess(PassRefPtr<IDBKey>) = 0;
     virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>) = 0;
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>) = 0;
diff --git a/Source/WebCore/storage/IDBCursorBackendInterface.h b/Source/WebCore/storage/IDBCursorBackendInterface.h
index 6cdab42..21425c9 100644
--- a/Source/WebCore/storage/IDBCursorBackendInterface.h
+++ b/Source/WebCore/storage/IDBCursorBackendInterface.h
@@ -41,7 +41,7 @@ class IDBKey;
 class IDBRequest;
 class SerializedScriptValue;
 
-class IDBCursorBackendInterface : public ThreadSafeShared<IDBCursorBackendInterface> {
+class IDBCursorBackendInterface : public ThreadSafeRefCounted<IDBCursorBackendInterface> {
 public:
     virtual ~IDBCursorBackendInterface() {}
 
diff --git a/Source/WebCore/storage/IDBDatabase.cpp b/Source/WebCore/storage/IDBDatabase.cpp
index fe8d350..d54b969 100644
--- a/Source/WebCore/storage/IDBDatabase.cpp
+++ b/Source/WebCore/storage/IDBDatabase.cpp
@@ -29,6 +29,7 @@
 #include "Document.h"
 #include "EventQueue.h"
 #include "IDBAny.h"
+#include "IDBDatabaseCallbacksImpl.h"
 #include "IDBDatabaseError.h"
 #include "IDBDatabaseException.h"
 #include "IDBEventDispatcher.h"
@@ -58,10 +59,12 @@ IDBDatabase::IDBDatabase(ScriptExecutionContext* context, PassRefPtr<IDBDatabase
 {
     // We pass a reference of this object before it can be adopted.
     relaxAdoptionRequirement();
+    m_databaseCallbacks = IDBDatabaseCallbacksImpl::create(this);
 }
 
 IDBDatabase::~IDBDatabase()
 {
+    m_databaseCallbacks->unregisterDatabase(this);
 }
 
 void IDBDatabase::setSetVersionTransaction(IDBTransaction* transaction)
@@ -103,7 +106,7 @@ void IDBDatabase::deleteObjectStore(const String& name, ExceptionCode& ec)
 PassRefPtr<IDBVersionChangeRequest> IDBDatabase::setVersion(ScriptExecutionContext* context, const String& version, ExceptionCode& ec)
 {
     RefPtr<IDBVersionChangeRequest> request = IDBVersionChangeRequest::create(context, IDBAny::create(this), version);
-    m_backend->setVersion(version, request, this, ec);
+    m_backend->setVersion(version, request, m_databaseCallbacks, ec);
     return request;
 }
 
@@ -154,7 +157,7 @@ void IDBDatabase::close()
     }
 
     m_noNewTransactions = true;
-    m_backend->close(this);
+    m_backend->close(m_databaseCallbacks);
 }
 
 void IDBDatabase::onVersionChange(const String& version)
@@ -174,7 +177,7 @@ bool IDBDatabase::hasPendingActivity() const
 
 void IDBDatabase::open()
 {
-    m_backend->open(this);
+    m_backend->open(m_databaseCallbacks);
 }
 
 void IDBDatabase::enqueueEvent(PassRefPtr<Event> event)
diff --git a/Source/WebCore/storage/IDBDatabase.h b/Source/WebCore/storage/IDBDatabase.h
index 51f1d23..9d4883e 100644
--- a/Source/WebCore/storage/IDBDatabase.h
+++ b/Source/WebCore/storage/IDBDatabase.h
@@ -32,7 +32,7 @@
 #include "EventTarget.h"
 #include "ExceptionCode.h"
 #include "IDBDatabaseBackendInterface.h"
-#include "IDBDatabaseCallbacks.h"
+#include "IDBDatabaseCallbacksImpl.h"
 #include "IDBObjectStore.h"
 #include "IDBTransaction.h"
 #include "OptionsObject.h"
@@ -47,7 +47,7 @@ namespace WebCore {
 class IDBVersionChangeRequest;
 class ScriptExecutionContext;
 
-class IDBDatabase : public IDBDatabaseCallbacks, public EventTarget, public ActiveDOMObject {
+class IDBDatabase : public RefCounted<IDBDatabase>, public EventTarget, public ActiveDOMObject {
 public:
     static PassRefPtr<IDBDatabase> create(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendInterface>);
     ~IDBDatabase();
@@ -91,8 +91,8 @@ public:
     bool dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec) { return EventTarget::dispatchEvent(event, ec); }
     virtual bool dispatchEvent(PassRefPtr<Event>);
 
-    using RefCounted<IDBDatabaseCallbacks>::ref;
-    using RefCounted<IDBDatabaseCallbacks>::deref;
+    using RefCounted<IDBDatabase>::ref;
+    using RefCounted<IDBDatabase>::deref;
 
 private:
     IDBDatabase(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendInterface>);
@@ -114,6 +114,8 @@ private:
     // Keep track of the versionchange events waiting to be fired on this
     // database so that we can cancel them if the database closes.
     Vector<RefPtr<Event> > m_enqueuedEvents;
+
+    RefPtr<IDBDatabaseCallbacksImpl> m_databaseCallbacks;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBDatabaseBackendInterface.h b/Source/WebCore/storage/IDBDatabaseBackendInterface.h
index ad6fdc7..2245bd7 100644
--- a/Source/WebCore/storage/IDBDatabaseBackendInterface.h
+++ b/Source/WebCore/storage/IDBDatabaseBackendInterface.h
@@ -46,7 +46,7 @@ class IDBTransactionBackendInterface;
 // This is implemented by IDBDatabaseBackendImpl and optionally others (in order to proxy
 // calls across process barriers). All calls to these classes should be non-blocking and
 // trigger work on a background thread if necessary.
-class IDBDatabaseBackendInterface : public ThreadSafeShared<IDBDatabaseBackendInterface> {
+class IDBDatabaseBackendInterface : public ThreadSafeRefCounted<IDBDatabaseBackendInterface> {
 public:
     virtual ~IDBDatabaseBackendInterface() { }
 
diff --git a/Source/WebCore/storage/IDBDatabaseCallbacksImpl.cpp b/Source/WebCore/storage/IDBDatabaseCallbacksImpl.cpp
new file mode 100644
index 0000000..39c4409
--- /dev/null
+++ b/Source/WebCore/storage/IDBDatabaseCallbacksImpl.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IDBDatabaseCallbacksImpl.h"
+
+#if ENABLE(INDEXED_DATABASE)
+
+#include "IDBDatabase.h"
+
+namespace WebCore {
+
+PassRefPtr<IDBDatabaseCallbacksImpl> IDBDatabaseCallbacksImpl::create(IDBDatabase* database)
+{
+    return adoptRef(new IDBDatabaseCallbacksImpl(database));
+}
+
+IDBDatabaseCallbacksImpl::IDBDatabaseCallbacksImpl(IDBDatabase* database)
+    : m_database(database)
+{
+}
+
+IDBDatabaseCallbacksImpl::~IDBDatabaseCallbacksImpl()
+{
+}
+
+void IDBDatabaseCallbacksImpl::onVersionChange(const String& version)
+{
+    if (m_database)
+        m_database->onVersionChange(version);
+}
+
+void IDBDatabaseCallbacksImpl::unregisterDatabase(IDBDatabase* database)
+{
+    ASSERT(database == m_database);
+    m_database = 0;
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/storage/IDBDatabaseCallbacksImpl.h b/Source/WebCore/storage/IDBDatabaseCallbacksImpl.h
new file mode 100644
index 0000000..e8b1f99
--- /dev/null
+++ b/Source/WebCore/storage/IDBDatabaseCallbacksImpl.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IDBDatabaseCallbacksImpl_h
+#define IDBDatabaseCallbacksImpl_h
+
+#include "IDBDatabaseCallbacks.h"
+#include "PlatformString.h"
+#include <wtf/RefCounted.h>
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+class IDBDatabase;
+
+class IDBDatabaseCallbacksImpl : public IDBDatabaseCallbacks {
+public:
+    static PassRefPtr<IDBDatabaseCallbacksImpl> create(IDBDatabase*);
+    virtual ~IDBDatabaseCallbacksImpl();
+
+    virtual void onVersionChange(const String& version);
+    void unregisterDatabase(IDBDatabase*);
+
+private:
+    IDBDatabaseCallbacksImpl(IDBDatabase*);
+
+    // m_database has a RefPtr to this, so use a weak pointer to avoid a cycle.
+    IDBDatabase* m_database;
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif // IDBDatabaseCallbacksImpl_h
diff --git a/Source/WebCore/storage/IDBFactory.cpp b/Source/WebCore/storage/IDBFactory.cpp
index 85e976c..295398b 100644
--- a/Source/WebCore/storage/IDBFactory.cpp
+++ b/Source/WebCore/storage/IDBFactory.cpp
@@ -74,7 +74,7 @@ PassRefPtr<IDBRequest> IDBFactory::open(ScriptExecutionContext* context, const S
 
     RefPtr<IDBRequest> request = IDBRequest::create(document, IDBAny::create(this), 0);
     GroupSettings* groupSettings = document->page()->group().groupSettings();
-    m_factoryBackend->open(name, request, document->securityOrigin(), document->frame(), groupSettings->indexedDBDatabasePath(), groupSettings->indexedDBQuotaBytes());
+    m_factoryBackend->open(name, request, document->securityOrigin(), document->frame(), groupSettings->indexedDBDatabasePath(), groupSettings->indexedDBQuotaBytes(), IDBFactoryBackendInterface::DefaultBackingStore);
     return request;
 }
 
diff --git a/Source/WebCore/storage/IDBFactoryBackendImpl.cpp b/Source/WebCore/storage/IDBFactoryBackendImpl.cpp
index 9127455..461e930 100644
--- a/Source/WebCore/storage/IDBFactoryBackendImpl.cpp
+++ b/Source/WebCore/storage/IDBFactoryBackendImpl.cpp
@@ -30,9 +30,9 @@
 #include "IDBFactoryBackendImpl.h"
 
 #include "DOMStringList.h"
-#include "IDBBackingStore.h"
 #include "IDBDatabaseBackendImpl.h"
 #include "IDBDatabaseException.h"
+#include "IDBSQLiteBackingStore.h"
 #include "IDBTransactionCoordinator.h"
 #include "SecurityOrigin.h"
 #include <wtf/Threading.h>
@@ -69,7 +69,7 @@ void IDBFactoryBackendImpl::removeIDBBackingStore(const String& uniqueIdentifier
     m_backingStoreMap.remove(uniqueIdentifier);
 }
 
-void IDBFactoryBackendImpl::open(const String& name, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<SecurityOrigin> securityOrigin, Frame*, const String& dataDir, int64_t maximumSize)
+void IDBFactoryBackendImpl::open(const String& name, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<SecurityOrigin> securityOrigin, Frame*, const String& dataDir, int64_t maximumSize, BackingStoreType)
 {
     String fileIdentifier = securityOrigin->databaseIdentifier();
     String uniqueIdentifier = fileIdentifier + "@" + name;
@@ -86,7 +86,7 @@ void IDBFactoryBackendImpl::open(const String& name, PassRefPtr<IDBCallbacks> ca
     if (it2 != m_backingStoreMap.end())
         backingStore = it2->second;
     else {
-        backingStore = IDBBackingStore::open(securityOrigin.get(), dataDir, maximumSize, fileIdentifier, this);
+        backingStore = IDBSQLiteBackingStore::open(securityOrigin.get(), dataDir, maximumSize, fileIdentifier, this);
         if (!backingStore) {
             callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Internal error."));
             return;
diff --git a/Source/WebCore/storage/IDBFactoryBackendImpl.h b/Source/WebCore/storage/IDBFactoryBackendImpl.h
index 071bcf8..ab6e153 100644
--- a/Source/WebCore/storage/IDBFactoryBackendImpl.h
+++ b/Source/WebCore/storage/IDBFactoryBackendImpl.h
@@ -55,7 +55,7 @@ public:
     void addIDBBackingStore(const String& uniqueIdentifier, IDBBackingStore*);
     void removeIDBBackingStore(const String& uniqueIdentifier);
 
-    virtual void open(const String& name, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir, int64_t maximumSize);
+    virtual void open(const String& name, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir, int64_t maximumSize, BackingStoreType);
 
 private:
     IDBFactoryBackendImpl();
diff --git a/Source/WebCore/storage/IDBFactoryBackendInterface.h b/Source/WebCore/storage/IDBFactoryBackendInterface.h
index e05f316..87362d4 100644
--- a/Source/WebCore/storage/IDBFactoryBackendInterface.h
+++ b/Source/WebCore/storage/IDBFactoryBackendInterface.h
@@ -46,12 +46,17 @@ class SecurityOrigin;
 // This is implemented by IDBFactoryBackendImpl and optionally others (in order to proxy
 // calls across process barriers). All calls to these classes should be non-blocking and
 // trigger work on a background thread if necessary.
-class IDBFactoryBackendInterface : public ThreadSafeShared<IDBFactoryBackendInterface> {
+class IDBFactoryBackendInterface : public ThreadSafeRefCounted<IDBFactoryBackendInterface> {
 public:
     static PassRefPtr<IDBFactoryBackendInterface> create();
     virtual ~IDBFactoryBackendInterface() { }
 
-    virtual void open(const String& name, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir, int64_t maximumSize) = 0;
+    enum BackingStoreType {
+        DefaultBackingStore,
+        LevelDBBackingStore
+    };
+
+    virtual void open(const String& name, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir, int64_t maximumSize, BackingStoreType) = 0;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBIndexBackendInterface.h b/Source/WebCore/storage/IDBIndexBackendInterface.h
index e0e578d..81ef1d5 100644
--- a/Source/WebCore/storage/IDBIndexBackendInterface.h
+++ b/Source/WebCore/storage/IDBIndexBackendInterface.h
@@ -39,7 +39,7 @@ class IDBKey;
 class IDBKeyRange;
 class IDBTransactionBackendInterface;
 
-class IDBIndexBackendInterface : public ThreadSafeShared<IDBIndexBackendInterface> {
+class IDBIndexBackendInterface : public ThreadSafeRefCounted<IDBIndexBackendInterface> {
 public:
     virtual ~IDBIndexBackendInterface() { }
 
diff --git a/Source/WebCore/storage/IDBKey.h b/Source/WebCore/storage/IDBKey.h
index 5816ce3..8ee9b8e 100644
--- a/Source/WebCore/storage/IDBKey.h
+++ b/Source/WebCore/storage/IDBKey.h
@@ -34,7 +34,7 @@
 
 namespace WebCore {
 
-class IDBKey : public ThreadSafeShared<IDBKey> {
+class IDBKey : public ThreadSafeRefCounted<IDBKey> {
 public:
     static PassRefPtr<IDBKey> createNull()
     {
@@ -100,8 +100,8 @@ public:
     bool isLessThan(const IDBKey* other) const;
     bool isEqual(const IDBKey* other) const;
 
-    using ThreadSafeShared<IDBKey>::ref;
-    using ThreadSafeShared<IDBKey>::deref;
+    using ThreadSafeRefCounted<IDBKey>::ref;
+    using ThreadSafeRefCounted<IDBKey>::deref;
 
 private:
     IDBKey();
diff --git a/Source/WebCore/storage/IDBKeyRange.h b/Source/WebCore/storage/IDBKeyRange.h
index 636a5c1..7a87088 100644
--- a/Source/WebCore/storage/IDBKeyRange.h
+++ b/Source/WebCore/storage/IDBKeyRange.h
@@ -35,7 +35,7 @@
 
 namespace WebCore {
 
-class IDBKeyRange : public ThreadSafeShared<IDBKeyRange> {
+class IDBKeyRange : public ThreadSafeRefCounted<IDBKeyRange> {
 public:
     static PassRefPtr<IDBKeyRange> create(PassRefPtr<IDBKey> lower, PassRefPtr<IDBKey> upper, bool lowerOpen, bool upperOpen)
     {
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendInterface.h b/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
index 177701c..2975ed7 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
+++ b/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
@@ -42,7 +42,7 @@ class IDBKeyRange;
 class IDBTransactionBackendInterface;
 class SerializedScriptValue;
 
-class IDBObjectStoreBackendInterface : public ThreadSafeShared<IDBObjectStoreBackendInterface> {
+class IDBObjectStoreBackendInterface : public ThreadSafeRefCounted<IDBObjectStoreBackendInterface> {
 public:
     virtual ~IDBObjectStoreBackendInterface() { }
 
diff --git a/Source/WebCore/storage/IDBRequest.cpp b/Source/WebCore/storage/IDBRequest.cpp
index e1837fc..f8d818a 100644
--- a/Source/WebCore/storage/IDBRequest.cpp
+++ b/Source/WebCore/storage/IDBRequest.cpp
@@ -39,7 +39,6 @@
 #include "IDBCursorWithValue.h"
 #include "IDBDatabase.h"
 #include "IDBEventDispatcher.h"
-#include "IDBIndex.h"
 #include "IDBPendingTransactionMonitor.h"
 #include "IDBTransaction.h"
 
@@ -205,11 +204,6 @@ void IDBRequest::onSuccess(PassRefPtr<IDBDatabaseBackendInterface> backend)
     enqueueEvent(createSuccessEvent());
 }
 
-void IDBRequest::onSuccess(PassRefPtr<IDBIndexBackendInterface> backend)
-{
-    ASSERT_NOT_REACHED(); // FIXME: This method should go away.
-}
-
 void IDBRequest::onSuccess(PassRefPtr<IDBKey> idbKey)
 {
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
diff --git a/Source/WebCore/storage/IDBRequest.h b/Source/WebCore/storage/IDBRequest.h
index b6b4e5b..900df01 100644
--- a/Source/WebCore/storage/IDBRequest.h
+++ b/Source/WebCore/storage/IDBRequest.h
@@ -76,7 +76,6 @@ public:
     virtual void onError(PassRefPtr<IDBDatabaseError>);
     virtual void onSuccess(PassRefPtr<IDBDatabaseBackendInterface>);
     virtual void onSuccess(PassRefPtr<IDBCursorBackendInterface>);
-    virtual void onSuccess(PassRefPtr<IDBIndexBackendInterface>);
     virtual void onSuccess(PassRefPtr<IDBKey>);
     virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>);
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>);
@@ -92,8 +91,8 @@ public:
     bool dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec) { return EventTarget::dispatchEvent(event, ec); }
     virtual void uncaughtExceptionInEventHandler();
 
-    using ThreadSafeShared<IDBCallbacks>::ref;
-    using ThreadSafeShared<IDBCallbacks>::deref;
+    using ThreadSafeRefCounted<IDBCallbacks>::ref;
+    using ThreadSafeRefCounted<IDBCallbacks>::deref;
 
 protected:
     IDBRequest(ScriptExecutionContext*, PassRefPtr<IDBAny> source, IDBTransaction*);
diff --git a/Source/WebCore/storage/IDBBackingStore.cpp b/Source/WebCore/storage/IDBSQLiteBackingStore.cpp
index 3859c4c..e43b7a3 100644
--- a/Source/WebCore/storage/IDBBackingStore.cpp
+++ b/Source/WebCore/storage/IDBSQLiteBackingStore.cpp
@@ -24,7 +24,7 @@
  */
 
 #include "config.h"
-#include "IDBBackingStore.h"
+#include "IDBSQLiteBackingStore.h"
 
 #if ENABLE(INDEXED_DATABASE)
 
@@ -39,14 +39,14 @@
 
 namespace WebCore {
 
-IDBBackingStore::IDBBackingStore(String identifier, IDBFactoryBackendImpl* factory)
+IDBSQLiteBackingStore::IDBSQLiteBackingStore(String identifier, IDBFactoryBackendImpl* factory)
     : m_identifier(identifier)
     , m_factory(factory)
 {
     m_factory->addIDBBackingStore(identifier, this);
 }
 
-IDBBackingStore::~IDBBackingStore()
+IDBSQLiteBackingStore::~IDBSQLiteBackingStore()
 {
     m_factory->removeIDBBackingStore(m_identifier);
 }
@@ -165,9 +165,9 @@ static bool migrateDatabase(SQLiteDatabase& sqliteDatabase)
     return true;
 }
 
-PassRefPtr<IDBBackingStore> IDBBackingStore::open(SecurityOrigin* securityOrigin, const String& pathBase, int64_t maximumSize, const String& fileIdentifier, IDBFactoryBackendImpl* factory)
+PassRefPtr<IDBBackingStore> IDBSQLiteBackingStore::open(SecurityOrigin* securityOrigin, const String& pathBase, int64_t maximumSize, const String& fileIdentifier, IDBFactoryBackendImpl* factory)
 {
-    RefPtr<IDBBackingStore> backingStore(adoptRef(new IDBBackingStore(fileIdentifier, factory)));
+    RefPtr<IDBSQLiteBackingStore> backingStore(adoptRef(new IDBSQLiteBackingStore(fileIdentifier, factory)));
 
     String path = ":memory:";
     if (!pathBase.isEmpty()) {
@@ -197,7 +197,7 @@ PassRefPtr<IDBBackingStore> IDBBackingStore::open(SecurityOrigin* securityOrigin
     return backingStore.release();
 }
 
-bool IDBBackingStore::extractIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId)
+bool IDBSQLiteBackingStore::extractIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId)
 {
     SQLiteStatement databaseQuery(m_db, "SELECT id, version FROM Databases WHERE name = ?");
     if (databaseQuery.prepare() != SQLResultOk) {
@@ -216,7 +216,7 @@ bool IDBBackingStore::extractIDBDatabaseMetaData(const String& name, String& fou
     return true;
 }
 
-bool IDBBackingStore::setIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId, bool invalidRowId)
+bool IDBSQLiteBackingStore::setIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId, bool invalidRowId)
 {
     ASSERT(!name.isNull());
     ASSERT(!version.isNull());
@@ -242,7 +242,7 @@ bool IDBBackingStore::setIDBDatabaseMetaData(const String& name, const String& v
     return true;
 }
 
-void IDBBackingStore::getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags)
+void IDBSQLiteBackingStore::getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags)
 {
     SQLiteStatement query(m_db, "SELECT id, name, keyPath, doAutoIncrement FROM ObjectStores WHERE databaseId = ?");
     bool ok = query.prepare() == SQLResultOk;
@@ -263,7 +263,7 @@ void IDBBackingStore::getObjectStores(int64_t databaseId, Vector<int64_t>& found
     }
 }
 
-bool IDBBackingStore::createObjectStore(const String& name, const String& keyPath, bool autoIncrement, int64_t databaseId, int64_t& assignedObjectStoreId)
+bool IDBSQLiteBackingStore::createObjectStore(const String& name, const String& keyPath, bool autoIncrement, int64_t databaseId, int64_t& assignedObjectStoreId)
 {
     SQLiteStatement query(m_db, "INSERT INTO ObjectStores (name, keyPath, doAutoIncrement, databaseId) VALUES (?, ?, ?, ?)");
     if (query.prepare() != SQLResultOk)
@@ -291,7 +291,7 @@ static void doDelete(SQLiteDatabase& db, const char* sql, int64_t id)
     ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
 }
 
-void IDBBackingStore::deleteObjectStore(int64_t objectStoreId)
+void IDBSQLiteBackingStore::deleteObjectStore(int64_t objectStoreId)
 {
     doDelete(m_db, "DELETE FROM ObjectStores WHERE id = ?", objectStoreId);
     doDelete(m_db, "DELETE FROM ObjectStoreData WHERE objectStoreId = ?", objectStoreId);
@@ -373,7 +373,7 @@ static String upperCursorWhereFragment(const IDBKey& key, String comparisonOpera
     return "";
 }
 
-String IDBBackingStore::getObjectStoreRecord(int64_t objectStoreId, const IDBKey& key)
+String IDBSQLiteBackingStore::getObjectStoreRecord(int64_t objectStoreId, const IDBKey& key)
 {
     SQLiteStatement query(m_db, "SELECT keyString, keyDate, keyNumber, value FROM ObjectStoreData WHERE objectStoreId = ? AND " + whereSyntaxForKey(key));
     bool ok = query.prepare() == SQLResultOk;
@@ -422,7 +422,7 @@ static void bindKeyToQueryWithNulls(SQLiteStatement& query, int baseColumn, cons
     }
 }
 
-bool IDBBackingStore::putObjectStoreRecord(int64_t objectStoreId, const IDBKey& key, const String& value, int64_t& rowId, bool invalidRowId)
+bool IDBSQLiteBackingStore::putObjectStoreRecord(int64_t objectStoreId, const IDBKey& key, const String& value, int64_t& rowId, bool invalidRowId)
 {
     String sql = !invalidRowId ? "UPDATE ObjectStoreData SET keyString = ?, keyDate = ?, keyNumber = ?, value = ? WHERE id = ?"
                                : "INSERT INTO ObjectStoreData (keyString, keyDate, keyNumber, value, objectStoreId) VALUES (?, ?, ?, ?, ?)";
@@ -446,13 +446,13 @@ bool IDBBackingStore::putObjectStoreRecord(int64_t objectStoreId, const IDBKey&
     return true;
 }
 
-void IDBBackingStore::clearObjectStore(int64_t objectStoreId)
+void IDBSQLiteBackingStore::clearObjectStore(int64_t objectStoreId)
 {
     doDelete(m_db, "DELETE FROM IndexData WHERE objectStoreDataId IN (SELECT id FROM ObjectStoreData WHERE objectStoreId = ?)", objectStoreId);
     doDelete(m_db, "DELETE FROM ObjectStoreData WHERE objectStoreId = ?", objectStoreId);
 }
 
-void IDBBackingStore::deleteObjectStoreRecord(int64_t, int64_t objectStoreDataId)
+void IDBSQLiteBackingStore::deleteObjectStoreRecord(int64_t, int64_t objectStoreDataId)
 {
     SQLiteStatement osQuery(m_db, "DELETE FROM ObjectStoreData WHERE id = ?");
     bool ok = osQuery.prepare() == SQLResultOk;
@@ -473,7 +473,7 @@ void IDBBackingStore::deleteObjectStoreRecord(int64_t, int64_t objectStoreDataId
     ASSERT_UNUSED(ok, ok);
 }
 
-double IDBBackingStore::nextAutoIncrementNumber(int64_t objectStoreId)
+double IDBSQLiteBackingStore::nextAutoIncrementNumber(int64_t objectStoreId)
 {
     SQLiteStatement query(m_db, "SELECT max(keyNumber) + 1 FROM ObjectStoreData WHERE objectStoreId = ? AND keyString IS NULL AND keyDate IS NULL");
     bool ok = query.prepare() == SQLResultOk;
@@ -487,7 +487,7 @@ double IDBBackingStore::nextAutoIncrementNumber(int64_t objectStoreId)
     return query.getColumnDouble(0);
 }
 
-bool IDBBackingStore::keyExistsInObjectStore(int64_t objectStoreId, const IDBKey& key, int64_t& foundObjectStoreDataId)
+bool IDBSQLiteBackingStore::keyExistsInObjectStore(int64_t objectStoreId, const IDBKey& key, int64_t& foundObjectStoreDataId)
 {
     String sql = String("SELECT id FROM ObjectStoreData WHERE objectStoreId = ? AND ") + whereSyntaxForKey(key);
     SQLiteStatement query(m_db, sql);
@@ -504,7 +504,7 @@ bool IDBBackingStore::keyExistsInObjectStore(int64_t objectStoreId, const IDBKey
     return true;
 }
 
-bool IDBBackingStore::forEachObjectStoreRecord(int64_t objectStoreId, ObjectStoreRecordCallback& callback)
+bool IDBSQLiteBackingStore::forEachObjectStoreRecord(int64_t objectStoreId, ObjectStoreRecordCallback& callback)
 {
     SQLiteStatement query(m_db, "SELECT id, value FROM ObjectStoreData WHERE objectStoreId = ?");
     if (query.prepare() != SQLResultOk)
@@ -522,7 +522,7 @@ bool IDBBackingStore::forEachObjectStoreRecord(int64_t objectStoreId, ObjectStor
     return true;
 }
 
-void IDBBackingStore::getIndexes(int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags)
+void IDBSQLiteBackingStore::getIndexes(int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags)
 {
     SQLiteStatement query(m_db, "SELECT id, name, keyPath, isUnique FROM Indexes WHERE objectStoreId = ?");
     bool ok = query.prepare() == SQLResultOk;
@@ -543,7 +543,7 @@ void IDBBackingStore::getIndexes(int64_t objectStoreId, Vector<int64_t>& foundId
     }
 }
 
-bool IDBBackingStore::createIndex(int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId)
+bool IDBSQLiteBackingStore::createIndex(int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId)
 {
     SQLiteStatement query(m_db, "INSERT INTO Indexes (objectStoreId, name, keyPath, isUnique) VALUES (?, ?, ?, ?)");
     if (query.prepare() != SQLResultOk)
@@ -561,13 +561,13 @@ bool IDBBackingStore::createIndex(int64_t objectStoreId, const String& name, con
     return true;
 }
 
-void IDBBackingStore::deleteIndex(int64_t indexId)
+void IDBSQLiteBackingStore::deleteIndex(int64_t indexId)
 {
     doDelete(m_db, "DELETE FROM Indexes WHERE id = ?", indexId);
     doDelete(m_db, "DELETE FROM IndexData WHERE indexId = ?", indexId);
 }
 
-bool IDBBackingStore::putIndexDataForRecord(int64_t indexId, const IDBKey& key, int64_t objectStoreDataId)
+bool IDBSQLiteBackingStore::putIndexDataForRecord(int64_t indexId, const IDBKey& key, int64_t objectStoreDataId)
 {
     SQLiteStatement query(m_db, "INSERT INTO IndexData (keyString, keyDate, keyNumber, indexId, objectStoreDataId) VALUES (?, ?, ?, ?, ?)");
     if (query.prepare() != SQLResultOk)
@@ -580,7 +580,7 @@ bool IDBBackingStore::putIndexDataForRecord(int64_t indexId, const IDBKey& key,
     return query.step() == SQLResultDone;
 }
 
-bool IDBBackingStore::deleteIndexDataForRecord(int64_t objectStoreDataId)
+bool IDBSQLiteBackingStore::deleteIndexDataForRecord(int64_t objectStoreDataId)
 {
     SQLiteStatement query(m_db, "DELETE FROM IndexData WHERE objectStoreDataId = ?");
     if (query.prepare() != SQLResultOk)
@@ -590,7 +590,7 @@ bool IDBBackingStore::deleteIndexDataForRecord(int64_t objectStoreDataId)
     return query.step() == SQLResultDone;
 }
 
-String IDBBackingStore::getObjectViaIndex(int64_t indexId, const IDBKey& key)
+String IDBSQLiteBackingStore::getObjectViaIndex(int64_t indexId, const IDBKey& key)
 {
     String sql = String("SELECT ")
                  + "ObjectStoreData.value "
@@ -629,7 +629,7 @@ static PassRefPtr<IDBKey> keyFromQuery(SQLiteStatement& query, int baseColumn)
     return IDBKey::createNull();
 }
 
-PassRefPtr<IDBKey> IDBBackingStore::getPrimaryKeyViaIndex(int64_t indexId, const IDBKey& key)
+PassRefPtr<IDBKey> IDBSQLiteBackingStore::getPrimaryKeyViaIndex(int64_t indexId, const IDBKey& key)
 {
     String sql = String("SELECT ")
                  + "ObjectStoreData.keyString, ObjectStoreData.keyDate, ObjectStoreData.keyNumber "
@@ -651,7 +651,7 @@ PassRefPtr<IDBKey> IDBBackingStore::getPrimaryKeyViaIndex(int64_t indexId, const
     return foundKey.release();
 }
 
-bool IDBBackingStore::keyExistsInIndex(int64_t indexId, const IDBKey& key)
+bool IDBSQLiteBackingStore::keyExistsInIndex(int64_t indexId, const IDBKey& key)
 {
     String sql = String("SELECT id FROM IndexData WHERE indexId = ? AND ") + whereSyntaxForKey(key);
     SQLiteStatement query(m_db, sql);
@@ -666,7 +666,7 @@ bool IDBBackingStore::keyExistsInIndex(int64_t indexId, const IDBKey& key)
 
 namespace {
 
-class CursorImplCommon : public IDBBackingStore::Cursor {
+class CursorImplCommon : public IDBSQLiteBackingStore::Cursor {
 public:
     CursorImplCommon(SQLiteDatabase& sqliteDatabase, String query, bool uniquenessConstraint, bool iterateForward)
         : m_query(sqliteDatabase, query)
@@ -849,7 +849,7 @@ bool IndexCursorImpl::currentRowExists()
 
 } // namespace
 
-PassRefPtr<IDBBackingStore::Cursor> IDBBackingStore::openObjectStoreCursor(int64_t objectStoreId, const IDBKeyRange* range, IDBCursor::Direction direction)
+PassRefPtr<IDBBackingStore::Cursor> IDBSQLiteBackingStore::openObjectStoreCursor(int64_t objectStoreId, const IDBKeyRange* range, IDBCursor::Direction direction)
 {
     bool lowerBound = range && range->lower();
     bool upperBound = range && range->upper();
@@ -886,7 +886,7 @@ PassRefPtr<IDBBackingStore::Cursor> IDBBackingStore::openObjectStoreCursor(int64
     return cursor.release();
 }
 
-PassRefPtr<IDBBackingStore::Cursor> IDBBackingStore::openIndexKeyCursor(int64_t indexId, const IDBKeyRange* range, IDBCursor::Direction direction)
+PassRefPtr<IDBBackingStore::Cursor> IDBSQLiteBackingStore::openIndexKeyCursor(int64_t indexId, const IDBKeyRange* range, IDBCursor::Direction direction)
 {
     String sql = String("SELECT IndexData.id, IndexData.keyString, IndexData.keyDate, IndexData.keyNumber, ")
                  + ("ObjectStoreData.keyString, ObjectStoreData.keyDate, ObjectStoreData.keyNumber ")
@@ -926,7 +926,7 @@ PassRefPtr<IDBBackingStore::Cursor> IDBBackingStore::openIndexKeyCursor(int64_t
     return cursor.release();
 }
 
-PassRefPtr<IDBBackingStore::Cursor> IDBBackingStore::openIndexCursor(int64_t indexId, const IDBKeyRange* range, IDBCursor::Direction direction)
+PassRefPtr<IDBBackingStore::Cursor> IDBSQLiteBackingStore::openIndexCursor(int64_t indexId, const IDBKeyRange* range, IDBCursor::Direction direction)
 {
     String sql = String("SELECT IndexData.id, IndexData.keyString, IndexData.keyDate, IndexData.keyNumber, ")
                  + ("ObjectStoreData.value, ObjectStoreData.keyString, ObjectStoreData.keyDate, ObjectStoreData.keyNumber ")
@@ -986,7 +986,7 @@ private:
 
 } // namespace
 
-PassRefPtr<IDBBackingStore::Transaction> IDBBackingStore::createTransaction()
+PassRefPtr<IDBBackingStore::Transaction> IDBSQLiteBackingStore::createTransaction()
 {
     return adoptRef(new TransactionImpl(m_db));
 }
diff --git a/Source/WebCore/storage/IDBSQLiteBackingStore.h b/Source/WebCore/storage/IDBSQLiteBackingStore.h
new file mode 100644
index 0000000..fe0c6c1
--- /dev/null
+++ b/Source/WebCore/storage/IDBSQLiteBackingStore.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IDBSQLiteBackingStore_h
+#define IDBSQLiteBackingStore_h
+
+#if ENABLE(INDEXED_DATABASE)
+
+#include "IDBBackingStore.h"
+
+namespace WebCore {
+
+class IDBSQLiteBackingStore : public IDBBackingStore {
+public:
+    static PassRefPtr<IDBBackingStore> open(SecurityOrigin*, const String& pathBase, int64_t maximumSize, const String& fileIdentifier, IDBFactoryBackendImpl*);
+    virtual ~IDBSQLiteBackingStore();
+
+    virtual bool extractIDBDatabaseMetaData(const String& name, String& foundVersion, int64_t& foundId);
+    virtual bool setIDBDatabaseMetaData(const String& name, const String& version, int64_t& rowId, bool invalidRowId);
+
+    virtual void getObjectStores(int64_t databaseId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundAutoIncrementFlags);
+    virtual bool createObjectStore(const String& name, const String& keyPath, bool autoIncrement, int64_t databaseId, int64_t& assignedObjectStoreId);
+    virtual void deleteObjectStore(int64_t objectStoreId);
+    virtual String getObjectStoreRecord(int64_t objectStoreId, const IDBKey&);
+    virtual bool putObjectStoreRecord(int64_t objectStoreId, const IDBKey&, const String& value, int64_t& rowId, bool invalidRowId);
+    virtual void clearObjectStore(int64_t objectStoreId);
+    virtual void deleteObjectStoreRecord(int64_t objectStoreId, int64_t objectStoreDataId);
+    virtual double nextAutoIncrementNumber(int64_t objectStoreId);
+    virtual bool keyExistsInObjectStore(int64_t objectStoreId, const IDBKey&, int64_t& foundObjectStoreDataId);
+
+    virtual bool forEachObjectStoreRecord(int64_t objectStoreId, ObjectStoreRecordCallback&);
+
+    virtual void getIndexes(int64_t objectStoreId, Vector<int64_t>& foundIds, Vector<String>& foundNames, Vector<String>& foundKeyPaths, Vector<bool>& foundUniqueFlags);
+    virtual bool createIndex(int64_t objectStoreId, const String& name, const String& keyPath, bool isUnique, int64_t& indexId);
+    virtual void deleteIndex(int64_t indexId);
+    virtual bool putIndexDataForRecord(int64_t indexId, const IDBKey&, int64_t objectStoreDataId);
+    virtual bool deleteIndexDataForRecord(int64_t objectStoreDataId);
+    virtual String getObjectViaIndex(int64_t indexId, const IDBKey&);
+    virtual PassRefPtr<IDBKey> getPrimaryKeyViaIndex(int64_t indexId, const IDBKey&);
+    virtual bool keyExistsInIndex(int64_t indexId, const IDBKey&);
+
+    virtual PassRefPtr<Cursor> openObjectStoreCursor(int64_t objectStoreId, const IDBKeyRange*, IDBCursor::Direction);
+    virtual PassRefPtr<Cursor> openIndexKeyCursor(int64_t indexId, const IDBKeyRange*, IDBCursor::Direction);
+    virtual PassRefPtr<Cursor> openIndexCursor(int64_t indexId, const IDBKeyRange*, IDBCursor::Direction);
+
+    virtual PassRefPtr<Transaction> createTransaction();
+
+private:
+    IDBSQLiteBackingStore(String identifier, IDBFactoryBackendImpl*);
+
+    SQLiteDatabase m_db;
+    String m_identifier;
+    RefPtr<IDBFactoryBackendImpl> m_factory;
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif // IDBSQLiteBackingStore_h
diff --git a/Source/WebCore/storage/IDBTransactionBackendInterface.h b/Source/WebCore/storage/IDBTransactionBackendInterface.h
index 1b370af..3432e9a 100644
--- a/Source/WebCore/storage/IDBTransactionBackendInterface.h
+++ b/Source/WebCore/storage/IDBTransactionBackendInterface.h
@@ -43,7 +43,7 @@ class IDBTransactionCallbacks;
 // This is implemented by IDBTransactionBackendImpl and optionally others (in order to proxy
 // calls across process barriers). All calls to these classes should be non-blocking and
 // trigger work on a background thread if necessary.
-class IDBTransactionBackendInterface : public ThreadSafeShared<IDBTransactionBackendInterface> {
+class IDBTransactionBackendInterface : public ThreadSafeRefCounted<IDBTransactionBackendInterface> {
 public:
     virtual ~IDBTransactionBackendInterface() { }
 
diff --git a/Source/WebCore/storage/LocalStorageTask.cpp b/Source/WebCore/storage/LocalStorageTask.cpp
index d31c991..5d2c807 100644
--- a/Source/WebCore/storage/LocalStorageTask.cpp
+++ b/Source/WebCore/storage/LocalStorageTask.cpp
@@ -30,6 +30,7 @@
 
 #include "LocalStorageThread.h"
 #include "StorageAreaSync.h"
+#include "StorageTracker.h"
 
 namespace WebCore {
 
@@ -50,6 +51,27 @@ LocalStorageTask::LocalStorageTask(Type type, LocalStorageThread* thread)
     ASSERT(m_thread);
     ASSERT(m_type == TerminateThread);
 }
+    
+LocalStorageTask::LocalStorageTask(Type type)
+    : m_type(type)
+{
+    ASSERT(m_type == ImportOrigins || m_type == DeleteAllOrigins);
+}
+    
+LocalStorageTask::LocalStorageTask(Type type, const String& originIdentifier)
+    : m_type(type)
+    , m_originIdentifier(originIdentifier)
+{
+    ASSERT(m_type == DeleteOrigin);
+}
+
+LocalStorageTask::LocalStorageTask(Type type, const String& originIdentifier, const String& databaseFilename)
+    : m_type(type)
+    , m_originIdentifier(originIdentifier)
+    , m_databaseFilename(databaseFilename)
+{
+    ASSERT(m_type == SetOriginDetails);
+}
 
 LocalStorageTask::~LocalStorageTask()
 {
@@ -64,6 +86,18 @@ void LocalStorageTask::performTask()
         case AreaSync:
             m_area->performSync();
             break;
+        case SetOriginDetails:
+            StorageTracker::tracker().syncSetOriginDetails(m_originIdentifier, m_databaseFilename);
+            break;
+        case ImportOrigins:
+            StorageTracker::tracker().syncImportOriginIdentifiers();
+            break;
+        case DeleteAllOrigins:
+            StorageTracker::tracker().syncDeleteAllOrigins();
+            break;
+        case DeleteOrigin:
+            StorageTracker::tracker().syncDeleteOrigin(m_originIdentifier);
+            break;
         case DeleteEmptyDatabase:
             m_area->deleteEmptyDatabase();
             break;
diff --git a/Source/WebCore/storage/LocalStorageTask.h b/Source/WebCore/storage/LocalStorageTask.h
index 27a8eb5..99e72f5 100644
--- a/Source/WebCore/storage/LocalStorageTask.h
+++ b/Source/WebCore/storage/LocalStorageTask.h
@@ -28,6 +28,7 @@
 
 #if ENABLE(DOM_STORAGE)
 
+#include "PlatformString.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Threading.h>
 
@@ -40,13 +41,17 @@ namespace WebCore {
     class LocalStorageTask {
         WTF_MAKE_NONCOPYABLE(LocalStorageTask); WTF_MAKE_FAST_ALLOCATED;
     public:
-        enum Type { AreaImport, AreaSync, DeleteEmptyDatabase, TerminateThread };
+        enum Type { AreaImport, AreaSync, DeleteEmptyDatabase, SetOriginDetails, ImportOrigins, DeleteAllOrigins, DeleteOrigin, TerminateThread };
 
         ~LocalStorageTask();
 
         static PassOwnPtr<LocalStorageTask> createImport(StorageAreaSync* area) { return adoptPtr(new LocalStorageTask(AreaImport, area)); }
         static PassOwnPtr<LocalStorageTask> createSync(StorageAreaSync* area) { return adoptPtr(new LocalStorageTask(AreaSync, area)); }
         static PassOwnPtr<LocalStorageTask> createDeleteEmptyDatabase(StorageAreaSync* area) { return adoptPtr(new LocalStorageTask(DeleteEmptyDatabase, area)); }
+        static PassOwnPtr<LocalStorageTask> createOriginIdentifiersImport() { return adoptPtr(new LocalStorageTask(ImportOrigins)); }
+        static PassOwnPtr<LocalStorageTask> createSetOriginDetails(const String& originIdentifier, const String& databaseFilename) { return adoptPtr(new LocalStorageTask(SetOriginDetails, originIdentifier, databaseFilename)); }
+        static PassOwnPtr<LocalStorageTask> createDeleteOrigin(const String& originIdentifier) { return adoptPtr(new LocalStorageTask(DeleteOrigin, originIdentifier)); }
+        static PassOwnPtr<LocalStorageTask> createDeleteAllOrigins() { return adoptPtr(new LocalStorageTask(DeleteAllOrigins)); }
         static PassOwnPtr<LocalStorageTask> createTerminate(LocalStorageThread* thread) { return adoptPtr(new LocalStorageTask(TerminateThread, thread)); }
 
         void performTask();
@@ -54,10 +59,15 @@ namespace WebCore {
     private:
         LocalStorageTask(Type, StorageAreaSync*);
         LocalStorageTask(Type, LocalStorageThread*);
+        LocalStorageTask(Type, const String& originIdentifier);
+        LocalStorageTask(Type, const String& originIdentifier, const String& databaseFilename);
+        LocalStorageTask(Type);
 
         Type m_type;
         StorageAreaSync* m_area;
         LocalStorageThread* m_thread;
+        String m_originIdentifier;
+        String m_databaseFilename;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/SQLCallbackWrapper.h b/Source/WebCore/storage/SQLCallbackWrapper.h
new file mode 100644
index 0000000..38059fa
--- /dev/null
+++ b/Source/WebCore/storage/SQLCallbackWrapper.h
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef SQLCallbackWrapper_h
+#define SQLCallbackWrapper_h
+
+#if ENABLE(DATABASE)
+
+#include "CrossThreadTask.h"
+#include "ScriptExecutionContext.h"
+#include <wtf/ThreadingPrimitives.h>
+
+namespace WebCore {
+
+// A helper class to safely dereference the callback objects held by
+// SQLStatement and SQLTransaction on the proper thread. The 'wrapped'
+// callback is dereferenced:
+// - by destructing the enclosing wrapper - on any thread
+// - by calling clear() - on any thread
+// - by unwrapping and then dereferencing normally - on context thread only
+template<typename T> class SQLCallbackWrapper {
+public:
+    SQLCallbackWrapper(PassRefPtr<T> callback, ScriptExecutionContext* scriptExecutionContext)
+        : m_callback(callback)
+        , m_scriptExecutionContext(m_callback ? scriptExecutionContext : 0)
+    {
+        ASSERT(!m_callback || (m_scriptExecutionContext.get() && m_scriptExecutionContext->isContextThread()));
+    }
+
+    ~SQLCallbackWrapper()
+    {
+        clear();
+    }
+
+    void clear()
+    {
+        ScriptExecutionContext* context;
+        T* callback;
+        {
+            MutexLocker locker(m_mutex);
+            if (!m_callback) {
+                ASSERT(!m_scriptExecutionContext);
+                return;
+            }
+            if (m_scriptExecutionContext->isContextThread()) {
+                m_callback = 0;
+                m_scriptExecutionContext = 0;
+                return;
+            }
+            context = m_scriptExecutionContext.release().leakRef();
+            callback = m_callback.release().leakRef();
+        }
+        context->postTask(createCallbackTask(&safeRelease, callback));
+    }
+
+    PassRefPtr<T> unwrap()
+    {
+        MutexLocker locker(m_mutex);
+        ASSERT(!m_callback || m_scriptExecutionContext->isContextThread());
+        m_scriptExecutionContext = 0;
+        return m_callback.release();
+    }
+
+    // Useful for optimizations only, please test the return value of unwrap to be sure.
+    bool hasCallback() const { return m_callback; }
+
+private:
+    static void safeRelease(ScriptExecutionContext* context, T* callback)
+    {
+        ASSERT(callback && context && context->isContextThread());
+        callback->deref();
+        context->deref();
+    }
+
+    Mutex m_mutex;
+    RefPtr<T> m_callback;
+    RefPtr<ScriptExecutionContext> m_scriptExecutionContext;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(DATABASE)
+
+#endif // SQLCallbackWrapper_h
diff --git a/Source/WebCore/storage/SQLError.h b/Source/WebCore/storage/SQLError.h
index 496145a..eb9005b 100644
--- a/Source/WebCore/storage/SQLError.h
+++ b/Source/WebCore/storage/SQLError.h
@@ -32,11 +32,11 @@
 #if ENABLE(DATABASE)
 
 #include "PlatformString.h"
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
-class SQLError : public ThreadSafeShared<SQLError> {
+class SQLError : public ThreadSafeRefCounted<SQLError> {
 public:
     static PassRefPtr<SQLError> create(unsigned code, const String& message) { return adoptRef(new SQLError(code, message)); }
 
diff --git a/Source/WebCore/storage/SQLResultSet.h b/Source/WebCore/storage/SQLResultSet.h
index 268472f..964504c 100644
--- a/Source/WebCore/storage/SQLResultSet.h
+++ b/Source/WebCore/storage/SQLResultSet.h
@@ -33,11 +33,11 @@
 
 #include "ExceptionCode.h"
 #include "SQLResultSetRowList.h"
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
-class SQLResultSet : public ThreadSafeShared<SQLResultSet> {
+class SQLResultSet : public ThreadSafeRefCounted<SQLResultSet> {
 public:
     static PassRefPtr<SQLResultSet> create() { return adoptRef(new SQLResultSet); }
 
diff --git a/Source/WebCore/storage/SQLStatement.cpp b/Source/WebCore/storage/SQLStatement.cpp
index 306f561..58b7f71 100644
--- a/Source/WebCore/storage/SQLStatement.cpp
+++ b/Source/WebCore/storage/SQLStatement.cpp
@@ -43,16 +43,16 @@
 
 namespace WebCore {
 
-PassRefPtr<SQLStatement> SQLStatement::create(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, int permissions)
+PassRefPtr<SQLStatement> SQLStatement::create(Database* database, const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, int permissions)
 {
-    return adoptRef(new SQLStatement(statement, arguments, callback, errorCallback, permissions));
+    return adoptRef(new SQLStatement(database, statement, arguments, callback, errorCallback, permissions));
 }
 
-SQLStatement::SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, int permissions)
+SQLStatement::SQLStatement(Database* database, const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, int permissions)
     : m_statement(statement.crossThreadString())
     , m_arguments(arguments)
-    , m_statementCallback(callback)
-    , m_statementErrorCallback(errorCallback)
+    , m_statementCallbackWrapper(callback, database->scriptExecutionContext())
+    , m_statementErrorCallbackWrapper(errorCallback, database->scriptExecutionContext())
     , m_permissions(permissions)
 {
 }
@@ -166,17 +166,16 @@ bool SQLStatement::performCallback(SQLTransaction* transaction)
 
     bool callbackError = false;
 
+    RefPtr<SQLStatementCallback> callback = m_statementCallbackWrapper.unwrap();
+    RefPtr<SQLStatementErrorCallback> errorCallback = m_statementErrorCallbackWrapper.unwrap();
+
     // Call the appropriate statement callback and track if it resulted in an error,
     // because then we need to jump to the transaction error callback.
     if (m_error) {
-        ASSERT(m_statementErrorCallback);
-        callbackError = m_statementErrorCallback->handleEvent(transaction, m_error.get());
-    } else if (m_statementCallback)
-        callbackError = !m_statementCallback->handleEvent(transaction, m_resultSet.get());
-
-    // Now release our callbacks, to break reference cycles.
-    m_statementCallback = 0;
-    m_statementErrorCallback = 0;
+        ASSERT(errorCallback);
+        callbackError = errorCallback->handleEvent(transaction, m_error.get());
+    } else if (callback)
+        callbackError = !callback->handleEvent(transaction, m_resultSet.get());
 
     return callbackError;
 }
diff --git a/Source/WebCore/storage/SQLStatement.h b/Source/WebCore/storage/SQLStatement.h
index afd605a..1d81eb2 100644
--- a/Source/WebCore/storage/SQLStatement.h
+++ b/Source/WebCore/storage/SQLStatement.h
@@ -31,6 +31,7 @@
 #if ENABLE(DATABASE)
 
 #include "PlatformString.h"
+#include "SQLCallbackWrapper.h"
 #include "SQLResultSet.h"
 #include "SQLValue.h"
 #include <wtf/Forward.h>
@@ -44,15 +45,15 @@ class SQLStatementCallback;
 class SQLStatementErrorCallback;
 class SQLTransaction;
 
-class SQLStatement : public ThreadSafeShared<SQLStatement> {
+class SQLStatement : public ThreadSafeRefCounted<SQLStatement> {
 public:
-    static PassRefPtr<SQLStatement> create(const String&, const Vector<SQLValue>&, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>, int permissions);
+    static PassRefPtr<SQLStatement> create(Database*, const String&, const Vector<SQLValue>&, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>, int permissions);
 
     bool execute(Database*);
     bool lastExecutionFailedDueToQuota() const;
 
-    bool hasStatementCallback() const { return m_statementCallback; }
-    bool hasStatementErrorCallback() const { return m_statementErrorCallback; }
+    bool hasStatementCallback() const { return m_statementCallbackWrapper.hasCallback(); }
+    bool hasStatementErrorCallback() const { return m_statementErrorCallbackWrapper.hasCallback(); }
 
     void setDatabaseDeletedError();
     void setVersionMismatchedError();
@@ -61,15 +62,15 @@ public:
 
     SQLError* sqlError() const { return m_error.get(); }
 private:
-    SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>, int permissions);
+    SQLStatement(Database*, const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>, int permissions);
 
     void setFailureDueToQuota();
     void clearFailureDueToQuota();
 
     String m_statement;
     Vector<SQLValue> m_arguments;
-    RefPtr<SQLStatementCallback> m_statementCallback;
-    RefPtr<SQLStatementErrorCallback> m_statementErrorCallback;
+    SQLCallbackWrapper<SQLStatementCallback> m_statementCallbackWrapper;
+    SQLCallbackWrapper<SQLStatementErrorCallback> m_statementErrorCallbackWrapper;
 
     RefPtr<SQLError> m_error;
     RefPtr<SQLResultSet> m_resultSet;
diff --git a/Source/WebCore/storage/SQLStatementCallback.h b/Source/WebCore/storage/SQLStatementCallback.h
index f86e29f..cae5827 100644
--- a/Source/WebCore/storage/SQLStatementCallback.h
+++ b/Source/WebCore/storage/SQLStatementCallback.h
@@ -30,14 +30,14 @@
 
 #if ENABLE(DATABASE)
 
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
 class SQLTransaction;
 class SQLResultSet;
 
-class SQLStatementCallback : public ThreadSafeShared<SQLStatementCallback> {
+class SQLStatementCallback : public ThreadSafeRefCounted<SQLStatementCallback> {
 public:
     virtual ~SQLStatementCallback() { }
     virtual bool handleEvent(SQLTransaction*, SQLResultSet*) = 0;
diff --git a/Source/WebCore/storage/SQLStatementErrorCallback.h b/Source/WebCore/storage/SQLStatementErrorCallback.h
index acb8f64..5fecec4 100644
--- a/Source/WebCore/storage/SQLStatementErrorCallback.h
+++ b/Source/WebCore/storage/SQLStatementErrorCallback.h
@@ -31,14 +31,14 @@
 
 #if ENABLE(DATABASE)
 
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
 class SQLTransaction;
 class SQLError;
 
-class SQLStatementErrorCallback : public ThreadSafeShared<SQLStatementErrorCallback> {
+class SQLStatementErrorCallback : public ThreadSafeRefCounted<SQLStatementErrorCallback> {
 public:
     virtual ~SQLStatementErrorCallback() { }
     virtual bool handleEvent(SQLTransaction*, SQLError*) = 0;
diff --git a/Source/WebCore/storage/SQLTransaction.cpp b/Source/WebCore/storage/SQLTransaction.cpp
index dea9d97..dfcd568 100644
--- a/Source/WebCore/storage/SQLTransaction.cpp
+++ b/Source/WebCore/storage/SQLTransaction.cpp
@@ -71,9 +71,9 @@ SQLTransaction::SQLTransaction(Database* db, PassRefPtr<SQLTransactionCallback>
     , m_executeSqlAllowed(false)
     , m_database(db)
     , m_wrapper(wrapper)
-    , m_callback(callback)
-    , m_successCallback(successCallback)
-    , m_errorCallback(errorCallback)
+    , m_callbackWrapper(callback, db->scriptExecutionContext())
+    , m_successCallbackWrapper(successCallback, db->scriptExecutionContext())
+    , m_errorCallbackWrapper(errorCallback, db->scriptExecutionContext())
     , m_shouldRetryCurrentStatement(false)
     , m_modifiedDatabase(false)
     , m_lockAcquired(false)
@@ -100,7 +100,7 @@ void SQLTransaction::executeSQL(const String& sqlStatement, const Vector<SQLValu
     else if (m_readOnly)
         permissions |= DatabaseAuthorizer::ReadOnlyMask;
 
-    RefPtr<SQLStatement> statement = SQLStatement::create(sqlStatement, arguments, callback, callbackError, permissions);
+    RefPtr<SQLStatement> statement = SQLStatement::create(m_database.get(), sqlStatement, arguments, callback, callbackError, permissions);
 
     if (m_database->deleted())
         statement->setDatabaseDeletedError();
@@ -159,9 +159,9 @@ void SQLTransaction::checkAndHandleClosedOrInterruptedDatabase()
     m_nextStep = 0;
 
     // Release the unneeded callbacks, to break reference cycles.
-    m_callback = 0;
-    m_successCallback = 0;
-    m_errorCallback = 0;
+    m_callbackWrapper.clear();
+    m_successCallbackWrapper.clear();
+    m_errorCallbackWrapper.clear();
 
     // The next steps should be executed only if we're on the DB thread.
     if (currentThread() != database()->scriptExecutionContext()->databaseThread()->getThreadID())
@@ -293,11 +293,11 @@ void SQLTransaction::deliverTransactionCallback()
 {
     bool shouldDeliverErrorCallback = false;
 
-    if (m_callback) {
+    RefPtr<SQLTransactionCallback> callback = m_callbackWrapper.unwrap();
+    if (callback) {
         m_executeSqlAllowed = true;
-        shouldDeliverErrorCallback = !m_callback->handleEvent(this);
+        shouldDeliverErrorCallback = !callback->handleEvent(this);
         m_executeSqlAllowed = false;
-        m_callback = 0;
     }
 
     // Transaction Step 5 - If the transaction callback was null or raised an exception, jump to the error callback
@@ -425,7 +425,7 @@ void SQLTransaction::deliverStatementCallback()
     m_executeSqlAllowed = false;
 
     if (result) {
-      m_transactionError = SQLError::create(SQLError::UNKNOWN_ERR, "the statement callback raised an exception or statement error callback did not return false");
+        m_transactionError = SQLError::create(SQLError::UNKNOWN_ERR, "the statement callback raised an exception or statement error callback did not return false");
         handleTransactionError(true);
     } else
         scheduleToRunStatements();
@@ -465,7 +465,7 @@ void SQLTransaction::postflightAndCommit()
 
     // If the commit failed, the transaction will still be marked as "in progress"
     if (m_sqliteTransaction->inProgress()) {
-        m_successCallback = 0;
+        m_successCallbackWrapper.clear();
         m_transactionError = SQLError::create(SQLError::DATABASE_ERR, "failed to commit the transaction");
         handleTransactionError(false);
         return;
@@ -480,10 +480,10 @@ void SQLTransaction::postflightAndCommit()
         m_database->transactionClient()->didCommitWriteTransaction(database());
 
     // Now release our unneeded callbacks, to break reference cycles.
-    m_errorCallback = 0;
+    m_errorCallbackWrapper.clear();
 
     // Transaction Step 10 - Deliver success callback, if there is one
-    if (m_successCallback) {
+    if (m_successCallbackWrapper.hasCallback()) {
         m_nextStep = &SQLTransaction::deliverSuccessCallback;
         LOG(StorageAPI, "Scheduling deliverSuccessCallback for transaction %p\n", this);
         m_database->scheduleTransactionCallback(this);
@@ -494,11 +494,9 @@ void SQLTransaction::postflightAndCommit()
 void SQLTransaction::deliverSuccessCallback()
 {
     // Transaction Step 10 - Deliver success callback
-    ASSERT(m_successCallback);
-    m_successCallback->handleEvent();
-
-    // Release the last callback to break reference cycle
-    m_successCallback = 0;
+    RefPtr<VoidCallback> successCallback = m_successCallbackWrapper.unwrap();
+    if (successCallback)
+        successCallback->handleEvent();
 
     // Schedule a "post-success callback" step to return control to the database thread in case there
     // are further transactions queued up for this Database
@@ -524,7 +522,7 @@ void SQLTransaction::cleanupAfterSuccessCallback()
 
 void SQLTransaction::handleTransactionError(bool inCallback)
 {
-    if (m_errorCallback) {
+    if (m_errorCallbackWrapper.hasCallback()) {
         if (inCallback)
             deliverTransactionErrorCallback();
         else {
@@ -552,10 +550,9 @@ void SQLTransaction::deliverTransactionErrorCallback()
 
     // Transaction Step 12 - If exists, invoke error callback with the last
     // error to have occurred in this transaction.
-    if (m_errorCallback) {
-        m_errorCallback->handleEvent(m_transactionError.get());
-        m_errorCallback = 0;
-    }
+    RefPtr<SQLTransactionErrorCallback> errorCallback = m_errorCallbackWrapper.unwrap();
+    if (errorCallback)
+        errorCallback->handleEvent(m_transactionError.get());
 
     m_nextStep = &SQLTransaction::cleanupAfterTransactionErrorCallback;
     LOG(StorageAPI, "Scheduling cleanupAfterTransactionErrorCallback for transaction %p\n", this);
diff --git a/Source/WebCore/storage/SQLTransaction.h b/Source/WebCore/storage/SQLTransaction.h
index 3eb1fd5..4c84f91 100644
--- a/Source/WebCore/storage/SQLTransaction.h
+++ b/Source/WebCore/storage/SQLTransaction.h
@@ -34,7 +34,7 @@
 #include "SQLStatement.h"
 #include <wtf/Deque.h>
 #include <wtf/Forward.h>
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -50,7 +50,7 @@ class SQLTransactionErrorCallback;
 class SQLValue;
 class VoidCallback;
 
-class SQLTransactionWrapper : public ThreadSafeShared<SQLTransactionWrapper> {
+class SQLTransactionWrapper : public ThreadSafeRefCounted<SQLTransactionWrapper> {
 public:
     virtual ~SQLTransactionWrapper() { }
     virtual bool performPreflight(SQLTransaction*) = 0;
@@ -59,7 +59,7 @@ public:
     virtual SQLError* sqlError() const = 0;
 };
 
-class SQLTransaction : public ThreadSafeShared<SQLTransaction> {
+class SQLTransaction : public ThreadSafeRefCounted<SQLTransaction> {
 public:
     static PassRefPtr<SQLTransaction> create(Database*, PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>,
                                              PassRefPtr<VoidCallback>, PassRefPtr<SQLTransactionWrapper>, bool readOnly = false);
@@ -115,9 +115,9 @@ private:
 
     RefPtr<Database> m_database;
     RefPtr<SQLTransactionWrapper> m_wrapper;
-    RefPtr<SQLTransactionCallback> m_callback;
-    RefPtr<VoidCallback> m_successCallback;
-    RefPtr<SQLTransactionErrorCallback> m_errorCallback;
+    SQLCallbackWrapper<SQLTransactionCallback> m_callbackWrapper;
+    SQLCallbackWrapper<VoidCallback> m_successCallbackWrapper;
+    SQLCallbackWrapper<SQLTransactionErrorCallback> m_errorCallbackWrapper;
     RefPtr<SQLError> m_transactionError;
     bool m_shouldRetryCurrentStatement;
     bool m_modifiedDatabase;
diff --git a/Source/WebCore/storage/SQLTransactionCallback.h b/Source/WebCore/storage/SQLTransactionCallback.h
index aff6233..6904880 100644
--- a/Source/WebCore/storage/SQLTransactionCallback.h
+++ b/Source/WebCore/storage/SQLTransactionCallback.h
@@ -31,13 +31,13 @@
 
 #if ENABLE(DATABASE)
 
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
 class SQLTransaction;
 
-class SQLTransactionCallback : public ThreadSafeShared<SQLTransactionCallback> {
+class SQLTransactionCallback : public ThreadSafeRefCounted<SQLTransactionCallback> {
 public:
     virtual ~SQLTransactionCallback() { }
     virtual bool handleEvent(SQLTransaction*) = 0;
diff --git a/Source/WebCore/storage/SQLTransactionErrorCallback.h b/Source/WebCore/storage/SQLTransactionErrorCallback.h
index 4095d6a..f067571 100644
--- a/Source/WebCore/storage/SQLTransactionErrorCallback.h
+++ b/Source/WebCore/storage/SQLTransactionErrorCallback.h
@@ -31,13 +31,13 @@
 
 #if ENABLE(DATABASE)
 
-#include <wtf/ThreadSafeShared.h>
+#include <wtf/ThreadSafeRefCounted.h>
 
 namespace WebCore {
 
 class SQLError;
 
-class SQLTransactionErrorCallback : public ThreadSafeShared<SQLTransactionErrorCallback> {
+class SQLTransactionErrorCallback : public ThreadSafeRefCounted<SQLTransactionErrorCallback> {
 public:
     virtual ~SQLTransactionErrorCallback() { }
     virtual bool handleEvent(SQLError*) = 0;
diff --git a/Source/WebCore/storage/StorageAreaImpl.cpp b/Source/WebCore/storage/StorageAreaImpl.cpp
index 54df135..bb2d702 100644
--- a/Source/WebCore/storage/StorageAreaImpl.cpp
+++ b/Source/WebCore/storage/StorageAreaImpl.cpp
@@ -231,6 +231,31 @@ void StorageAreaImpl::close()
 #endif
 }
 
+void StorageAreaImpl::clearForOriginDeletion()
+{
+    ASSERT(!m_isShutdown);
+    blockUntilImportComplete();
+    
+    if (m_storageMap->length()) {
+        unsigned quota = m_storageMap->quota();
+        m_storageMap = StorageMap::create(quota);
+    }
+
+    if (m_storageAreaSync) {
+        m_storageAreaSync->scheduleClear();
+        m_storageAreaSync->scheduleCloseDatabase();
+    }
+}
+    
+void StorageAreaImpl::sync()
+{
+    ASSERT(!m_isShutdown);
+    blockUntilImportComplete();
+    
+    if (m_storageAreaSync)
+        m_storageAreaSync->scheduleSync();
+}
+
 void StorageAreaImpl::blockUntilImportComplete() const
 {
     if (m_storageAreaSync)
diff --git a/Source/WebCore/storage/StorageAreaImpl.h b/Source/WebCore/storage/StorageAreaImpl.h
index 60d72cb..9f87e69 100644
--- a/Source/WebCore/storage/StorageAreaImpl.h
+++ b/Source/WebCore/storage/StorageAreaImpl.h
@@ -59,6 +59,11 @@ namespace WebCore {
         // Only called from a background thread.
         void importItem(const String& key, const String& value);
 
+        // Used to clear a StorageArea and close db before backing db file is deleted.
+        void clearForOriginDeletion();
+
+        void sync();
+
     private:
         StorageAreaImpl(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>, unsigned quota);
         StorageAreaImpl(StorageAreaImpl*);
diff --git a/Source/WebCore/storage/StorageAreaSync.cpp b/Source/WebCore/storage/StorageAreaSync.cpp
index f2008ab..94a002a 100644
--- a/Source/WebCore/storage/StorageAreaSync.cpp
+++ b/Source/WebCore/storage/StorageAreaSync.cpp
@@ -36,6 +36,7 @@
 #include "SecurityOrigin.h"
 #include "StorageAreaImpl.h"
 #include "StorageSyncManager.h"
+#include "StorageTracker.h"
 #include "SuddenTermination.h"
 #include <wtf/text/CString.h>
 
@@ -60,6 +61,7 @@ inline StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSy
     , m_syncScheduled(false)
     , m_syncInProgress(false)
     , m_databaseOpenFailed(false)
+    , m_syncCloseDatabase(false)
     , m_importComplete(false)
 {
     ASSERT(isMainThread());
@@ -138,6 +140,25 @@ void StorageAreaSync::scheduleClear()
     }
 }
 
+void StorageAreaSync::scheduleCloseDatabase()
+{
+    ASSERT(isMainThread());
+    ASSERT(!m_finalSyncScheduled);
+
+    if (!m_database.isOpen())
+        return;
+
+    m_syncCloseDatabase = true;
+    
+    if (!m_syncTimer.isActive()) {
+        m_syncTimer.startOneShot(StorageSyncInterval);
+        
+        // The following is balanced by the call to enableSuddenTermination in the
+        // syncTimerFired function.
+        disableSuddenTermination();
+    }
+}
+
 void StorageAreaSync::syncTimerFired(Timer<StorageAreaSync>*)
 {
     ASSERT(isMainThread());
@@ -222,6 +243,10 @@ void StorageAreaSync::openDatabase(OpenDatabaseParamType openingStrategy)
         return;
     }
 
+    // A StorageTracker thread may have been scheduled to delete the db we're
+    // reopening, so cancel possible deletion.
+    StorageTracker::tracker().cancelDeletingOrigin(m_databaseIdentifier);
+
     if (!m_database.open(databaseFilename)) {
         LOG_ERROR("Failed to open database file %s for local storage", databaseFilename.utf8().data());
         markImported();
@@ -235,6 +260,8 @@ void StorageAreaSync::openDatabase(OpenDatabaseParamType openingStrategy)
         m_databaseOpenFailed = true;
         return;
     }
+
+    StorageTracker::tracker().setOriginDetails(m_databaseIdentifier, databaseFilename);
 }
 
 void StorageAreaSync::performImport()
@@ -319,6 +346,15 @@ void StorageAreaSync::sync(bool clearItems, const HashMap<String, String>& items
     if (!m_database.isOpen())
         return;
 
+    // Closing this db because it is about to be deleted by StorageTracker.
+    // The delete will be cancelled if StorageAreaSync needs to reopen the db
+    // to write new items created after the request to delete the db.
+    if (m_syncCloseDatabase) {
+        m_syncCloseDatabase = false;
+        m_database.close();
+        return;
+    }
+    
     // If the clear flag is set, then we clear all items out before we write any new ones in.
     if (clearItems) {
         SQLiteStatement clear(m_database, "DELETE FROM ItemTable");
@@ -421,12 +457,21 @@ void StorageAreaSync::deleteEmptyDatabase()
     if (!count) {
         query.finalize();
         m_database.close();
-        String databaseFilename = m_syncManager->fullDatabaseFilename(m_databaseIdentifier);
-        if (!SQLiteFileSystem::deleteDatabaseFile(databaseFilename))
-            LOG_ERROR("Failed to delete database file %s\n", databaseFilename.utf8().data());
+        if (StorageTracker::tracker().isActive())
+            StorageTracker::tracker().deleteOrigin(m_databaseIdentifier);
+        else {
+            String databaseFilename = m_syncManager->fullDatabaseFilename(m_databaseIdentifier);
+            if (!SQLiteFileSystem::deleteDatabaseFile(databaseFilename))
+                LOG_ERROR("Failed to delete database file %s\n", databaseFilename.utf8().data());
+        }
     }
 }
 
+void StorageAreaSync::scheduleSync()
+{
+    syncTimerFired(&m_syncTimer);
+}
+    
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
diff --git a/Source/WebCore/storage/StorageAreaSync.h b/Source/WebCore/storage/StorageAreaSync.h
index 90aa6a7..ebfb053 100644
--- a/Source/WebCore/storage/StorageAreaSync.h
+++ b/Source/WebCore/storage/StorageAreaSync.h
@@ -49,6 +49,9 @@ namespace WebCore {
 
         void scheduleItemForSync(const String& key, const String& value);
         void scheduleClear();
+        void scheduleCloseDatabase();
+
+        void scheduleSync();
 
     private:
         StorageAreaSync(PassRefPtr<StorageSyncManager>, PassRefPtr<StorageAreaImpl>, const String& databaseIdentifier);
@@ -92,6 +95,8 @@ namespace WebCore {
         bool m_syncScheduled;
         bool m_syncInProgress;
         bool m_databaseOpenFailed;
+        
+        bool m_syncCloseDatabase;
 
         mutable Mutex m_importLock;
         mutable ThreadCondition m_importCondition;
diff --git a/Source/WebCore/storage/StorageNamespace.h b/Source/WebCore/storage/StorageNamespace.h
index f7dad1e..f5604b0 100644
--- a/Source/WebCore/storage/StorageNamespace.h
+++ b/Source/WebCore/storage/StorageNamespace.h
@@ -50,10 +50,16 @@ public:
     virtual PassRefPtr<StorageNamespace> copy() = 0;
     virtual void close() = 0;
     virtual void unlock() = 0;
+<<<<<<< HEAD
 
 #ifdef ANDROID
     virtual void clear(Page*) = 0;
 #endif
+=======
+    virtual void clearOriginForDeletion(SecurityOrigin*) = 0;
+    virtual void clearAllOriginsForDeletion() = 0;
+    virtual void sync() = 0;
+>>>>>>> webkit.org at r82507
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/StorageNamespaceImpl.cpp b/Source/WebCore/storage/StorageNamespaceImpl.cpp
index 68508a7..c6279ed 100644
--- a/Source/WebCore/storage/StorageNamespaceImpl.cpp
+++ b/Source/WebCore/storage/StorageNamespaceImpl.cpp
@@ -32,6 +32,7 @@
 #include "StorageAreaImpl.h"
 #include "StorageMap.h"
 #include "StorageSyncManager.h"
+#include "StorageTracker.h"
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/StringHash.h>
 
@@ -167,6 +168,32 @@ void StorageNamespaceImpl::unlock()
     // Because there's a single event loop per-process, this is a no-op.
 }
 
+void StorageNamespaceImpl::clearOriginForDeletion(SecurityOrigin* origin)
+{
+    ASSERT(isMainThread());
+
+    RefPtr<StorageAreaImpl> storageArea = m_storageAreaMap.get(origin);
+    if (storageArea)
+        storageArea->clearForOriginDeletion();
+}
+
+void StorageNamespaceImpl::clearAllOriginsForDeletion()
+{
+    ASSERT(isMainThread());
+
+    StorageAreaMap::iterator end = m_storageAreaMap.end();
+    for (StorageAreaMap::iterator it = m_storageAreaMap.begin(); it != end; ++it)
+        it->second->clearForOriginDeletion();
+}
+    
+void StorageNamespaceImpl::sync()
+{
+    ASSERT(isMainThread());
+    StorageAreaMap::iterator end = m_storageAreaMap.end();
+    for (StorageAreaMap::iterator it = m_storageAreaMap.begin(); it != end; ++it)
+        it->second->sync();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
diff --git a/Source/WebCore/storage/StorageNamespaceImpl.h b/Source/WebCore/storage/StorageNamespaceImpl.h
index c2361fa..871f540 100644
--- a/Source/WebCore/storage/StorageNamespaceImpl.h
+++ b/Source/WebCore/storage/StorageNamespaceImpl.h
@@ -53,10 +53,21 @@ namespace WebCore {
         virtual void close();
         virtual void unlock();
 
+<<<<<<< HEAD
 #ifdef ANDROID
         virtual void clear(Page*);
 #endif
 
+=======
+        // Not removing the origin's StorageArea from m_storageAreaMap because
+        // we're just deleting the underlying db file. If an item is added immediately
+        // after file deletion, we want the same StorageArea to eventually trigger
+        // a sync and for StorageAreaSync to recreate the backing db file.
+        virtual void clearOriginForDeletion(SecurityOrigin*);
+        virtual void clearAllOriginsForDeletion();
+        virtual void sync();
+        
+>>>>>>> webkit.org at r82507
     private:
         StorageNamespaceImpl(StorageType, const String& path, unsigned quota);
 
diff --git a/Source/WebCore/storage/StorageTracker.cpp b/Source/WebCore/storage/StorageTracker.cpp
new file mode 100644
index 0000000..e18b4b8
--- /dev/null
+++ b/Source/WebCore/storage/StorageTracker.cpp
@@ -0,0 +1,539 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StorageTracker.h"
+
+#if ENABLE(DOM_STORAGE)
+
+#include "DatabaseThread.h"
+#include "FileSystem.h"
+#include "LocalStorageTask.h"
+#include "LocalStorageThread.h"
+#include "Logging.h"
+#include "PageGroup.h"
+#include "SQLiteFileSystem.h"
+#include "SQLiteStatement.h"
+#include "SecurityOrigin.h"
+#include "StorageTrackerClient.h"
+#include "TextEncoding.h"
+#include <wtf/MainThread.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/Vector.h>
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+static StorageTracker* storageTracker = 0;
+
+void StorageTracker::initializeTracker(const String& storagePath)
+{
+    ASSERT(isMainThread());
+    ASSERT(!storageTracker);
+    
+    if (!storageTracker)
+        storageTracker = new StorageTracker(storagePath);
+    
+    // Make sure text encoding maps have been built on the main thread, as the StorageTracker thread might try to do it there instead.
+    // FIXME (<rdar://problem/9127819>): Is there a more explicit way of doing this besides accessing the UTF8Encoding?
+    UTF8Encoding();
+    
+    SQLiteFileSystem::registerSQLiteVFS();
+    storageTracker->setIsActive(true);
+    storageTracker->m_thread->start();  
+    storageTracker->importOriginIdentifiers();
+}
+
+StorageTracker& StorageTracker::tracker()
+{
+    if (!storageTracker)
+        storageTracker = new StorageTracker("");
+    
+    return *storageTracker;
+}
+
+StorageTracker::StorageTracker(const String& storagePath)
+    : m_client(0)
+    , m_thread(LocalStorageThread::create())
+    , m_isActive(false)
+{
+    setStorageDirectoryPath(storagePath);
+}
+
+void StorageTracker::setStorageDirectoryPath(const String& path)
+{
+    MutexLocker lockDatabase(m_databaseGuard);
+    ASSERT(!m_database.isOpen());
+    
+    m_storageDirectoryPath = path.threadsafeCopy();
+}
+
+String StorageTracker::trackerDatabasePath()
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    return SQLiteFileSystem::appendDatabaseFileNameToPath(m_storageDirectoryPath, "StorageTracker.db");
+}
+
+void StorageTracker::openTrackerDatabase(bool createIfDoesNotExist)
+{
+    ASSERT(m_isActive);
+    ASSERT(!isMainThread());
+    ASSERT(!m_databaseGuard.tryLock());
+
+    if (m_database.isOpen())
+        return;
+    
+    String databasePath = trackerDatabasePath();
+    
+    if (!SQLiteFileSystem::ensureDatabaseFileExists(databasePath, createIfDoesNotExist)) {
+        if (createIfDoesNotExist)
+            LOG_ERROR("Failed to create database file '%s'", databasePath.ascii().data());
+        return;
+    }
+    
+    if (!m_database.open(databasePath)) {
+        LOG_ERROR("Failed to open databasePath %s.", databasePath.ascii().data());
+        return;
+    }
+    
+    m_database.disableThreadingChecks();
+    
+    if (!m_database.tableExists("Origins")) {
+        if (!m_database.executeCommand("CREATE TABLE Origins (origin TEXT UNIQUE ON CONFLICT REPLACE, path TEXT);"))
+            LOG_ERROR("Failed to create Origins table.");
+    }
+}
+
+void StorageTracker::importOriginIdentifiers()
+{   
+    if (!m_isActive)
+        return;
+    
+    ASSERT(isMainThread());
+    ASSERT(m_thread);
+
+    m_thread->scheduleTask(LocalStorageTask::createOriginIdentifiersImport());
+}
+
+void StorageTracker::syncImportOriginIdentifiers()
+{
+    ASSERT(m_isActive);
+    
+    ASSERT(!isMainThread());
+
+    {
+        MutexLocker lockDatabase(m_databaseGuard);
+
+        // Don't force creation of StorageTracker's db just because a tracker
+        // was initialized. It will be created if local storage dbs are found
+        // by syncFileSystemAndTrackerDatabse() or the next time a local storage
+        // db is created by StorageAreaSync.
+        openTrackerDatabase(false);
+
+        if (m_database.isOpen()) {
+            SQLiteStatement statement(m_database, "SELECT origin FROM Origins");
+            if (statement.prepare() != SQLResultOk) {
+                LOG_ERROR("Failed to prepare statement.");
+                return;
+            }
+            
+            int result;
+            
+            {
+                MutexLocker lockOrigins(m_originSetGuard);
+                while ((result = statement.step()) == SQLResultRow)
+                    m_originSet.add(statement.getColumnText(0).threadsafeCopy());
+            }
+            
+            if (result != SQLResultDone) {
+                LOG_ERROR("Failed to read in all origins from the database.");
+                return;
+            }
+        }
+    }
+    
+    syncFileSystemAndTrackerDatabase();
+    
+    {
+        MutexLocker lockClient(m_clientGuard);
+        if (m_client) {
+            MutexLocker lockOrigins(m_originSetGuard);
+            OriginSet::const_iterator end = m_originSet.end();
+            for (OriginSet::const_iterator it = m_originSet.begin(); it != end; ++it)
+                m_client->dispatchDidModifyOrigin(*it);
+        }
+    }
+}
+    
+void StorageTracker::syncFileSystemAndTrackerDatabase()
+{
+    ASSERT(!isMainThread());
+    ASSERT(m_isActive);
+
+    m_databaseGuard.lock();
+    DEFINE_STATIC_LOCAL(const String, fileMatchPattern, ("*.localstorage"));
+    DEFINE_STATIC_LOCAL(const String, fileExt, (".localstorage"));
+    DEFINE_STATIC_LOCAL(const unsigned, fileExtLength, (fileExt.length()));
+    m_databaseGuard.unlock();
+
+    Vector<String> paths;
+    {
+        MutexLocker lock(m_databaseGuard);
+        paths = listDirectory(m_storageDirectoryPath, fileMatchPattern);
+    }
+
+    // Use a copy of m_originSet to find expired entries and to schedule their
+    // deletions from disk and from m_originSet.
+    OriginSet originSetCopy;
+    {
+        MutexLocker lock(m_originSetGuard);
+        OriginSet::const_iterator end = m_originSet.end();
+        for (OriginSet::const_iterator it = m_originSet.begin(); it != end; ++it)
+            originSetCopy.add((*it).threadsafeCopy());
+    }
+    
+    // Add missing StorageTracker records.
+    OriginSet foundOrigins;
+    Vector<String>::const_iterator end = paths.end();
+    for (Vector<String>::const_iterator it = paths.begin(); it != end; ++it) {
+        String path = *it;
+        if (path.endsWith(fileExt, true) && path.length() > fileExtLength) {
+            String file = pathGetFileName(path);
+            String originIdentifier = file.substring(0, file.length() - fileExtLength);
+            if (!originSetCopy.contains(originIdentifier))
+                syncSetOriginDetails(originIdentifier, path);
+
+            foundOrigins.add(originIdentifier);
+        }
+    }
+
+    // Delete stale StorageTracker records.
+    OriginSet::const_iterator setEnd = originSetCopy.end();
+    for (OriginSet::const_iterator it = originSetCopy.begin(); it != setEnd; ++it) {
+        if (!foundOrigins.contains(*it))
+            syncDeleteOrigin(*it);
+    }
+}
+
+void StorageTracker::setOriginDetails(const String& originIdentifier, const String& databaseFile)
+{
+    if (!m_isActive)
+        return;
+
+    {
+        MutexLocker lockOrigins(m_originSetGuard);
+
+        if (m_originSet.contains(originIdentifier))
+            return;
+
+        m_originSet.add(originIdentifier);
+    }
+
+    OwnPtr<LocalStorageTask> task = LocalStorageTask::createSetOriginDetails(originIdentifier.threadsafeCopy(), databaseFile);
+
+    if (isMainThread()) {
+        ASSERT(m_thread);
+        m_thread->scheduleTask(task.release());
+    } else 
+        callOnMainThread(scheduleTask, reinterpret_cast<void*>(task.leakPtr()));
+}
+
+void StorageTracker::scheduleTask(void* taskIn)
+{
+    ASSERT(isMainThread());
+    ASSERT(StorageTracker::tracker().m_thread);
+    
+    OwnPtr<LocalStorageTask> task = adoptPtr(reinterpret_cast<LocalStorageTask*>(taskIn));
+
+    StorageTracker::tracker().m_thread->scheduleTask(task.release());
+}
+
+void StorageTracker::syncSetOriginDetails(const String& originIdentifier, const String& databaseFile)
+{
+    ASSERT(!isMainThread());
+
+    MutexLocker lockDatabase(m_databaseGuard);
+
+    openTrackerDatabase(true);
+    
+    if (!m_database.isOpen())
+        return;
+
+    SQLiteStatement statement(m_database, "INSERT INTO Origins VALUES (?, ?)");
+    if (statement.prepare() != SQLResultOk) {
+        LOG_ERROR("Unable to establish origin '%s' in the tracker", originIdentifier.ascii().data());
+        return;
+    } 
+    
+    statement.bindText(1, originIdentifier);
+    statement.bindText(2, databaseFile);
+    
+    if (statement.step() != SQLResultDone)
+        LOG_ERROR("Unable to establish origin '%s' in the tracker", originIdentifier.ascii().data());
+
+    {
+        MutexLocker lockOrigins(m_originSetGuard);
+        if (!m_originSet.contains(originIdentifier))
+            m_originSet.add(originIdentifier);
+    }
+
+    {
+        MutexLocker lockClient(m_clientGuard);
+        if (m_client)
+            m_client->dispatchDidModifyOrigin(originIdentifier);
+    }
+}
+
+void StorageTracker::origins(Vector<RefPtr<SecurityOrigin> >& result)
+{
+    ASSERT(m_isActive);
+    
+    if (!m_isActive)
+        return;
+
+    MutexLocker lockOrigins(m_originSetGuard);
+
+    OriginSet::const_iterator end = m_originSet.end();
+    for (OriginSet::const_iterator it = m_originSet.begin(); it != end; ++it)
+        result.append(SecurityOrigin::createFromDatabaseIdentifier(*it));
+}
+
+void StorageTracker::deleteAllOrigins()
+{
+    ASSERT(m_isActive);
+    ASSERT(isMainThread());
+    ASSERT(m_thread);
+    
+    if (!m_isActive)
+        return;
+
+    {
+        MutexLocker lockOrigins(m_originSetGuard);
+        willDeleteAllOrigins();
+        m_originSet.clear();
+    }
+
+    PageGroup::clearLocalStorageForAllOrigins();
+    
+    m_thread->scheduleTask(LocalStorageTask::createDeleteAllOrigins());
+}
+    
+void StorageTracker::syncDeleteAllOrigins()
+{
+    ASSERT(!isMainThread());
+    
+    MutexLocker lockDatabase(m_databaseGuard);
+    
+    openTrackerDatabase(false);
+    if (!m_database.isOpen())
+        return;
+    
+    SQLiteStatement statement(m_database, "SELECT origin, path FROM Origins");
+    if (statement.prepare() != SQLResultOk) {
+        LOG_ERROR("Failed to prepare statement.");
+        return;
+    }
+    
+    int result;
+    while ((result = statement.step()) == SQLResultRow) {
+        if (!canDeleteOrigin(statement.getColumnText(0)))
+            continue;
+
+        SQLiteFileSystem::deleteDatabaseFile(statement.getColumnText(1));
+
+        {
+            MutexLocker lockClient(m_clientGuard);
+            if (m_client)
+                m_client->dispatchDidModifyOrigin(statement.getColumnText(0));
+        }
+    }
+    
+    if (result != SQLResultDone)
+        LOG_ERROR("Failed to read in all origins from the database.");
+    
+    if (m_database.isOpen())
+        m_database.close();
+    
+    SQLiteFileSystem::deleteDatabaseFile(trackerDatabasePath());
+    SQLiteFileSystem::deleteEmptyDatabaseDirectory(m_storageDirectoryPath);
+}
+
+void StorageTracker::deleteOrigin(const String& originIdentifier)
+{
+    deleteOrigin(SecurityOrigin::createFromDatabaseIdentifier(originIdentifier).get());
+}
+
+void StorageTracker::deleteOrigin(SecurityOrigin* origin)
+{    
+    ASSERT(m_isActive);
+    ASSERT(isMainThread());
+    ASSERT(m_thread);
+    
+    if (!m_isActive)
+        return;
+
+    // Before deleting database, we need to clear in-memory local storage data
+    // in StorageArea, and to close the StorageArea db. It's possible for an
+    // item to be added immediately after closing the db and cause StorageAreaSync
+    // to reopen the db before the db is deleted by a StorageTracker thread.
+    // In this case, reopening the db in StorageAreaSync will cancel a pending
+    // StorageTracker db deletion.
+    PageGroup::clearLocalStorageForOrigin(origin);
+
+    String originId = origin->databaseIdentifier();
+    
+    {
+        MutexLocker lockOrigins(m_originSetGuard);
+        willDeleteOrigin(originId);
+        m_originSet.remove(originId);
+    }
+    
+    m_thread->scheduleTask(LocalStorageTask::createDeleteOrigin(originId));
+}
+
+void StorageTracker::syncDeleteOrigin(const String& originIdentifier)
+{
+    ASSERT(!isMainThread());
+
+    MutexLocker lockDatabase(m_databaseGuard);
+    
+    if (!canDeleteOrigin(originIdentifier)) {
+        LOG_ERROR("Attempted to delete origin '%s' while it was being created\n", originIdentifier.ascii().data());
+        return;
+    }
+    
+    openTrackerDatabase(false);
+    if (!m_database.isOpen())
+        return;
+    
+    // Get origin's db file path, delete entry in tracker's db, then delete db file.
+    SQLiteStatement pathStatement(m_database, "SELECT path FROM Origins WHERE origin=?");
+    if (pathStatement.prepare() != SQLResultOk) {
+        LOG_ERROR("Unable to prepare selection of path for origin '%s'", originIdentifier.ascii().data());
+        return;
+    }
+    pathStatement.bindText(1, originIdentifier);
+    int result = pathStatement.step();
+    if (result != SQLResultRow) {
+        LOG_ERROR("Unable to find origin '%s' in Origins table", originIdentifier.ascii().data());
+        return;
+    }
+    
+    String path = pathStatement.getColumnText(0);
+
+    ASSERT(!path.isEmpty());
+    
+    SQLiteStatement deleteStatement(m_database, "DELETE FROM Origins where origin=?");
+    if (deleteStatement.prepare() != SQLResultOk) {
+        LOG_ERROR("Unable to prepare deletion of origin '%s'", originIdentifier.ascii().data());
+        return;
+    }
+    deleteStatement.bindText(1, originIdentifier);
+    if (!deleteStatement.executeCommand()) {
+        LOG_ERROR("Unable to execute deletion of origin '%s'", originIdentifier.ascii().data());
+        return;
+    }
+
+    SQLiteFileSystem::deleteDatabaseFile(path);
+    
+    bool shouldDeleteTrackerFiles = false;
+    {
+        MutexLocker originLock(m_originSetGuard);
+        m_originSet.remove(originIdentifier);
+        shouldDeleteTrackerFiles = m_originSet.isEmpty();
+    }
+
+    if (shouldDeleteTrackerFiles) {
+        m_database.close();
+        SQLiteFileSystem::deleteDatabaseFile(trackerDatabasePath());
+        SQLiteFileSystem::deleteEmptyDatabaseDirectory(m_storageDirectoryPath);
+    }
+
+    {
+        MutexLocker lockClient(m_clientGuard);
+        if (m_client)
+            m_client->dispatchDidModifyOrigin(originIdentifier);
+    }
+}
+    
+void StorageTracker::willDeleteAllOrigins()
+{
+    ASSERT(!m_originSetGuard.tryLock());
+
+    OriginSet::const_iterator end = m_originSet.end();
+    for (OriginSet::const_iterator it = m_originSet.begin(); it != end; ++it)
+        m_originsBeingDeleted.add((*it).threadsafeCopy());
+}
+
+void StorageTracker::willDeleteOrigin(const String& originIdentifier)
+{
+    ASSERT(isMainThread());
+    ASSERT(!m_originSetGuard.tryLock());
+
+    m_originsBeingDeleted.add(originIdentifier);
+}
+    
+bool StorageTracker::canDeleteOrigin(const String& originIdentifier)
+{
+    ASSERT(!m_databaseGuard.tryLock());
+    MutexLocker lockOrigins(m_originSetGuard);
+    return m_originsBeingDeleted.contains(originIdentifier);
+}
+
+void StorageTracker::cancelDeletingOrigin(const String& originIdentifier)
+{
+    if (!m_isActive)
+        return;
+
+    MutexLocker lockDatabase(m_databaseGuard);
+    MutexLocker lockOrigins(m_originSetGuard);
+    if (!m_originsBeingDeleted.isEmpty())
+        m_originsBeingDeleted.remove(originIdentifier);
+}
+
+void StorageTracker::setClient(StorageTrackerClient* client)
+{
+    MutexLocker lockClient(m_clientGuard);
+    m_client = client;
+}
+
+void StorageTracker::syncLocalStorage()
+{
+    PageGroup::syncLocalStorage();
+}
+    
+bool StorageTracker::isActive()
+{
+    return m_isActive;
+}
+
+void StorageTracker::setIsActive(bool flag)
+{
+    m_isActive = flag;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(DOM_STORAGE)
diff --git a/Source/WebCore/storage/StorageTracker.h b/Source/WebCore/storage/StorageTracker.h
new file mode 100644
index 0000000..04a821b
--- /dev/null
+++ b/Source/WebCore/storage/StorageTracker.h
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StorageTracker_h
+#define StorageTracker_h
+
+#if ENABLE(DOM_STORAGE)
+    
+#include "PlatformString.h"
+#include "SQLiteDatabase.h"
+#include <wtf/HashSet.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/Vector.h>
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+class LocalStorageTask;
+class LocalStorageThread;
+class SecurityOrigin;
+class StorageTrackerClient;    
+
+class StorageTracker {
+    WTF_MAKE_NONCOPYABLE(StorageTracker);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    static void initializeTracker(const String& storagePath);
+    static StorageTracker& tracker();
+    static void scheduleTask(void*);
+
+    void importOriginIdentifiers();
+    void setOriginDetails(const String& originIdentifier, const String& databaseFile);
+    
+    void deleteAllOrigins();
+    void deleteOrigin(SecurityOrigin*);
+    void deleteOrigin(const String& originIdentifier);
+    void origins(Vector<RefPtr<SecurityOrigin> >& result);
+
+    void cancelDeletingOrigin(const String& originIdentifier);
+    
+    void setClient(StorageTrackerClient*);
+    
+    bool isActive();
+
+    // Sync to disk on background thread.
+    void syncDeleteAllOrigins();
+    void syncDeleteOrigin(const String& originIdentifier);
+    void syncSetOriginDetails(const String& originIdentifier, const String& databaseFile);
+    void syncImportOriginIdentifiers();
+    void syncFileSystemAndTrackerDatabase();
+
+    void syncLocalStorage();
+
+private:
+    StorageTracker(const String& storagePath);
+
+    String trackerDatabasePath();
+    void openTrackerDatabase(bool createIfDoesNotExist);
+
+    void setStorageDirectoryPath(const String&);
+
+    void deleteTrackerFiles();
+
+    bool canDeleteOrigin(const String& originIdentifier);
+    void willDeleteOrigin(const String& originIdentifier);
+    void willDeleteAllOrigins();
+
+    void originFilePaths(Vector<String>& paths);
+    
+    void setIsActive(bool);
+
+    // Guard for m_database, m_storageDirectoryPath and static Strings in syncFileSystemAndTrackerDatabase().
+    Mutex m_databaseGuard;
+    SQLiteDatabase m_database;
+    String m_storageDirectoryPath;
+
+    Mutex m_clientGuard;
+    StorageTrackerClient* m_client;
+
+    // Guard for m_originSet and m_originsBeingDeleted.
+    Mutex m_originSetGuard;
+    typedef HashSet<String> OriginSet;
+    OriginSet m_originSet;
+    OriginSet m_originsBeingDeleted;
+
+    OwnPtr<LocalStorageThread> m_thread;
+    
+    bool m_isActive;
+};
+    
+} // namespace WebCore
+
+#endif // ENABLE(DOM_STORAGE)
+
+#endif // StorageTracker_h
diff --git a/Source/WebCore/storage/StorageTrackerClient.h b/Source/WebCore/storage/StorageTrackerClient.h
new file mode 100644
index 0000000..9c2d53e
--- /dev/null
+++ b/Source/WebCore/storage/StorageTrackerClient.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#ifndef StorageTrackerClient_h
+#define StorageTrackerClient_h
+
+#include <wtf/Forward.h>
+
+namespace WebCore {
+
+class StorageTrackerClient {
+public:
+    virtual ~StorageTrackerClient() { }
+    virtual void dispatchDidModifyOrigin(const String& originIdentifier) = 0;
+};
+
+} // namespace WebCore
+
+#endif // StorageTrackerClient_h
diff --git a/Source/WebCore/svg/SVGAElement.cpp b/Source/WebCore/svg/SVGAElement.cpp
index 601b432..4d02c69 100644
--- a/Source/WebCore/svg/SVGAElement.cpp
+++ b/Source/WebCore/svg/SVGAElement.cpp
@@ -195,7 +195,7 @@ void SVGAElement::defaultEventHandler(Event* event)
 
 bool SVGAElement::supportsFocus() const
 {
-    if (isContentEditable())
+    if (rendererIsEditable())
         return SVGStyledTransformableElement::supportsFocus();
     return true;
 }
diff --git a/Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp b/Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp
index c35a344..6ed5813 100644
--- a/Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp
+++ b/Source/WebCore/svg/SVGComponentTransferFunctionElement.cpp
@@ -81,6 +81,17 @@ void SVGComponentTransferFunctionElement::parseMappedAttribute(Attribute* attr)
         SVGElement::parseMappedAttribute(attr);
 }
 
+void SVGComponentTransferFunctionElement::svgAttributeChanged(const QualifiedName& attrName)
+{
+    SVGElement::svgAttributeChanged(attrName);
+
+    if (attrName == SVGNames::typeAttr) {
+        ComponentTransferType componentType = static_cast<ComponentTransferType>(type());
+        if (componentType < FECOMPONENTTRANSFER_TYPE_UNKNOWN || componentType > FECOMPONENTTRANSFER_TYPE_GAMMA)
+            setTypeBaseValue(FECOMPONENTTRANSFER_TYPE_UNKNOWN);
+    }
+}
+
 void SVGComponentTransferFunctionElement::synchronizeProperty(const QualifiedName& attrName)
 {
     SVGElement::synchronizeProperty(attrName);
diff --git a/Source/WebCore/svg/SVGComponentTransferFunctionElement.h b/Source/WebCore/svg/SVGComponentTransferFunctionElement.h
index 2be693b..931e52e 100644
--- a/Source/WebCore/svg/SVGComponentTransferFunctionElement.h
+++ b/Source/WebCore/svg/SVGComponentTransferFunctionElement.h
@@ -37,6 +37,7 @@ protected:
     SVGComponentTransferFunctionElement(const QualifiedName&, Document*);
 
     virtual void parseMappedAttribute(Attribute*);
+    virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
     virtual void fillAttributeToPropertyTypeMap();
     virtual AttributeToPropertyTypeMap& attributeToPropertyTypeMap();
diff --git a/Source/WebCore/svg/SVGElement.cpp b/Source/WebCore/svg/SVGElement.cpp
index 4630ccb..044f439 100644
--- a/Source/WebCore/svg/SVGElement.cpp
+++ b/Source/WebCore/svg/SVGElement.cpp
@@ -316,12 +316,9 @@ void SVGElement::sendSVGLoadEventIfPossible(bool sendParentLoadEvents)
         RefPtr<Node> parent;
         if (sendParentLoadEvents)
             parent = currentTarget->parentNode(); // save the next parent to dispatch too incase dispatching the event changes the tree
-        if (hasLoadListener(currentTarget.get())) {
-            RefPtr<Event> event = Event::create(eventNames().loadEvent, false, false);
-            event->setTarget(currentTarget);
-            currentTarget->dispatchGenericEvent(event.release());
-        }
-        currentTarget = (parent && parent->isSVGElement()) ? static_pointer_cast<SVGElement>(parent) : 0;
+        if (hasLoadListener(currentTarget.get()))
+            currentTarget->dispatchEvent(Event::create(eventNames().loadEvent, false, false));
+        currentTarget = (parent && parent->isSVGElement()) ? static_pointer_cast<SVGElement>(parent) : RefPtr<SVGElement>();
     }
 }
 
diff --git a/Source/WebCore/svg/SVGElementInstance.cpp b/Source/WebCore/svg/SVGElementInstance.cpp
index a873f0b..6b9c085 100644
--- a/Source/WebCore/svg/SVGElementInstance.cpp
+++ b/Source/WebCore/svg/SVGElementInstance.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ * Copyright (C) 2011 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -40,15 +41,16 @@ namespace WebCore {
 static WTF::RefCountedLeakCounter instanceCounter("WebCoreSVGElementInstance");
 #endif
 
-SVGElementInstance::SVGElementInstance(SVGUseElement* useElement, PassRefPtr<SVGElement> originalElement)
-    : m_useElement(useElement)
+SVGElementInstance::SVGElementInstance(SVGUseElement* correspondingUseElement, SVGUseElement* directUseElement, PassRefPtr<SVGElement> originalElement)
+    : m_correspondingUseElement(correspondingUseElement)
+    , m_directUseElement(directUseElement)
     , m_element(originalElement)
     , m_previousSibling(0)
     , m_nextSibling(0)
     , m_firstChild(0)
     , m_lastChild(0)
 {
-    ASSERT(m_useElement);
+    ASSERT(m_correspondingUseElement);
     ASSERT(m_element);
 
     // Register as instance for passed element.
@@ -131,19 +133,13 @@ void SVGElementInstance::removeAllEventListeners()
     m_element->removeAllEventListeners();
 }
 
-bool SVGElementInstance::dispatchEvent(PassRefPtr<Event> prpEvent)
+bool SVGElementInstance::dispatchEvent(PassRefPtr<Event> event)
 {
-    RefPtr<EventTarget> protect = this;
-    RefPtr<Event> event = prpEvent;
-
-    event->setTarget(this);
-
     SVGElement* element = shadowTreeElement();
     if (!element)
         return false;
 
-    RefPtr<FrameView> view = element->document()->view();
-    return element->dispatchGenericEvent(event.release());
+    return element->dispatchEvent(event);
 }
 
 EventTargetData* SVGElementInstance::eventTargetData()
diff --git a/Source/WebCore/svg/SVGElementInstance.h b/Source/WebCore/svg/SVGElementInstance.h
index 6dbcff4..2a8c52f 100644
--- a/Source/WebCore/svg/SVGElementInstance.h
+++ b/Source/WebCore/svg/SVGElementInstance.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2011 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -39,9 +40,9 @@ class SVGElementInstanceList;
 class SVGElementInstance : public TreeShared<SVGElementInstance>,
                            public EventTarget {
 public:
-    static PassRefPtr<SVGElementInstance> create(SVGUseElement* useElement, PassRefPtr<SVGElement> originalElement)
+    static PassRefPtr<SVGElementInstance> create(SVGUseElement* correspondingUseElement, SVGUseElement* directUseElement, PassRefPtr<SVGElement> originalElement)
     {
-        return adoptRef(new SVGElementInstance(useElement, originalElement));
+        return adoptRef(new SVGElementInstance(correspondingUseElement, directUseElement, originalElement));
     }
 
     virtual ~SVGElementInstance();
@@ -55,9 +56,14 @@ public:
     virtual bool dispatchEvent(PassRefPtr<Event>);
 
     SVGElement* correspondingElement() const { return m_element.get(); }
-    SVGUseElement* correspondingUseElement() const { return m_useElement; }
+    SVGUseElement* correspondingUseElement() const { return m_correspondingUseElement; }
+    SVGUseElement* directUseElement() const { return m_directUseElement; }
     SVGElement* shadowTreeElement() const { return m_shadowTreeElement.get(); }
-    void clearUseElement() { m_useElement = 0; }
+    void clearUseElements()
+    {
+        m_directUseElement = 0;
+        m_correspondingUseElement = 0;
+    }
 
     SVGElementInstance* parentNode() const { return parent(); }
     PassRefPtr<SVGElementInstanceList> childNodes();
@@ -120,7 +126,7 @@ public:
 private:
     friend class SVGUseElement;
 
-    SVGElementInstance(SVGUseElement*, PassRefPtr<SVGElement> originalElement);
+    SVGElementInstance(SVGUseElement*, SVGUseElement*, PassRefPtr<SVGElement> originalElement);
 
     virtual Node* toNode() { return shadowTreeElement(); }
     virtual SVGElementInstance* toSVGElementInstance() { return this; }
@@ -150,7 +156,8 @@ private:
     virtual EventTargetData* eventTargetData();
     virtual EventTargetData* ensureEventTargetData();
 
-    SVGUseElement* m_useElement;
+    SVGUseElement* m_correspondingUseElement;
+    SVGUseElement* m_directUseElement;
     RefPtr<SVGElement> m_element;
     RefPtr<SVGElement> m_shadowTreeElement;
 
diff --git a/Source/WebCore/svg/SVGFEDisplacementMapElement.cpp b/Source/WebCore/svg/SVGFEDisplacementMapElement.cpp
index 873f85a..1429b34 100644
--- a/Source/WebCore/svg/SVGFEDisplacementMapElement.cpp
+++ b/Source/WebCore/svg/SVGFEDisplacementMapElement.cpp
@@ -97,13 +97,19 @@ void SVGFEDisplacementMapElement::svgAttributeChanged(const QualifiedName& attrN
 {
     SVGFilterPrimitiveStandardAttributes::svgAttributeChanged(attrName);
 
-    if (attrName == SVGNames::xChannelSelectorAttr
-        || attrName == SVGNames::yChannelSelectorAttr
-        || attrName == SVGNames::scaleAttr)
+    if (attrName == SVGNames::xChannelSelectorAttr) {
+        ChannelSelectorType selector = static_cast<ChannelSelectorType>(xChannelSelector());
+        if (CHANNEL_UNKNOWN > selector || selector > CHANNEL_A)
+            setXChannelSelectorBaseValue(CHANNEL_UNKNOWN);
         primitiveAttributeChanged(attrName);
-
-    if (attrName == SVGNames::inAttr
-        || attrName == SVGNames::in2Attr)
+    } else if (attrName == SVGNames::yChannelSelectorAttr) {
+        ChannelSelectorType selector = static_cast<ChannelSelectorType>(yChannelSelector());
+        if (CHANNEL_UNKNOWN > selector || selector > CHANNEL_A)
+            setYChannelSelectorBaseValue(CHANNEL_UNKNOWN);
+        primitiveAttributeChanged(attrName);
+    } else if (attrName == SVGNames::scaleAttr)
+        primitiveAttributeChanged(attrName);
+    else if (attrName == SVGNames::inAttr || attrName == SVGNames::in2Attr)
         invalidate();
 }
 
diff --git a/Source/WebCore/svg/SVGTitleElement.cpp b/Source/WebCore/svg/SVGTitleElement.cpp
index 6281f10..ebcddb4 100644
--- a/Source/WebCore/svg/SVGTitleElement.cpp
+++ b/Source/WebCore/svg/SVGTitleElement.cpp
@@ -40,7 +40,7 @@ void SVGTitleElement::insertedIntoDocument()
 {
     SVGStyledElement::insertedIntoDocument();
     if (firstChild())
-        document()->setTitle(textContent(), this);
+        document()->setTitleElement(textContent(), this);
 }
 
 void SVGTitleElement::removedFromDocument()
@@ -53,7 +53,7 @@ void SVGTitleElement::childrenChanged(bool changedByParser, Node* beforeChange,
 {
     SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
     if (inDocument())
-        document()->setTitle(textContent(), this);
+        document()->setTitleElement(textContent(), this);
 }
 
 AttributeToPropertyTypeMap& SVGTitleElement::attributeToPropertyTypeMap()
diff --git a/Source/WebCore/svg/SVGUseElement.cpp b/Source/WebCore/svg/SVGUseElement.cpp
index 4239f66..21f0954 100644
--- a/Source/WebCore/svg/SVGUseElement.cpp
+++ b/Source/WebCore/svg/SVGUseElement.cpp
@@ -239,11 +239,15 @@ void SVGUseElement::fillAttributeToPropertyTypeMap()
     attributeToPropertyTypeMap.set(XLinkNames::hrefAttr, AnimatedString);
 }
 
-static void updateContainerSize(SVGUseElement* useElement, SVGElementInstance* targetInstance)
+static void updateContainerSize(SVGElementInstance* targetInstance)
 {
     // Depth-first used to write the method in early exit style, no particular other reason.
     for (SVGElementInstance* instance = targetInstance->firstChild(); instance; instance = instance->nextSibling())
-        updateContainerSize(useElement, instance);
+        updateContainerSize(instance);
+
+    SVGUseElement* useElement = targetInstance->directUseElement();
+    if (!useElement)
+        return;
 
     SVGElement* correspondingElement = targetInstance->correspondingElement();
     ASSERT(correspondingElement);
@@ -281,7 +285,8 @@ void SVGUseElement::updateContainerSizes()
         return;
 
     // Update whole subtree, scanning for shadow container elements, that correspond to <svg>/<symbol> tags
-    updateContainerSize(this, m_targetElementInstance.get());
+    ASSERT(m_targetElementInstance->directUseElement() == this);
+    updateContainerSize(m_targetElementInstance.get());
 
     if (RenderObject* object = renderer())
         RenderSVGResource::markForLayoutAndParentResourceInvalidation(object);
@@ -380,6 +385,9 @@ void dumpInstanceTree(unsigned int& depth, String& text, SVGElementInstance* tar
     SVGElement* shadowTreeElement = targetInstance->shadowTreeElement();
     ASSERT(shadowTreeElement);
 
+    SVGUseElement* directUseElement = targetInstance->directUseElement();
+    String directUseElementName = directUseElement ? directUseElement->nodeName() : "null";
+
     String elementId = element->getIdAttribute();
     String elementNodeName = element->nodeName();
     String shadowTreeElementNodeName = shadowTreeElement->nodeName();
@@ -389,9 +397,9 @@ void dumpInstanceTree(unsigned int& depth, String& text, SVGElementInstance* tar
     for (unsigned int i = 0; i < depth; ++i)
         text += "  ";
 
-    text += String::format("SVGElementInstance this=%p, (parentNode=%s (%p), firstChild=%s (%p), correspondingElement=%s (%p), shadowTreeElement=%s (%p), id=%s)\n",
+    text += String::format("SVGElementInstance this=%p, (parentNode=%s (%p), firstChild=%s (%p), correspondingElement=%s (%p), directUseElement=%s (%p), shadowTreeElement=%s (%p), id=%s)\n",
                            targetInstance, parentNodeName.latin1().data(), element->parentNode(), firstChildNodeName.latin1().data(), element->firstChild(),
-                           elementNodeName.latin1().data(), element, shadowTreeElementNodeName.latin1().data(), shadowTreeElement, elementId.latin1().data());
+                           elementNodeName.latin1().data(), element, directUseElementName.latin1().data(), directUseElement, shadowTreeElementNodeName.latin1().data(), shadowTreeElement, elementId.latin1().data());
 
     for (unsigned int i = 0; i < depth; ++i)
         text += "  ";
@@ -533,7 +541,7 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
     // Spec: If the 'use' element references a simple graphics element such as a 'rect', then there is only a
     // single SVGElementInstance object, and the correspondingElement attribute on this SVGElementInstance object
     // is the SVGRectElement that corresponds to the referenced 'rect' element.
-    m_targetElementInstance = SVGElementInstance::create(this, target);
+    m_targetElementInstance = SVGElementInstance::create(this, this, target);
 
     // Eventually enter recursion to build SVGElementInstance objects for the sub-tree children
     bool foundProblem = false;
@@ -550,6 +558,7 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
     ASSERT(m_targetElementInstance);
     ASSERT(!m_targetElementInstance->shadowTreeElement());
     ASSERT(m_targetElementInstance->correspondingUseElement() == this);
+    ASSERT(m_targetElementInstance->directUseElement() == this);
     ASSERT(m_targetElementInstance->correspondingElement() == target);
 
     // Build shadow tree from instance tree
@@ -559,11 +568,11 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
 #if ENABLE(SVG) && ENABLE(SVG_USE)
     // Expand all <use> elements in the shadow tree.
     // Expand means: replace the actual <use> element by what it references.
-    expandUseElementsInShadowTree(shadowRoot, shadowRoot);
+    expandUseElementsInShadowTree(shadowRoot);
 
     // Expand all <symbol> elements in the shadow tree.
     // Expand means: replace the actual <symbol> element by the <svg> element.
-    expandSymbolElementsInShadowTree(shadowRoot, shadowRoot);
+    expandSymbolElementsInShadowTree(shadowRoot);
 #endif
 
     // Now that the shadow tree is completly expanded, we can associate
@@ -582,6 +591,16 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
     // Consistency checks - this is assumed in updateContainerOffset().
     ASSERT(m_targetElementInstance->shadowTreeElement()->parentNode() == shadowRoot);
 
+    // Transfer event listeners assigned to the referenced element to our shadow tree elements.
+    transferEventListenersToShadowTree(m_targetElementInstance.get());
+
+    // Update container offset/size
+    updateContainerOffsets();
+    updateContainerSizes();
+
+    // Update relative length information
+    updateRelativeLengthsInformation();
+
     // Eventually dump instance tree
 #ifdef DUMP_INSTANCE_TREE
     String text;
@@ -602,23 +621,13 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
 
     fprintf(stderr, "Dumping <use> shadow tree markup:\n%s\n", markup.latin1().data());
 #endif
-
-    // Transfer event listeners assigned to the referenced element to our shadow tree elements.
-    transferEventListenersToShadowTree(m_targetElementInstance.get());
-
-    // Update container offset/size
-    updateContainerOffsets();
-    updateContainerSizes();
-
-    // Update relative length information
-    updateRelativeLengthsInformation();
 }
 
 void SVGUseElement::detachInstance()
 {
     if (!m_targetElementInstance)
         return;
-    m_targetElementInstance->clearUseElement();
+    m_targetElementInstance->clearUseElements();
     m_targetElementInstance = 0;
 }
 
@@ -722,7 +731,7 @@ void SVGUseElement::buildInstanceTree(SVGElement* target, SVGElementInstance* ta
             continue;
 
         // Create SVGElementInstance object, for both container/non-container nodes.
-        RefPtr<SVGElementInstance> instance = SVGElementInstance::create(this, element);
+        RefPtr<SVGElementInstance> instance = SVGElementInstance::create(this, 0, element);
         SVGElementInstance* instancePtr = instance.get();
         targetInstance->appendChild(instance.release());
 
@@ -735,7 +744,7 @@ void SVGUseElement::buildInstanceTree(SVGElement* target, SVGElementInstance* ta
     if (!targetHasUseTag || !newTarget)
         return;
 
-    RefPtr<SVGElementInstance> newInstance = SVGElementInstance::create(this, newTarget);
+    RefPtr<SVGElementInstance> newInstance = SVGElementInstance::create(this, static_cast<SVGUseElement*>(target), newTarget);
     SVGElementInstance* newInstancePtr = newInstance.get();
     targetInstance->appendChild(newInstance.release());
     buildInstanceTree(newTarget, newInstancePtr, foundProblem);
@@ -812,7 +821,7 @@ void SVGUseElement::buildShadowTree(SVGShadowTreeRootElement* shadowRoot, SVGEle
 }
 
 #if ENABLE(SVG) && ENABLE(SVG_USE)
-void SVGUseElement::expandUseElementsInShadowTree(SVGShadowTreeRootElement* shadowRoot, Node* element)
+void SVGUseElement::expandUseElementsInShadowTree(Node* element)
 {
     // Why expand the <use> elements in the shadow tree here, and not just
     // do this directly in buildShadowTree, if we encounter a <use> element?
@@ -860,21 +869,25 @@ void SVGUseElement::expandUseElementsInShadowTree(SVGShadowTreeRootElement* shad
         if (subtreeContainsDisallowedElement(cloneParent.get()))
             removeDisallowedElementsFromSubtree(cloneParent.get());
 
+        RefPtr<Node> replacingElement(cloneParent.get());
+
         // Replace <use> with referenced content.
         ASSERT(use->parentNode()); 
         use->parentNode()->replaceChild(cloneParent.release(), use, ec);
         ASSERT(!ec);
 
-        // Immediately stop here, and restart expanding.
-        expandUseElementsInShadowTree(shadowRoot, shadowRoot);
-        return;
+        // Expand the siblings because the *element* is replaced and we will
+        // lose the sibling chain when we are back from recursion.
+        element = replacingElement.get();
+        for (RefPtr<Node> sibling = element->nextSibling(); sibling; sibling = sibling->nextSibling())
+            expandUseElementsInShadowTree(sibling.get());
     }
 
     for (RefPtr<Node> child = element->firstChild(); child; child = child->nextSibling())
-        expandUseElementsInShadowTree(shadowRoot, child.get());
+        expandUseElementsInShadowTree(child.get());
 }
 
-void SVGUseElement::expandSymbolElementsInShadowTree(SVGShadowTreeRootElement* shadowRoot, Node* element)
+void SVGUseElement::expandSymbolElementsInShadowTree(Node* element)
 {
     if (element->hasTagName(SVGNames::symbolTag)) {
         // Spec: The referenced 'symbol' and its contents are deep-cloned into the generated tree,
@@ -904,18 +917,22 @@ void SVGUseElement::expandSymbolElementsInShadowTree(SVGShadowTreeRootElement* s
         if (subtreeContainsDisallowedElement(svgElement.get()))
             removeDisallowedElementsFromSubtree(svgElement.get());
 
+        RefPtr<Node> replacingElement(svgElement.get());
+
         // Replace <symbol> with <svg>.
         ASSERT(element->parentNode()); 
         element->parentNode()->replaceChild(svgElement.release(), element, ec);
         ASSERT(!ec);
 
-        // Immediately stop here, and restart expanding.
-        expandSymbolElementsInShadowTree(shadowRoot, shadowRoot);
-        return;
+        // Expand the siblings because the *element* is replaced and we will
+        // lose the sibling chain when we are back from recursion.
+        element = replacingElement.get();
+        for (RefPtr<Node> sibling = element->nextSibling(); sibling; sibling = sibling->nextSibling())
+            expandSymbolElementsInShadowTree(sibling.get());
     }
 
     for (RefPtr<Node> child = element->firstChild(); child; child = child->nextSibling())
-        expandSymbolElementsInShadowTree(shadowRoot, child.get());
+        expandSymbolElementsInShadowTree(child.get());
 }
 
 #endif
diff --git a/Source/WebCore/svg/SVGUseElement.h b/Source/WebCore/svg/SVGUseElement.h
index 10c9be9..30569b5 100644
--- a/Source/WebCore/svg/SVGUseElement.h
+++ b/Source/WebCore/svg/SVGUseElement.h
@@ -91,8 +91,8 @@ private:
     void buildShadowTree(SVGShadowTreeRootElement*, SVGElement* target, SVGElementInstance* targetInstance);
 
 #if ENABLE(SVG) && ENABLE(SVG_USE)
-    void expandUseElementsInShadowTree(SVGShadowTreeRootElement*, Node* element);
-    void expandSymbolElementsInShadowTree(SVGShadowTreeRootElement*, Node* element);
+    void expandUseElementsInShadowTree(Node* element);
+    void expandSymbolElementsInShadowTree(Node* element);
 #endif
 
     // "Tree connector" 
diff --git a/Source/WebCore/svg/properties/SVGAnimatedPropertyDescription.h b/Source/WebCore/svg/properties/SVGAnimatedPropertyDescription.h
index 6fb5e66..5fbaf9e 100644
--- a/Source/WebCore/svg/properties/SVGAnimatedPropertyDescription.h
+++ b/Source/WebCore/svg/properties/SVGAnimatedPropertyDescription.h
@@ -69,7 +69,7 @@ struct SVGAnimatedPropertyDescription {
 struct SVGAnimatedPropertyDescriptionHash {
     static unsigned hash(const SVGAnimatedPropertyDescription& key)
     {
-        return WTF::StringHasher::createBlobHash<sizeof(SVGAnimatedPropertyDescription)>(&key);
+        return StringHasher::hashMemory<sizeof(SVGAnimatedPropertyDescription)>(&key);
     }
 
     static bool equal(const SVGAnimatedPropertyDescription& a, const SVGAnimatedPropertyDescription& b)
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h b/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h
index 4099615..683ee84 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h
+++ b/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h
@@ -42,7 +42,7 @@
 
 namespace WebCore {
 
-class ThreadableWebSocketChannelClientWrapper : public ThreadSafeShared<ThreadableWebSocketChannelClientWrapper> {
+class ThreadableWebSocketChannelClientWrapper : public ThreadSafeRefCounted<ThreadableWebSocketChannelClientWrapper> {
 public:
     static PassRefPtr<ThreadableWebSocketChannelClientWrapper> create(WebSocketChannelClient* client)
     {
diff --git a/Source/WebCore/websockets/WebSocket.cpp b/Source/WebCore/websockets/WebSocket.cpp
index e15d079..5dfd48b 100644
--- a/Source/WebCore/websockets/WebSocket.cpp
+++ b/Source/WebCore/websockets/WebSocket.cpp
@@ -283,7 +283,10 @@ void WebSocket::didClose(unsigned long unhandledBufferedAmount)
     m_bufferedAmountAfterClose += unhandledBufferedAmount;
     ASSERT(scriptExecutionContext());
     dispatchEvent(Event::create(eventNames().closeEvent, false, false));
-    m_channel = 0;
+    if (m_channel) {
+        m_channel->disconnect();
+        m_channel = 0;
+    }
     if (hasPendingActivity())
         ActiveDOMObject::unsetPendingActivity(this);
 }
diff --git a/Source/WebCore/wml/WMLInputElement.cpp b/Source/WebCore/wml/WMLInputElement.cpp
index 80e4e70..5d35be3 100644
--- a/Source/WebCore/wml/WMLInputElement.cpp
+++ b/Source/WebCore/wml/WMLInputElement.cpp
@@ -307,8 +307,8 @@ void WMLInputElement::defaultEventHandler(Event* evt)
 
     if (clickDefaultFormButton) {
         // Fire onChange for text fields.
-        if (wasChangedSinceLastChangeEvent()) {
-            setChangedSinceLastChangeEvent(false);
+        if (wasChangedSinceLastFormControlChangeEvent()) {
+            setChangedSinceLastFormControlChangeEvent(false);
             dispatchEvent(Event::create(eventNames().changeEvent, true, false));
         }
 
diff --git a/Source/WebCore/wml/WMLInputElement.h b/Source/WebCore/wml/WMLInputElement.h
index 558147a..4cffef8 100644
--- a/Source/WebCore/wml/WMLInputElement.h
+++ b/Source/WebCore/wml/WMLInputElement.h
@@ -36,6 +36,8 @@ public:
     WMLInputElement(const QualifiedName& tagName, Document*);
     virtual ~WMLInputElement();
 
+    virtual InputElement* toInputElement() { return this; }
+
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
     virtual void dispatchFocusEvent();
diff --git a/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp b/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp
index c20cd30..31b2d4f 100644
--- a/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp
+++ b/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp
@@ -58,7 +58,7 @@
 
 namespace WebCore {
 
-class SharedWorkerProxy : public ThreadSafeShared<SharedWorkerProxy>, public WorkerLoaderProxy, public WorkerReportingProxy {
+class SharedWorkerProxy : public ThreadSafeRefCounted<SharedWorkerProxy>, public WorkerLoaderProxy, public WorkerReportingProxy {
 public:
     static PassRefPtr<SharedWorkerProxy> create(const String& name, const KURL& url, PassRefPtr<SecurityOrigin> origin) { return adoptRef(new SharedWorkerProxy(name, url, origin)); }
 
diff --git a/Source/WebCore/workers/WorkerContext.cpp b/Source/WebCore/workers/WorkerContext.cpp
index acf7f04..3b14e59 100644
--- a/Source/WebCore/workers/WorkerContext.cpp
+++ b/Source/WebCore/workers/WorkerContext.cpp
@@ -67,9 +67,12 @@
 
 #if ENABLE(FILE_SYSTEM)
 #include "AsyncFileSystem.h"
+#include "DirectoryEntrySync.h"
 #include "DOMFileSystem.h"
+#include "DOMFileSystemBase.h"
 #include "DOMFileSystemSync.h"
 #include "ErrorCallback.h"
+#include "FileEntrySync.h"
 #include "FileError.h"
 #include "FileException.h"
 #include "FileSystemCallback.h"
@@ -377,6 +380,53 @@ PassRefPtr<DOMFileSystemSync> WorkerContext::requestFileSystemSync(int type, lon
     return helper.getResult(ec);
 }
 
+void WorkerContext::resolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    KURL completedURL = completeURL(url);
+    if (!AsyncFileSystem::isAvailable() || !securityOrigin()->canAccessFileSystem() || !securityOrigin()->canRequest(completedURL)) {
+        DOMFileSystem::scheduleCallback(this, errorCallback, FileError::create(FileError::SECURITY_ERR));
+        return;
+    }
+
+    AsyncFileSystem::Type type;
+    String filePath;
+    if (!completedURL.isValid() || !DOMFileSystemBase::crackFileSystemURL(completedURL, type, filePath)) {
+        DOMFileSystem::scheduleCallback(this, errorCallback, FileError::create(FileError::ENCODING_ERR));
+        return;
+    }
+
+    LocalFileSystem::localFileSystem().readFileSystem(this, type, ResolveURICallbacks::create(successCallback, errorCallback, this, filePath));
+}
+
+PassRefPtr<EntrySync> WorkerContext::resolveLocalFileSystemSyncURL(const String& url, ExceptionCode& ec)
+{
+    ec = 0;
+    KURL completedURL = completeURL(url);
+    if (!AsyncFileSystem::isAvailable() || !securityOrigin()->canAccessFileSystem() || !securityOrigin()->canRequest(completedURL)) {
+        ec = FileException::SECURITY_ERR;
+        return 0;
+    }
+
+    AsyncFileSystem::Type type;
+    String filePath;
+    if (!completedURL.isValid() || !DOMFileSystemBase::crackFileSystemURL(completedURL, type, filePath)) {
+        ec = FileException::ENCODING_ERR;
+        return 0;
+    }
+
+    FileSystemSyncCallbackHelper readFileSystemHelper;
+    LocalFileSystem::localFileSystem().readFileSystem(this, type, FileSystemCallbacks::create(readFileSystemHelper.successCallback(), readFileSystemHelper.errorCallback(), this), true);
+    RefPtr<DOMFileSystemSync> fileSystem = readFileSystemHelper.getResult(ec);
+    if (!fileSystem)
+        return 0;
+
+    RefPtr<EntrySync> entry = fileSystem->root()->getDirectory(filePath, 0, ec);
+    if (ec == FileException::TYPE_MISMATCH_ERR)
+        return fileSystem->root()->getFile(filePath, 0, ec);
+
+    return entry.release();
+}
+
 COMPILE_ASSERT(static_cast<int>(WorkerContext::TEMPORARY) == static_cast<int>(AsyncFileSystem::Temporary), enum_mismatch);
 COMPILE_ASSERT(static_cast<int>(WorkerContext::PERSISTENT) == static_cast<int>(AsyncFileSystem::Persistent), enum_mismatch);
 #endif
diff --git a/Source/WebCore/workers/WorkerContext.h b/Source/WebCore/workers/WorkerContext.h
index 2e802f2..d2ccb11 100644
--- a/Source/WebCore/workers/WorkerContext.h
+++ b/Source/WebCore/workers/WorkerContext.h
@@ -50,6 +50,8 @@ namespace WebCore {
     class Database;
     class DatabaseCallback;
     class DatabaseSync;
+    class EntryCallback;
+    class EntrySync;
     class ErrorCallback;
     class FileSystemCallback;
     class NotificationCenter;
@@ -129,8 +131,10 @@ namespace WebCore {
             TEMPORARY,
             PERSISTENT,
         };
-        void requestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback>, PassRefPtr<ErrorCallback>);
+        void requestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback>);
         PassRefPtr<DOMFileSystemSync> requestFileSystemSync(int type, long long size, ExceptionCode&);
+        void resolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback>);
+        PassRefPtr<EntrySync> resolveLocalFileSystemSyncURL(const String& url, ExceptionCode&);
 #endif
 
         // These methods are used for GC marking. See JSWorkerContext::markChildren(MarkStack&) in
diff --git a/Source/WebCore/workers/WorkerContext.idl b/Source/WebCore/workers/WorkerContext.idl
index 179221e..7b2af6b 100644
--- a/Source/WebCore/workers/WorkerContext.idl
+++ b/Source/WebCore/workers/WorkerContext.idl
@@ -110,8 +110,12 @@ module threads {
         const unsigned short PERSISTENT = 1;
         [EnabledAtRuntime=FileSystem] void requestFileSystem(in unsigned short type, in long long size, in [Callback, Optional] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
         [EnabledAtRuntime=FileSystem] DOMFileSystemSync requestFileSystemSync(in unsigned short type, in long long size) raises (FileException);
+        [EnabledAtRuntime=FileSystem] void resolveLocalFileSystemURL(in DOMString url, in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [EnabledAtRuntime=FileSystem] EntrySync resolveLocalFileSystemSyncURL(in DOMString url) raises (FileException);
 
                  attribute [EnabledAtRuntime=FileSystem] FlagsConstructor Flags;
+                 attribute [EnabledAtRuntime=FileSystem] FileErrorConstructor FileError;
+                 attribute [EnabledAtRuntime=FileSystem] FileExceptionConstructor FileException;
 #endif
 
         attribute ArrayBufferConstructor ArrayBuffer; // Usable with new operator
diff --git a/Source/WebCore/xml/XMLTreeViewer.cpp b/Source/WebCore/xml/XMLTreeViewer.cpp
index 7a893f6..f1e2c0f 100644
--- a/Source/WebCore/xml/XMLTreeViewer.cpp
+++ b/Source/WebCore/xml/XMLTreeViewer.cpp
@@ -14,7 +14,7 @@
  * distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS
- * “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GOOGLE INC.
  * OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
@@ -33,6 +33,7 @@
 
 
 #include "Base64.h"
+#include "Element.h"
 #include "Document.h"
 #include "Frame.h"
 #include "HTMLNames.h"
@@ -88,7 +89,7 @@ bool XMLTreeViewer::hasNoStyleInformation() const
 
 void XMLTreeViewer::transformDocumentToTreeView()
 {
-    String sheetString(reinterpret_cast<char*>(XMLViewer_xsl), sizeof(XMLViewer_xsl));
+    String sheetString(reinterpret_cast<const char*>(XMLViewer_xsl), sizeof(XMLViewer_xsl));
     RefPtr<XSLStyleSheet> styleSheet = XSLStyleSheet::createForXMLTreeViewer(m_document, sheetString);
 
     RefPtr<XSLTProcessor> processor = XSLTProcessor::create();
@@ -104,9 +105,16 @@ void XMLTreeViewer::transformDocumentToTreeView()
     // FIXME: We should introduce error handling
     if (processor->transformToString(m_document, resultMIMEType, newSource, resultEncoding))
         processor->createDocumentFromSource(newSource, resultEncoding, resultMIMEType, m_document, frame);
+
+    // Adding source xml for dealing with namespaces and CDATA issues and for extensions use.
+    Element* sourceXmlElement = frame->document()->getElementById(AtomicString("source-xml"));
+    if (sourceXmlElement)
+        m_document->cloneChildNodes(sourceXmlElement);
+
     // New document should have been loaded in frame. Tell it to use view source styles.
     frame->document()->setUsesViewSourceStyles(true);
     frame->document()->styleSelectorChanged(RecalcStyleImmediately);
+
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/xml/XMLTreeViewer.h b/Source/WebCore/xml/XMLTreeViewer.h
index 7fde7bc..84297ea 100644
--- a/Source/WebCore/xml/XMLTreeViewer.h
+++ b/Source/WebCore/xml/XMLTreeViewer.h
@@ -14,7 +14,7 @@
  * distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS
- * “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GOOGLE INC.
  * OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
diff --git a/Source/WebCore/xml/XMLViewer.xsl b/Source/WebCore/xml/XMLViewer.xsl
index cb66858..4ee3ca8 100644
--- a/Source/WebCore/xml/XMLViewer.xsl
+++ b/Source/WebCore/xml/XMLViewer.xsl
@@ -248,16 +248,16 @@
                 <xsl:call-template name="style"/>
                 <xsl:call-template name="script"/>
             </head>
-            <body onload="onload()">
+            <body onload="onWebKitXMLViewerLoad()">
                 <div class="header">
-                    <span> <xsl:value-of select="$xml_has_no_style_message"/> </span> 
+                    <span> <xsl:value-of select="$xml_has_no_style_message"/> </span>
                     <br/>
                 </div>
 
                 <div class="pretty-print">
                     <xsl:apply-templates/>
                 </div>
-                <div> </div>
+                <div id="source-xml"></div>
             </body>
         </html>
     </xsl:template>
@@ -265,7 +265,7 @@
     <xsl:template name="script">
         <script type="text/javascript">
             <xsl:text>
-                function onload()
+                function onWebKitXMLViewerLoad()
                 {
                     drawArrows();
                     initButtons();
@@ -339,7 +339,6 @@
                    // To prevent selection on double click
                    e.preventDefault();
                 }
-
             </xsl:text>
         </script>
     </xsl:template>
@@ -363,6 +362,10 @@
                 font-size: 13px;
             }
 
+            #source-xml {
+                display: none;
+            }
+
             .collapsable-content {
                 margin-left: 1em;
             }
diff --git a/Source/WebCore/xml/XPathResult.cpp b/Source/WebCore/xml/XPathResult.cpp
index b608280..1dcde2e 100644
--- a/Source/WebCore/xml/XPathResult.cpp
+++ b/Source/WebCore/xml/XPathResult.cpp
@@ -41,6 +41,8 @@ using namespace XPath;
 
 XPathResult::XPathResult(Document* document, const Value& value)
     : m_value(value)
+    , m_nodeSetPosition(0)
+    , m_domTreeVersion(0)
 {
     switch (m_value.type()) {
         case Value::BooleanValue:
diff --git a/Source/WebCore/xml/XPathResult.h b/Source/WebCore/xml/XPathResult.h
index cbb51f5..e45916c 100644
--- a/Source/WebCore/xml/XPathResult.h
+++ b/Source/WebCore/xml/XPathResult.h
@@ -80,7 +80,7 @@ namespace WebCore {
         XPath::NodeSet m_nodeSet; // FIXME: why duplicate the node set stored in m_value?
         unsigned short m_resultType;
         RefPtr<Document> m_document;
-        unsigned m_domTreeVersion;
+        uint64_t m_domTreeVersion;
     };
 
 } // namespace WebCore